@davesheffer/hunch 1.38.1 → 1.39.1

package/dist/cli/index.js

@@ -40,7 +40,7 @@ import { assertCompleteRepoScan, indexRepo, scanRepo } from "../extractors/index
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { readSynthesisPreference, resolveSynthesisProvider, selectProvider, SYNTH_PREFERENCES, writeSynthesisPreference, normalizeProviderName, } from "../synthesis/provider.js";
-import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedDiff, workingDiff, commitDiff, rangeFiles, rangeDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatus, mergeRangeChanges, commitsExist } from "../extractors/git.js";
+import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedGateDiff, workingGateDiff, commitGateDiff, rangeFiles, rangeGateDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatus, mergeRangeChanges, commitsExist } from "../extractors/git.js";
 import { parseMemoryLog } from "../core/memorylog.js";
 import { renamesOf, planRepair, repairDecision, repairConstraint } from "../core/repair.js";
 import { orphanedCommitDecisions, planCommitRepair, repairDecisionCommit, pickRewrite, commitRepairReviewHash, mergeRewrites, firstFor, deadRewrites, resolvedRewriteIds, withoutDropped, addDropped, withheldForUnresolvableTo } from "../core/commitrepair.js";
@@ -52,11 +52,11 @@ import { deriveForbids, effectiveForbids } from "../core/constraintmatch.js";
 import { extractInlineIntent } from "../extractors/comments.js";
 import { renderText, renderMarkdown, renderSarif, renderImpact, reportFailsStrict } from "../core/checkreport.js";
 import { partitionReview, isReviewDraft, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
-import { installPostCommitHook, installPreCommitHook, installPostMergeHook, hookStatus } from "../integrations/hooks.js";
+import { installPostCommitHook, installPreCommitHook, installPostMergeHook, installPostCheckoutHook, hookStatus, hookReport, formatHookInstall } from "../integrations/hooks.js";
 import { ensureSharedOverlayPointer } from "../integrations/worktree.js";
 import { flushCapture, flushMemoryHome, flushMemoryHomes, pinSharedRemote, sharedRemoteFor } from "../integrations/sync.js";
 import { installMergeDriver } from "../integrations/mergeDriver.js";
-import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS } from "../integrations/gitignore.js";
+import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS, upgradeManagedGitignore, describeGitignoreUpgrade } from "../integrations/gitignore.js";
 import { writeCiWorkflow } from "../integrations/ciAction.js";
 import { updateClaudeMd, renderHunchSection } from "../integrations/claudemd.js";
 import { classifyGroundingBlock, describeGroundingFreshness } from "../core/groundingLag.js";
@@ -78,7 +78,10 @@ import { deriveChangeProof } from "../core/changeProof.js";
 import { discoverProjectDna, evaluateProjectDnaMatch } from "../core/projectDna.js";
 import { diffProjectDna } from "../core/projectDnaDelta.js";
 import { projectDnaDeliverySupplement } from "../core/projectDnaDelivery.js";
-import { readConfig, writeConfig, FIRMNESS_LEVELS, isFirmness } from "../core/config.js";
+import { readConfig, writeConfig, FIRMNESS_LEVELS, isFirmness, workspacesConfig } from "../core/config.js";
+import { loadOrCreateMachine, setMachineLabel, machineFile, labelLeaksIdentity } from "../core/machine.js";
+import { worktreeRows, branchRows } from "../core/workspace.js";
+import { workspaceLedgerView, recordWorkspaceSnapshot, renderWorktreeTable, renderBranchTable, workspaceSummaryLine, prunePlanFor, renderPrunePlan, applyPrune, confirmPrune, pruneConfirmQuestion } from "../integrations/workspaceLedger.js";
 import { blockingInScope, vetoInScope, proposedEditLines } from "../core/hookpolicy.js";
 import { isHumanConfirmed } from "../core/strictgate.js";
 import { appendEvent, readEvents } from "../core/events.js";
@@ -338,6 +341,10 @@ program
     const gi = ensureGitignore(root);
     if (gi.action !== "unchanged")
         console.log(`  ✓ .gitignore ${gi.action} (Hunch runtime index excluded)`);
+    // A repo migrated to a private overlay by an older release: bring its private-only
+    // block up to date (and stop publishing newly ignored memory dirs).
+    for (const line of describeGitignoreUpgrade(upgradeManagedGitignore(root)))
+        console.log(`  ✓ ${line}`);
     if (opts.index !== false) {
         if (isGitRepo(root) && revExists("HEAD", root)) {
             const res = indexRepo(store, root, { source: { kind: "commit", ref: "HEAD" } });
@@ -390,9 +397,14 @@ program
     if (isGitRepo(root)) {
         const syncToOverlay = !!(opts.privateSync || opts.sharedSync);
         const h = installPostCommitHook(root, inv.shell, { private: syncToOverlay, commit: opts.autoCommit, localOnly: syncToOverlay });
-        console.log(`  ✓ post-commit hook ${h.action} (learning loop)${syncToOverlay ? " — syncs to the shared overlay" : ""}${opts.autoCommit ? " — auto-commit on" : ""}`);
+        for (const line of formatHookInstall(root, "post-commit hook", h, ` (learning loop)${syncToOverlay ? " — syncs to the shared overlay" : ""}${opts.autoCommit ? " — auto-commit on" : ""}`))
+            console.log(line);
         const pm = installPostMergeHook(root, inv.shell);
-        console.log(`  ✓ post-merge hook ${pm.action} (squash-merge provenance repair + re-syncs grounding docs after a merge that brought memory in)`);
+        for (const line of formatHookInstall(root, "post-merge hook", pm, " (squash-merge provenance repair + re-syncs grounding docs after a merge that brought memory in)"))
+            console.log(line);
+        const pc = installPostCheckoutHook(root, inv.shell);
+        for (const line of formatHookInstall(root, "post-checkout hook", pc, " (workspace ledger: records this machine's branches + worktrees on checkout)"))
+            console.log(line);
         const m = installMergeDriver(root, inv.shell);
         console.log(`  ✓ team merge driver ${m.action}`);
         // Auto-install the pre-commit guard by default (advisory: flags invariants
@@ -401,7 +413,8 @@ program
         if (opts.enforce !== false || opts.enforceStrict) {
             const strict = !!opts.enforceStrict;
             const p = installPreCommitHook(root, inv.shell, strict);
-            console.log(`  ✓ pre-commit constraint guard ${p.action} (${strict ? "strict — fails only on direct, high-confidence, non-stale blocking invariants" : "advisory — flags invariants in scope or blast radius"})`);
+            for (const line of formatHookInstall(root, "pre-commit constraint guard", p, ` (${strict ? "strict — fails only on direct, high-confidence, non-stale blocking invariants" : "advisory — flags invariants in scope or blast radius"})`))
+                console.log(line);
         }
     }
     else {
@@ -473,7 +486,10 @@ program
     .action((opts) => {
     const { store, root } = storeFor();
     store.json.ensureDirs();
-    ensureGitignore(root); // keep the derived SQLite index out of git (idempotent)
+    // Keep the derived SQLite index out of git (idempotent). Adds a missing block but
+    // never rewrites an existing one: `index` runs in CI/release gates on a clean
+    // checkout. Older blocks are upgraded by `hunch update` / init / private setup.
+    ensureGitignore(root, { upgradeExisting: false });
     // The post-merge hook only ever got installed by `hunch init`/`hunch
     // private`/`hunch shared` — a repo that already ran init before this hook
     // existed never receives it. `hunch index` already self-heals gitignore
@@ -481,8 +497,11 @@ program
     // re-running init by hand. Gated on already having post-commit: `index`
     // is not a setup command (it runs in CI, on any git repo), so it must
     // never be what FIRST hooks a repo that never ran init at all.
-    if (isGitRepo(root) && hookStatus(root).postCommit)
-        installPostMergeHook(root, resolveInvocation().shell);
+    if (isGitRepo(root) && hookStatus(root).postCommit) {
+        const inv = resolveInvocation().shell;
+        installPostMergeHook(root, inv);
+        installPostCheckoutHook(root, inv); // same upgrade path for the workspace-ledger hook
+    }
     const res = indexRepo(store, root, { requireClean: true });
     const { counts } = store.reindex();
     const correctionSweep = new ConstitutionService(store, root).upgradeCorrections();
@@ -707,7 +726,7 @@ program
             const sweep = constitution.g2ShadowSweep();
             g2Recorded = sweep.recorded.length;
             if (!opts.quiet) {
-                console.log(`  ↳ G2 shadow: ${sweep.recorded.length} recorded · ${sweep.existing.length} existing · ${sweep.failures.length} failed; authority none`);
+                console.log(`  ↳ G2 shadow: ${sweep.recorded.length} recorded · ${sweep.existing.length} existing · ${sweep.failures.length} failed${sweep.retired.length ? ` · ${sweep.retired.length} retired (skipped)` : ""}; authority none`);
             }
         }
     }
@@ -1242,9 +1261,12 @@ function configureOverlay(dir, opts, mode) {
         if (opts.hook && isGitRepo(root)) {
             freshSetup?.markHookWrite();
             const h = installPostCommitHook(root, inv.shell, { private: true, commit: opts.autoCommit, localOnly: mode === "private" });
-            hookNote = `  ✓ post-commit hook ${h.action} — captured decisions route here${opts.autoCommit ? " (auto-commit+push on)" : ""}\n`;
+            const note = (lines) => lines.map((l) => `${l}\n`).join("");
+            hookNote = note(formatHookInstall(root, "post-commit hook", h, ` — captured decisions route here${opts.autoCommit ? " (auto-commit+push on)" : ""}`));
             const pm = installPostMergeHook(root, inv.shell);
-            hookNote += `  ✓ post-merge hook ${pm.action} (squash-merge provenance repair + re-syncs grounding docs after a merge that brought memory in)\n`;
+            hookNote += note(formatHookInstall(root, "post-merge hook", pm, " (squash-merge provenance repair + re-syncs grounding docs after a merge that brought memory in)"));
+            const pc = installPostCheckoutHook(root, inv.shell);
+            hookNote += note(formatHookInstall(root, "post-checkout hook", pc, " (workspace ledger: this machine's branches + worktrees sync through the overlay)"));
         }
         // 5) one-time migration: MOVE existing public memory INTO the overlay, then make
         //    THIS repo code-only. Records are absorbed (union by id) BEFORE the public
@@ -1304,6 +1326,13 @@ function configureOverlay(dir, opts, mode) {
                     `  next: review, then commit the PUBLIC repo:\n` +
                     `      git add -A && git commit -m "chore: move engineering memory to a private overlay" && git push\n`;
         }
+        else {
+            // Re-running setup on a repo migrated by an older release upgrades its private-only
+            // block in place and stops publishing memory dirs that block did not yet list.
+            const upgraded = describeGitignoreUpgrade(upgradeManagedGitignore(root));
+            if (upgraded.length)
+                migrateNote = upgraded.map((line) => `  ✓ ${line}\n`).join("");
+        }
         const lead = mode === "private"
             ? `✓ private overlay enabled → ${hunchDir}\n`
             : `✓ shared overlay enabled → ${hunchDir}\n`;
@@ -1409,11 +1438,220 @@ program
             openStore = null;
         }
     }
+    // 4) the workspace ledger: the new worktree is exactly what other machines want to know about.
+    let ledgerNote = "";
+    try {
+        const lstore = openTeamStore(root).store;
+        try {
+            const out = recordWorkspaceSnapshot(lstore, root);
+            if (out.status === "written")
+                ledgerNote = `\n  ✓ workspace ledger updated (${out.record.worktrees.length} worktree(s) on this machine → ${out.home === "private" ? "overlay" : "public .hunch/"})`;
+        }
+        finally {
+            lstore.close();
+            openStore = null;
+        }
+    }
+    catch { /* the ledger is a side effect; the worktree itself is what this command promised */ }
     console.log(`✓ worktree created → ${dest}${opts.branch ? ` (new branch ${opts.branch})` : ""}\n` +
-        `${shareNote}${indexNote}\n` +
+        `${shareNote}${indexNote}${ledgerNote}\n` +
         `  hooks + MCP server are shared (worktree-aware) — open your assistant in the new worktree to start.\n` +
         `  (needs \`hunch\` installed globally; a worktree has no node_modules of its own)`);
 });
+// ---- workspaces / branches (workspace ledger — docs/workspace-ledger.md) ---------------
+// One shared code path (src/integrations/workspaceLedger.ts): this machine is always read
+// LIVE from git, other machines from the store, and stored records are display-only.
+const workspacesCmd = program
+    .command("workspaces")
+    .description("Workspace ledger: which worktrees are open on which machine (this machine live, other machines from memory). Read-only unless you run `snapshot`.");
+workspacesCmd
+    .command("list", { isDefault: true })
+    .description("Every worktree across machines: branch, dirty, last commit, when the machine last reported.")
+    .option("--machine <label>", "only this machine")
+    .option("--branch <name>", "only worktrees on this branch")
+    .option("--fetch", "run `git fetch --prune` first (network; off by default)")
+    .option("--json", "emit the rows as JSON")
+    .action((opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (!isGitRepo(root))
+            return fail("`hunch workspaces` needs a git repo");
+        const view = workspaceLedgerView(store, root, { fetch: opts.fetch });
+        let rows = worktreeRows(view.records, { staleAfterDays: view.config.stale_after_days });
+        if (opts.machine)
+            rows = rows.filter((r) => r.machine === opts.machine);
+        if (opts.branch)
+            rows = rows.filter((r) => r.branch === opts.branch);
+        if (opts.json)
+            return console.log(JSON.stringify({ machine: view.machine.label, worktrees: rows }, null, 2));
+        console.log(renderWorktreeTable(view, rows));
+    }
+    finally {
+        store.close();
+    }
+});
+workspacesCmd
+    .command("snapshot")
+    .description("Record this machine's worktrees and branches into memory (the overlay when one is configured). Offline unless --fetch. Also run by the post-checkout / post-commit hooks and at MCP session start.")
+    .option("--fetch", "run `git fetch --prune` first (network; off by default)")
+    .option("--dry-run", "print the record that WOULD be written and write nothing")
+    .option("--json", "print the record as JSON")
+    .option("--quiet", "no output on success (for hooks)")
+    .action((opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (!isGitRepo(root))
+            return fail("`hunch workspaces snapshot` needs a git repo");
+        const out = recordWorkspaceSnapshot(store, root, { fetch: opts.fetch, dryRun: opts.dryRun });
+        if (out.status !== "off" && (opts.dryRun || opts.json))
+            console.log(JSON.stringify(out.record, null, 2));
+        if (opts.quiet || out.status === "dry-run")
+            return;
+        switch (out.status) {
+            case "off":
+                return console.log("workspaces.publish is \"off\" in .hunch/config.json — nothing recorded.");
+            case "no-home":
+                console.log("No memory overlay is configured, so this machine's record is not written (queries read this machine live).");
+                console.log("  · run `hunch private` or `hunch shared --repo <url>` to sync workspaces across machines");
+                return console.log("  · or set .hunch/config.json {\"workspaces\":{\"publish_public\":true}} to commit it into this repo's .hunch/");
+            case "unchanged":
+                return console.log(`✓ unchanged since ${out.previous.observed_at} (${out.record.id}) — nothing written`);
+            case "collision":
+                return fail(`not written: ${out.reason}\n  · \`hunch workspaces forget ${out.record.id}\` removes the stale copy (a normal, revertable memory move), then snapshot again`);
+            case "written":
+                return console.log(`✓ recorded ${out.record.worktrees.length} worktree(s), ${out.record.branches.length} branch(es) as ${out.record.machine.label} (${out.record.id}, publish=${out.record.publish}) → ${out.home === "private" ? "overlay" : "public .hunch/"}${out.flushed ? `, ${out.flushed}` : ""}`);
+        }
+    }
+    finally {
+        store.close();
+    }
+});
+workspacesCmd
+    .command("prune")
+    .description("Branches and worktrees that are provably merged and safe to delete. Prints the exact git commands per machine (dry run). --apply runs them on THIS machine only — never a remote, never another machine — from a live snapshot, with `git branch -d` / `git worktree remove` (no force flags), after confirmation.")
+    .option("--apply", "execute this machine's commands (asks for confirmation; --yes in a non-interactive shell)")
+    .option("--yes", "skip the confirmation prompt (required with --apply when stdin is not a terminal)")
+    .option("--fetch", "run `git fetch --prune` first (network; off by default)")
+    .option("--json", "emit the plan (and results) as JSON")
+    .action(async (opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (!isGitRepo(root))
+            return fail("`hunch workspaces prune` needs a git repo");
+        const view = workspaceLedgerView(store, root, { fetch: opts.fetch });
+        const plan = prunePlanFor(view, root);
+        if (!opts.apply) {
+            if (opts.json)
+                return console.log(JSON.stringify({ machine: view.machine.label, plan }, null, 2));
+            console.log(renderPrunePlan(view, plan));
+            return console.log(plan.local.length ? "\n(dry run — `hunch workspaces prune --apply` runs this machine's commands after confirmation)" : "\n(dry run — nothing to apply on this machine)");
+        }
+        if (!plan.local.length) {
+            if (opts.json)
+                return console.log(JSON.stringify({ machine: view.machine.label, plan, results: [] }, null, 2));
+            console.log(renderPrunePlan(view, plan));
+            return console.log("\nnothing to apply on this machine");
+        }
+        if (!opts.json)
+            console.log(renderPrunePlan(view, plan));
+        if (!opts.yes) {
+            const ok = await confirmPrune(pruneConfirmQuestion(view, plan));
+            if (!ok)
+                return fail(process.stdin.isTTY ? "not confirmed — nothing was deleted" : "refusing to apply without confirmation: stdin is not a terminal; pass --yes to confirm explicitly");
+        }
+        const results = applyPrune(root, plan.local);
+        // Memory follows what actually happened: re-snapshot so other machines see the change.
+        // Best effort — the deletions above are real whatever the ledger write says.
+        let recorded;
+        try {
+            recorded = recordWorkspaceSnapshot(store, root).status;
+        }
+        catch (error) {
+            recorded = `failed: ${error.message}`;
+        }
+        if (opts.json)
+            return console.log(JSON.stringify({ machine: view.machine.label, plan, results, recorded }, null, 2));
+        console.log("");
+        for (const r of results)
+            console.log(`  ${r.outcome === "deleted" ? "✓" : r.outcome === "skipped" ? "–" : "✗"} ${r.step.branch}: ${r.detail}`);
+        const failed = results.filter((r) => r.outcome === "failed").length;
+        const skipped = results.filter((r) => r.outcome === "skipped").length;
+        const ledger = recorded === "written" ? " · ledger updated" : recorded === "unchanged" || recorded === "no-home" || recorded === "off" ? "" : ` · ledger not updated (${recorded})`;
+        console.log(`\n${results.length - failed - skipped} deleted, ${skipped ? `${skipped} skipped (nothing changed), ` : ""}${failed} refused by git${ledger}`);
+        if (failed || skipped)
+            process.exitCode = 1;
+    }
+    finally {
+        store.close();
+    }
+});
+workspacesCmd
+    .command("label [label]")
+    .description("Show or set this machine's label (what other machines see). Defaults to machine-<id>; never the hostname.")
+    .action((label) => {
+    const identity = label ? setMachineLabel(label) : loadOrCreateMachine();
+    console.log(`${identity.label}  (${identity.id}, ${machineFile()})`);
+    const leak = labelLeaksIdentity(identity.label);
+    if (leak)
+        console.log(`  ⚠ the label equals this machine's ${leak}; in a shared store every teammate sees it`);
+});
+workspacesCmd
+    .command("forget <machine>")
+    .description("Remove a machine's stored workspace record (by label or id) — e.g. a retired laptop. A memory move like any other: revertable via `hunch log`.")
+    .action((machine) => {
+    const { store, root } = storeFor();
+    try {
+        const victims = store.recs("workspaces").filter((r) => r.machine.label === machine || r.machine.id === machine || r.id === machine);
+        if (!victims.length)
+            return fail(`no workspace record for "${machine}" — \`hunch workspaces\` lists the machines in memory`);
+        // Decide each record's home BEFORE deleting it, then flush exactly those homes.
+        const homes = victims.map((v) => store.getPrivateRec("workspaces", v.id) ? "private" : "public");
+        for (const v of victims)
+            store.deleteWhereItLives("workspaces", v.id);
+        pumpMemoryHomes(store, root, homes, `hunch: forget workspace ${machine}`);
+        console.log(`✓ forgot ${victims.length} record(s) for ${machine}`);
+    }
+    finally {
+        store.close();
+    }
+});
+program
+    .command("branches")
+    .description("Every local branch across machines with a deterministic verdict: merged (ancestry / squash / rebase), pushed, dirty worktree, and a recommended action. Read-only; never deletes anything.")
+    .option("--merged", "only branches proven merged")
+    .option("--unpushed", "only branches with no upstream")
+    .option("--stale <days>", "only branches whose last commit is older than N days")
+    .option("--machine <label>", "only branches present on this machine")
+    .option("--fetch", "run `git fetch --prune` first (network; off by default)")
+    .option("--json", "emit the rows as JSON")
+    .action((opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (!isGitRepo(root))
+            return fail("`hunch branches` needs a git repo");
+        const view = workspaceLedgerView(store, root, { fetch: opts.fetch });
+        const now = new Date();
+        let rows = branchRows(view.records, { staleAfterDays: view.config.stale_after_days, now });
+        if (opts.merged)
+            rows = rows.filter((r) => r.merged.status === "merged");
+        if (opts.unpushed)
+            rows = rows.filter((r) => r.upstream === null);
+        if (opts.machine)
+            rows = rows.filter((r) => r.machines.includes(opts.machine));
+        if (opts.stale) {
+            const days = Number(opts.stale);
+            if (!Number.isFinite(days) || days < 0)
+                return fail("--stale takes a number of days");
+            rows = rows.filter((r) => !r.last_commit_at || now.getTime() - Date.parse(r.last_commit_at) > days * 86_400_000);
+        }
+        if (opts.json)
+            return console.log(JSON.stringify({ machine: view.machine.label, branches: rows }, null, 2));
+        console.log(renderBranchTable(view, rows));
+    }
+    finally {
+        store.close();
+    }
+});
 // ---- query ----------------------------------------------------------------
 program
     .command("query")
@@ -3806,14 +4044,17 @@ program
     // vacuous green (deletions are excluded by the enumerators' --diff-filter=ACMR, so
     // such a PR enumerates zero files) — including a deletion of the very symbol a
     // blocking conformance predicate or an active policy guards.
-    const diff = files.length
-        ? (exactCommit ? commitDiff(exactCommit, root) : opts.base ? rangeDiff(opts.base, root) : opts.working ? workingDiff(root) : stagedDiff(root))
-        : "";
+    // The COMPLETE diff (no synthesis byte budget); an incomplete one is flagged so
+    // content-matched blocking invariants fail closed instead of passing unseen.
+    const gate = files.length
+        ? (exactCommit ? commitGateDiff(exactCommit, root) : opts.base ? rangeGateDiff(opts.base, root) : opts.working ? workingGateDiff(root) : stagedGateDiff(root))
+        : { diff: "" };
     const report = files.length
-        ? store.buildCheckReport(files, diff, {
+        ? store.buildCheckReport(files, gate.diff, {
             strict: !!opts.strict,
             lastChange: (f) => lastChangeDate(f, root),
             publicOnly: !!opts.publicOnly,
+            diffStatus: gate,
         })
         : emptyReport;
     if (opts.blast && !markdown && !sarif && files.length) {
@@ -3951,8 +4192,8 @@ const vetoCmd = program
         store.close();
         return;
     }
-    const diff = opts.commit ? commitDiff(opts.commit, root) : opts.base ? rangeDiff(opts.base, root) : stagedDiff(root);
-    const full = store.buildCheckReport(files, diff, { strict: !!opts.strict, lastChange: (f) => lastChangeDate(f, root) });
+    const gate = opts.commit ? commitGateDiff(opts.commit, root) : opts.base ? rangeGateDiff(opts.base, root) : stagedGateDiff(root);
+    const full = store.buildCheckReport(files, gate.diff, { strict: !!opts.strict, lastChange: (f) => lastChangeDate(f, root), diffStatus: gate });
     if (!full.vetoes.length) {
         console.log(`✓ ${files.length} changed file(s) reverse no decision you rejected.`);
         store.close();
@@ -4513,11 +4754,14 @@ program
             const before = st;
             let activity = null;
             if (/^(Edit|Write|MultiEdit)$/.test(evt.tool_name ?? "")) {
-                const p = evt.tool_input?.file_path;
-                if (p) {
+                // A Codex apply_patch touches every file it lists (and each Move-to
+                // destination); the Stop gate must see all of them, not only the first.
+                const patchPaths = evt.tool_input?.patch_files?.flatMap((f) => f.moved_to ? [f.path, f.moved_to] : [f.path]);
+                const edited = patchPaths?.length ? patchPaths : evt.tool_input?.file_path ? [evt.tool_input.file_path] : [];
+                for (const p of edited)
                     st = onEdit(st, toRepoRel(root, p));
+                if (edited.length)
                     activity = { kind: "edit" };
-                }
             }
             else if (evt.tool_name === "Bash" || evt.tool_name === "PowerShell") {
                 const command = String(evt.tool_input?.command ?? "");
@@ -4827,18 +5071,16 @@ program
         }
         if (evt.hook_event_name !== "PreToolUse")
             return;
-        const abs = evt.tool_input?.file_path;
-        if (!abs)
-            return;
-        const target = toRepoRel(root, abs);
-        // Outside the repo (".." prefix) or on another drive (absolute, e.g. "D:/…")
-        // → nothing for Hunch to say.
-        if (!target || target.startsWith("..") || /^[a-zA-Z]:/.test(target))
+        const targets = editTargets(root, evt.tool_input);
+        // Nothing inside the repo → nothing for Hunch to say.
+        if (!targets.length)
             return;
+        // Grounding below stays about the first in-repo file; the strict gate checks every target.
+        const { abs, target } = targets[0];
         // A compiled red→green probe is only meaningful if its red receipt exists
         // before implementation. Firm/strict may deny two edits per prompt, then
         // fail open so a malformed or unavailable probe can never deadlock work.
-        if ((firmness === "firm" || firmness === "strict") && evt.session_id && pipelineEnabled() && isProductPath(target)) {
+        if ((firmness === "firm" || firmness === "strict") && evt.session_id && pipelineEnabled() && targets.some((t) => isProductPath(t.target))) {
             const baseline = beforeEditProbeVerdict(loadPipelineState(evt.session_id));
             if (baseline.block) {
                 savePipelineState(evt.session_id, baseline.state);
@@ -4870,23 +5112,28 @@ program
             store.reindex();
             // The lines this edit would ADD — so a content-matched invariant denies only
             // when the edit actually trips it (not on every edit in scope), and the Veto
-            // Guard can test the proposed text. Covers Edit/Write/MultiEdit.
-            const proposedLines = proposedEditLines(evt.tool_input);
-            const deny = blockingInScope(store, target, proposedLines);
-            if (deny) {
-                appendEvent(paths, { at: new Date().toISOString(), file: target, ...deny.event });
-                emitDeny(provider, deny.reason);
-                observeHookDenial(root, provider, evt, target, deny);
-                return;
+            // Guard can test the proposed text. Covers Edit/Write/MultiEdit, and each
+            // file of a Codex apply_patch with that file's own added lines.
+            const denials = [];
+            for (const t of targets) {
+                // Veto Guard (live): the proposed edit text re-introduces an approach an
+                // in-force decision REJECTED. The agent self-corrects before staging;
+                // only human-confirmed tripwires deny.
+                const hit = blockingInScope(store, t.target, t.lines) ?? (t.lines.length ? vetoInScope(store, t.target, t.lines) : null);
+                if (hit)
+                    denials.push({ target: t.target, hit });
             }
-            // Veto Guard (live): the proposed edit text re-introduces an approach an
-            // in-force decision REJECTED. The agent self-corrects before staging;
-            // only human-confirmed tripwires deny.
-            const vetoDeny = proposedLines.length ? vetoInScope(store, target, proposedLines) : null;
-            if (vetoDeny) {
-                appendEvent(paths, { at: new Date().toISOString(), file: target, ...vetoDeny.event });
-                emitDeny(provider, vetoDeny.reason);
-                observeHookDenial(root, provider, evt, target, vetoDeny);
+            if (denials.length) {
+                for (const d of denials)
+                    appendEvent(paths, { at: new Date().toISOString(), file: d.target, ...d.hit.event });
+                // One denied file keeps the single-file reason verbatim; several are
+                // listed so the agent knows every file it must reconsider.
+                const reason = denials.length === 1
+                    ? denials[0].hit.reason
+                    : `Hunch: this patch is denied for ${denials.length} files (${denials.map((d) => d.target).join(", ")}).\n${denials.map((d) => d.hit.reason).join("\n")}`;
+                emitDeny(provider, reason);
+                for (const d of denials)
+                    observeHookDenial(root, provider, evt, d.target, d.hit);
                 return;
             }
         }
@@ -6343,8 +6590,8 @@ program
             console.log(`No changed files in ${scope}.`);
             return;
         }
-        const diff = opts.commit ? commitDiff(opts.commit, root) : base ? rangeDiff(base, root) : opts.working ? workingDiff(root) : stagedDiff(root);
-        console.log(renderImpact(store.prImpact(files, diff), scope));
+        const gate = opts.commit ? commitGateDiff(opts.commit, root) : base ? rangeGateDiff(base, root) : opts.working ? workingGateDiff(root) : stagedGateDiff(root);
+        console.log(renderImpact(store.prImpact(files, gate.diff, gate), scope));
     }
     finally {
         store.close();
@@ -6502,6 +6749,10 @@ program
             console.log(`\n📊 ${rankingStatusLine(resolveTaskRankingMode(store.publicRoot, store))}`);
         }
         catch { /* no task records or no cache dir: nothing to say */ }
+        // Workspace ledger, from stored records only (no git) so the hot view stays fast.
+        const ws = workspaceSummaryLine(opts.private ? store.recs("workspaces") : store.json.loadAll("workspaces"), workspacesConfig(readConfig(hunchPaths(store.publicRoot))));
+        if (ws)
+            console.log(`\n${ws}`);
     }
     finally {
         store.close();
@@ -6760,16 +7011,43 @@ program
     // squash-merge went unrepaired. pre-commit is opt-out (`--no-enforce`),
     // so its absence is informational only, never a warning.
     if (isGitRepo(root)) {
+        const report = hookReport(root);
         const hooks = hookStatus(root);
-        const missing = [!hooks.postCommit && "post-commit", !hooks.postMerge && "post-merge"].filter((h) => !!h);
+        const missing = [report.postCommit.state === "missing" && "post-commit", report.postMerge.state === "missing" && "post-merge"].filter((h) => !!h);
+        // A block that is present but never runs (after an exec/exit, or inside a
+        // hook manager's regenerated file — issue #311) is NOT installed.
+        const unreachable = [["post-commit", report.postCommit], ["post-merge", report.postMerge], ["pre-commit", report.preCommit], ["post-checkout", report.postCheckout]]
+            .filter(([, e]) => e.state === "unreachable");
         // `hunch index` only ever installs post-merge onto an existing
         // post-commit install (it never hooks an un-hooked repo — see
-        // isGitRepo(root) && hookStatus(root).postCommit above) — so the fix
-        // hint must not point there when post-commit itself is missing.
-        const fix = !hooks.postCommit ? "run `hunch init` for the full setup" : "run `hunch index` to install it";
-        console.log(`hooks:      ${missing.length
-            ? `⚠ missing ${missing.join(", ")} — ${fix}`
+        // isGitRepo(root) && hookStatus(root).postCommit above) and never writes
+        // into a manager-owned hook — so the fix hint must not point there when
+        // post-commit itself is missing or a hook manager is in play.
+        const managedMissing = [report.postCommit, report.postMerge].find((e) => e.state === "missing" && e.manager !== "none");
+        const fix = managedMissing
+            ? `${managedMissing.manager === "exec-exit" ? "the existing hook exits before an appended block would run" : `a hook manager (${managedMissing.manager}) owns these hooks`}; run \`hunch init\` to print the snippet to add to ${rel(root, managedMissing.path)}`
+            : !hooks.postCommit ? "run `hunch init` for the full setup" : "run `hunch index` to install it";
+        const problems = [
+            missing.length ? `⚠ missing ${missing.join(", ")} — ${fix}` : "",
+            unreachable.length ? `⚠ installed but unreachable: ${unreachable.map(([n]) => n).join(", ")} — never runs; run \`hunch init\` to print the snippet for your hook manager` : "",
+        ].filter(Boolean);
+        console.log(`hooks:      ${problems.length
+            ? problems.join("\n            ")
             : `post-commit, post-merge installed${hooks.preCommit ? " (+ pre-commit)" : ""}`}`);
+        for (const [name, e] of unreachable) {
+            console.log(dim(`            ↳ ${name}: ${e.reason ?? "the block sits where git never reaches it"} (${rel(root, e.path)})`));
+        }
+        // Workspace ledger: what this machine is called, whether its record is in memory,
+        // and whether the checkout hook that keeps it fresh is installed.
+        try {
+            const machine = loadOrCreateMachine();
+            const stored = store.recs("workspaces").find((r) => r.machine.id === machine.id);
+            const others = store.recs("workspaces").filter((r) => r.machine.id !== machine.id).length;
+            const leak = labelLeaksIdentity(machine.label);
+            console.log(`workspaces: this machine is ${machine.label}${leak ? ` (⚠ label equals the ${leak})` : ""} · record in memory: ${stored ? `yes (${stored.observed_at})` : "no"} · ${others} other machine(s)` +
+                `${hooks.postCheckout ? " · post-checkout hook installed" : report.postCheckout.state === "unreachable" ? " · ⚠ post-checkout hook unreachable" : hooks.postCommit ? " · post-checkout hook not installed (`hunch index` adds it)" : ""}`);
+        }
+        catch { /* no machine file writable: nothing to report */ }
     }
     // In unified mode the public .hunch directory is only a routing shell.
     // Report the same effective manifest that `hunch migrate` reads and stamps,
@@ -6935,6 +7213,28 @@ function realpathNorm(p) {
 function toRepoRel(root, abs) {
     return relative(realpathNorm(root), realpathNorm(abs)).split("\\").join("/");
 }
+/** The in-repo files a pre-edit event would change, each with the lines the edit
+ *  ADDS to that file. A Codex apply_patch yields one entry per touched path (a
+ *  Move-to destination is its own entry, carrying the section's added lines);
+ *  every other edit tool yields its single `file_path`. Paths outside the repo
+ *  ("..") or on another drive ("D:/…") are skipped. */
+function editTargets(root, input) {
+    const raw = input?.patch_files?.length
+        ? input.patch_files.flatMap((f) => (f.moved_to ? [f.path, f.moved_to] : [f.path]).map((abs) => ({ abs, lines: f.added_lines })))
+        : input?.file_path ? [{ abs: input.file_path, lines: proposedEditLines(input) }] : [];
+    const byTarget = new Map();
+    for (const { abs, lines } of raw) {
+        const target = toRepoRel(root, abs);
+        if (!target || target.startsWith("..") || /^[a-zA-Z]:/.test(target))
+            continue;
+        const seen = byTarget.get(target);
+        if (seen)
+            seen.lines = [...seen.lines, ...lines];
+        else
+            byTarget.set(target, { abs, target, lines });
+    }
+    return [...byTarget.values()];
+}
 function emitContext(provider, event, text, 
 /** One user-facing line where the host shows hook messages (Claude Code's
  * `systemMessage`); never a block, never a second model turn. */

package/dist/cli/integrations.js

@@ -1,6 +1,7 @@
 import { findRoot } from "../core/paths.js";
 import { CAPABILITIES, HARNESSES, inspectIntegrations, integrationHealthFails, formatIntegrationHealth, repairIntegrationPins } from "../integrations/health.js";
 import { probeIntegration } from "../integrations/probe.js";
+import { describeGitignoreUpgrade, upgradeManagedGitignore } from "../integrations/gitignore.js";
 export function registerIntegrationCommands(program, refreshGrounding) {
     const integrations = program.command("integrations").description("Check harness coverage and repair stale repository Hunch pins");
     integrations.command("check")
@@ -34,6 +35,15 @@ export function registerIntegrationCommands(program, refreshGrounding) {
         if (files.includes(".codex/hooks.json")) {
             console.log("Codex: open /hooks to review and trust the changed commands, then start a new session. Command changes require renewed trust; Hunch does not grant it automatically.");
         }
+        // `hunch update` runs this command with the NEW release, so existing repos pick up
+        // managed .gitignore entries added since they were set up (no re-init needed).
+        try {
+            for (const line of describeGitignoreUpgrade(upgradeManagedGitignore(root)))
+                console.log(line);
+        }
+        catch (error) {
+            console.log(`.gitignore not upgraded: ${error.message}`);
+        }
         const grounding = refreshGrounding();
         if (grounding.length)
             console.log(`Updated Hunch instructions: ${grounding.join(", ")}. Reconnect the agent to load task reporting instructions.`);

package/dist/cli/serve.js

@@ -35,6 +35,7 @@ export function registerServeCommands(program) {
         app.listen(port, "127.0.0.1", () => {
             console.log(`hunch ${HUNCH_VERSION} serving nuryel.state/1 on http://127.0.0.1:${port} — ${config.partitions.map((p) => scopePath(p.scope)).join(", ")} (${config.principals.length} principal(s))`);
             console.log(`Shared state view: http://127.0.0.1:${port}/operator`);
+            console.log(`MCP (streamable HTTP): http://127.0.0.1:${port}/nuryel/v1/mcp`);
         });
         const stop = () => { app.close(() => { app.closeStores(); process.exit(0); }); };
         process.on("SIGINT", stop);