@davesheffer/hunch 1.45.0 → 1.45.1

package/dist/integrations/hooks.d.ts

@@ -61,6 +61,11 @@ export declare const PORTABLE_HOOK_INVOCATION: string;
  *  or a trailing top-level `if … else … fi` whose every branch ends in
  *  `exec`/`exit` — the shape of the pre-commit framework's generated hook. */
 export declare function terminalExitLine(content: string): string | null;
+export declare function isInside(parent: string, child: string): boolean;
+export declare function gitRun(args: string[], cwd: string): {
+    status: number | null;
+    stdout: string;
+};
 type BlockState = "installed" | "unreachable" | "stale" | "missing";
 /** The result of inspecting the command a managed block actually runs (issue #315). */
 export type HookInvocationHealth = {
@@ -78,6 +83,21 @@ export type HookInvocationHealth = {
  *  the subcommand; env assignments and a leading `(` belong to the block's own
  *  shape and are stripped. Never spawns anything, never touches the network. */
 export declare function hookInvocationHealth(command: string, root: string): HookInvocationHealth;
+/** The repo's worktree tops as `git worktree list --porcelain` reports them:
+ *  `linked` is every entry AFTER the first (the first is always the main
+ *  worktree, or the bare repo) that is not the bare entry, and `count` is how
+ *  many non-bare worktrees the repo has — the number the shared-hooks note
+ *  quotes, which must not include a bare repo's phantom entry. `main` is the
+ *  first entry when it is a checkout, null when the common dir is bare (no
+ *  main checkout exists). Entries are
+ *  separated by blank lines and each starts with a `worktree <path>` line.
+ *  Read straight from git rather than the workspace ledger: this runs during
+ *  `hunch init`, before any ledger exists. */
+export declare function worktreeTops(root: string): {
+    linked: string[];
+    count: number;
+    main: string | null;
+};
 export declare function installPostCommitHook(root: string, invocation: string, opts?: {
     private?: boolean;
     commit?: boolean;

package/dist/integrations/hooks.js

@@ -139,12 +139,12 @@ function realish(p) {
         return resolve(p);
     }
 }
-function isInside(parent, child) {
+export function isInside(parent, child) {
     const norm = (p) => (process.platform === "win32" ? realish(p).toLowerCase() : realish(p));
     const rel = relative(norm(parent), norm(child));
     return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
 }
-function gitRun(args, cwd) {
+export function gitRun(args, cwd) {
     const p = spawnSync("git", args, { cwd, encoding: "utf8", env: initiatorChildEnv(), stdio: ["ignore", "pipe", "ignore"] });
     return { status: p.status, stdout: (p.stdout ?? "").trim() };
 }
@@ -504,14 +504,16 @@ function snippetFor(t, mark, build, localInvocation) {
  *  `linked` is every entry AFTER the first (the first is always the main
  *  worktree, or the bare repo) that is not the bare entry, and `count` is how
  *  many non-bare worktrees the repo has — the number the shared-hooks note
- *  quotes, which must not include a bare repo's phantom entry. Entries are
+ *  quotes, which must not include a bare repo's phantom entry. `main` is the
+ *  first entry when it is a checkout, null when the common dir is bare (no
+ *  main checkout exists). Entries are
  *  separated by blank lines and each starts with a `worktree <path>` line.
  *  Read straight from git rather than the workspace ledger: this runs during
  *  `hunch init`, before any ledger exists. */
-function worktreeTops(root) {
+export function worktreeTops(root) {
     const out = gitRun(["worktree", "list", "--porcelain"], root).stdout;
     if (!out)
-        return { linked: [], count: 0 };
+        return { linked: [], count: 0, main: null };
     const entries = normalizeEol(out).split(/\n\s*\n/).map((e) => e.split("\n"));
     const parsed = entries
         .map((lines) => ({
@@ -519,7 +521,12 @@ function worktreeTops(root) {
         bare: lines.some((l) => l.trim() === "bare"),
     }))
         .filter((e) => e.path !== "");
-    return { linked: parsed.slice(1).filter((e) => !e.bare).map((e) => e.path), count: parsed.filter((e) => !e.bare).length };
+    const first = parsed[0];
+    return {
+        linked: parsed.slice(1).filter((e) => !e.bare).map((e) => e.path),
+        count: parsed.filter((e) => !e.bare).length,
+        main: first && !first.bare ? first.path : null,
+    };
 }
 /** The LINKED worktree an invocation is bound to — one it can only work from
  *  inside, because some token is an absolute path under it (that worktree's own

package/dist/integrations/providers.js

@@ -26,6 +26,7 @@ import { renderHunchSection, stripManagedSection, upsertSection, updateClaudeMd,
 import { headFileContent, isGitCleanPath } from "../extractors/git.js";
 import { parseJsonc } from "../core/jsonc.js";
 import { parse as parseToml } from "smol-toml";
+import { publishedMcpInvocation } from "../cli/invocation.js";
 /** JSONC comments are user prose. A parsed object cannot retain their position,
  * so refuse a write rather than reserialize the file without them. */
 function hasJsoncComments(raw) {
@@ -388,18 +389,52 @@ export function writeVscodeHooks(root, inv) {
         Stop: [{ type: "command", command }],
     });
 }
+const WINDSURF_EVENTS = ["pre_user_prompt", "pre_write_code", "post_write_code", "post_run_command"];
+/** The published npx pin (any version), in the current spelling and in the fully
+ * quoted one written before v1.21.1 (`"npx" "-y" "--package=…" …`). */
+const PUBLISHED_PIN = /^\s*"?npx(?:\.cmd)?"?\s+"?-y"?\s+"?--package=(?:hunch-exact@npm:)?@davesheffer\/hunch/;
+/** The events of `file` holding a Hunch hook entry, when it has at least one and
+ * every one of them runs the published pin; null otherwise. Throws, like every
+ * writer, on a file it cannot parse. */
+function publishedPinEvents(file) {
+    const hooks = objectField(readJsonObj(file), "hooks", file);
+    const events = new Set();
+    let onlyPins = true;
+    const collect = (event) => (entry) => {
+        const e = entry && typeof entry === "object" ? entry : null;
+        if (Array.isArray(e?.hooks) && typeof e.command !== "string")
+            e.hooks.forEach(collect(event));
+        else if (typeof e?.command === "string") {
+            if (PUBLISHED_PIN.test(e.command))
+                events.add(event);
+            else
+                onlyPins = false;
+        }
+    };
+    for (const [event, entries] of Object.entries(hooks)) {
+        if (Array.isArray(entries))
+            entries.filter(isHunchProviderHook).forEach(collect(event));
+    }
+    return onlyPins && events.size > 0 ? events : null;
+}
 /** Windsurf's documented workspace hooks. It only supports deterministic
  * pre-hook blocking via exit code 2, so Hunch uses rules + MCP for context and
  * reserves the hook for strict edit protection and pipeline observation. */
 export function writeWindsurfHooks(root, inv) {
     const file = join(root, ".windsurf", "hooks.json");
-    const command = hookCommand(inv, "windsurf");
-    return writeHookConfig(file, {
-        pre_user_prompt: [{ command, show_output: false }],
-        pre_write_code: [{ command, show_output: false }],
-        post_write_code: [{ command, show_output: false }],
-        post_run_command: [{ command, show_output: false }],
-    });
+    const published = hookCommand(publishedMcpInvocation(), "windsurf");
+    let command = hookCommand(inv, "windsurf");
+    // A source-checkout run (tsx / local dist) must never replace a tracked
+    // published pin with a machine-local path (#466): a complete pinned file is
+    // kept as is, and a partial one is completed with the published pin.
+    if (command !== published) {
+        const pinned = publishedPinEvents(file);
+        if (pinned && WINDSURF_EVENTS.every((event) => pinned.has(event)))
+            return file;
+        if (pinned)
+            command = published;
+    }
+    return writeHookConfig(file, Object.fromEntries(WINDSURF_EVENTS.map((event) => [event, [{ command, show_output: false }]])));
 }
 function antigravityHandler(command) {
     return { type: "command", command, timeout: 15 };

package/dist/integrations/uninstall.d.ts

@@ -17,6 +17,8 @@ export interface UninstallPlan {
         path: string;
         reason: string;
     }>;
+    /** Consequences beyond this checkout (other worktrees, other branches); printed, never refused over. */
+    warnings?: string[];
 }
 /** Read-only: everything `hunch uninstall` would do in `root`. */
 export declare function planUninstall(root: string, opts?: {

package/dist/integrations/uninstall.js

@@ -14,15 +14,15 @@
  */
 import { existsSync, lstatSync, readFileSync, readdirSync, rmdirSync, rmSync, statSync, writeFileSync, chmodSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { basename, join, relative } from "node:path";
+import { basename, join, relative, resolve } from "node:path";
 import { parse as parseToml } from "smol-toml";
 import { writeFileAtomic } from "../core/io.js";
-import { gitCommonDir, isGitRepo, separateGitDirLink } from "../extractors/git.js";
+import { currentBranch, gitCommonDir, isGitRepo, isLinkedWorktree, separateGitDirLink } from "../extractors/git.js";
 import { HUNCH_END, HUNCH_START } from "./claudemd.js";
 import { ciWorkflowYaml } from "./ciAction.js";
 import { assertSafeTopLevelConfigFile, stripManagedGitignore } from "./gitignore.js";
 import { isHunchHookCommand } from "./hookmatch.js";
-import { planHookRemoval } from "./hooks.js";
+import { gitRun, isInside, planHookRemoval, worktreeTops } from "./hooks.js";
 import { ATTR_LINES, targetRepositoryEnv } from "./mergeDriver.js";
 import { antigravityMcpFile, isHunchProviderHook, readJsonObj, TOML_END, TOML_START, windsurfMcpFile } from "./providers.js";
 import { SLASH_COMMAND_FILES } from "./scaffold.js";
@@ -195,6 +195,31 @@ function gitConfigHasDrivers(root) {
     const r = spawnSync("git", ["config", "--local", "--get-regexp", "^merge\\.hunch(-grounding)?\\."], { cwd: root, env: targetRepositoryEnv(), encoding: "utf8" });
     return r.status === 0 && r.stdout.trim() !== "";
 }
+/** The branch the clone treats as default: origin's HEAD, else a local main, else
+ *  master; "" when none can be named. */
+function defaultBranch(root) {
+    const head = gitRun(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"], root);
+    if (head.status === 0 && head.stdout)
+        return head.stdout.replace(/^origin\//, "");
+    for (const b of ["main", "master"]) {
+        if (gitRun(["show-ref", "--verify", "--quiet", `refs/heads/${b}`], root).status === 0)
+            return b;
+    }
+    return "";
+}
+/** The marker is committed per branch: off the default branch, say the rest of the clone still has Hunch. */
+function branchWarning(root) {
+    try {
+        const branch = currentBranch(root);
+        const def = branch ? defaultBranch(root) : "";
+        if (!branch || !def || branch === def)
+            return null;
+        return `the ${OPT_OUT_FILE} marker is only on branch ${branch}; other branches of this clone still have Hunch's instruction blocks and config — commit and merge it, or run uninstall there too`;
+    }
+    catch {
+        return null;
+    }
+}
 /** The overlay clone a pointer names, for the "kept" note. Never deleted: it is
  *  its own repository holding memory that may not be pushed yet. */
 function pointerOverlay(file) {
@@ -295,22 +320,49 @@ export function planUninstall(root, opts = {}) {
             p.steps.push({ path: ciRel, kind: "keep", note: "it differs from the workflow Hunch generates (edited?); delete it yourself if you no longer want the Hunch Guard check" });
         }
     }
-    // Git hooks + merge driver.
+    // Git hooks + merge driver. Both live in the clone's common git dir, so they
+    // serve every worktree and every branch (#459): a linked worktree leaves them to
+    // the main checkout, and the main checkout says which worktrees lose them too.
+    // A bare common dir has no main checkout, so any worktree removes them and warns.
+    const warnings = [];
     if (isGitRepo(root)) {
+        const commonDir = gitCommonDir(root);
+        const top = gitRun(["rev-parse", "--show-toplevel"], root).stdout;
+        const here = top || root;
+        const same = (a, b) => isInside(a, b) && isInside(b, a);
+        // The main checkout as git lists it, not the common dir's parent, which in a
+        // bare clone or a --separate-git-dir checkout is no checkout at all.
+        const tops = worktreeTops(root);
+        const mainCheckout = tops.main;
+        const linked = commonDir !== "" && mainCheckout !== null && !same(mainCheckout, here) && isLinkedWorktree(root);
+        // The same test `hunch init` uses: in the common dir, or outside this checkout.
+        const shared = (file) => (commonDir !== "" && isInside(commonDir, file)) || (top !== "" && !isInside(top, file));
+        const elsewhere = (what, it) => `${what} shared by every worktree of this clone — run \`hunch uninstall\` from the main checkout (${mainCheckout}) to remove ${it}`;
+        let removesShared = false;
         for (const h of planHookRemoval(root)) {
             const path = p.rel(h.path);
             if (h.reason)
                 p.steps.push({ path, kind: "keep", note: h.reason });
-            else if (h.next === null)
-                p.steps.push({ path, kind: "delete", note: `Hunch's ${h.hookName} git hook`, run: () => rmSync(h.path, { force: true }) });
+            else if (linked && shared(h.path))
+                p.steps.push({ path, kind: "keep", note: elsewhere(`Hunch's ${h.hookName} git hook is`, "it") });
             else {
-                const next = h.next;
-                p.steps.push({ path, kind: "edit", note: `removed Hunch's block from the ${h.hookName} git hook (your own lines are kept)`, run: () => { writeFileSync(h.path, next); chmodSync(h.path, 0o755); } });
+                if (shared(h.path))
+                    removesShared = true;
+                if (h.next === null)
+                    p.steps.push({ path, kind: "delete", note: `Hunch's ${h.hookName} git hook`, run: () => rmSync(h.path, { force: true }) });
+                else {
+                    const next = h.next;
+                    p.steps.push({ path, kind: "edit", note: `removed Hunch's block from the ${h.hookName} git hook (your own lines are kept)`, run: () => { writeFileSync(h.path, next); chmodSync(h.path, 0o755); } });
+                }
             }
         }
-        if (gitConfigHasDrivers(root)) {
+        if (gitConfigHasDrivers(root) && linked) {
+            p.steps.push({ path: p.rel(join(commonDir, "config")), kind: "keep", note: elsewhere("the merge.hunch and merge.hunch-grounding drivers are", "them") });
+        }
+        else if (gitConfigHasDrivers(root)) {
+            removesShared = true;
             p.steps.push({
-                path: ".git/config", kind: "edit", note: "unregistered the merge.hunch and merge.hunch-grounding drivers",
+                path: commonDir ? p.rel(join(commonDir, "config")) : ".git/config", kind: "edit", note: "unregistered the merge.hunch and merge.hunch-grounding drivers",
                 run: () => {
                     for (const section of ["merge.hunch", "merge.hunch-grounding"]) {
                         spawnSync("git", ["config", "--local", "--remove-section", section], { cwd: root, env: targetRepositoryEnv(), stdio: "ignore" });
@@ -318,6 +370,13 @@ export function planUninstall(root, opts = {}) {
                 },
             });
         }
+        const others = linked ? [] : tops.linked.filter((w) => !same(w, here)).map((w) => resolve(w));
+        if (removesShared && others.length) {
+            warnings.push(`the git hooks and merge drivers are shared with ${others.length === 1 ? "the linked worktree" : `${others.length} linked worktrees`} ${others.join(", ")}, so they are removed there too, though ${others.length === 1 ? "it still has" : "those still have"} Hunch and no ${OPT_OUT_FILE} marker`);
+        }
+        const onBranch = branchWarning(root);
+        if (onBranch)
+            warnings.push(onBranch);
     }
     const attrs = p.text(".gitattributes");
     if (attrs !== null) {
@@ -378,7 +437,7 @@ export function planUninstall(root, opts = {}) {
     for (const dir of overlays) {
         p.steps.push({ path: p.rel(dir), kind: "keep", note: "a private/shared overlay clone: its own repository with memory that may not be pushed; never deleted here" });
     }
-    return { root, purge, steps: p.steps, refused: p.refused };
+    return { root, purge, steps: p.steps, refused: p.refused, warnings };
 }
 /** Directories Hunch's writers create; removed only when left empty. Deepest first. */
 const PRUNE_DIRS = [
@@ -430,6 +489,8 @@ export function formatUninstallPlan(plan, dryRun) {
         out.push(`  ✗ ${r.path}: ${r.reason}`);
     for (const s of plan.steps)
         out.push(`  ${icon(s.kind)} ${verb(s.kind)} ${s.path} — ${s.note}`);
+    for (const w of plan.warnings ?? [])
+        out.push(`  ⚠ ${w}`);
     return out;
 }
 //# sourceMappingURL=uninstall.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.45.0",
+  "version": "1.45.1",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.45.0",
+  "version": "1.45.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.45.0",
+      "version": "1.45.1",
       "runtimeHint": "npx",
       "packageArguments": [
         {