@davesheffer/hunch 1.45.1 → 1.46.0

package/dist/cli/index.js

@@ -22,13 +22,16 @@ import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 import { hunchPaths, hunchPathsForDir, findRoot, toPosixTarget, isDir, realpathNorm, repoRelativeTarget } from "../core/paths.js";
 import { writeFileAtomic } from "../core/io.js";
+import { boundedSpawnSync } from "../core/boundedSpawn.js";
 import { looksLikeCorrection, CORRECTION_NUDGE } from "../core/correction.js";
 import { HUNCH_VERSION } from "../core/version.js";
 import { registerIntegrationCommands } from "./integrations.js";
 import { registerTaskReportCommands } from "./taskReport.js";
 import { registerStateCommands } from "./state.js";
-import { registerServeCommands } from "./serve.js";
+import { DEFAULT_CONFIG as SERVE_DEFAULT_CONFIG_FILE, registerServeCommands } from "./serve.js";
+import { readServeConfig } from "../serve/config.js";
 import { registerUpdateCommand } from "./update.js";
+import { registerVerifyCommand } from "./verify.js";
 import { registerReviewMemoryCommands } from "./reviewMemory.js";
 import { detectInitiator, normalizeInitiator } from "../synthesis/initiator.js";
 import { inspectIntegrations, formatIntegrationHealth, integrationHealthFails, integrationSessionWarning } from "../integrations/health.js";
@@ -43,7 +46,7 @@ import { isParserLoadError, loadNativeTreeSitter } from "../extractors/nativeTre
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { readSynthesisPreference, resolveSynthesisProvider, selectProvider, SYNTH_PREFERENCES, writeSynthesisPreference, normalizeProviderName, } from "../synthesis/provider.js";
-import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, checkFreshnessRevision, teamPullIsFresh, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedGateDiff, workingGateDiff, commitGateDiff, rangeFiles, rangeGateDiff, rangeCommits, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, checkoutCommonDir, separateGitDirCandidate, separateGitDirLink, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatusAgainst, commitPatchIds, mergeRangeChanges, commitsExist } from "../extractors/git.js";
+import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, checkFreshnessRevision, teamPullIsFresh, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedGateDiff, workingGateDiff, commitGateDiff, rangeFiles, rangeGateDiff, rangeCommits, revExists, revParse, commitAndPushHunch, pullHunchStatus, pullHunchStatusDetailed, describePullFailure, syncExistingHunch, gitUntrackCached, gitCommonDir, checkoutCommonDir, separateGitDirCandidate, separateGitDirLink, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatusAgainst, commitPatchIds, mergeRangeChanges, commitsExist } from "../extractors/git.js";
 import { runbookDraft } from "../core/runbookDraft.js";
 import { parseMemoryLog } from "../core/memorylog.js";
 import { renamesOf, planRepair, repairDecision, repairConstraint } from "../core/repair.js";
@@ -62,7 +65,7 @@ import { flushCapture, flushMemoryHome, flushMemoryHomes, pinSharedRemote, share
 import { installMergeDriver } from "../integrations/mergeDriver.js";
 import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS, upgradeManagedGitignore, describeGitignoreUpgrade, memoryIgnoreRule, describeMemoryIgnoreRule } from "../integrations/gitignore.js";
 import { writeCiWorkflow } from "../integrations/ciAction.js";
-import { applyUninstall, formatUninstallPlan, isOptedOut, OPT_OUT_FILE, optOutMessage, planUninstall } from "../integrations/uninstall.js";
+import { applyUninstall, formatUninstallPlan, isOptedOut, OPT_OUT_FILE, optOutMarkerAt, optOutMessage, planUninstall } from "../integrations/uninstall.js";
 import { updateClaudeMd, renderHunchSection } from "../integrations/claudemd.js";
 import { HOOK_REMINDER } from "../core/hookText.js";
 import { measureFootprint } from "../core/footprint.js";
@@ -102,7 +105,7 @@ import { renderRecalledLine } from "../core/taskReportRender.js";
 import { closeHookTask, hookReportTaskId, isNotificationPrompt, nativeHookCwd, settleHookSession, startHookReport, stopHookReport, observeHookDenial } from "../core/taskReportHook.js";
 import { persistTaskRecord } from "../core/taskRecord.js";
 import { recordHookObservation } from "../core/hookObservations.js";
-import { contextHookOutput, deliversPromptEvent, denyHookOutput, hookProvider, normalizeHookEvent, stopHookOutput } from "../core/agenthook.js";
+import { contextHookOutput, deliversCommandOutcome, deliversPromptEvent, denyHookOutput, hookProvider, normalizeHookEvent, stopHookOutput } from "../core/agenthook.js";
 import { PIPELINE_LOOP, armExecutionObligations, beforeEditProbeVerdict, compileExecutableProbes, environmentExecutableProbes, environmentExecutionObligations, executionObligationBrief, isProductPath, loadPipelineState, onCommand, onEdit, onPrompt, onSkill, pipelineEnabled, proofCheckpoint, savePipelineState, stopVerdict, onLessonsDelivered, lessonReminder, unverifiedNag, } from "../core/pipeline.js";
 import { draftDuplicateOf, isAcceptedDuplicateAnchor } from "../core/dupdetect.js";
 import { planAutoReview, planMutations } from "../core/autoreview.js";
@@ -147,6 +150,7 @@ import { partitionOf, stateHomeFor } from "../store/stateBinding.js";
 import { scopePath } from "../core/stateContract.js";
 import { movePublicMemoryToPrivate } from "../store/privateMigrate.js";
 import { ENTITY_KINDS } from "../core/types.js";
+import { formatWhyRecord } from "../core/whyRecord.js";
 import { planCompaction } from "../store/compact.js";
 import { repairDecisionReference } from "../core/refrepair.js";
 import { resolveInvocation, dim, synthesisStatusLines, maybeWarnOllamaContext } from "./invocation.js";
@@ -187,6 +191,7 @@ registerTaskReportCommands(program, () => { const { store, root } = storeFor();
 registerServeCommands(program);
 registerStateCommands(program);
 registerUpdateCommand(program);
+registerVerifyCommand(program);
 registerReviewMemoryCommands(program, (records, repository, privateOnly) => {
     const { store, root } = storeFor();
     if (!repositoryUsesRemote(root, `https://github.com/${repository}.git`)) {
@@ -227,6 +232,103 @@ registerReviewMemoryCommands(program, (records, repository, privateOnly) => {
 // run: a leftover driver that exits without writing %A would let git drop `theirs`.
 const OPT_OUT_ALLOWED = new Set(["uninstall", "doctor", "help", "merge-driver", "merge-driver-grounding"]);
 const OPT_OUT_QUIET = new Set(["hook", "sync", "check", "grounding", "repair-provenance", "workspaces"]);
+/** Locations a command writes to (#488), keyed by command path: an opted-out repository
+ *  must never receive them, so their repository is gated IN ADDITION to the cwd's.
+ *  `base` is what the command itself resolves a relative value against: the cwd's
+ *  repository root (`findRoot`), Git's top level (`verify`), or the cwd; `join` marks a
+ *  command that joins the value onto that base even when absolute (`export-adr`).
+ *  `checkout` marks a command that also writes into the MAIN checkout (the overlay
+ *  anchor) and the git common dir (the shared-overlay pointer, the shared git hooks),
+ *  so both are gated; with no target (`init`) only those are. */
+const OPT_OUT_OUTPUTS = {
+    "init": { base: "root", checkout: true },
+    "private": { arg: 0, base: "root", checkout: true },
+    "shared": { arg: 0, base: "root", checkout: true },
+    "worktree": { arg: 0, base: "root", checkout: true },
+    "export-adr": { arg: 0, base: "root", join: true },
+    "review-memory auto": { option: "output", base: "cwd" },
+    "verify": { option: "map", base: "toplevel" },
+};
+/** Where `hunch private`/`shared` anchor the default overlay store: the MAIN worktree
+ *  root, shared by the write and the opt-out gate so they cannot diverge. */
+function overlayAnchor(root) {
+    return mainWorktreeRoot(root);
+}
+/** Git's top level for the cwd, as `hunch verify` resolves it; findRoot() outside Git. */
+function gitToplevel() {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }).trim() || findRoot();
+    }
+    catch {
+        return findRoot();
+    }
+}
+/** The marker gating `path` (the cwd, or a location a command writes to). Its own store
+ *  or repository root (`findRoot`: git-less stores included) counts first; inside a
+ *  repository the walk then passes any nested `.hunch` store up to the repository
+ *  (#488). A stray marker in a non-store, non-repository ancestor (e.g. ~) gates nothing. */
+function markerFor(path) {
+    const real = realpathNorm(path);
+    const root = findRoot(real);
+    if (isOptedOut(root))
+        return join(root, OPT_OUT_FILE);
+    return optOutMarkerAt(real, { withinRepo: true });
+}
+/** Every location whose repository the opt-out gate judges for this invocation (#458,
+ *  #488). A `--root` or a `serve` config names the repository the command acts on, so
+ *  it REPLACES the cwd; `serve` also gates every partition root its config names (an
+ *  unreadable config gates its directory only; the command itself then fails). An
+ *  output location only ADDS to the cwd. */
+function optOutTargets(top, action) {
+    const path = [];
+    for (let c = action; c && c !== program; c = c.parent)
+        path.unshift(c.name());
+    const given = (v) => typeof v === "string" && v.trim() !== "";
+    const actionOpts = action.opts();
+    const targets = [];
+    let cwd = true;
+    if (given(actionOpts.root)) {
+        targets.push(resolve(actionOpts.root));
+        cwd = false;
+    }
+    if (top.name() === "serve" && (path[1] === "init" || cwd)) {
+        // `serve` and `serve init` both take --config; the command reads the parent's first.
+        const configOpt = top.opts().config ?? actionOpts.config;
+        const configFile = resolve(given(configOpt) ? configOpt : SERVE_DEFAULT_CONFIG_FILE);
+        targets.push(dirname(configFile));
+        if (cwd) {
+            try {
+                for (const p of readServeConfig(configFile).partitions)
+                    targets.push(p.root);
+            }
+            catch { /* the command reports it */ }
+        }
+        cwd = false;
+    }
+    // Output locations follow the cwd rule: a marker gates them only inside a repository,
+    // never from a non-repository ancestor (bare / --separate-git-dir common dirs included).
+    const outputs = [];
+    const out = OPT_OUT_OUTPUTS[path.join(" ")];
+    if (out) {
+        const value = out.option !== undefined ? actionOpts[out.option] : action.processedArgs[out.arg ?? 0];
+        if (given(value)) {
+            const base = out.base === "root" ? findRoot() : out.base === "toplevel" ? gitToplevel() : process.cwd();
+            // `join`: the path the command writes, plus the absolute path the user named.
+            if (out.join)
+                outputs.push(join(base, toPosixTarget(value)));
+            outputs.push(resolve(base, value));
+        }
+        if (out.checkout) {
+            const root = findRoot();
+            const common = gitCommonDir(root);
+            // Only a real linked worktree shares a common dir with a main checkout; a submodule's
+            // common dir (super/.git/modules/x) must not pull the superproject's marker in.
+            if (common && mainWorktreeRoot(root) !== root)
+                outputs.push(overlayAnchor(root), resolve(root, common));
+        }
+    }
+    return { targets, outputs, cwd };
+}
 program.hook("preAction", (_thisCommand, actionCommand) => {
     let top = actionCommand;
     while (top.parent && top.parent !== program)
@@ -234,10 +336,26 @@ program.hook("preAction", (_thisCommand, actionCommand) => {
     const name = top.name();
     if (OPT_OUT_ALLOWED.has(name))
         return;
-    if (!isOptedOut(findRoot()))
+    // Gate the repository each location acts on (#458, #488): its real path is walked up
+    // through its ancestors to its repository, past any nested `.hunch` store (fail
+    // closed, so a cwd inside a nested store is gated too), and the refusal names the
+    // marker that actually gates it.
+    const { targets, outputs, cwd } = optOutTargets(top, actionCommand);
+    let marker = cwd ? markerFor(process.cwd()) : null;
+    for (const target of targets) {
+        if (marker)
+            break;
+        marker = optOutMarkerAt(realpathNorm(target));
+    }
+    for (const target of outputs) {
+        if (marker)
+            break;
+        marker = markerFor(target);
+    }
+    if (!marker)
         return;
     if (name !== "hook")
-        console.error(optOutMessage());
+        console.error(optOutMessage(marker));
     process.exit(OPT_OUT_QUIET.has(name) ? 0 : 1);
 });
 // Read an already-known update and schedule any registry refresh in a detached
@@ -301,6 +419,7 @@ function openTeamStore(root, opts = {}) {
     // from their durable local overlay when the network is temporarily down, but a
     // strict guard must prove it saw the advertised remote before it may pass.
     let pullStatus = null;
+    let pullDetail;
     if (teamAdvertised && store.mode === "shared" && store.privateDir) {
         const remote = advertisedTeamRemoteContract(root, dirname(store.privateDir));
         if (!remote || !remote.verify()) {
@@ -309,10 +428,9 @@ function openTeamStore(root, opts = {}) {
             throw new Error("the advertised team memory route could not be pinned for this command");
         }
         pinSharedRemote(store, remote);
-        pullStatus = pullHunchStatus(store.privateDir, {
-            timeoutMs: 5_000,
+        ({ status: pullStatus, detail: pullDetail } = pullHunchStatusDetailed(store.privateDir, {
             remote,
-        });
+        }));
         // The route may be coherently rewritten while the bounded pull is blocked.
         // No handler — including an ordinary non-strict read — may run after the
         // graph epoch that admitted this command stops verifying.
@@ -322,12 +440,12 @@ function openTeamStore(root, opts = {}) {
             throw new Error("the advertised team memory route changed while this command was refreshing; refusing to serve or mutate stale memory");
         }
     }
-    return { store, teamWired, teamPullStatus: opts.requireFreshTeamMemory ? pullStatus : null };
+    return { store, teamWired, teamPullStatus: opts.requireFreshTeamMemory ? pullStatus : null, teamPullDetail: opts.requireFreshTeamMemory ? pullDetail : undefined };
 }
 function storeFor(opts = {}) {
     const root = findRoot();
-    const { store, teamPullStatus } = openTeamStore(root, opts);
-    return { store, root, teamPullStatus };
+    const { store, teamPullStatus, teamPullDetail } = openTeamStore(root, opts);
+    return { store, root, teamPullStatus, teamPullDetail };
 }
 function pumpMemoryHome(store, root, home, message) {
     flushMemoryHome(store, hunchPaths(root).hunch, home, message);
@@ -539,8 +657,8 @@ program
     }
     // Windows self-heal: if an earlier global `claude mcp add` left a drive-letter
     // case-split in ~/.claude.json, merge it so hunch resolves under either casing.
-    // No-op (silent) off Windows.
-    reportClaudeConfigHeal();
+    // No-op (silent) off Windows; the no-op line belongs to --details (#493).
+    reportClaudeConfigHeal(say);
     // Worktree-seamless: register any configured overlay at the git common dir so EVERY
     // worktree of this repo auto-discovers it (also backfills pre-0.32 single-worktree setups),
     // and note when we're initializing inside a linked worktree (memory is shared, not separate).
@@ -971,13 +1089,12 @@ function discoverSharedRemote(remoteUrl) {
                 && remoteUrl.startsWith(prefix))
                 return null;
         }
-        const listed = spawnSync("git", [
+        // Bounded so a timeout kills git's whole tree, not just the root (#498).
+        const listed = boundedSpawnSync("git", [
             "-C", probe,
             "-c", `core.hooksPath=${hooksDir}`,
             "ls-remote", "--refs", "--heads", "--upload-pack=git-upload-pack", remoteUrl,
         ], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
             env: boundedTeamGitEnv(),
             timeout: 15_000,
         });
@@ -1054,7 +1171,6 @@ function configureExistingValidatedOverlay(destRoot, codeRoot, requestedRemote,
     }
     else {
         const pulled = pullHunchStatus(hunchDir, {
-            timeoutMs: 5_000,
             remote: contract,
             allowUnrelatedHistories: true,
         });
@@ -1311,7 +1427,7 @@ function configureOverlay(dir, opts, mode) {
         // Anchor the default store at the MAIN worktree root: a linked worktree can be
         // `git worktree remove`d, which would take the store (and every other worktree's
         // absolute pointer to it) down with it. An explicit [dir] still resolves from here.
-        const anchor = mainWorktreeRoot(root);
+        const anchor = overlayAnchor(root);
         if (opts.repo) {
             const dest = join(anchor, ".hunch-private");
             // Canonicalize once in the invocation context so clone, attach, fetch, and
@@ -3783,7 +3899,7 @@ program
 program
     .command("why")
     .description("Explain why a file/symbol is the way it is (decisions, bugs, constraints).")
-    .argument("<target>", "file path or symbol name")
+    .argument("<target>", "file path, symbol name, or record id (dec_/con_/bug_/fnd_/cmp_)")
     .option("--as-of <ref>", "time-travel: what was believed as of a commit/tag/branch (e.g. v0.7.0, HEAD~5)")
     .action((target, opts) => {
     const { store, root } = storeFor();
@@ -3791,6 +3907,13 @@ program
     if (opts.asOf && !asOf)
         return fail(`could not resolve --as-of "${opts.asOf}" to a commit (need a git repo and a valid ref)`);
     const w = store.why(target, { asOf });
+    if (w.byId?.record) {
+        if (asOf)
+            console.log(`Why "${target}" (as of ${opts.asOf} — ${asOf.slice(0, 10)}):\n`);
+        console.log(formatWhyRecord(w.byId).join("\n"));
+        store.close();
+        return;
+    }
     const staleIds = new Set(store.staleness((f) => lastChangeDate(f, root)).map((s) => s.id));
     const drift = (id) => (staleIds.has(id) ? " ⚠STALE" : "");
     console.log(asOf ? `Why "${target}" (as of ${opts.asOf} — ${asOf.slice(0, 10)}):\n` : `Why "${target}":\n`);
@@ -3810,7 +3933,7 @@ program
             console.log(`  • ${b.id} [${b.status}] ${b.title} — ${b.root_cause}`);
     }
     if (!w.decisions.length && !w.constraints.length && !w.bugs.length) {
-        console.log("(No recorded decisions/bugs/constraints yet. Try `hunch backfill` or make a commit.)");
+        console.log(w.byId ? formatWhyRecord(w.byId).join("\n") : "(No recorded decisions/bugs/constraints yet. Try `hunch backfill` or make a commit.)");
     }
     if (w.symbols.length)
         console.log(`\nSYMBOLS: ${w.symbols.map((s) => `${s.name} [fan-in ${s.metrics.fan_in}, churn ${s.metrics.churn_90d}]`).join(", ")}`);
@@ -4233,9 +4356,10 @@ program
     // interleaved section prints are suppressed for this format.
     const sarif = opts.format === "sarif";
     const emptyReport = { fileCount: 0, strict: !!opts.strict, direct: [], near: [], regressions: [], vetoes: [], redundant: [], strictBlockers: 0, regBlocking: 0, vetoBlocking: 0 };
-    const { store, root, teamPullStatus } = storeFor({ requireFreshTeamMemory: !!opts.strict && !opts.publicOnly });
+    const { store, root, teamPullStatus, teamPullDetail } = storeFor({ requireFreshTeamMemory: !!opts.strict && !opts.publicOnly });
     const teamFreshnessFailure = teamPullStatus !== null && !teamPullIsFresh(teamPullStatus)
         ? `strict check could not refresh the advertised team memory (${teamPullStatus}); refusing a stale pass` +
+            (teamPullDetail ? ` (${describePullFailure(teamPullDetail)})` : "") +
             (teamPullStatus === "unconfigured" ? " — the shared memory remote has no published branch while this clone has memory; publish it with `hunch shared --sync`" : "")
         : null;
     // An empty team remote is in sync with a never-committed clone, but it is also what
@@ -5466,7 +5590,11 @@ program
         // before implementation. Firm/strict may deny two edits per prompt, then
         // fail open so a malformed or unavailable probe can never deadlock work.
         if ((firmness === "firm" || firmness === "strict") && evt.session_id && pipelineEnabled() && targets.some((t) => isProductPath(t.target))) {
-            const baseline = beforeEditProbeVerdict(loadPipelineState(evt.session_id));
+            const baseline = beforeEditProbeVerdict(loadPipelineState(evt.session_id), { commandOutcomes: deliversCommandOutcome(provider) });
+            // Unverifiable on this host: the edit proceeds and the hook says why on
+            // stderr (stdout stays free for the grounding/deny response below).
+            if (baseline.unverifiable && baseline.reason)
+                process.stderr.write(`${baseline.reason}\n`);
             if (baseline.block) {
                 savePipelineState(evt.session_id, baseline.state);
                 emitDeny(provider, baseline.reason ?? "Hunch evidence gate — establish the pre-edit probe baseline first.");
@@ -6069,12 +6197,15 @@ program
         return;
     }
     const res = target.persistMigration();
-    writeManifest(paths, SCHEMA_VERSION);
+    writeManifest(paths, res.version); // held at `from` while any record failed to migrate
     store.reindex();
-    pumpMemoryHome(store, root, store.unified ? "private" : "public", `hunch: migrate schema v${from} to v${SCHEMA_VERSION}`);
-    console.log(`✓ Migrated v${from} → v${SCHEMA_VERSION}: ${res.migrated} record(s) upgraded.`);
+    pumpMemoryHome(store, root, store.unified ? "private" : "public", `hunch: migrate schema v${from} to v${res.version}`);
+    console.log(`✓ Migrated v${from} → v${res.version}: ${res.migrated} record(s) upgraded.`);
     if (res.skipped) {
-        console.warn(`⚠ ${res.skipped} record(s) could NOT be migrated and will no longer load. They are preserved on disk in their old shape under .hunch/ for manual recovery.`);
+        console.warn(`⚠ ${res.skipped} record(s) could not be migrated. They are preserved on disk in their old shape under .hunch/ for manual recovery; the schema stays at v${res.version}, so re-running \`hunch migrate\` after a fix completes the migration to v${SCHEMA_VERSION}.`);
+    }
+    if (res.invalid) {
+        console.warn(`⚠ ${res.invalid} record(s) are invalid or unreadable and no pending migration applies to them. They were left untouched under .hunch/; fix them by hand.`);
     }
     store.close();
 });
@@ -7585,26 +7716,27 @@ function rel(root, p) {
 }
 /** Run the Windows ~/.claude.json drive-letter case-split heal and print what it
  *  did. Silent + no-op off Windows. A parse refusal is surfaced as a warning, never
- *  thrown out of doctor/init (those commands must still complete). */
-function reportClaudeConfigHeal() {
+ *  thrown out of doctor/init (those commands must still complete). `say` lets `init`
+ *  route the lines into its buffered output (shown with --details; warnings always). */
+function reportClaudeConfigHeal(say = (text) => console.log(text)) {
     let res;
     try {
         res = healClaudeConfigCaseSplit();
     }
     catch (e) {
-        console.log(`  ⚠ Claude config: ${e.message}`);
+        say(`  ⚠ Claude config: ${e.message}`);
         return;
     }
     if (!res.applicable)
         return; // non-Windows: the case-split bug can't occur
     if (!res.changed) {
-        console.log(dim(`Claude config: no drive-letter project split (${res.file})`));
+        say(dim(`Claude config: no drive-letter project split (${res.file})`));
         return;
     }
     for (const g of res.groups) {
-        console.log(`✓ healed Claude Code project case-split: mirrored [${g.servers.join(", ")}] across ${g.casings.join("  ·  ")}`);
+        say(`✓ healed Claude Code project case-split: mirrored [${g.servers.join(", ")}] across ${g.casings.join("  ·  ")}`);
     }
-    console.log(dim(`  ↳ backup: ${res.backup}`));
+    say(dim(`  ↳ backup: ${res.backup}`));
 }
 function fail(msg) {
     console.error(`error: ${msg}`);

package/dist/cli/invocation.d.ts

@@ -41,3 +41,17 @@ export declare function classifyEntry(entry: string): {
     installed: boolean;
 };
 export declare function resolveInvocation(): ResolvedInvocation;
+/** The command prefix for the git merge drivers. git runs a driver with the
+ *  repository being merged as its cwd, so the dev-mode `npx tsx <entry>` would
+ *  resolve tsx from THAT repo (or fetch it from the registry), not from Hunch's
+ *  own checkout (#492). In dev mode, launch the absolute node binary against
+ *  this checkout's tsx cli.mjs, the same shape selfBuildInvocation gives the
+ *  git hooks (src/integrations/hooks.ts); every other invocation (published,
+ *  dist, or a caller-supplied one) passes through unchanged. */
+export declare function mergeDriverShell(invShell: string): string;
+/** Filesystem paths, never a file URL: git expands `%`-escapes in the driver
+ *  command, so a percent-encoded URL (any non-ASCII checkout path) would be
+ *  corrupted. POSIX single quotes keep `$`, backticks and `"` literal under the
+ *  /bin/sh git runs drivers with on every platform, and a literal `%` in a path
+ *  is doubled so git expands it back to one. */
+export declare function devMergeDriverShell(execPath: string, tsxCli: string, entry: string): string;

package/dist/cli/invocation.js

@@ -125,4 +125,27 @@ export function resolveInvocation() {
         installed,
     };
 }
+/** The command prefix for the git merge drivers. git runs a driver with the
+ *  repository being merged as its cwd, so the dev-mode `npx tsx <entry>` would
+ *  resolve tsx from THAT repo (or fetch it from the registry), not from Hunch's
+ *  own checkout (#492). In dev mode, launch the absolute node binary against
+ *  this checkout's tsx cli.mjs, the same shape selfBuildInvocation gives the
+ *  git hooks (src/integrations/hooks.ts); every other invocation (published,
+ *  dist, or a caller-supplied one) passes through unchanged. */
+export function mergeDriverShell(invShell) {
+    const inv = resolveInvocation();
+    if (inv.installed || !inv.shell.startsWith("npx tsx ") || invShell !== inv.shell)
+        return invShell;
+    const entry = fileURLToPath(import.meta.url).replace(/invocation\.ts$/, "index.ts");
+    return devMergeDriverShell(process.execPath, fileURLToPath(import.meta.resolve("tsx/cli")), entry);
+}
+/** Filesystem paths, never a file URL: git expands `%`-escapes in the driver
+ *  command, so a percent-encoded URL (any non-ASCII checkout path) would be
+ *  corrupted. POSIX single quotes keep `$`, backticks and `"` literal under the
+ *  /bin/sh git runs drivers with on every platform, and a literal `%` in a path
+ *  is doubled so git expands it back to one. */
+export function devMergeDriverShell(execPath, tsxCli, entry) {
+    const quote = (s) => `'${s.replace(/'/g, "'\\''")}'`.replace(/%/g, "%%");
+    return [execPath, tsxCli, entry].map(quote).join(" ");
+}
 //# sourceMappingURL=invocation.js.map

package/dist/cli/serve.d.ts

@@ -13,4 +13,6 @@ export declare function compactPartition(root: string, scope: {
     floor_seq: number;
     head_seq: number;
 }>;
+/** The serve config file used when no --config is given, resolved against the cwd. */
+export declare const DEFAULT_CONFIG = "hunch-serve.json";
 export declare function registerServeCommands(program: Command): void;

package/dist/cli/serve.js

@@ -32,8 +32,9 @@ export async function compactPartition(root, scope, keep, lockOptions = {}) {
         store.close();
     }
 }
+/** The serve config file used when no --config is given, resolved against the cwd. */
+export const DEFAULT_CONFIG = "hunch-serve.json";
 export function registerServeCommands(program) {
-    const DEFAULT_CONFIG = "hunch-serve.json";
     const serve = program.command("serve")
         .description("Serve nuryel.state/1 over HTTP for organization / team / user / repository partitions (binds 127.0.0.1; put it behind SSH or a reverse proxy)")
         .option("--config <file>", `serve config (nuryel.serve-config/1); default ${DEFAULT_CONFIG}`)

package/dist/cli/verify.d.ts

@@ -0,0 +1,28 @@
+import type { Command } from "commander";
+import { type ImpactMap } from "../core/testSelection.js";
+export declare const DEFAULT_IMPACT_MAP = ".hunch-cache/test-impact.json";
+/** Split a command template into argv tokens; double/single quotes group. */
+export declare function tokenize(template: string): string[];
+/** The runner argv (never a shell). A configured template wins (`{files}` expands
+ *  to one argv entry per file); otherwise this repo's runner when present, else
+ *  `npm test` (full) / `npm test -- <files>`. */
+export declare function runnerArgv(root: string, template: string | undefined, files: string[], extra: string[], full: boolean): string[];
+/** Run each test in its own runner process under NODE_V8_COVERAGE (inherited
+ *  by spawned CLI/MCP children) and record the repo files each executed. An
+ *  entry is `complete` only when the test file passed and produced coverage;
+ *  failing tests still record their (partial) files. `only` merges into the
+ *  old map, keeping each untouched entry's own commit stamp. */
+export declare function refreshImpactMap(opts: {
+    root: string;
+    tests: string[];
+    files: string[];
+    template?: string;
+    mapPath: string;
+    only?: string[];
+    concurrency?: number;
+    log?: (line: string) => void;
+}): Promise<{
+    map: ImpactMap;
+    failed: string[];
+}>;
+export declare function registerVerifyCommand(program: Command): void;