@davesheffer/hunch 1.39.1 → 1.39.3

package/dist/cli/index.js

@@ -14,13 +14,13 @@
  *   doctor    environment diagnostics
  */
 import "./preflight.js"; // MUST stay the first import — Node-version gate before node:sqlite loads
-import { chmodSync, existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, writeFileSync, mkdirSync, mkdtempSync, realpathSync, rmSync, rmdirSync, symlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, writeFileSync, mkdirSync, mkdtempSync, rmSync, rmdirSync, symlinkSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
 import { join, relative, dirname, basename, resolve, isAbsolute } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
-import { hunchPaths, hunchPathsForDir, findRoot, toPosixTarget, isDir } from "../core/paths.js";
+import { hunchPaths, hunchPathsForDir, findRoot, toPosixTarget, isDir, realpathNorm, repoRelativeTarget } from "../core/paths.js";
 import { writeFileAtomic } from "../core/io.js";
 import { looksLikeCorrection, CORRECTION_NUDGE } from "../core/correction.js";
 import { HUNCH_VERSION } from "../core/version.js";
@@ -36,7 +36,7 @@ import { publishedStatus } from "../integrations/registry.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { JsonStore } from "../store/jsonStore.js";
 import { selectEmbedder } from "../store/embedder.js";
-import { assertCompleteRepoScan, indexRepo, scanRepo } from "../extractors/indexer.js";
+import { assertCompleteRepoScan, indexRepo, mergeScannedEdges, scanRepo } from "../extractors/indexer.js";
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { readSynthesisPreference, resolveSynthesisProvider, selectProvider, SYNTH_PREFERENCES, writeSynthesisPreference, normalizeProviderName, } from "../synthesis/provider.js";
@@ -52,7 +52,7 @@ import { deriveForbids, effectiveForbids } from "../core/constraintmatch.js";
 import { extractInlineIntent } from "../extractors/comments.js";
 import { renderText, renderMarkdown, renderSarif, renderImpact, reportFailsStrict } from "../core/checkreport.js";
 import { partitionReview, isReviewDraft, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
-import { installPostCommitHook, installPreCommitHook, installPostMergeHook, installPostCheckoutHook, hookStatus, hookReport, formatHookInstall } from "../integrations/hooks.js";
+import { installPostCommitHook, installPreCommitHook, installPostMergeHook, installPostCheckoutHook, hookStatus, hookReport, hookInvocationLines, formatHookInstall } from "../integrations/hooks.js";
 import { ensureSharedOverlayPointer } from "../integrations/worktree.js";
 import { flushCapture, flushMemoryHome, flushMemoryHomes, pinSharedRemote, sharedRemoteFor } from "../integrations/sync.js";
 import { installMergeDriver } from "../integrations/mergeDriver.js";
@@ -80,7 +80,7 @@ import { diffProjectDna } from "../core/projectDnaDelta.js";
 import { projectDnaDeliverySupplement } from "../core/projectDnaDelivery.js";
 import { readConfig, writeConfig, FIRMNESS_LEVELS, isFirmness, workspacesConfig } from "../core/config.js";
 import { loadOrCreateMachine, setMachineLabel, machineFile, labelLeaksIdentity } from "../core/machine.js";
-import { worktreeRows, branchRows } from "../core/workspace.js";
+import { worktreeRows, branchRows, publicWorkspaceRemovalRecipe } from "../core/workspace.js";
 import { workspaceLedgerView, recordWorkspaceSnapshot, renderWorktreeTable, renderBranchTable, workspaceSummaryLine, prunePlanFor, renderPrunePlan, applyPrune, confirmPrune, pruneConfirmQuestion } from "../integrations/workspaceLedger.js";
 import { blockingInScope, vetoInScope, proposedEditLines } from "../core/hookpolicy.js";
 import { isHumanConfirmed } from "../core/strictgate.js";
@@ -88,7 +88,7 @@ import { appendEvent, readEvents } from "../core/events.js";
 import { computeStats, formatStats } from "../core/stats.js";
 import { injectionMode, resetSessionInjections } from "../core/hookcache.js";
 import { recordServed, servedSummary } from "../core/served.js";
-import { recordTaskDelivery, reportActivity, reportPresentationEnabled, unseenLessons } from "../core/taskReport.js";
+import { recordTaskDelivery, reportActivity, reportHash, reportPresentationEnabled, unseenLessons } from "../core/taskReport.js";
 import { snapshotDeliveredRecords } from "../core/taskReportEvidence.js";
 import { renderRecalledLine } from "../core/taskReportRender.js";
 import { closeHookTask, hookReportTaskId, nativeHookCwd, settleHookSession, startHookReport, stopHookReport, observeHookDenial } from "../core/taskReportHook.js";
@@ -102,10 +102,11 @@ import { loadGoldenSet, evaluateRetrieval, evaluateTraversalLift } from "../eval
 import { loadGuardCases, evalGuards, generateGuardCases } from "../eval/guards.js";
 import { DRIFT_KINDS, computeDrift } from "../core/drift.js";
 import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/scorecard.js";
-import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
+import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData, unconfirmedRoadmapMarker } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
 import { topicCollisions, isInForce, liveForTopic } from "../core/topics.js";
 import { ADR_DIR_CANDIDATES, ADR_FILE_RE, mapAdrCorpus } from "../extractors/adrImport.js";
+import { countersignConstraint, countersignDecision } from "../core/countersign.js";
 import { applyImportedAdrReview, carryImportedAdrReview, importedAdrReviewHash, importedAdrSourceHash, isImportedAdrDecision, pendingImportedAdrReviews } from "../core/importReview.js";
 import { exportMadrCorpus, isRegenerableMadr } from "../integrations/madrExport.js";
 import { buildMadrManifest, writeMadrManifest, refreshMadrCorpus } from "../integrations/madrManifest.js";
@@ -362,7 +363,7 @@ program
             // any mutator. With no commit identity there is no safe public source,
             // so leave no source-derived records behind for a future pump.
             store.json.replaceAll("symbols", []);
-            store.json.replaceAll("edges", []);
+            store.json.replaceAll("edges", mergeScannedEdges(store.json.loadAll("edges"), []));
             store.json.replaceAll("components", []);
             store.reindex();
             console.log("  ⚠ skipped code graph: no committed HEAD — commit code, then run `hunch index`");
@@ -496,8 +497,10 @@ program
     // the same way; do the same for the hook so an upgrade doesn't require
     // re-running init by hand. Gated on already having post-commit: `index`
     // is not a setup command (it runs in CI, on any git repo), so it must
-    // never be what FIRST hooks a repo that never ran init at all.
-    if (isGitRepo(root) && hookStatus(root).postCommit) {
+    // never be what FIRST hooks a repo that never ran init at all. A STALE
+    // post-commit block counts too (issue #315): it proves init ran, so the
+    // missing post-merge/post-checkout hooks are still this repo's to heal.
+    if (isGitRepo(root) && ["installed", "stale"].includes(hookReport(root).postCommit.state)) {
         const inv = resolveInvocation().shell;
         installPostMergeHook(root, inv);
         installPostCheckoutHook(root, inv); // same upgrade path for the workspace-ledger hook
@@ -1516,8 +1519,15 @@ workspacesCmd
                 return console.log("  · or set .hunch/config.json {\"workspaces\":{\"publish_public\":true}} to commit it into this repo's .hunch/");
             case "unchanged":
                 return console.log(`✓ unchanged since ${out.previous.observed_at} (${out.record.id}) — nothing written`);
+            case "deferred":
+                return console.log(out.reason === "detached-head"
+                    ? "deferred: HEAD is detached — the next checkout or ledger read records this machine"
+                    : "deferred: a git operation is in progress — the next checkout or ledger read records this machine");
             case "collision":
-                return fail(`not written: ${out.reason}\n  · \`hunch workspaces forget ${out.record.id}\` removes the stale copy (a normal, revertable memory move), then snapshot again`);
+                // The capture is routed to the overlay, so the only home it can collide with is
+                // this repo's committed `.hunch/`. `forget` refuses that record (an additive pump
+                // never stages a deletion), so the recipe here is the manual git removal.
+                return fail(`not written: ${out.reason}\n  the stale copy lives in this repo's .hunch/ — remove it by hand, then snapshot again:\n${publicWorkspaceRemovalRecipe(out.record.id, out.record.machine.label)}`);
             case "written":
                 return console.log(`✓ recorded ${out.record.worktrees.length} worktree(s), ${out.record.branches.length} branch(es) as ${out.record.machine.label} (${out.record.id}, publish=${out.record.publish}) → ${out.home === "private" ? "overlay" : "public .hunch/"}${out.flushed ? `, ${out.flushed}` : ""}`);
         }
@@ -1576,7 +1586,7 @@ workspacesCmd
             console.log(`  ${r.outcome === "deleted" ? "✓" : r.outcome === "skipped" ? "–" : "✗"} ${r.step.branch}: ${r.detail}`);
         const failed = results.filter((r) => r.outcome === "failed").length;
         const skipped = results.filter((r) => r.outcome === "skipped").length;
-        const ledger = recorded === "written" ? " · ledger updated" : recorded === "unchanged" || recorded === "no-home" || recorded === "off" ? "" : ` · ledger not updated (${recorded})`;
+        const ledger = recorded === "written" ? " · ledger updated" : recorded === "unchanged" || recorded === "no-home" || recorded === "off" ? "" : recorded === "deferred" ? " · ledger deferred (git operation in progress or detached HEAD)" : ` · ledger not updated (${recorded})`;
         console.log(`\n${results.length - failed - skipped} deleted, ${skipped ? `${skipped} skipped (nothing changed), ` : ""}${failed} refused by git${ledger}`);
         if (failed || skipped)
             process.exitCode = 1;
@@ -1604,12 +1614,25 @@ workspacesCmd
         const victims = store.recs("workspaces").filter((r) => r.machine.label === machine || r.machine.id === machine || r.id === machine);
         if (!victims.length)
             return fail(`no workspace record for "${machine}" — \`hunch workspaces\` lists the machines in memory`);
-        // Decide each record's home BEFORE deleting it, then flush exactly those homes.
-        const homes = victims.map((v) => store.getPrivateRec("workspaces", v.id) ? "private" : "public");
-        for (const v of victims)
+        // Decide each record's home BEFORE deleting anything, then flush exactly those homes.
+        // A PUBLIC record (workspaces.publish_public) is refused rather than deleted: the
+        // memory pump never stages a tracked deletion, so removing the file here would strand
+        // `D .hunch/workspaces/<id>.json` and wedge every later auto-commit — see
+        // publicWorkspaceRemovalRecipe.
+        const overlay = victims.filter((v) => store.getPrivateRec("workspaces", v.id));
+        const refused = victims.filter((v) => !store.getPrivateRec("workspaces", v.id));
+        for (const v of overlay)
             store.deleteWhereItLives("workspaces", v.id);
-        pumpMemoryHomes(store, root, homes, `hunch: forget workspace ${machine}`);
-        console.log(`✓ forgot ${victims.length} record(s) for ${machine}`);
+        if (overlay.length) {
+            pumpMemoryHome(store, root, "private", `hunch: forget workspace ${machine}`);
+            console.log(`✓ forgot ${overlay.length} record(s) for ${machine}`);
+        }
+        for (const v of refused) {
+            console.log(`refused: ${v.id} (${v.machine.label}) lives in this repo's .hunch/ — Hunch publication is additive and never stages a deletion, so it is removed by hand:\n`
+                + publicWorkspaceRemovalRecipe(v.id, v.machine.label));
+        }
+        if (refused.length && !overlay.length)
+            process.exitCode = 1;
     }
     finally {
         store.close();
@@ -4501,18 +4524,26 @@ program
     .requiredOption("--by <new>", "decision id that supersedes it")
     .action((oldId, opts) => {
     const { store, root } = storeFor();
-    const by = store.json.get("decisions", opts.by);
+    // `old`'s home decides which store the close is written to; `--by` must resolve in
+    // that SAME store, or a private `by` linked against a public `old` would write the
+    // private id straight into the committed public store.
+    const home = decisionMemoryHome(store, oldId);
+    if (!store.decisionInStore(oldId, home === "private")) {
+        store.close();
+        return fail(`decision "${oldId}" not found`);
+    }
+    const by = store.decisionInStore(opts.by, home === "private");
     if (!by) {
         store.close();
-        return fail(`--by decision "${opts.by}" not found`);
+        return fail(`--by decision "${opts.by}" not found in the ${home} store that holds "${oldId}"`);
     }
-    const closed = store.supersede(oldId, by);
+    const closed = home === "private" ? store.supersedePrivate(oldId, by) : store.supersede(oldId, by);
     if (!closed) {
         store.close();
-        return fail(`decision "${oldId}" not found (or same as --by)`);
+        return fail(`decision "${oldId}" cannot supersede itself`);
     }
     store.reindex();
-    pumpMemoryHome(store, root, "public", `hunch: supersede ${oldId} by ${opts.by}`);
+    pumpMemoryHome(store, root, home, `hunch: supersede ${oldId} by ${opts.by}`);
     console.log(`✓ ${oldId} superseded by ${opts.by} — window closed at ${closed.valid_to?.slice(0, 10)}.`);
     store.close();
 });
@@ -4756,10 +4787,12 @@ program
             if (/^(Edit|Write|MultiEdit)$/.test(evt.tool_name ?? "")) {
                 // A Codex apply_patch touches every file it lists (and each Move-to
                 // destination); the Stop gate must see all of them, not only the first.
-                const patchPaths = evt.tool_input?.patch_files?.flatMap((f) => f.moved_to ? [f.path, f.moved_to] : [f.path]);
-                const edited = patchPaths?.length ? patchPaths : evt.tool_input?.file_path ? [evt.tool_input.file_path] : [];
-                for (const p of edited)
-                    st = onEdit(st, toRepoRel(root, p));
+                // Same in-repo filter as the pre-edit path: a scratch file outside the
+                // repository is not a product edit, and recording it would block Stop on
+                // a path no check can ever verify.
+                const edited = editTargets(root, evt.tool_input);
+                for (const e of edited)
+                    st = onEdit(st, e.target);
                 if (edited.length)
                     activity = { kind: "edit" };
             }
@@ -5042,7 +5075,10 @@ program
                         L.push(`  ${r.date} [${r.status}] ${r.title} (${r.id})`);
                 }
                 if (roadmap.length) {
-                    L.push(`Roadmap (${roadmap.length} live proposed): ${roadmap.slice(0, 3).map((r) => r.title).join(" · ")}${roadmap.length > 3 ? " · …" : ""}`);
+                    L.push(`Roadmap (${roadmap.length} live proposed): ${roadmap.slice(0, 3).map((r) => (r.unconfirmed ? `${r.title} [unconfirmed, ${r.id}]` : r.title)).join(" · ")}${roadmap.length > 3 ? " · …" : ""}`);
+                    const unconfirmed = roadmap.filter((r) => r.unconfirmed).length;
+                    if (unconfirmed)
+                        L.push(`${unconfirmed} roadmap item(s) are unconfirmed agent testimony — the human confirms each with \`hunch review --confirm <id>${s.unified ? " --private" : ""}\`.`);
                 }
                 if (pendingReview > 0)
                     L.push(`${pendingReview} legacy un-vouched draft(s) — adopt as advisory memory with \`hunch adopt-drafts\` (new captures auto-trust).`);
@@ -5214,7 +5250,11 @@ program
         const reportTaskId = hookReportTaskId(root, provider, evt);
         // A new authoritative prompt gets its own full delivery. An earlier
         // prompt's session-level delta cannot establish this task's receipt.
-        if (injectionMode(evt.session_id, `pre:${target}${reportTaskId ? `:${reportTaskId}` : ""}`, text) === "delta") {
+        // A subagent reports to the prompt's task but starts with FRESH context:
+        // it never saw that grounding, so its dedup is scoped by its own agent
+        // identity (hashed — the raw agent_id is never retained in the key).
+        const agentKey = evt.agent_id ? `:${reportHash(evt.agent_id).slice(7, 19)}` : "";
+        if (injectionMode(evt.session_id, `pre:${target}${reportTaskId ? `:${reportTaskId}` : ""}${agentKey}`, text) === "delta") {
             receipts("refreshed");
             emitContext(provider, "PreToolUse", `Hunch grounding for ${target}: unchanged this session (${envelope.delivered.filter((item) => item.kind === "decisions").length} decision(s), ${envelope.delivered.filter((item) => item.kind === "constraints").length} invariant(s) shown earlier — still current; hunch_why("${target}") to re-expand).`);
             return;
@@ -5358,6 +5398,8 @@ program
     .description("Answer hash-bound imported-ADR questions, or triage deliberate proposed drafts.")
     .option("--accept <id>", "promote a decision to accepted/human-confirmed (confirms its tripwires)")
     .option("--reject <id>", "reject a draft decision with a durable lifecycle tombstone")
+    .option("--confirm <id>", "countersign an agent-recorded decision (dec_…) or correction (con_…) as human-confirmed WITHOUT changing its status or content — the human act a capture token alone cannot stand in for")
+    .option("--severity <s>", "with --confirm on a correction: the severity you grant (advisory | warning | blocking); default keeps its current severity")
     .option("--approve-import <id>", "approve one exact imported ADR as human-confirmed authority")
     .option("--decline-import <id>", "record that one exact imported ADR was reviewed and must stay advisory")
     .option("--expected-source-hash <hash>", "exact sha256 source hash printed with the imported-ADR question")
@@ -5374,11 +5416,15 @@ program
         store.close();
         return fail("--private needs HUNCH_PRIVATE_DIR set to a private store");
     }
-    const actionCount = [opts.accept, opts.reject, opts.approveImport, opts.declineImport, opts.acceptVerified, opts.rejectDuplicates].filter(Boolean).length;
+    const actionCount = [opts.accept, opts.reject, opts.confirm, opts.approveImport, opts.declineImport, opts.acceptVerified, opts.rejectDuplicates].filter(Boolean).length;
     if (actionCount > 1) {
         store.close();
         return fail("choose exactly one review action at a time");
     }
+    if (opts.severity && !opts.confirm) {
+        store.close();
+        return fail("--severity applies only with --confirm on a correction");
+    }
     const decisions = () => opts.private ? store.recs("decisions") : store.json.loadAll("decisions");
     let publicGroundingChanged = false;
     const touchedHomes = new Set();
@@ -5418,6 +5464,58 @@ program
             return fail(error instanceof Error ? error.message : String(error));
         }
     }
+    else if (opts.confirm) {
+        // Human countersign of agent testimony. A capture token proves only that the
+        // interview tool was called (inside the agent's channel), so agent-written records
+        // land as agent_recorded; this is the out-of-channel human act that signs them.
+        // Content and status are untouched: confirming a proposed decision is not shipping it.
+        const id = opts.confirm;
+        const SEV = ["advisory", "warning", "blocking"];
+        if (opts.severity && !SEV.includes(opts.severity)) {
+            store.close();
+            return fail(`--severity must be one of: ${SEV.join(", ")}`);
+        }
+        const now = new Date().toISOString();
+        const d = opts.private ? store.getRec("decisions", id) : store.json.get("decisions", id);
+        const c = d ? undefined : opts.private ? store.getRec("constraints", id) : store.json.get("constraints", id);
+        if (!d && !c) {
+            store.close();
+            return fail(`no decision or constraint ${id} found${opts.private ? "" : " in the public home (add --private for overlay records)"}`);
+        }
+        let home;
+        if (d) {
+            if (opts.severity) {
+                store.close();
+                return fail("--severity applies only when confirming a correction (con_…), not a decision");
+            }
+            if (isImportedAdrDecision(d)) {
+                store.close();
+                return fail(`imported ADR ${d.id} requires the hash-bound --approve-import flow shown by hunch review`);
+            }
+            home = opts.private ? decisionMemoryHome(store, d.id) : "public";
+            putDecisionInHome(store, countersignDecision(d, now), home);
+            console.log(`✓ confirmed decision ${id} as human_confirmed (status ${d.status} unchanged)`);
+        }
+        else {
+            home = opts.private && store.getPrivateRec("constraints", id) ? "private" : "public";
+            const next = countersignConstraint(c, now, opts.severity);
+            if (home === "private")
+                store.putPrivate("constraints", next);
+            else
+                store.json.put("constraints", next);
+            const repoWide = next.scope.length === 1 && next.scope[0] === "**";
+            console.log(`✓ confirmed ${next.severity} constraint ${id} as human_confirmed (scope: ${next.scope.join(", ")})`);
+            if (next.severity === "blocking" && repoWide)
+                console.log("  ⚠ repo-wide blocking rule: it can deny any edit at strict firmness and fail hunch check --strict.");
+        }
+        touchedHomes.add(home);
+        store.reindex();
+        if (home === "public") {
+            publicGroundingChanged = true;
+            if (!store.autoCommit)
+                refreshExistingGrounding(root, store);
+        }
+    }
     else if (opts.accept) {
         const d = opts.private ? store.getRec("decisions", opts.accept) : store.json.get("decisions", opts.accept);
         if (!d) {
@@ -5541,7 +5639,7 @@ program
                 if (dupCount)
                     console.log(`\n   Batch-reject the ${dupCount} duplicate(s): hunch review --reject-duplicates`);
             }
-            console.log(`\nAccept: hunch review --accept <id>   Reject: hunch review --reject <id>`);
+            console.log(`\nAccept: hunch review --accept <id>   Reject: hunch review --reject <id>   Confirm (sign, keep status): hunch review --confirm <id>`);
         }
     }
     if (touchedHomes.size)
@@ -6741,7 +6839,7 @@ program
         if (!roadmap.length)
             console.log("  (empty — record what's next as a PROPOSED decision via /capture and it appears here)");
         for (const r of roadmap)
-            console.log(`  • ${r.title}  (${r.id}${r.topic ? `, ${r.topic}` : ""}, since ${r.date})\n      ${r.note}`);
+            console.log(`  • ${r.title}  (${r.id}${r.topic ? `, ${r.topic}` : ""}, since ${r.date})${r.unconfirmed ? `\n      ${unconfirmedRoadmapMarker(r, { private: !!opts.private })}` : ""}\n      ${r.note}`);
         if (pendingReview > 0)
             console.log(`\n  (${pendingReview} legacy un-vouched draft(s) — \`hunch adopt-drafts\` to auto-trust them as advisory)`);
         // Task-record ranking: evaluated automatically on every task write; the kill rule applies itself.
@@ -7018,9 +7116,23 @@ program
         // hook manager's regenerated file — issue #311) is NOT installed.
         const unreachable = [["post-commit", report.postCommit], ["post-merge", report.postMerge], ["pre-commit", report.preCommit], ["post-checkout", report.postCheckout]]
             .filter(([, e]) => e.state === "unreachable");
+        // Present where git runs it, but its command is not a Hunch launcher that
+        // exists (hand-edited, or an absolute path gone after a reinstall) — issue #315.
+        const stale = [["post-commit", report.postCommit], ["post-merge", report.postMerge], ["pre-commit", report.preCommit], ["post-checkout", report.postCheckout]]
+            .filter(([, e]) => e.state === "stale");
+        // A bare `hunch init` regenerates post-commit without --private/--commit
+        // and pre-commit without --strict, so pointing at it without naming the
+        // options that keep them silently DOWNGRADES the install. --commit is left
+        // out: init's auto-commit is ON unless --no-auto-commit is passed, so a
+        // bare re-run keeps it and naming it here would claim a loss that never happens.
+        const carried = [...new Set(stale.flatMap(([, e]) => e.flags ?? []))].filter((f) => f !== "--commit");
+        const keep = carried.map((f) => (f === "--strict" ? "--enforce-strict" : f === "--private" ? "--private-sync (or --shared-sync)" : "")).filter(Boolean);
+        const staleKeep = carried.length
+            ? ` — the stale block carried ${carried.join(", ")}${keep.length ? `: pass ${keep.join(", ")} or they are dropped` : ""}`
+            : "";
         // `hunch index` only ever installs post-merge onto an existing
-        // post-commit install (it never hooks an un-hooked repo — see
-        // isGitRepo(root) && hookStatus(root).postCommit above) and never writes
+        // post-commit install (it never hooks an un-hooked repo — see the
+        // hookReport(root).postCommit.state gate above) and never writes
         // into a manager-owned hook — so the fix hint must not point there when
         // post-commit itself is missing or a hook manager is in play.
         const managedMissing = [report.postCommit, report.postMerge].find((e) => e.state === "missing" && e.manager !== "none");
@@ -7030,6 +7142,7 @@ program
         const problems = [
             missing.length ? `⚠ missing ${missing.join(", ")} — ${fix}` : "",
             unreachable.length ? `⚠ installed but unreachable: ${unreachable.map(([n]) => n).join(", ")} — never runs; run \`hunch init\` to print the snippet for your hook manager` : "",
+            stale.length ? `⚠ stale: ${stale.map(([n]) => n).join(", ")} — the hook's command is not a working Hunch launcher; run \`hunch init\` to regenerate it${staleKeep}` : "",
         ].filter(Boolean);
         console.log(`hooks:      ${problems.length
             ? problems.join("\n            ")
@@ -7037,6 +7150,13 @@ program
         for (const [name, e] of unreachable) {
             console.log(dim(`            ↳ ${name}: ${e.reason ?? "the block sits where git never reaches it"} (${rel(root, e.path)})`));
         }
+        for (const [name, e] of stale) {
+            console.log(dim(`            ↳ ${name}: ${e.reason ?? "the block's command is not a Hunch launcher"} (${rel(root, e.path)})`));
+        }
+        // Where the live hooks point — informational (a hook may legitimately run
+        // another install), but the fastest way to spot a stale/foreign launcher.
+        for (const line of hookInvocationLines(report, resolveInvocation().shell))
+            console.log(dim(`            ↳ ${line}`));
         // Workspace ledger: what this machine is called, whether its record is in memory,
         // and whether the checkout hook that keeps it fresh is installed.
         try {
@@ -7045,7 +7165,7 @@ program
             const others = store.recs("workspaces").filter((r) => r.machine.id !== machine.id).length;
             const leak = labelLeaksIdentity(machine.label);
             console.log(`workspaces: this machine is ${machine.label}${leak ? ` (⚠ label equals the ${leak})` : ""} · record in memory: ${stored ? `yes (${stored.observed_at})` : "no"} · ${others} other machine(s)` +
-                `${hooks.postCheckout ? " · post-checkout hook installed" : report.postCheckout.state === "unreachable" ? " · ⚠ post-checkout hook unreachable" : hooks.postCommit ? " · post-checkout hook not installed (`hunch index` adds it)" : ""}`);
+                `${hooks.postCheckout ? " · post-checkout hook installed" : report.postCheckout.state === "unreachable" ? " · ⚠ post-checkout hook unreachable" : report.postCheckout.state === "stale" ? " · ⚠ post-checkout hook stale" : hooks.postCommit ? " · post-checkout hook not installed (`hunch index` adds it)" : ""}`);
         }
         catch { /* no machine file writable: nothing to report */ }
     }
@@ -7190,28 +7310,17 @@ function readStdin() {
     });
 }
 /** Absolute edit path → repo-relative, forward-slash (constraint scopes are
- *  forward-slash globs even on Windows). */
-/** realpath a path even if it doesn't exist yet (a new file an agent is about to
- *  Write): resolve the longest existing ancestor, then re-append the missing tail.
- *  Idempotent on already-resolved paths. */
-function realpathNorm(p) {
-    try {
-        return realpathSync.native(p);
-    }
-    catch {
-        const parent = dirname(p);
-        if (parent === p)
-            return p; // hit the root; nothing more to resolve
-        return join(realpathNorm(parent), basename(p));
-    }
-}
-/** Repo-relative POSIX path. BOTH ends are realpath-normalized first: on macOS
- *  `process.cwd()` (hence findRoot) resolves /var→/private/var, but a hook event's
- *  file_path arrives UN-resolved — so a naive relative() yields a bogus "../" path
- *  under any symlinked root (/var, /tmp, symlinked $HOME) and the caller treats the
- *  file as outside the repo, silently dropping all context (dec_e0a36efbf5). */
+ *  forward-slash globs even on Windows), or "" when `abs` isn't (resolvably)
+ *  inside `root`. Thin adapter over the shared `repoRelativeTarget` (core/paths.ts,
+ *  which realpath-normalizes both ends first — see its docstring for why, incl.
+ *  dec_e0a36efbf5): that function passes an unresolvable absolute path through
+ *  UNCHANGED (still absolute) rather than signaling failure directly, since other
+ *  callers want the original target back to fail their own match safely. This
+ *  adapter converts that "still absolute" signal to "" — the sentinel `onEdit`
+ *  and `editTargets` below already treat as "skip, not in this repo". */
 function toRepoRel(root, abs) {
-    return relative(realpathNorm(root), realpathNorm(abs)).split("\\").join("/");
+    const rel = repoRelativeTarget(abs, root);
+    return isAbsolute(rel) || /^[a-zA-Z]:/.test(rel) ? "" : rel;
 }
 /** The in-repo files a pre-edit event would change, each with the lines the edit
  *  ADDS to that file. A Codex apply_patch yields one entry per touched path (a

package/dist/cli/serve.d.ts

@@ -1,2 +1,16 @@
 import type { Command } from "commander";
+/** Compact one served partition's ledger. Compaction is read → slice → write, so it takes the
+ *  partition write lock like every other writer (#286): without it a live server's append between
+ *  the read and the write is overwritten, regressing head_seq and reusing a seq. The ledger lives
+ *  in the store's RESOLVED state home (the overlay in shared mode), never `<root>/.hunch` blindly. */
+export declare function compactPartition(root: string, scope: {
+    kind: "organization" | "team" | "user" | "repository";
+    id: string;
+}, keep: number, lockOptions?: {
+    timeoutMs?: number;
+}): Promise<{
+    dropped: number;
+    floor_seq: number;
+    head_seq: number;
+}>;
 export declare function registerServeCommands(program: Command): void;

package/dist/cli/serve.js

@@ -6,9 +6,9 @@ import { initServeConfig, partitionFor, readServeConfig, writeServeConfig } from
 import { compactLedger } from "../store/changeLedger.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { hunchPaths } from "../core/paths.js";
-import { partitionOf } from "../store/stateBinding.js";
+import { partitionOf, stateHomeFor } from "../store/stateBinding.js";
 import { formatReplayReport, verifyReplay } from "../store/replay.js";
-import { join } from "node:path";
+import { withWriteLock } from "../serve/writelock.js";
 import { ScopeSchema, scopePath } from "../core/stateContract.js";
 import { HUNCH_VERSION } from "../core/version.js";
 function parseScopeArg(value) {
@@ -18,6 +18,20 @@ function parseScopeArg(value) {
         throw new Error(`partition must be kind:id (organization|team|user|repository), got "${value}"`);
     return parsed.data;
 }
+/** Compact one served partition's ledger. Compaction is read → slice → write, so it takes the
+ *  partition write lock like every other writer (#286): without it a live server's append between
+ *  the read and the write is overwritten, regressing head_seq and reusing a seq. The ledger lives
+ *  in the store's RESOLVED state home (the overlay in shared mode), never `<root>/.hunch` blindly. */
+export async function compactPartition(root, scope, keep, lockOptions = {}) {
+    const store = new HunchStore(hunchPaths(root));
+    try {
+        const { hunchDir } = stateHomeFor(store, scope);
+        return await withWriteLock(hunchDir, () => compactLedger(hunchDir, scope, { keep }), lockOptions);
+    }
+    finally {
+        store.close();
+    }
+}
 export function registerServeCommands(program) {
     const DEFAULT_CONFIG = "hunch-serve.json";
     const serve = program.command("serve")
@@ -57,7 +71,7 @@ export function registerServeCommands(program) {
         .requiredOption("--partition <kind:id>", "the partition whose ledger to compact")
         .option("--keep <n>", "events to keep", "1000")
         .option("--json", "machine-readable output")
-        .action((opts) => {
+        .action(async (opts) => {
         const parent = serve.opts();
         const config = readServeConfig(resolve(parent.config ?? DEFAULT_CONFIG));
         const scope = parseScopeArg(opts.partition);
@@ -67,7 +81,7 @@ export function registerServeCommands(program) {
         const keep = Number(opts.keep);
         if (!Number.isInteger(keep) || keep < 0)
             throw new Error("--keep must be a non-negative integer");
-        const result = compactLedger(join(partition.root, ".hunch"), scope, { keep });
+        const result = await compactPartition(partition.root, scope, keep);
         if (opts.json) {
             console.log(JSON.stringify({ partition: scopePath(scope), ...result }));
             return;

package/dist/client/state.d.ts

@@ -306,11 +306,12 @@ export declare function createStateClient(opts: StateClientOptions): {
         missing: string[];
         denied: string[];
     }>;
+    /** Liveness; `partitions` is present because this client sends its credential. */
     health: () => Promise<{
         ok: boolean;
         version: string;
         protocol: string;
-        partitions: string[];
+        partitions?: string[];
     }>;
 };
 export type StateClient = ReturnType<typeof createStateClient>;

package/dist/client/state.js

@@ -59,6 +59,7 @@ export function createStateClient(opts) {
         captureBatch: (request) => call("POST", "/nuryel/v1/capture-batch", request),
         subscribe: (request) => call("POST", "/nuryel/v1/subscribe", request),
         records: (request) => call("POST", "/nuryel/v1/records", request),
+        /** Liveness; `partitions` is present because this client sends its credential. */
         health: () => call("GET", "/nuryel/v1/health"),
     };
 }

package/dist/core/agenthook.js

@@ -152,8 +152,12 @@ function toolOutput(value) {
 }
 function explicitToolOutcome(response) {
     const raw = obj(response);
+    // A bare string carries no status. Codex sends a Bash call's raw output this
+    // way, without its exit code, and a failing test run prints output as readily
+    // as a passing one. Status-looking text inside it ("Exit code: 0") is output
+    // the command itself can print, so it is never parsed as a status either.
     if (!raw)
-        return typeof response === "string" && response.trim() ? "success" : "unknown";
+        return "unknown";
     if (raw.success === false || raw.is_error === true || raw.isError === true || (raw.error !== undefined && raw.error !== null))
         return "failure";
     const status = raw.status;
@@ -176,8 +180,8 @@ function explicitToolOutcome(response) {
     if (explicitSuccess)
         return "success";
     // Common successful tool-result shapes carry output fields even when the
-    // output is empty. An unstructured empty string (Codex's native failure
-    // payload) remains unknown until the host supplies an explicit status.
+    // output is empty (Claude Code routes failed calls to PostToolUseFailure
+    // instead). An unstructured string remains unknown (see above).
     if (["stdout", "stderr", "output", "content"].some(key => Object.prototype.hasOwnProperty.call(raw, key)))
         return "success";
     return "unknown";

package/dist/core/capturetoken.d.ts

@@ -3,10 +3,18 @@
  *
  * hunch_capture_decision issues a short-lived token; the commit path consumes it, so a
  * decision written through the capture front door is provably the tail of an interview
- * — the identity-principle guard against a silent, un-interviewed write. In-memory (the
- * MCP server is long-lived); tokens are one-time-use and expire so an abandoned
- * interview can't leak. Absence of a token never BLOCKS a write yet (staged
+ * PROTOCOL — the identity-principle guard against a silent, un-interviewed write.
+ * In-memory (the MCP server is long-lived); tokens are one-time-use and expire so an
+ * abandoned interview can't leak. Absence of a token never BLOCKS a write yet (staged
  * deprecation §9.3) — the caller decides how to treat an un-gated write.
+ *
+ * WHAT A TOKEN DOES NOT PROVE: that a human answered. Any agent — or content steering
+ * one — can call hunch_capture_decision and consume the token it gets back, entirely
+ * inside the agent's own MCP channel. So a consumed token never confers
+ * `human_confirmed` on its own (the stamp the strict gate and the edit hook trust). It
+ * only licenses ASKING the human through a channel the agent does not control: an MCP
+ * elicitation answered in the client UI (`isHumanConfirmationAnswer`), or a human
+ * running `hunch review --confirm <id>`. Without one of those, the write is testimony.
  */
 declare const CAPTURE_TOKEN_TTL_MS: number;
 /** Issue a token stamped `now` (epoch ms). Prunes expired tokens first so the map can't
@@ -16,4 +24,23 @@ export declare function issueCaptureToken(mint: () => string, now: number): stri
 /** Consume a token iff it is a live, unexpired capture session. One-time use: a second
  *  consume of the same token returns false. */
 export declare function consumeCaptureToken(token: string | undefined, now: number): boolean;
+/** The form a human answers in the client UI (MCP `elicitation/create`, form mode). One
+ *  required boolean, so a bare "accept" (an empty submit) is never read as a yes. */
+export declare const HUMAN_CONFIRMATION_SCHEMA: {
+    type: "object";
+    properties: {
+        confirm: {
+            type: "boolean";
+            title: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** Did the human affirmatively confirm? Only an explicit accept WITH confirm === true
+ *  counts; decline, cancel, and a missing or false checkbox all mean "no signature". */
+export declare function isHumanConfirmationAnswer(result: {
+    action?: string;
+    content?: Record<string, unknown>;
+} | null | undefined): boolean;
 export { CAPTURE_TOKEN_TTL_MS };

package/dist/core/capturetoken.js

@@ -3,10 +3,18 @@
  *
  * hunch_capture_decision issues a short-lived token; the commit path consumes it, so a
  * decision written through the capture front door is provably the tail of an interview
- * — the identity-principle guard against a silent, un-interviewed write. In-memory (the
- * MCP server is long-lived); tokens are one-time-use and expire so an abandoned
- * interview can't leak. Absence of a token never BLOCKS a write yet (staged
+ * PROTOCOL — the identity-principle guard against a silent, un-interviewed write.
+ * In-memory (the MCP server is long-lived); tokens are one-time-use and expire so an
+ * abandoned interview can't leak. Absence of a token never BLOCKS a write yet (staged
  * deprecation §9.3) — the caller decides how to treat an un-gated write.
+ *
+ * WHAT A TOKEN DOES NOT PROVE: that a human answered. Any agent — or content steering
+ * one — can call hunch_capture_decision and consume the token it gets back, entirely
+ * inside the agent's own MCP channel. So a consumed token never confers
+ * `human_confirmed` on its own (the stamp the strict gate and the edit hook trust). It
+ * only licenses ASKING the human through a channel the agent does not control: an MCP
+ * elicitation answered in the client UI (`isHumanConfirmationAnswer`), or a human
+ * running `hunch review --confirm <id>`. Without one of those, the write is testimony.
  */
 const CAPTURE_TOKEN_TTL_MS = 30 * 60 * 1000; // 30 min
 const sessions = new Map(); // token -> issuedAt (epoch ms)
@@ -32,5 +40,23 @@ export function consumeCaptureToken(token, now) {
     sessions.delete(token);
     return now - at <= CAPTURE_TOKEN_TTL_MS;
 }
+/** The form a human answers in the client UI (MCP `elicitation/create`, form mode). One
+ *  required boolean, so a bare "accept" (an empty submit) is never read as a yes. */
+export const HUMAN_CONFIRMATION_SCHEMA = {
+    type: "object",
+    properties: {
+        confirm: {
+            type: "boolean",
+            title: "I confirm this myself",
+            description: "Check only if YOU stated this. Unchecked, it is kept as agent testimony that cannot block.",
+        },
+    },
+    required: ["confirm"],
+};
+/** Did the human affirmatively confirm? Only an explicit accept WITH confirm === true
+ *  counts; decline, cancel, and a missing or false checkbox all mean "no signature". */
+export function isHumanConfirmationAnswer(result) {
+    return result?.action === "accept" && result.content?.confirm === true;
+}
 export { CAPTURE_TOKEN_TTL_MS };
 //# sourceMappingURL=capturetoken.js.map