@davesheffer/hunch 1.43.0 → 1.44.0

package/dist/serve/writelock.js

@@ -10,7 +10,10 @@
  * stealable once its owner is provably gone (pid dead — or RECYCLED — on the same
  * host) or older than any plausible write. "Recycled" is decided by comparing the
  * owner's recorded process-instance token with the current holder's, by string
- * equality and never by clock arithmetic (see core/procstart.ts). Removing a stale
+ * equality and never by clock arithmetic (see core/procstart.ts). Where no token can
+ * compare them (macOS, Windows, legacy records) a stale-looking lock whose live pid
+ * belongs to a process CREATED after the lock's recorded `at` is taken over too: that
+ * process cannot be the one that took it (issue #287). Removing a stale
  * lock is itself serialized behind an exclusive `.reclaim` claim directory, because
  * judging and removing are two steps and two contenders can otherwise both "win"
  * (see `takeOver`).
@@ -19,7 +22,7 @@ import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
 import { closeSync, mkdirSync, openSync, readFileSync, rmSync, rmdirSync, statSync, writeSync } from "node:fs";
 import { join } from "node:path";
-import { heldLockNonces, judgeSameHostOwner, selfStartToken, startTokenOf } from "../core/procstart.js";
+import { heldLockNonces, judgeSameHostOwner, processStartedAt, selfStartToken, startTokenOf } from "../core/procstart.js";
 /** Longest a write may hold the lock before another process may steal it: a put plus a
  *  git commit and push — seconds, not minutes. */
 export const STALE_AFTER_MS = 60_000;
@@ -30,6 +33,10 @@ export const ACQUIRE_TIMEOUT_MS = 10_000;
  *  crashed inside it. */
 export const CLAIM_STALE_MS = 10_000;
 const POLL_MS = 25;
+/** How much later than the lock's recorded `at` the pid's current process must
+ *  have been created before it is proven not to be the owner. A genuine owner
+ *  started BEFORE it took the lock; the slack only absorbs clock granularity. */
+export const CREATED_AFTER_SLACK_MS = 5_000;
 export class WriteLockTimeout extends Error {
     path;
     heldBy;
@@ -109,11 +116,22 @@ function stealable(path, owner, now, token) {
             selfPid: process.pid,
             heldNonces: heldLockNonces,
         });
+        if (verdict === "unproven")
+            return ageMs > STALE_AFTER_MS && createdAfterLock(owner, token);
         if (verdict !== "age")
             return verdict === "stale";
     }
     return ageMs > STALE_AFTER_MS;
 }
+/** Is the process now holding the owner's pid provably newer than the lock?
+ *  Unreadable either way means not proven, and a live pid keeps its lock. */
+function createdAfterLock(owner, token) {
+    const at = Date.parse(owner.at);
+    if (!Number.isFinite(at))
+        return false;
+    const started = (token.startedAt ?? processStartedAt)(owner.pid);
+    return started !== null && started > at + CREATED_AFTER_SLACK_MS;
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /** The claim a contender must hold to REMOVE a stale lock. A sibling directory,
  *  created with the same exclusive `mkdir` the commit lock uses
@@ -204,7 +222,16 @@ function takeOver(path, token) {
 export async function withWriteLock(hunchDir, fn, opts = {}) {
     const path = writeLockPath(hunchDir);
     const timeoutMs = opts.timeoutMs ?? ACQUIRE_TIMEOUT_MS;
-    const token = opts.startToken ?? { self: selfStartToken(), of: startTokenOf };
+    const probe = opts.startToken ?? { self: selfStartToken(), of: startTokenOf };
+    // The creation-time probe spawns; ask it once per pid for this acquisition, not
+    // on every poll.
+    const createdAt = new Map();
+    const startedAt = probe.startedAt ?? processStartedAt;
+    const token = { ...probe, startedAt: (pid) => {
+            if (!createdAt.has(pid))
+                createdAt.set(pid, startedAt(pid));
+            return createdAt.get(pid);
+        } };
     const nonce = randomBytes(8).toString("hex");
     const started = Date.now();
     let fd;

package/dist/store/changeLedger.d.ts

@@ -127,8 +127,11 @@ export declare function compactLedger(hunchDir: string, scope: Scope, opts?: {
 };
 /** Three-way merge of one scope's ledger, for the git merge driver: two clones that both
  *  appended to the same partition. The union of events is kept (identity = what changed, to
- *  which hash, when, by whom), ordered by time then ours-before-theirs, and RE-SEQUENCED from
- *  the higher floor. When that renumbering moves an event either side had already published,
+ *  which hash, when, by whom), interleaved so each side keeps its own order (see `interleave`;
+ *  the result does not depend on which side is "ours"), and RE-SEQUENCED from the higher floor.
+ *  Two sides that published opposite orders (left by the side-biased merge before #361) are
+ *  resolved by (time, identity), never a conflict: that moves published seqs, so the floor
+ *  rule below makes every subscriber resynchronize onto the one merged order. When that renumbering moves an event either side had already published,
  *  no pre-merge cursor of EITHER side can be trusted — a cursor could otherwise sit above an
  *  event that now holds a lower seq and never see it (issue #285). The floor is then raised
  *  past BOTH pre-merge heads, so every such cursor satisfies subscribe's `after_seq <

package/dist/store/changeLedger.js

@@ -149,10 +149,79 @@ export function compactLedger(hunchDir, scope, opts = {}) {
     return { dropped, floor_seq: ledger.floor_seq, head_seq: ledger.head_seq };
 }
 const eventIdentity = (e) => [e.change, e.facet, e.record_id, e.record_hash, e.at, e.cause ? JSON.stringify(e.cause) : ""].join("|");
+/** A total order: by instant (so `...:09Z`, `...:09.500Z` and `+02:00` offsets compare as
+ *  times, not text), unparseable `at` after every parseable one, then `at` text, then identity. */
+const byTimeThenIdentity = (a, b) => {
+    const ta = Date.parse(a.at), tb = Date.parse(b.at);
+    if (Number.isNaN(ta) !== Number.isNaN(tb))
+        return Number.isNaN(ta) ? 1 : -1;
+    if (!Number.isNaN(ta) && ta !== tb)
+        return ta < tb ? -1 : 1;
+    if (a.at !== b.at)
+        return a.at < b.at ? -1 : 1;
+    const ka = eventIdentity(a), kb = eventIdentity(b);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+};
+/** Interleave two event sequences without reordering either (issue #361). Each side's order
+ *  is history it already published — a batch, or successive updates to one record — so it is
+ *  kept; only events neither side orders relative to each other are placed by (time, identity).
+ *  Every rule is mirrored, so swapping the sides yields the same sequence: merge(A,B) and
+ *  merge(B,A) agree, and re-merging their results renumbers nothing. Where the two sides
+ *  order a pair oppositely — clones an older, side-biased merge already left diverged — the
+ *  same (time, identity) rule decides, so even they converge on one order. */
+function interleave(a, b) {
+    const posA = new Map(a.map((e, i) => [eventIdentity(e), i]));
+    const posB = new Map(b.map((e, i) => [eventIdentity(e), i]));
+    const emitted = new Set();
+    const out = [];
+    const emit = (e) => { emitted.add(eventIdentity(e)); out.push(e); };
+    let i = 0, j = 0;
+    for (;;) {
+        while (i < a.length && emitted.has(eventIdentity(a[i])))
+            i++;
+        while (j < b.length && emitted.has(eventIdentity(b[j])))
+            j++;
+        if (i >= a.length) {
+            for (; j < b.length; j++)
+                if (!emitted.has(eventIdentity(b[j])))
+                    emit(b[j]);
+            break;
+        }
+        if (j >= b.length) {
+            for (; i < a.length; i++)
+                if (!emitted.has(eventIdentity(a[i])))
+                    emit(a[i]);
+            break;
+        }
+        const x = a[i], y = b[j];
+        const kx = eventIdentity(x), ky = eventIdentity(y);
+        if (kx === ky) {
+            emit(x);
+            continue;
+        }
+        const xLaterInB = (posB.get(kx) ?? -1) > j; // b orders y before x
+        const yLaterInA = (posA.get(ky) ?? -1) > i; // a orders x before y
+        if (xLaterInB && !yLaterInA)
+            emit(y);
+        else if (yLaterInA && !xLaterInB)
+            emit(x);
+        else
+            emit(byTimeThenIdentity(x, y) <= 0 ? x : y);
+    }
+    return out;
+}
+function uniqueByIdentity(events) {
+    const seen = new Set();
+    return events.filter((e) => { const k = eventIdentity(e); if (seen.has(k))
+        return false; seen.add(k); return true; });
+}
 /** Three-way merge of one scope's ledger, for the git merge driver: two clones that both
  *  appended to the same partition. The union of events is kept (identity = what changed, to
- *  which hash, when, by whom), ordered by time then ours-before-theirs, and RE-SEQUENCED from
- *  the higher floor. When that renumbering moves an event either side had already published,
+ *  which hash, when, by whom), interleaved so each side keeps its own order (see `interleave`;
+ *  the result does not depend on which side is "ours"), and RE-SEQUENCED from the higher floor.
+ *  Two sides that published opposite orders (left by the side-biased merge before #361) are
+ *  resolved by (time, identity), never a conflict: that moves published seqs, so the floor
+ *  rule below makes every subscriber resynchronize onto the one merged order. When that renumbering moves an event either side had already published,
  *  no pre-merge cursor of EITHER side can be trusted — a cursor could otherwise sit above an
  *  event that now holds a lower seq and never see it (issue #285). The floor is then raised
  *  past BOTH pre-merge heads, so every such cursor satisfies subscribe's `after_seq <
@@ -164,47 +233,29 @@ const eventIdentity = (e) => [e.change, e.facet, e.record_id, e.record_hash, e.a
 export function mergeLedgers(base, ours, theirs) {
     if (scopePath(ours.scope) !== scopePath(theirs.scope))
         throw new Error("ledgers for different scopes cannot be merged");
-    const seen = new Map();
-    const order = [];
-    const add = (e) => { const k = eventIdentity(e); if (!seen.has(k)) {
-        seen.set(k, e);
-        order.push(e);
-    } };
-    const ourIdentities = new Set(ours.events.map(eventIdentity));
-    const theirIdentities = new Set(theirs.events.map(eventIdentity));
-    // Base is a merge ancestor, not a source of history both clones have compacted away.
-    for (const e of base?.events ?? []) {
+    const oursEvents = uniqueByIdentity(ours.events);
+    const theirsEvents = uniqueByIdentity(theirs.events);
+    const ourIdentities = new Set(oursEvents.map(eventIdentity));
+    const theirIdentities = new Set(theirsEvents.map(eventIdentity));
+    // Base is a merge ancestor, not a source of history both clones have compacted away: it adds
+    // only events neither side holds that are still above both floors.
+    const baseOnly = uniqueByIdentity((base?.events ?? []).filter((e) => {
         const key = eventIdentity(e);
-        if (ourIdentities.has(key) || theirIdentities.has(key) || (e.seq > ours.floor_seq && e.seq > theirs.floor_seq))
-            add(e);
-    }
-    for (const e of ours.events)
-        add(e);
-    for (const e of theirs.events)
-        add(e);
-    // The tiebreak is "ours before theirs", so only an event theirs ALONE contributed sorts late:
-    // side 1 iff theirs holds it and neither ours nor base does. Deciding by object identity
-    // (`includes`) would instead put anything ours compacted away — base's object, which `add`
-    // keeps — after its same-`at` siblings and silently reorder a batch both sides already had.
-    const baseIdentities = new Set((base?.events ?? []).map(eventIdentity));
-    const theirsOnly = (e) => {
-        const k = eventIdentity(e);
-        return !ourIdentities.has(k) && !baseIdentities.has(k);
-    };
-    const ranked = order.map((e, i) => ({ e, i, side: (theirsOnly(e) ? 1 : 0) }));
-    ranked.sort((a, b) => a.e.at.localeCompare(b.e.at) || a.side - b.side || a.i - b.i);
-    const theirSeqs = new Map(theirs.events.map((e) => [eventIdentity(e), e.seq]));
-    const ourSeqs = new Map(ours.events.map((e) => [eventIdentity(e), e.seq]));
+        return !ourIdentities.has(key) && !theirIdentities.has(key) && e.seq > ours.floor_seq && e.seq > theirs.floor_seq;
+    }));
+    const merged = interleave(interleave(oursEvents, theirsEvents), baseOnly);
+    const conflicts = [];
+    const theirSeqs = new Map(theirsEvents.map((e) => [eventIdentity(e), e.seq]));
+    const ourSeqs = new Map(oursEvents.map((e) => [eventIdentity(e), e.seq]));
     let floor = Math.max(base?.floor_seq ?? 0, ours.floor_seq, theirs.floor_seq);
-    const renumbers = ranked.some(({ e }, i) => {
+    const renumbers = merged.some((e, i) => {
         const k = eventIdentity(e);
-        const merged = floor + i + 1;
-        return (ourSeqs.get(k) ?? merged) !== merged || (theirSeqs.get(k) ?? merged) !== merged;
+        const seq = floor + i + 1;
+        return (ourSeqs.get(k) ?? seq) !== seq || (theirSeqs.get(k) ?? seq) !== seq;
     });
     if (renumbers)
         floor = Math.max(floor, Math.max(ours.head_seq, theirs.head_seq) + 1);
-    const events = ranked.map(({ e }, i) => ({ ...e, seq: floor + i + 1 }));
-    const conflicts = [];
+    const events = merged.map((e, i) => ({ ...e, seq: floor + i + 1 }));
     const idempotency = { ...(base?.idempotency ?? {}), ...theirs.idempotency, ...ours.idempotency };
     for (const [key, entry] of Object.entries(theirs.idempotency)) {
         const mine = ours.idempotency[key];

package/dist/store/hunchStore.js

@@ -202,7 +202,10 @@ export class HunchStore {
      *  that re-registers it. Never auto-re-registered: the pointer may be repository content. */
     unregisteredPointerMessage(dir) {
         const { mode, autoCommit } = this.ignoredLocalPointerSetup;
-        const quoted = /^[\w@%+=:,./-]+$/.test(dir) ? dir : JSON.stringify(dir);
+        // A Windows drive path is shown with forward slashes: it means the same path to Hunch and
+        // pastes unquoted into bash, PowerShell and cmd. JSON quoting would double every backslash.
+        const shown = /^[a-z]:\\/i.test(dir) ? dir.replace(/\\/g, "/") : dir;
+        const quoted = /^[\w@%+=:,./-]+$/.test(shown) ? shown : JSON.stringify(shown);
         const command = `hunch ${mode === "shared" ? "shared" : "private"} ${quoted}${autoCommit === false ? " --no-auto-commit" : ""}`;
         return `.hunch/local.json names a memory store at ${dir} that this machine's setup has not registered in the git common dir, ` +
             "so Hunch refuses to open this repository's memory rather than silently writing captures to the public .hunch/. " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
@@ -96,11 +96,11 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@tree-sitter-grammars/tree-sitter-yaml": "^0.6.1",
     "commander": "^15.0.0",
     "cross-spawn": "^7.0.6",
-    "smol-toml": "1.8.0",
+    "smol-toml": "1.9.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-go": "^0.23.4",
     "tree-sitter-php": "0.23.12",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.43.0",
+      "version": "1.44.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {