@davesheffer/hunch 1.39.0 → 1.39.2

package/dist/core/agenthook.js

@@ -49,16 +49,59 @@ function edits(value) {
         .map((item) => ({ new_string: stringAt(item, "new_string", "newString", "ReplacementContent", "replacementContent") }));
     return normalized.length ? normalized : undefined;
 }
+/** Parse Codex `apply_patch` text into one entry per touched file. Only `+` lines
+ * inside a file section count as added: removed (`-`) and context (` `) lines are
+ * text the edit takes away or leaves alone, so a content-matched gate must not read
+ * them as proposed content. Paths are returned exactly as written in the patch;
+ * the CLI normalizes them against the repository root. */
+const PATCH_HEADER = /^\*\*\* (Update|Add|Delete) File: (.+?)\s*$/;
+const PATCH_MOVE = /^\*\*\* Move to: (.+?)\s*$/;
+export function parseApplyPatch(patch) {
+    const files = [];
+    let current;
+    for (const line of patch.split(/\r?\n/)) {
+        const header = PATCH_HEADER.exec(line);
+        if (header) {
+            current = { path: header[2], action: header[1].toLowerCase(), added_lines: [] };
+            files.push(current);
+            continue;
+        }
+        if (!current)
+            continue;
+        const move = PATCH_MOVE.exec(line);
+        if (move) {
+            current.moved_to = move[1];
+            continue;
+        }
+        // `*** End Patch` / `*** End of File` close sections; they carry no content.
+        if (line.startsWith("*** "))
+            continue;
+        // A unified-diff style file header is not content; apply_patch has none, but
+        // a model can still emit one.
+        if (/^\+\+\+ (?:[ab]\/|\/dev\/null)/.test(line))
+            continue;
+        if (line.startsWith("+"))
+            current.added_lines.push(line.slice(1));
+    }
+    return files;
+}
 /** Codex edits files through `apply_patch`, whose input is the patch text itself
- * (`*** Update File: path`). The first touched path becomes the edit target so the
- * per-file pre-edit gate applies; the whole patch stands in for the new content. */
-const PATCH_FILE = /^\*\*\* (?:Update|Add|Delete) File: (.+?)\s*$/m;
+ * (`*** Update File: path`). Every touched file is listed in `patch_files` so the
+ * pre-edit gate runs per file; the first path stays `file_path` and the whole patch
+ * stays `content` for consumers that read the single-file shape.
+ *
+ * TODO(codex-exec-patch): a Codex code-mode `exec` tool call that embeds an
+ * apply_patch does NOT reach this parser: `.codex/hooks.json` (integrations/
+ * providers.ts) matches PreToolUse on `apply_patch` only, and `normalizeHookEvent`
+ * enables patch parsing only for tool names `apply_patch`/`patch`. No captured
+ * payload of such a call exists in the repo, so its shape is not guessed here;
+ * capture a real hook payload before extending the matcher or this parser. */
 function applyPatchInput(raw) {
     const patch = [raw.input, raw.patch, raw.content].find((v) => typeof v === "string" && /\*\*\* Begin Patch/.test(v));
     if (!patch)
         return undefined;
-    const file = PATCH_FILE.exec(patch)?.[1];
-    return file ? { file_path: file, content: patch } : undefined;
+    const files = parseApplyPatch(patch);
+    return files.length ? { file_path: files[0].path, content: patch, patch_files: files } : undefined;
 }
 function normalizeToolInput(value, allowPatch = false) {
     const raw = obj(value);
@@ -109,8 +152,12 @@ function toolOutput(value) {
 }
 function explicitToolOutcome(response) {
     const raw = obj(response);
+    // A bare string carries no status. Codex sends a Bash call's raw output this
+    // way, without its exit code, and a failing test run prints output as readily
+    // as a passing one. Status-looking text inside it ("Exit code: 0") is output
+    // the command itself can print, so it is never parsed as a status either.
     if (!raw)
-        return typeof response === "string" && response.trim() ? "success" : "unknown";
+        return "unknown";
     if (raw.success === false || raw.is_error === true || raw.isError === true || (raw.error !== undefined && raw.error !== null))
         return "failure";
     const status = raw.status;
@@ -133,8 +180,8 @@ function explicitToolOutcome(response) {
     if (explicitSuccess)
         return "success";
     // Common successful tool-result shapes carry output fields even when the
-    // output is empty. An unstructured empty string (Codex's native failure
-    // payload) remains unknown until the host supplies an explicit status.
+    // output is empty (Claude Code routes failed calls to PostToolUseFailure
+    // instead). An unstructured string remains unknown (see above).
     if (["stdout", "stderr", "output", "content"].some(key => Object.prototype.hasOwnProperty.call(raw, key)))
         return "success";
     return "unknown";

package/dist/core/capturetoken.d.ts

@@ -3,10 +3,18 @@
  *
  * hunch_capture_decision issues a short-lived token; the commit path consumes it, so a
  * decision written through the capture front door is provably the tail of an interview
- * — the identity-principle guard against a silent, un-interviewed write. In-memory (the
- * MCP server is long-lived); tokens are one-time-use and expire so an abandoned
- * interview can't leak. Absence of a token never BLOCKS a write yet (staged
+ * PROTOCOL — the identity-principle guard against a silent, un-interviewed write.
+ * In-memory (the MCP server is long-lived); tokens are one-time-use and expire so an
+ * abandoned interview can't leak. Absence of a token never BLOCKS a write yet (staged
  * deprecation §9.3) — the caller decides how to treat an un-gated write.
+ *
+ * WHAT A TOKEN DOES NOT PROVE: that a human answered. Any agent — or content steering
+ * one — can call hunch_capture_decision and consume the token it gets back, entirely
+ * inside the agent's own MCP channel. So a consumed token never confers
+ * `human_confirmed` on its own (the stamp the strict gate and the edit hook trust). It
+ * only licenses ASKING the human through a channel the agent does not control: an MCP
+ * elicitation answered in the client UI (`isHumanConfirmationAnswer`), or a human
+ * running `hunch review --confirm <id>`. Without one of those, the write is testimony.
  */
 declare const CAPTURE_TOKEN_TTL_MS: number;
 /** Issue a token stamped `now` (epoch ms). Prunes expired tokens first so the map can't
@@ -16,4 +24,23 @@ export declare function issueCaptureToken(mint: () => string, now: number): stri
 /** Consume a token iff it is a live, unexpired capture session. One-time use: a second
  *  consume of the same token returns false. */
 export declare function consumeCaptureToken(token: string | undefined, now: number): boolean;
+/** The form a human answers in the client UI (MCP `elicitation/create`, form mode). One
+ *  required boolean, so a bare "accept" (an empty submit) is never read as a yes. */
+export declare const HUMAN_CONFIRMATION_SCHEMA: {
+    type: "object";
+    properties: {
+        confirm: {
+            type: "boolean";
+            title: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** Did the human affirmatively confirm? Only an explicit accept WITH confirm === true
+ *  counts; decline, cancel, and a missing or false checkbox all mean "no signature". */
+export declare function isHumanConfirmationAnswer(result: {
+    action?: string;
+    content?: Record<string, unknown>;
+} | null | undefined): boolean;
 export { CAPTURE_TOKEN_TTL_MS };

package/dist/core/capturetoken.js

@@ -3,10 +3,18 @@
  *
  * hunch_capture_decision issues a short-lived token; the commit path consumes it, so a
  * decision written through the capture front door is provably the tail of an interview
- * — the identity-principle guard against a silent, un-interviewed write. In-memory (the
- * MCP server is long-lived); tokens are one-time-use and expire so an abandoned
- * interview can't leak. Absence of a token never BLOCKS a write yet (staged
+ * PROTOCOL — the identity-principle guard against a silent, un-interviewed write.
+ * In-memory (the MCP server is long-lived); tokens are one-time-use and expire so an
+ * abandoned interview can't leak. Absence of a token never BLOCKS a write yet (staged
  * deprecation §9.3) — the caller decides how to treat an un-gated write.
+ *
+ * WHAT A TOKEN DOES NOT PROVE: that a human answered. Any agent — or content steering
+ * one — can call hunch_capture_decision and consume the token it gets back, entirely
+ * inside the agent's own MCP channel. So a consumed token never confers
+ * `human_confirmed` on its own (the stamp the strict gate and the edit hook trust). It
+ * only licenses ASKING the human through a channel the agent does not control: an MCP
+ * elicitation answered in the client UI (`isHumanConfirmationAnswer`), or a human
+ * running `hunch review --confirm <id>`. Without one of those, the write is testimony.
  */
 const CAPTURE_TOKEN_TTL_MS = 30 * 60 * 1000; // 30 min
 const sessions = new Map(); // token -> issuedAt (epoch ms)
@@ -32,5 +40,23 @@ export function consumeCaptureToken(token, now) {
     sessions.delete(token);
     return now - at <= CAPTURE_TOKEN_TTL_MS;
 }
+/** The form a human answers in the client UI (MCP `elicitation/create`, form mode). One
+ *  required boolean, so a bare "accept" (an empty submit) is never read as a yes. */
+export const HUMAN_CONFIRMATION_SCHEMA = {
+    type: "object",
+    properties: {
+        confirm: {
+            type: "boolean",
+            title: "I confirm this myself",
+            description: "Check only if YOU stated this. Unchecked, it is kept as agent testimony that cannot block.",
+        },
+    },
+    required: ["confirm"],
+};
+/** Did the human affirmatively confirm? Only an explicit accept WITH confirm === true
+ *  counts; decline, cancel, and a missing or false checkbox all mean "no signature". */
+export function isHumanConfirmationAnswer(result) {
+    return result?.action === "accept" && result.content?.confirm === true;
+}
 export { CAPTURE_TOKEN_TTL_MS };
 //# sourceMappingURL=capturetoken.js.map

package/dist/core/changeProof.js

@@ -94,7 +94,8 @@ function exactChangedPaths(root, baseRevision, resultRevision) {
 }
 function exactDiff(root, baseRevision, resultRevision) {
     const raw = gitBytes(root, [
-        "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--no-renames", "--unified=2",
+        "-c", "core.quotePath=false",
+        "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--no-renames", "--unified=2", "--src-prefix=a/", "--dst-prefix=b/",
         baseRevision, resultRevision, "--",
     ]);
     if (raw.byteLength <= MAX_DIFF_BYTES)
@@ -309,6 +310,9 @@ export function deriveChangeProof(root, store, baseRef, resultRef = "HEAD", opti
     const guardReport = store.buildCheckReport(changed.paths, diff.diff, {
         strict: true,
         publicOnly,
+        // A diff cut at MAX_DIFF_BYTES is a prefix: content-matched blocking rules over the
+        // files it omits fail closed rather than read as compliant (dec_20db57c576).
+        diffStatus: diff.gaps.length ? { incomplete: `the guard diff exceeded ${MAX_DIFF_BYTES} bytes and was cut`, truncated: true } : undefined,
         lastChange: (path) => lastChangeAt(root, change.head_revision, path),
     });
     const allStrictBlockerIds = sortedUnique([

package/dist/core/checkreport.d.ts

@@ -29,6 +29,13 @@ export interface CheckDirect {
     strictBlocks: boolean;
     /** If a blocking invariant is downgraded to advisory under strict, why. */
     downgrade?: "stale" | "low-confidence";
+    /** Set when a content-matched blocking invariant could NOT be evaluated because the
+     *  added lines of some scoped files are missing from the diff (truncated diff, git
+     *  failure, unreadable file). Reported as a hit, never as compliance: it fails closed. */
+    unevaluable?: {
+        reason: string;
+        files: string[];
+    };
     /** The causal citation (the "why this guard exists") — present when the graph links it. */
     why?: CausalWhy;
 }

package/dist/core/checkreport.js

@@ -44,6 +44,16 @@ export function renderImpact(im, scope) {
     }
     return out.join("\n");
 }
+/** Strict-failure reason fragments for direct invariants: proven hits and the
+ *  content-matched invariants that could not be evaluated are named separately. */
+function strictBlockerReasons(r) {
+    const unevaluable = r.direct.filter((d) => d.strictBlocks && d.unevaluable).length;
+    const proven = r.strictBlockers - unevaluable;
+    return [
+        proven > 0 ? `${proven} high-confidence blocking invariant(s) directly in scope` : "",
+        unevaluable > 0 ? `${unevaluable} blocking invariant(s) that could not be evaluated against the complete diff` : "",
+    ];
+}
 /** True when --strict should FAIL the commit/PR. */
 export function reportFailsStrict(r) {
     return r.strict && (r.strictBlockers > 0 || r.regBlocking > 0 || r.vetoBlocking > 0);
@@ -93,7 +103,10 @@ export function renderText(r) {
             const note = r.strict && c.severity === "blocking" && !c.strictBlocks
                 ? c.downgrade === "stale" ? "  (advisory: stale)" : "  (advisory: low confidence)"
                 : "";
-            out.push(`  ${mark(c.severity)} [${c.severity}] ${c.statement}${note}\n      ${c.id} · in: ${c.files.join(", ")}\n      rationale: ${c.rationale || "—"}${whyText(c.why)}`);
+            const unevaluable = c.unevaluable
+                ? `\n      ‼ NOT EVALUATED — ${c.unevaluable.reason}; added lines unavailable for: ${c.unevaluable.files.join(", ")} (fails closed)`
+                : "";
+            out.push(`  ${mark(c.severity)} [${c.severity}] ${c.statement}${note}\n      ${c.id} · in: ${c.files.join(", ")}\n      rationale: ${c.rationale || "—"}${unevaluable}${whyText(c.why)}`);
         }
     }
     if (r.near.length) {
@@ -122,7 +135,7 @@ export function renderText(r) {
     }
     if (reportFailsStrict(r)) {
         const reasons = [
-            r.strictBlockers ? `${r.strictBlockers} high-confidence blocking invariant(s) directly in scope` : "",
+            ...strictBlockerReasons(r),
             r.regBlocking ? `${r.regBlocking} blocking-linked regression(s)` : "",
             r.vetoBlocking ? `${r.vetoBlocking} reversed-decision veto(es)` : "",
         ].filter(Boolean).join(" + ");
@@ -153,6 +166,8 @@ export function renderMarkdown(r) {
                 : "";
             out.push(`- **[${c.severity}] ${c.statement}** — \`${c.id}\`${note}`);
             out.push(`  - in: ${c.files.map((f) => `\`${f}\``).join(", ")}`);
+            if (c.unevaluable)
+                out.push(`  - ‼ **Not evaluated** — ${c.unevaluable.reason}; added lines unavailable for ${c.unevaluable.files.map((f) => `\`${f}\``).join(", ")} _(fails closed)_`);
             if (c.rationale)
                 out.push(`  - _${c.rationale}_`);
             for (const line of whyMd(c.why))
@@ -196,7 +211,7 @@ export function renderMarkdown(r) {
     out.push("---");
     if (reportFailsStrict(r)) {
         const reasons = [
-            r.strictBlockers ? `${r.strictBlockers} high-confidence blocking invariant(s) directly in scope` : "",
+            ...strictBlockerReasons(r),
             r.regBlocking ? `${r.regBlocking} blocking-linked regression(s)` : "",
             r.vetoBlocking ? `${r.vetoBlocking} reversed-decision veto(es)` : "",
         ].filter(Boolean).join(" + ");
@@ -233,6 +248,8 @@ export function renderSarif(r, version, extras = {}) {
             text += ` — ${c.rationale}`;
         if (c.downgrade)
             text += ` (advisory under strict: ${c.downgrade})`;
+        if (c.unevaluable)
+            text += `\nNOT EVALUATED (fails closed): ${c.unevaluable.reason}; added lines unavailable for ${c.unevaluable.files.join(", ")}`;
         if (c.why?.decision)
             text += `\nwhy: “${c.why.decision.title}” (${c.why.decision.id})`;
         if (c.why?.bug)

package/dist/core/compare.js

@@ -1,5 +1,5 @@
 import { verdict } from "./checkreport.js";
-import { revExists, rangeFiles, rangeDiff } from "../extractors/git.js";
+import { revExists, rangeFiles, rangeGateDiff } from "../extractors/git.js";
 /** A lower fit score is better. Verdict dominates (pass < warn < block), then the
  *  blocking count, then total advisory hits. Errored candidates sort last. */
 function fitKey(c) {
@@ -14,7 +14,8 @@ export function compareCandidates(store, root, base, candidates) {
         const files = rangeFiles(base, root, ref);
         if (!files.length)
             return { ...zero, verdict: "pass", error: `no changes vs ${base}` };
-        const r = store.buildCheckReport(files, rangeDiff(base, root, ref), { strict: true });
+        const gate = rangeGateDiff(base, root, ref);
+        const r = store.buildCheckReport(files, gate.diff, { strict: true, diffStatus: gate });
         return {
             ref,
             verdict: verdict(r),

package/dist/core/correction.d.ts

@@ -25,12 +25,18 @@ export interface CorrectionInput {
      *  consumer matches repo-relative paths — so without this an absolute hint mints a
      *  scope that can never match. */
     root?: string;
-    /** True when a capture token was CONSUMED for this write — proof a grilling interview
-     *  preceded it. Determines the TIER, never whether the write lands: an un-vouched
-     *  correction still records immediately and still surfaces at edit time and in CI.
-     *  Only the authority to DENY waits for a countersign. */
+    /** True only when a HUMAN confirmed this write outside the agent's channel (an MCP
+     *  elicitation answered in the client UI). A consumed capture token alone is NOT
+     *  enough — any agent can mint and consume one. Determines the TIER, never whether
+     *  the write lands: an un-vouched correction still records immediately and still
+     *  surfaces at edit time and in CI. Only the authority to DENY waits for a countersign
+     *  (`hunch review --confirm <id>`). */
     vouched?: boolean;
 }
+/** Default rationales, exported so a later human countersign can replace the testimony
+ *  wording without touching a rationale a person actually wrote. */
+export declare const VOUCHED_CORRECTION_RATIONALE = "Captured from a human correction of the agent (Never Twice).";
+export declare const TESTIMONY_CORRECTION_RATIONALE = "Recorded by the agent as a correction, without a human confirmation \u2014 advisory testimony until a human countersigns it (`hunch review --confirm`) (Never Twice).";
 /**
  * Build the Constraint a correction mints. Pure (caller passes `now`), so the
  * scope/severity policy is testable in isolation. Key safety rule (research

package/dist/core/correction.js

@@ -41,6 +41,10 @@ export const CORRECTION_NUDGE = "This looks like a correction. If it's a rule th
     "call hunch_record_correction({ rule, scope_hint_file, severity, applies_to_all }) so it " +
     "becomes an enforced, scoped constraint (held at edit-time and in CI) — not a one-off the next session forgets. " +
     "Use severity:\"blocking\" only when the human said never/must; set applies_to_all:true only if the rule is genuinely repo-wide.";
+/** Default rationales, exported so a later human countersign can replace the testimony
+ *  wording without touching a rationale a person actually wrote. */
+export const VOUCHED_CORRECTION_RATIONALE = "Captured from a human correction of the agent (Never Twice).";
+export const TESTIMONY_CORRECTION_RATIONALE = "Recorded by the agent as a correction, without a human confirmation — advisory testimony until a human countersigns it (`hunch review --confirm`) (Never Twice).";
 /** Normalize a scope hint to a repo-relative POSIX path.
  *
  *  An ABSOLUTE hint is the shape an agent naturally sends, but `checkConstraints`
@@ -94,7 +98,8 @@ export function buildCorrectionConstraint(input, now) {
     // the highest-authority write path the least gated one, and strictly worse than
     // hunch_record_decision, which only ever produced advisory memory and is now tiered.
     //
-    // The token sets the TIER, never whether the write lands. An un-vouched correction is
+    // A HUMAN confirmation sets the TIER (a capture token alone is not one — any agent can
+    // mint and consume a token), never whether the write lands. An un-vouched correction is
     // still recorded immediately and still held against every assistant at edit time and
     // in CI — Never Twice keeps its promise. What waits for a countersign is only the
     // authority to DENY.
@@ -114,9 +119,7 @@ export function buildCorrectionConstraint(input, now) {
         // rule that goes stale. Validated against the repo's real deps when supplied → never mints a
         // never-firing rule for a non-dependency. null when nothing derivable → falls back to scope.
         forbids: deriveForbids(rule, input.knownDeps),
-        rationale: input.rationale ?? (vouched
-            ? "Captured from a human correction of the agent (Never Twice)."
-            : "Recorded by the agent as a correction, WITHOUT a capture interview — advisory testimony until a human countersigns it via /capture (Never Twice)."),
+        rationale: input.rationale ?? (vouched ? VOUCHED_CORRECTION_RATIONALE : TESTIMONY_CORRECTION_RATIONALE),
         source_decision: input.source_decision ?? null,
         violations: [],
         status: "active",

package/dist/core/countersign.d.ts

@@ -0,0 +1,28 @@
+/** Human countersign: turn agent testimony into a human-confirmed record.
+ *
+ *  A capture token proves an interview protocol was issued, not that a human answered
+ *  (see capturetoken.ts), so agent-written decisions and corrections land as
+ *  `agent_recorded` testimony. This is the pure record transform behind the human act
+ *  that upgrades them — `hunch review --confirm <id>` (and, for a correction, the
+ *  severity the human grants). It never changes a record's content or status: confirming
+ *  a proposed decision is not shipping it. Pure (caller passes `now`) so it is testable. */
+import type { Constraint, Decision } from "./types.js";
+/** Is this record agent testimony awaiting a human countersign? Token-aware ("+"-joined
+ *  sources), and a record carrying a human signature is never testimony. */
+export declare function isAgentTestimony(source: string | undefined): boolean;
+/** The exact command a HUMAN runs to countersign agent testimony (outside the agent
+ *  channel). `private` targets the overlay home; `severity` grants a correction's authority. */
+export declare function confirmCommand(id: string, opts?: {
+    private?: boolean;
+    severity?: string;
+}): string;
+/** Replace the agent testimony tier with the human signature, keeping every other
+ *  "+"-joined source token ("llm_draft+agent_recorded" → "llm_draft+human_confirmed"). */
+export declare function withHumanSignature(source: string): string;
+/** Countersign a decision. Same tier + confidence the capture path grants a human-confirmed
+ *  write; status, content, and tripwires are untouched (`hunch review --accept` is the path
+ *  that ships a draft and arms its tripwires). */
+export declare function countersignDecision(d: Decision, now: string): Decision;
+/** Countersign a correction. `severity`, when given, is the authority the human grants
+ *  (an unconfirmed "blocking" request was capped to "warning"); otherwise it is kept. */
+export declare function countersignConstraint(c: Constraint, now: string, severity?: Constraint["severity"]): Constraint;

package/dist/core/countersign.js

@@ -0,0 +1,50 @@
+import { TESTIMONY_CORRECTION_RATIONALE, VOUCHED_CORRECTION_RATIONALE } from "./correction.js";
+/** Is this record agent testimony awaiting a human countersign? Token-aware ("+"-joined
+ *  sources), and a record carrying a human signature is never testimony. */
+export function isAgentTestimony(source) {
+    const tokens = (source ?? "").split("+");
+    return tokens.includes("agent_recorded") && !tokens.includes("human_confirmed");
+}
+/** The exact command a HUMAN runs to countersign agent testimony (outside the agent
+ *  channel). `private` targets the overlay home; `severity` grants a correction's authority. */
+export function confirmCommand(id, opts = {}) {
+    return `hunch review --confirm ${id}${opts.severity ? ` --severity ${opts.severity}` : ""}${opts.private ? " --private" : ""}`;
+}
+/** Replace the agent testimony tier with the human signature, keeping every other
+ *  "+"-joined source token ("llm_draft+agent_recorded" → "llm_draft+human_confirmed"). */
+export function withHumanSignature(source) {
+    const tokens = source.split("+").filter((t) => t && t !== "agent_recorded");
+    if (!tokens.includes("human_confirmed"))
+        tokens.push("human_confirmed");
+    return tokens.join("+");
+}
+/** Countersign a decision. Same tier + confidence the capture path grants a human-confirmed
+ *  write; status, content, and tripwires are untouched (`hunch review --accept` is the path
+ *  that ships a draft and arms its tripwires). */
+export function countersignDecision(d, now) {
+    return {
+        ...d,
+        provenance: {
+            ...d.provenance,
+            source: withHumanSignature(d.provenance.source),
+            confidence: Math.max(d.provenance.confidence ?? 0, 0.95),
+            last_verified: now,
+        },
+    };
+}
+/** Countersign a correction. `severity`, when given, is the authority the human grants
+ *  (an unconfirmed "blocking" request was capped to "warning"); otherwise it is kept. */
+export function countersignConstraint(c, now, severity) {
+    return {
+        ...c,
+        severity: severity ?? c.severity,
+        rationale: c.rationale === TESTIMONY_CORRECTION_RATIONALE ? VOUCHED_CORRECTION_RATIONALE : c.rationale,
+        provenance: {
+            ...c.provenance,
+            source: withHumanSignature(c.provenance.source),
+            confidence: 1,
+            last_verified: now,
+        },
+    };
+}
+//# sourceMappingURL=countersign.js.map

package/dist/core/reviewqueue.js

@@ -33,7 +33,12 @@ export const READY_MIN_GROUNDED = 0.7;
  *  explicit roadmap/intent entry a human hasn't confirmed — counts as a review draft.
  *  (Enforcement authority is granted INLINE, not by draining a background queue.) */
 export function isReviewDraft(d) {
-    return d.status === "proposed" && !d.provenance.source.includes("human_confirmed");
+    // Agent testimony (agent_recorded) is deliberate intent, not a machine draft: it shows
+    // on the roadmap marked unconfirmed, and a human confirms it with `hunch review
+    // --confirm`. Keeping it out of the draft queue keeps `adopt-drafts` / `auto-review`
+    // from accepting or rejecting it in bulk.
+    return d.status === "proposed" && !d.provenance.source.includes("human_confirmed")
+        && !d.provenance.source.split("+").includes("agent_recorded");
 }
 /** A draft is "ready to confirm" only when the Critic actually audited it (source
  *  includes "verified") AND judged it well-grounded. A high confidence number alone

package/dist/core/spawnCommand.js

@@ -9,16 +9,48 @@
  * npm/npx launchers run as plain Node scripts (no shell at all). */
 import { existsSync } from "node:fs";
 import { posix, win32 } from "node:path";
-/** cmd.exe quoting for one argument: wrap when it has whitespace or shell
- * metacharacters; double embedded quotes. Good for test/build commands; a
- * deliberately hostile argument still cannot escape because the whole line is
- * passed as one `/s /c "..."` token. */
+/** Quote one argument for a `cmd.exe /d /v:off /s /c "<line>"` launch of a
+ * batch file whose target program parses its command line with the MSVCRT
+ * rules (Node, Python, most native tools).
+ *
+ * Two parsers read the line, and a batch shim that forwards `%*` makes cmd.exe
+ * read it again, so the quoting must mean the same thing to both on every pass:
+ *
+ * - Every non-trivial argument is wrapped in quotes. An embedded quote becomes
+ *   `""` (not `\"`): MSVCRT reads `""` inside a quoted argument as one literal
+ *   quote, and cmd.exe sees two toggles, so its quote state never drifts from
+ *   the argument boundaries and `& | < > ( ) ^` always stay inside quotes.
+ *   A `\"` would look escaped to MSVCRT but end the quoted region for cmd.exe.
+ * - Backslashes are literal except before a quote, so a run of backslashes that
+ *   precedes an embedded or closing quote is doubled.
+ * - `%` expands even inside quotes. It is emitted as `"^%"`: the quote closes,
+ *   the caret escapes the percent outside quotes (cmd.exe removes the caret),
+ *   and the quote reopens. MSVCRT joins the pieces back into one argument.
+ *   Expansion of a forwarded `%*` is not rescanned, so a shim pass is safe too.
+ *
+ * A line break cannot be carried: cmd.exe ends the command at it and silently
+ * drops the rest, so such an argument is refused rather than truncated. */
 function quoteForCmd(arg) {
-    if (arg === "")
-        return '""';
-    if (!/[\s"&|<>^()%!]/.test(arg))
+    if (/[\r\n]/.test(arg))
+        throw new Error("a .cmd/.bat launcher cannot receive an argument containing a line break");
+    if (arg !== "" && /^[A-Za-z0-9_\-.:/\\@+]+$/.test(arg))
         return arg;
-    return `"${arg.replace(/"/g, '""')}"`;
+    let out = '"';
+    let backslashes = 0;
+    for (const ch of arg) {
+        if (ch === "\\") {
+            backslashes++;
+            continue;
+        }
+        if (ch === '"')
+            out += "\\".repeat(backslashes * 2) + '""';
+        else if (ch === "%")
+            out += "\\".repeat(backslashes * 2) + '"^%"';
+        else
+            out += "\\".repeat(backslashes) + ch;
+        backslashes = 0;
+    }
+    return out + "\\".repeat(backslashes * 2) + '"';
 }
 export function resolveSpawnCommand(command, options = {}) {
     const platform = options.platform ?? process.platform;
@@ -49,7 +81,7 @@ export function resolveSpawnCommand(command, options = {}) {
                 continue;
             if (/\.(cmd|bat)$/i.test(candidate)) {
                 const line = [candidate, ...args].map(quoteForCmd).join(" ");
-                return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true, how: "cmd-shim" };
+                return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/v:off", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true, how: "cmd-shim" };
             }
             if (ext === "" && !/\.(exe|com)$/i.test(candidate))
                 continue; // an extensionless file is not runnable on Windows

package/dist/core/stateHttp.d.ts

@@ -40,7 +40,7 @@ export declare const HttpHealthSchema: z.ZodObject<{
     ok: z.ZodBoolean;
     version: z.ZodString;
     protocol: z.ZodLiteral<"nuryel.state/1">;
-    partitions: z.ZodArray<z.ZodString>;
+    partitions: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export declare const HttpReadResponseSchema: z.ZodObject<{
     conventions: z.ZodOptional<z.ZodObject<{

package/dist/core/stateHttp.js

@@ -6,7 +6,9 @@ export const HttpCapabilitiesSchema = CapabilityNegotiationSchema.extend({
     principal: PrincipalSchema.pick({ id: true, kind: true, grants: true }),
 }).strict();
 export const HttpHealthSchema = z.object({
-    ok: z.boolean(), version: z.string(), protocol: z.literal(STATE_CONTRACT_VERSION), partitions: z.array(z.string()),
+    ok: z.boolean(), version: z.string(), protocol: z.literal(STATE_CONTRACT_VERSION),
+    // Present only when the request carried a valid credential.
+    partitions: z.array(z.string()).optional(),
 }).strict();
 // Delivery has its own richer assertion and receipt checks in delivery.ts.
 export const HttpReadResponseSchema = ReadResponseSchema.extend({ envelope: z.record(z.string(), z.unknown()) });

package/dist/core/taskReportEvidence.js

@@ -5,7 +5,7 @@ import { canonicalReportRoot } from "./taskReportPaths.js";
 import { resolveSpawnCommand } from "./spawnCommand.js";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { analyzeDiff } from "../extractors/diff.js";
-import { workingDiff, workingFiles } from "../extractors/git.js";
+import { workingGateDiff, workingFiles } from "../extractors/git.js";
 import { assertCompleteRepoScan, scanRepo } from "../extractors/indexer.js";
 import { checkConformance } from "./conformance.js";
 import { effectiveForbids, matchForbids } from "./constraintmatch.js";
@@ -104,9 +104,9 @@ export function runReportConformance(root, store, taskId) {
     const before = reportSourceSnapshot(root).hash;
     const files = workingFiles(root);
     const changed = new Set(files);
-    const diff = workingDiff(root);
-    const analysis = analyzeDiff(diff);
-    const truncated = diff.endsWith("…(diff truncated)…");
+    const gate = workingGateDiff(root);
+    const analysis = analyzeDiff(gate.diff);
+    const unread = new Set(gate.unreadFiles ?? []);
     let graph;
     const workingGraph = () => {
         if (graph !== undefined)
@@ -141,8 +141,8 @@ export function runReportConformance(root, store, taskId) {
                 note("constraint-forbids", "not-exercised", "No changed file falls in this constraint's scope.");
                 continue;
             }
-            if (truncated) {
-                note("constraint-forbids", "unavailable", "The working diff exceeds the bounded analysis budget; added lines were not fully inspected.", scoped);
+            if (gate.incomplete || scoped.some(f => unread.has(f))) {
+                note("constraint-forbids", "unavailable", "The complete working diff could not be read; added lines were not fully inspected.", scoped);
                 continue;
             }
             const match = matchForbids(forbids, new Set(analysis.addedDeps), scoped.flatMap(f => analysis.addedLinesByFile.get(f) ?? []));
@@ -216,9 +216,31 @@ export async function runReportCheck(root, taskId, command, label, timeoutMs = D
         // Windows launchers (npx.cmd, npm.cmd, other .cmd/.bat shims) cannot be spawned
         // without a shell; resolve them first so a check actually runs instead of
         // silently recording exit_code null (fnd: every Windows card said "no result").
-        const resolved = resolveSpawnCommand(command);
-        const child = spawn(resolved.file, resolved.args, { cwd: root, shell: false, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32", windowsVerbatimArguments: resolved.windowsVerbatimArguments === true });
         const stdout = createHash("sha256"), stderr = createHash("sha256");
+        const launchFailure = (error) => {
+            // A launch failure is a result the user must see (ENOENT is the common
+            // one); it is hashed like any other stderr and streamed to the caller.
+            const text = error instanceof Error ? error.message : String(error);
+            return Buffer.from(`hunch: could not start ${JSON.stringify(command[0])}: ${text}\n`);
+        };
+        const started = (() => {
+            try {
+                const resolved = resolveSpawnCommand(command);
+                return spawn(resolved.file, resolved.args, { cwd: root, shell: false, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32", windowsVerbatimArguments: resolved.windowsVerbatimArguments === true });
+            }
+            catch (error) {
+                // An argument the launcher cannot carry, or a synchronous spawn refusal
+                // (EINVAL for a batch file), is the same visible failure as ENOENT.
+                return launchFailure(error);
+            }
+        })();
+        if (Buffer.isBuffer(started)) {
+            stderr.update(started);
+            options.onStderr?.(started);
+            resolveResult({ code: null, timedOut: false, cancelled: false, hash: reportHash({ stdout: stdout.digest("hex"), stderr: stderr.digest("hex") }) });
+            return;
+        }
+        const child = started;
         let timedOut = false, cancelled = false, settled = false;
         let cleanupTimer;
         const settle = (code) => {
@@ -267,9 +289,7 @@ export async function runReportCheck(root, taskId, command, label, timeoutMs = D
             options.onStderr?.(chunk);
         } });
         child.once("error", (error) => {
-            // A launch failure is a result the user must see (ENOENT is the common
-            // one); it is hashed like any other stderr and streamed to the caller.
-            const message = Buffer.from(`hunch: could not start ${JSON.stringify(command[0])}: ${error.message}\n`);
+            const message = launchFailure(error);
             if (!settled) {
                 stderr.update(message);
                 options.onStderr?.(message);

package/dist/core/topics.js

@@ -86,7 +86,7 @@ export function renderGrounding(fileDecisions, allDecisions = fileDecisions) {
         // Token-aware match (mirrors strictgate.isHumanConfirmed; not imported — that
         // module imports this one).
         const testimony = d.provenance.source.split("+").includes("agent_recorded")
-            ? " — ⚠ agent-recorded testimony, no human countersign yet (/capture confirms it)"
+            ? ` — ⚠ agent-recorded testimony, no human countersign yet (a human confirms it: hunch review --confirm ${d.id})`
             : "";
         return `• "${d.topic}": ${d.decision || d.title} [${d.id}]${rej}${testimony}`;
     });