@davesheffer/hunch 1.45.1 → 1.46.0

package/dist/extractors/languages.js

@@ -17,7 +17,14 @@ const TS_QUERY = `
   (variable_declarator
      name: (identifier) @arrow.name
      value: [(arrow_function) (function_expression)]) @arrow.def
+  ;; Class-field arrows (\`handler = () => {}\`) are methods in every way that matters.
+  (public_field_definition
+     name: (property_identifier) @method.name
+     value: [(arrow_function) (function_expression)]) @method.def
   (import_statement source: (string) @import.src)
+  ;; require("./x") and dynamic import("./x") are imports too, when the specifier is literal.
+  (call_expression function: (identifier) @_require arguments: (arguments . (string) @import.src .) (#eq? @_require "require"))
+  (call_expression function: (import) arguments: (arguments . (string) @import.src .))
   (call_expression function: (identifier) @call.id)
   (call_expression function: (member_expression property: (property_identifier) @call.member))
   ;; Construction IS a call. Without these, \`new Foo()\` produced no edge at all, so
@@ -27,6 +34,24 @@ const TS_QUERY = `
   (new_expression constructor: (identifier) @call.id)
   (new_expression constructor: (member_expression property: (property_identifier) @call.member))
 `;
+/** Rendering a component IS a call; lowercase tags are intrinsic elements, not symbols. */
+const TSX_QUERY = `${TS_QUERY}
+  (jsx_opening_element name: (identifier) @call.id (#match? @call.id "^[A-Z]"))
+  (jsx_self_closing_element name: (identifier) @call.id (#match? @call.id "^[A-Z]"))
+  (jsx_opening_element name: (member_expression property: (property_identifier) @call.member))
+  (jsx_self_closing_element name: (member_expression property: (property_identifier) @call.member))
+`;
+/** Module-object bindings: \`import * as ns\`, \`const m = require()\`, \`const m = await import()\`. */
+const TS_BINDING_QUERY = `
+  (import_statement (import_clause (namespace_import (identifier) @bind.local)) source: (string) @bind.src)
+  (variable_declarator
+     name: (identifier) @bind.local
+     value: (call_expression function: (identifier) @_require arguments: (arguments . (string) @bind.src .))
+     (#eq? @_require "require"))
+  (variable_declarator
+     name: (identifier) @bind.local
+     value: (await_expression (call_expression function: (import) arguments: (arguments . (string) @bind.src .))))
+`;
 const TS_BUILTIN_METHODS = new Set([
     "map", "filter", "forEach", "reduce", "find", "findIndex", "some", "every", "includes",
     "push", "pop", "shift", "unshift", "slice", "splice", "concat", "join", "split", "flat", "flatMap",
@@ -45,6 +70,7 @@ const TS_SHARED = {
     defNodeTypes: new Set([
         "function_declaration", "generator_function_declaration", "method_definition",
         "class_declaration", "interface_declaration", "type_alias_declaration", "variable_declarator",
+        "public_field_definition",
     ]),
     defKindOf: {
         "fn.def": "function", "method.def": "method", "class.def": "class",
@@ -55,6 +81,7 @@ const TS_SHARED = {
         "iface.name": "iface.def", "type.name": "type.def", "arrow.name": "arrow.def",
     },
     builtinMethods: TS_BUILTIN_METHODS,
+    bindingQuery: TS_BINDING_QUERY,
     // ES2018 relaxed template literals: an INVALID escape (`\x` with no hex, `\u`
     // short, `\u{` unterminated) is legal inside a TAGGED template — the cooked
     // value is undefined and the raw text survives, which is the entire point of
@@ -81,6 +108,7 @@ const TSX = {
     extensions: [".tsx", ".jsx"],
     grammarKey: "tsx",
     loadGrammar: () => loadNativeTreeSitter().tsx,
+    query: TSX_QUERY,
     // tree-sitter-javascript rejects a bare ampersand in JSX text even though JSX
     // accepts it (tree-sitter-javascript#366). The ERROR is a direct jsx_element
     // child and its text begins at the ampersand. Require both facts plus text that

package/dist/extractors/parse.d.ts

@@ -15,6 +15,20 @@ export interface ParsedCall {
     endByte: number;
     /** true for `x.foo()` (property access), false for a direct `foo()` call. */
     member: boolean;
+    /** For a member call on a plain identifier (`x.foo()`), that identifier. */
+    qualifier?: string;
+}
+/** A local name bound by an import: a module object (`imported` null — `import *
+ *  as ns`, `require()`, Go package alias) or one aliased member of a module. */
+export interface ParsedBinding {
+    local: string;
+    module: string;
+    imported: string | null;
+}
+/** A call whose target is pinned to one imported module (`ns.fn()`, aliased `g()`). */
+export interface QualifiedCall {
+    callee: string;
+    module: string;
 }
 export interface ParsedRelation {
     target: string;
@@ -28,6 +42,7 @@ export interface ParsedFile {
     imports: string[];
     calls: ParsedCall[];
     relations: ParsedRelation[];
+    bindings: ParsedBinding[];
     namespace: string | null;
     parseable: boolean;
 }
@@ -50,6 +65,11 @@ export declare function parseSource(file: string, source: string, opts?: {
  *  `memberOnly` (true iff every occurrence was a `x.foo()` member call, never
  *  a direct `foo()`), so the indexer can resolve member calls conservatively. */
 export declare function attributeCalls(parsed: ParsedFile): Map<number, Map<string, boolean>>;
+/** Map each call bound to an imported module — `ns.fn()` through a module-object
+ *  binding, or `g()` through an aliased member import — to the innermost symbol
+ *  containing it (same index identity as attributeCalls). A local bound to two
+ *  different modules is ambiguous and dropped: never guess a binding. */
+export declare function attributeQualifiedCalls(parsed: ParsedFile): Map<number, QualifiedCall[]>;
 /** Map static semantic relationships (extends/implements/trait use) to the
  * innermost enclosing declaration using the same stable symbol-index identity
  * as call attribution. */

package/dist/extractors/parse.js

@@ -14,7 +14,8 @@ function bundleFor(spec) {
         const grammar = spec.loadGrammar();
         parser.setLanguage(grammar);
         const query = new Parser.Query(grammar, spec.query);
-        b = { parser, query };
+        const bindingQuery = spec.bindingQuery ? new Parser.Query(grammar, spec.bindingQuery) : null;
+        b = { parser, query, bindingQuery };
         cache.set(spec.grammarKey, b);
     }
     return b;
@@ -41,7 +42,7 @@ export function parseSource(file, source, opts = {}) {
     // statefulness here even if it forgets to keep its pattern flag-free.
     const templated = (spec.alwaysTemplatedExtensions?.some((ext) => file.endsWith(ext)) ?? false)
         || (spec.templatingMarkers?.some((marker) => source.search(marker) !== -1) ?? false);
-    const { parser, query } = bundleFor(spec);
+    const { parser, query, bindingQuery } = bundleFor(spec);
     // The native binding caps its scratch buffer at 32 KB unless bufferSize is
     // given — without this, any source >= 32768 bytes throws "Invalid argument"
     // and would abort the whole index run. Guard with try/catch as a backstop.
@@ -81,6 +82,7 @@ export function parseSource(file, source, opts = {}) {
     const imports = [];
     const calls = [];
     const relations = [];
+    const bindings = [];
     let namespace = null;
     const originalText = (node) => usingRecoveredTree
         ? source.slice(node.startIndex, node.endIndex)
@@ -125,8 +127,11 @@ export function parseSource(file, source, opts = {}) {
         else if (cname === "call.member") {
             // skip builtin method names to avoid false edges to similarly-named symbols
             const text = originalText(node);
-            if (!spec.builtinMethods.has(text))
-                calls.push({ callee: text, atByte: node.startIndex, endByte: node.endIndex, member: true });
+            if (!spec.builtinMethods.has(text)) {
+                const object = node.parent?.childForFieldName("object") ?? node.parent?.childForFieldName("operand");
+                const qualifier = object?.type === "identifier" ? originalText(object) : undefined;
+                calls.push({ callee: text, atByte: node.startIndex, endByte: node.endIndex, member: true, qualifier });
+            }
         }
         else if (spec.relationKindOf?.[cname]) {
             const relation = spec.relationKindOf[cname];
@@ -139,6 +144,29 @@ export function parseSource(file, source, opts = {}) {
             });
         }
     }
+    for (const match of bindingQuery?.matches(tree.rootNode) ?? []) {
+        const text = (capture) => {
+            const node = match.captures.find((c) => c.name === capture)?.node;
+            return node ? originalText(node) : null;
+        };
+        const src = text("bind.src")?.replace(STR_QUOTES, "");
+        if (!src)
+            continue;
+        const imported = text("bind.name");
+        if (imported) {
+            const local = text("bind.local") ?? imported;
+            // `from X import Y [as Z]`: Y may be a submodule or a member; record both
+            // readings — only the one that resolves to a tracked file/symbol yields an edge.
+            if (spec.joinSubmodule)
+                bindings.push({ local, module: spec.joinSubmodule(src, imported), imported: null });
+            bindings.push({ local, module: src, imported });
+        }
+        else {
+            const local = text("bind.local") ?? spec.defaultBindingLocal?.(src) ?? null;
+            if (local)
+                bindings.push({ local, module: src, imported: null });
+        }
+    }
     for (const { kind, def, name } of pendingDefs.values()) {
         const resolvedName = name ?? spec.fallbackDefName?.(file);
         if (!resolvedName)
@@ -167,7 +195,7 @@ export function parseSource(file, source, opts = {}) {
         });
     }
     symbols.sort((a, b) => a.startByte - b.startByte);
-    return { symbols, imports, calls, relations, namespace, parseable: templated || parseable };
+    return { symbols, imports, calls, relations, bindings, namespace, parseable: templated || parseable };
 }
 /** True when every ERROR/MISSING node in the tree sits in an ancestor shape this
  *  language declares as a known grammar limitation (LanguageSpec.toleratedErrorScopes).
@@ -259,6 +287,54 @@ export function attributeCalls(parsed) {
     }
     return out;
 }
+/** Map each call bound to an imported module — `ns.fn()` through a module-object
+ *  binding, or `g()` through an aliased member import — to the innermost symbol
+ *  containing it (same index identity as attributeCalls). A local bound to two
+ *  different modules is ambiguous and dropped: never guess a binding. */
+export function attributeQualifiedCalls(parsed) {
+    const unique = (entries) => {
+        const out = new Map();
+        for (const [local, target] of entries) {
+            const prev = out.get(local);
+            out.set(local, prev === undefined || (prev && prev.module === target.module && prev.callee === target.callee) ? target : null);
+        }
+        return out;
+    };
+    const modules = unique(parsed.bindings.filter((b) => b.imported === null).map((b) => [b.local, { callee: "", module: b.module }]));
+    const aliases = unique(parsed.bindings.filter((b) => b.imported !== null).map((b) => [b.local, { callee: b.imported, module: b.module }]));
+    const out = new Map();
+    if (modules.size === 0 && aliases.size === 0)
+        return out;
+    for (const call of parsed.calls) {
+        let target = null;
+        if (call.member && call.qualifier) {
+            const binding = modules.get(call.qualifier);
+            if (binding)
+                target = { callee: call.callee, module: binding.module };
+        }
+        else if (!call.member) {
+            target = aliases.get(call.callee) ?? null;
+        }
+        if (!target)
+            continue;
+        let best = null;
+        let bestIndex = -1;
+        for (let i = 0; i < parsed.symbols.length; i++) {
+            const s = parsed.symbols[i];
+            if (call.atByte >= s.startByte && call.atByte < s.endByte && (!best || s.endByte - s.startByte < best.endByte - best.startByte)) {
+                best = s;
+                bestIndex = i;
+            }
+        }
+        if (bestIndex < 0)
+            continue;
+        const list = out.get(bestIndex) ?? [];
+        if (!list.some((t) => t.callee === target.callee && t.module === target.module))
+            list.push(target);
+        out.set(bestIndex, list);
+    }
+    return out;
+}
 /** Map static semantic relationships (extends/implements/trait use) to the
  * innermost enclosing declaration using the same stable symbol-index identity
  * as call attribution. */

package/dist/extractors/workspaces.js

@@ -12,6 +12,7 @@ import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, realpathSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { foreignRepoEnv, gitCommonDir, mainWorktreeRoot, stableRepositoryName } from "./git.js";
+import { boundedSpawnSync } from "../core/boundedSpawn.js";
 import { extracted } from "../core/types.js";
 import { CONTROL_CHARS, MAX_BRANCHES, MAX_WORKTREES, WORKSPACE_SCHEMA_VERSION, WorkspaceSchema, isSafeBranchName, workspaceId, worktreeId, } from "../core/workspace.js";
 const SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
@@ -353,8 +354,9 @@ function fetchedAt(root) {
 export function snapshotWorkspace(root, opts) {
     const now = opts.now ?? new Date();
     const main = mainWorktreeRoot(root);
+    // Network fetch: bounded so a timeout kills git's whole tree, not just the root (#498).
     if (opts.fetch)
-        run(main, ["fetch", "--prune", "--quiet"], 120_000);
+        boundedSpawnSync("git", ["fetch", "--prune", "--quiet"], { cwd: main, env: env(), stdout: "ignore", timeout: 120_000 });
     const def = defaultBranch(main);
     const searched = opts.squashSearchCommits ?? DEFAULT_SQUASH_SEARCH_COMMITS;
     let patchIds = null;

package/dist/integrations/health.d.ts

@@ -40,6 +40,12 @@ export declare const HARNESSES: {
     };
 };
 export type Harness = keyof typeof HARNESSES;
+/** Devin Desktop (formerly Windsurf) reads workspace hooks from .devin/hooks.json
+ * and falls back to the legacy .windsurf/hooks.json only when that file is absent
+ * or defines no hooks (docs.devin.ai/desktop/cascade/hooks, #494). */
+export declare const DEVIN_HOOKS = ".devin/hooks.json";
+/** The hooks file the host actually reads, so doctor inspects the active one. */
+export declare function activeHooksFile(root: string, harness: Harness): string;
 export interface HealthIssue {
     file: string;
     code: string;

package/dist/integrations/health.js

@@ -29,6 +29,26 @@ export const HARNESSES = {
     windsurf: { mcp: ".windsurf/mcp_config.json", hooks: ".windsurf/hooks.json", key: "mcpServers", events: ["", "pre_write_code", "post_run_command", ""] },
     antigravity: { mcp: ".agents/mcp_config.json", hooks: ".agents/hooks.json", key: "mcpServers", events: ["PreInvocation", "PreToolUse", "", ""] },
 };
+/** Devin Desktop (formerly Windsurf) reads workspace hooks from .devin/hooks.json
+ * and falls back to the legacy .windsurf/hooks.json only when that file is absent
+ * or defines no hooks (docs.devin.ai/desktop/cascade/hooks, #494). */
+export const DEVIN_HOOKS = ".devin/hooks.json";
+/** The hooks file the host actually reads, so doctor inspects the active one. */
+export function activeHooksFile(root, harness) {
+    const legacy = HARNESSES[harness].hooks;
+    if (harness !== "windsurf" || !existsSync(join(root, DEVIN_HOOKS)))
+        return legacy;
+    try {
+        const hooks = parseJsonc(readFileSync(join(root, DEVIN_HOOKS), "utf8"))?.hooks;
+        if (hooks && typeof hooks === "object" && Object.values(hooks).some(v => Array.isArray(v) && v.length > 0))
+            return DEVIN_HOOKS;
+        return legacy;
+    }
+    catch {
+        // An unparseable .devin/hooks.json is reported against itself, not masked.
+        return DEVIN_HOOKS;
+    }
+}
 const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const pinPattern = /@davesheffer\/hunch@([^\s"'\],;]+)/g;
 const object = (v) => {
@@ -160,12 +180,13 @@ export function inspectIntegrations(root, selected) {
     }
     for (const harness of selected ? [selected] : Object.keys(HARNESSES)) {
         const spec = HARNESSES[harness];
-        if (!selected && !existsSync(join(root, spec.mcp)) && (!spec.hooks || !existsSync(join(root, spec.hooks))))
+        const hooksFile = activeHooksFile(root, harness);
+        if (!selected && !existsSync(join(root, spec.mcp)) && (!hooksFile || !existsSync(join(root, hooksFile))))
             continue;
         const capabilities = Object.fromEntries(CAPABILITIES.map(c => [c, { status: "untested", detail: "No runtime evidence" }]));
         report.harnesses.push({ harness, capabilities });
         const mcpPath = join(root, spec.mcp);
-        const hooksFileExists = Boolean(spec.hooks && existsSync(join(root, spec.hooks)));
+        const hooksFileExists = Boolean(hooksFile && existsSync(join(root, hooksFile)));
         let mcpEntryAbsent = false;
         try {
             lstatSync(mcpPath);
@@ -203,22 +224,22 @@ export function inspectIntegrations(root, selected) {
         // A hooks file that was never written is a coverage gap (the adapter is
         // not installed), not configuration drift: report it, never fail on it.
         // `--require` still refuses, because nothing unverified counts.
-        const hooksAbsent = !!spec.hooks && !existsSync(join(root, spec.hooks));
-        if (spec.hooks && !hooksAbsent) {
+        const hooksAbsent = !!hooksFile && !existsSync(join(root, hooksFile));
+        if (hooksFile && !hooksAbsent) {
             try {
-                const config = object(parseJsonc(readFileSync(join(root, spec.hooks), "utf8")));
+                const config = object(parseJsonc(readFileSync(join(root, hooksFile), "utf8")));
                 disabled = config.disableAllHooks === true;
                 events = object(harness === "antigravity" ? config.hunch : config.hooks);
                 const commands = Object.values(events).flatMap(v => hookCommands(v));
-                recordPins(spec.hooks, commands);
+                recordPins(hooksFile, commands);
                 if (commands.some(misroutedHook))
                     report.issues.push({
-                        file: spec.hooks, code: "hook-command",
+                        file: hooksFile, code: "hook-command",
                         detail: "Hunch hooks invoke the MCP subcommand instead of the hook handler; run hunch integrations repair-pins",
                     });
             }
             catch (e) {
-                report.issues.push({ file: spec.hooks, code: "hook-config", detail: e.message });
+                report.issues.push({ file: hooksFile, code: "hook-config", detail: e.message });
             }
         }
         for (const [i, capability] of ["context", "edit-blocking", "failure-capture", "compaction"].entries()) {
@@ -235,7 +256,7 @@ export function inspectIntegrations(root, selected) {
                 status.detail = capability === "context" ? "Hunch relies on instructions and voluntary MCP calls on this adapter" : "No Hunch lifecycle adapter for this capability";
             }
             else if (hooksAbsent) {
-                status.detail = `No ${spec.hooks}; run hunch init to install this host's lifecycle hooks`;
+                status.detail = `No ${hooksFile}; run hunch init to install this host's lifecycle hooks`;
             }
             else if (disabled || firmness === "off" || ((capability === "failure-capture") && process.env.HUNCH_PIPELINE === "0")) {
                 status.status = "unsupported";
@@ -248,7 +269,7 @@ export function inspectIntegrations(root, selected) {
                 }
                 else {
                     status.detail = `Missing Hunch ${event} handler`;
-                    report.issues.push({ file: spec.hooks, code: "missing-hook", detail: status.detail });
+                    report.issues.push({ file: hooksFile, code: "missing-hook", detail: status.detail });
                 }
             }
             else if (capability === "edit-blocking" && firmness !== "strict") {
@@ -302,7 +323,7 @@ export function repairIntegrationPins(root, opts = {}) {
     const version = expectedVersion(root);
     const pending = [];
     for (const [name, spec] of Object.entries(HARNESSES)) {
-        for (const file of [spec.mcp, spec.hooks].filter(Boolean)) {
+        for (const file of [spec.mcp, spec.hooks, ...(name === "windsurf" ? [DEVIN_HOOKS] : [])].filter(Boolean)) {
             const path = join(root, file);
             if (!existsSync(path) || opts.skip?.(file))
                 continue;
@@ -342,7 +363,7 @@ export function repairIntegrationPins(root, opts = {}) {
                 const replacements = new Map(values.map(v => {
                     // Every recognized npm token is shell-safe. Bare tokens also repair
                     // the legacy quoted executable, which PowerShell treats as a string.
-                    const published = file === spec.hooks ? publishedHookCommand(v) : undefined;
+                    const published = file === spec.hooks || file === DEVIN_HOOKS ? publishedHookCommand(v) : undefined;
                     const repaired = published?.replace(" hunch mcp hook", " hunch hook") ?? v;
                     return [v, replace(repaired)];
                 }).filter(([a, b]) => a !== b));

package/dist/integrations/hooks.d.ts

@@ -16,8 +16,10 @@ export interface HookInstall {
      *  managed-elsewhere: a hook manager owns the hook — nothing was written.
      *  unreachable: the existing hook ends in exec/exit before our block, or the
      *  block in it has no closing marker and so cannot be replaced in place —
-     *  nothing was written. */
-    action: "created" | "appended" | "updated" | "unchanged" | "kept-shared" | "managed-elsewhere" | "unreachable";
+     *  nothing was written.
+     *  opted-out: the main checkout opted out (#488) and git hooks live in the
+     *  common dir every worktree shares — nothing was written, on purpose. */
+    action: "created" | "appended" | "updated" | "unchanged" | "kept-shared" | "managed-elsewhere" | "unreachable" | "opted-out";
     manager?: HookManagerKind;
     /** Why nothing was written (non-writing actions only). */
     reason?: string;

package/dist/integrations/hooks.js

@@ -19,6 +19,7 @@ import { join, isAbsolute, dirname, basename, relative, resolve } from "node:pat
 import { homedir } from "node:os";
 import { hooksDir, gitCommonDir, isLinkedWorktree, mainWorktreeRoot } from "../extractors/git.js";
 import { initiatorChildEnv } from "../synthesis/initiator.js";
+import { isOptedOut, OPT_OUT_FILE } from "./optout.js";
 import { HUNCH_NPX_PACKAGE_SPEC, HUNCH_PACKAGE_NAME } from "../core/version.js";
 import { eolLengthAt, normalizeEol } from "../core/eol.js";
 const MARK = "# >>> hunch post-commit >>>";
@@ -617,6 +618,11 @@ function sharedInvocationFor(root, mark, invocation, own) {
  *  or the block would sit after an exec/exit, nothing is written and the result
  *  carries the snippet to add by hand (issue #311). */
 function installManagedBlock(root, hookName, mark, end, build, invocation) {
+    // A linked worktree whose branch predates the opt-out marker shares the main
+    // checkout's hooks dir: never re-hook a repository `hunch uninstall` opted out (#488).
+    const main = mainWorktreeRoot(root);
+    if (isOptedOut(main))
+        return { path: resolve(root, hooksDir(root), hookName), action: "opted-out", reason: `${join(main, OPT_OUT_FILE)} opts this repository out` };
     const t = resolveHookTarget(root, hookName, mark);
     if (t.manager !== "none") {
         const info = blockInfo(t, mark, root);
@@ -828,8 +834,8 @@ function repairProvenanceMergeBlock(invocation) {
  *  (the file itself is new) outranks "appended"/"updated" (an existing file
  *  changed), which outrank "unchanged". Non-writing results are handled before
  *  ranking (they must never be masked by a sibling's success). */
-const ACTION_RANK = { created: 3, appended: 2, updated: 2, unchanged: 1, "kept-shared": 1, "managed-elsewhere": 0, unreachable: 0 };
-const writes = (h) => h.action !== "managed-elsewhere" && h.action !== "unreachable";
+const ACTION_RANK = { created: 3, appended: 2, updated: 2, unchanged: 1, "kept-shared": 1, "managed-elsewhere": 0, unreachable: 0, "opted-out": 0 };
+const writes = (h) => h.action !== "managed-elsewhere" && h.action !== "unreachable" && h.action !== "opted-out";
 /** Install a post-merge hook carrying TWO independently-managed blocks:
  *  re-sync the committed grounding docs when a merge brought memory in behind
  *  them (fnd_c402046ac7, HUNCH_SYNC-guarded, foreground — it rewrites five
@@ -850,6 +856,8 @@ export function installPostMergeHook(root, invocation) {
     // passed invocation unchanged — see selfBuildInvocation.
     const grounding = installManagedBlock(root, "post-merge", GROUNDING_MERGE_MARK, GROUNDING_MERGE_END, (inv, ctx) => groundingMergeBlock(ctx.portable ? inv : selfBuildInvocation(root, inv)), invocation);
     const repair = installManagedBlock(root, "post-merge", REPAIR_MERGE_MARK, REPAIR_MERGE_END, repairProvenanceMergeBlock, invocation);
+    if (grounding.action === "opted-out")
+        return grounding;
     if (!writes(grounding) && !writes(repair)) {
         return { ...grounding, snippet: `${grounding.snippet}\n${stripComment(repair.snippet ?? "", grounding.manager)}` };
     }
@@ -1025,6 +1033,8 @@ export function formatHookInstall(root, label, h, detail = "") {
         const how = h.keptFlags?.length ? KEPT_HOW : "";
         return [`  ✓ ${label} kept — the shared hook keeps running ${h.sharedInvocation}${flags} (not re-pointed at this worktree)${how}`];
     }
+    if (h.action === "opted-out")
+        return [`  - ${label} skipped — ${h.reason}`];
     if (writes(h)) {
         // A union write (issue #316). Once an option was KEPT, `detail` — which
         // describes only what this run asked for — is no longer the truth about the

package/dist/integrations/mergeDriver.js

@@ -14,6 +14,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { writeFileAtomic } from "../core/io.js";
 import { assertSafeTopLevelConfigFile } from "./gitignore.js";
 import { GROUNDING_DOC_PATHS } from "./providers.js";
+import { mergeDriverShell } from "../cli/invocation.js";
 // Route the .hunch JSON records through the structured driver — but NOT the
 // manifest (an id-less `{schema_version}` object the driver can't merge by id; a
 // normal text merge with conflict markers is the right behavior for it).
@@ -58,9 +59,10 @@ export function installMergeDriver(root, invShell) {
     }
     // 2. Local git config — the driver definitions are per-clone (they reference
     //    this machine's node + cli path), so they are NOT committed; teammates
-    //    re-run init.
-    const driver = `${invShell} merge-driver "%O" "%A" "%B" "%P"`;
-    const groundingDriver = `${invShell} merge-driver-grounding "%O" "%A" "%B" "%P"`;
+    //    re-run init. Dev mode swaps `npx tsx` for Hunch's own loader (#492).
+    const shell = mergeDriverShell(invShell);
+    const driver = `${shell} merge-driver "%O" "%A" "%B" "%P"`;
+    const groundingDriver = `${shell} merge-driver-grounding "%O" "%A" "%B" "%P"`;
     const env = targetRepositoryEnv();
     try {
         execFileSync("git", ["config", "merge.hunch.name", "hunch structured JSON merge"], { cwd: root, env });

package/dist/integrations/optout.d.ts

@@ -0,0 +1,3 @@
+/** The opt-out marker, at the repository root. Commit it so every clone stays opted out. */
+export declare const OPT_OUT_FILE = ".hunch-removed";
+export declare function isOptedOut(root: string): boolean;

package/dist/integrations/optout.js

@@ -0,0 +1,17 @@
+/**
+ * The opt-out marker `hunch uninstall` leaves (#449), apart from uninstall.ts so the
+ * hook installers can honor it without an import cycle (uninstall.ts imports hooks.ts).
+ */
+import { lstatSync } from "node:fs";
+import { join } from "node:path";
+/** The opt-out marker, at the repository root. Commit it so every clone stays opted out. */
+export const OPT_OUT_FILE = ".hunch-removed";
+export function isOptedOut(root) {
+    try {
+        return lstatSync(join(root, OPT_OUT_FILE)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=optout.js.map

package/dist/integrations/providers.d.ts

@@ -73,8 +73,12 @@ export declare function writeCodexHooks(root: string, inv: Invocation): string;
 export declare function writeVscodeHooks(root: string, inv: Invocation): string;
 /** Windsurf's documented workspace hooks. It only supports deterministic
  * pre-hook blocking via exit code 2, so Hunch uses rules + MCP for context and
- * reserves the hook for strict edit protection and pipeline observation. */
-export declare function writeWindsurfHooks(root: string, inv: Invocation): string;
+ * reserves the hook for strict edit protection and pipeline observation.
+ * Devin Desktop (formerly Windsurf) reads .devin/hooks.json and ignores the
+ * legacy .windsurf/hooks.json whenever the former defines any hook, so Hunch
+ * merges into both (docs.devin.ai/desktop/cascade/hooks, #494). Both files are
+ * parsed before either is written: an unparseable one refuses the whole write. */
+export declare function writeWindsurfHooks(root: string, inv: Invocation): string[];
 /** Antigravity keeps hook groups at the top level (not under `hooks`). Hunch
  * owns only the `hunch` group and replaces its own old entries idempotently. */
 export declare function writeAntigravityHooks(root: string, inv: Invocation): string;

package/dist/integrations/providers.js

@@ -419,9 +419,26 @@ function publishedPinEvents(file) {
 }
 /** Windsurf's documented workspace hooks. It only supports deterministic
  * pre-hook blocking via exit code 2, so Hunch uses rules + MCP for context and
- * reserves the hook for strict edit protection and pipeline observation. */
+ * reserves the hook for strict edit protection and pipeline observation.
+ * Devin Desktop (formerly Windsurf) reads .devin/hooks.json and ignores the
+ * legacy .windsurf/hooks.json whenever the former defines any hook, so Hunch
+ * merges into both (docs.devin.ai/desktop/cascade/hooks, #494). Both files are
+ * parsed before either is written: an unparseable one refuses the whole write. */
 export function writeWindsurfHooks(root, inv) {
-    const file = join(root, ".windsurf", "hooks.json");
+    const files = [join(root, ".windsurf", "hooks.json"), join(root, ".devin", "hooks.json")];
+    // Same shape checks writeHookConfig applies at write time, so neither file is
+    // written when the other would refuse.
+    for (const file of files) {
+        const hooks = objectField(readJsonObj(file), "hooks", file);
+        for (const event of WINDSURF_EVENTS) {
+            if (hooks[event] !== undefined && !Array.isArray(hooks[event])) {
+                throw new Error(`refusing to edit ${file}: hooks.${event} must be an array when present; fix it, then re-run.`);
+            }
+        }
+    }
+    return files.map((file) => writeWindsurfHookFile(file, inv));
+}
+function writeWindsurfHookFile(file, inv) {
     const published = hookCommand(publishedMcpInvocation(), "windsurf");
     let command = hookCommand(inv, "windsurf");
     // A source-checkout run (tsx / local dist) must never replace a tracked

package/dist/integrations/team.js

@@ -8,11 +8,12 @@
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
+import { boundedSpawnSync } from "../core/boundedSpawn.js";
 import { writeFileAtomic } from "../core/io.js";
 import { machineFile } from "../core/machine.js";
 import { hunchTreeAttributesAreSafe, safeOverlayGitTreeListing, safeOverlayTree } from "../core/overlaySafety.js";
 import { hunchPaths, hunchPathsForDir } from "../core/paths.js";
-import { canonicalRemoteUrl, checkoutCommonDir, gitNullDevice, mainWorktreeRoot, sameFilesystemEntry, sameRemoteUrl } from "../extractors/git.js";
+import { canonicalRemoteUrl, checkoutCommonDir, gitNullDevice, mainWorktreeRoot, pullRemoteTimeoutMs, sameFilesystemEntry, sameRemoteUrl } from "../extractors/git.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { JsonStore } from "../store/jsonStore.js";
 import { ensureSharedOverlayPointer } from "./worktree.js";
@@ -654,13 +655,14 @@ export function cloneValidatedTeamOverlay(sharedRepo, sharedRepoCwd, destination
         }
         const cloneEnv = boundedTeamGitEnv();
         stage = "clone";
-        const cloned = spawnSync("git", [
+        // Bounded so a timeout kills git's whole tree, not just the root (#498).
+        const cloned = boundedSpawnSync("git", [
             "-c", "protocol.ext.allow=never",
             "-c", `core.hooksPath=${emptyHooks}`,
             "clone", "--no-checkout", `--template=${emptyTemplate}`,
             "--", repo, stagedDest,
         ], {
-            stdio: "ignore",
+            stdout: "ignore",
             env: cloneEnv,
             timeout: timeoutMs,
         });
@@ -854,7 +856,7 @@ export function ensureTeamOverlay(root) {
         if (!existsSync(dest)) {
             const cloned = cloneValidatedTeamOverlay(team.shared_repo, root, dest, {
                 sharedRef: team.shared_ref,
-                timeoutMs: 5_000,
+                timeoutMs: pullRemoteTimeoutMs(),
             });
             if (!cloned || !overlayMatchesTeamRemote(root, dest)) {
                 if (cloned)

package/dist/integrations/uninstall.d.ts

@@ -1,7 +1,20 @@
-/** The opt-out marker, at the repository root. Commit it so every clone stays opted out. */
-export declare const OPT_OUT_FILE = ".hunch-removed";
-export declare function isOptedOut(root: string): boolean;
-export declare function optOutMessage(): string;
+import { isOptedOut, OPT_OUT_FILE } from "./optout.js";
+export { isOptedOut, OPT_OUT_FILE };
+/** Whether `start`, or the repository containing it, opted out: walks up through
+ *  `start`'s ancestors (which need not exist yet), stopping after the first one holding
+ *  `.git` or at the filesystem root, so a path inside an opted-out repository (`serve
+ *  init --root ./partitions/x`) is gated like the repository itself (#458). A `.hunch`
+ *  store is deliberately not a boundary: a partition store nested in an opted-out
+ *  repository stays gated (fail closed). */
+export declare function optedOutAt(start: string): boolean;
+/** The opt-out marker that gates `start` (walked as in `optedOutAt`), or null. With
+ *  `withinRepo`, a marker counts only when the walk reaches a repository: outside one,
+ *  an ancestor's marker gates nothing. */
+export declare function optOutMarkerAt(start: string, opts?: {
+    withinRepo?: boolean;
+}): string | null;
+/** The refusal, naming the marker of the repository actually checked (#488). */
+export declare function optOutMessage(marker?: string): string;
 export interface UninstallStep {
     /** Repo-relative (POSIX) where possible, else absolute. */
     path: string;