@davesheffer/hunch 1.45.2 → 1.46.0

package/dist/cli/index.js

@@ -22,13 +22,16 @@ import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 import { hunchPaths, hunchPathsForDir, findRoot, toPosixTarget, isDir, realpathNorm, repoRelativeTarget } from "../core/paths.js";
 import { writeFileAtomic } from "../core/io.js";
+import { boundedSpawnSync } from "../core/boundedSpawn.js";
 import { looksLikeCorrection, CORRECTION_NUDGE } from "../core/correction.js";
 import { HUNCH_VERSION } from "../core/version.js";
 import { registerIntegrationCommands } from "./integrations.js";
 import { registerTaskReportCommands } from "./taskReport.js";
 import { registerStateCommands } from "./state.js";
 import { DEFAULT_CONFIG as SERVE_DEFAULT_CONFIG_FILE, registerServeCommands } from "./serve.js";
+import { readServeConfig } from "../serve/config.js";
 import { registerUpdateCommand } from "./update.js";
+import { registerVerifyCommand } from "./verify.js";
 import { registerReviewMemoryCommands } from "./reviewMemory.js";
 import { detectInitiator, normalizeInitiator } from "../synthesis/initiator.js";
 import { inspectIntegrations, formatIntegrationHealth, integrationHealthFails, integrationSessionWarning } from "../integrations/health.js";
@@ -62,7 +65,7 @@ import { flushCapture, flushMemoryHome, flushMemoryHomes, pinSharedRemote, share
 import { installMergeDriver } from "../integrations/mergeDriver.js";
 import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS, upgradeManagedGitignore, describeGitignoreUpgrade, memoryIgnoreRule, describeMemoryIgnoreRule } from "../integrations/gitignore.js";
 import { writeCiWorkflow } from "../integrations/ciAction.js";
-import { applyUninstall, formatUninstallPlan, isOptedOut, OPT_OUT_FILE, optedOutAt, optOutMessage, planUninstall } from "../integrations/uninstall.js";
+import { applyUninstall, formatUninstallPlan, isOptedOut, OPT_OUT_FILE, optOutMarkerAt, optOutMessage, planUninstall } from "../integrations/uninstall.js";
 import { updateClaudeMd, renderHunchSection } from "../integrations/claudemd.js";
 import { HOOK_REMINDER } from "../core/hookText.js";
 import { measureFootprint } from "../core/footprint.js";
@@ -188,6 +191,7 @@ registerTaskReportCommands(program, () => { const { store, root } = storeFor();
 registerServeCommands(program);
 registerStateCommands(program);
 registerUpdateCommand(program);
+registerVerifyCommand(program);
 registerReviewMemoryCommands(program, (records, repository, privateOnly) => {
     const { store, root } = storeFor();
     if (!repositoryUsesRemote(root, `https://github.com/${repository}.git`)) {
@@ -228,6 +232,103 @@ registerReviewMemoryCommands(program, (records, repository, privateOnly) => {
 // run: a leftover driver that exits without writing %A would let git drop `theirs`.
 const OPT_OUT_ALLOWED = new Set(["uninstall", "doctor", "help", "merge-driver", "merge-driver-grounding"]);
 const OPT_OUT_QUIET = new Set(["hook", "sync", "check", "grounding", "repair-provenance", "workspaces"]);
+/** Locations a command writes to (#488), keyed by command path: an opted-out repository
+ *  must never receive them, so their repository is gated IN ADDITION to the cwd's.
+ *  `base` is what the command itself resolves a relative value against: the cwd's
+ *  repository root (`findRoot`), Git's top level (`verify`), or the cwd; `join` marks a
+ *  command that joins the value onto that base even when absolute (`export-adr`).
+ *  `checkout` marks a command that also writes into the MAIN checkout (the overlay
+ *  anchor) and the git common dir (the shared-overlay pointer, the shared git hooks),
+ *  so both are gated; with no target (`init`) only those are. */
+const OPT_OUT_OUTPUTS = {
+    "init": { base: "root", checkout: true },
+    "private": { arg: 0, base: "root", checkout: true },
+    "shared": { arg: 0, base: "root", checkout: true },
+    "worktree": { arg: 0, base: "root", checkout: true },
+    "export-adr": { arg: 0, base: "root", join: true },
+    "review-memory auto": { option: "output", base: "cwd" },
+    "verify": { option: "map", base: "toplevel" },
+};
+/** Where `hunch private`/`shared` anchor the default overlay store: the MAIN worktree
+ *  root, shared by the write and the opt-out gate so they cannot diverge. */
+function overlayAnchor(root) {
+    return mainWorktreeRoot(root);
+}
+/** Git's top level for the cwd, as `hunch verify` resolves it; findRoot() outside Git. */
+function gitToplevel() {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }).trim() || findRoot();
+    }
+    catch {
+        return findRoot();
+    }
+}
+/** The marker gating `path` (the cwd, or a location a command writes to). Its own store
+ *  or repository root (`findRoot`: git-less stores included) counts first; inside a
+ *  repository the walk then passes any nested `.hunch` store up to the repository
+ *  (#488). A stray marker in a non-store, non-repository ancestor (e.g. ~) gates nothing. */
+function markerFor(path) {
+    const real = realpathNorm(path);
+    const root = findRoot(real);
+    if (isOptedOut(root))
+        return join(root, OPT_OUT_FILE);
+    return optOutMarkerAt(real, { withinRepo: true });
+}
+/** Every location whose repository the opt-out gate judges for this invocation (#458,
+ *  #488). A `--root` or a `serve` config names the repository the command acts on, so
+ *  it REPLACES the cwd; `serve` also gates every partition root its config names (an
+ *  unreadable config gates its directory only; the command itself then fails). An
+ *  output location only ADDS to the cwd. */
+function optOutTargets(top, action) {
+    const path = [];
+    for (let c = action; c && c !== program; c = c.parent)
+        path.unshift(c.name());
+    const given = (v) => typeof v === "string" && v.trim() !== "";
+    const actionOpts = action.opts();
+    const targets = [];
+    let cwd = true;
+    if (given(actionOpts.root)) {
+        targets.push(resolve(actionOpts.root));
+        cwd = false;
+    }
+    if (top.name() === "serve" && (path[1] === "init" || cwd)) {
+        // `serve` and `serve init` both take --config; the command reads the parent's first.
+        const configOpt = top.opts().config ?? actionOpts.config;
+        const configFile = resolve(given(configOpt) ? configOpt : SERVE_DEFAULT_CONFIG_FILE);
+        targets.push(dirname(configFile));
+        if (cwd) {
+            try {
+                for (const p of readServeConfig(configFile).partitions)
+                    targets.push(p.root);
+            }
+            catch { /* the command reports it */ }
+        }
+        cwd = false;
+    }
+    // Output locations follow the cwd rule: a marker gates them only inside a repository,
+    // never from a non-repository ancestor (bare / --separate-git-dir common dirs included).
+    const outputs = [];
+    const out = OPT_OUT_OUTPUTS[path.join(" ")];
+    if (out) {
+        const value = out.option !== undefined ? actionOpts[out.option] : action.processedArgs[out.arg ?? 0];
+        if (given(value)) {
+            const base = out.base === "root" ? findRoot() : out.base === "toplevel" ? gitToplevel() : process.cwd();
+            // `join`: the path the command writes, plus the absolute path the user named.
+            if (out.join)
+                outputs.push(join(base, toPosixTarget(value)));
+            outputs.push(resolve(base, value));
+        }
+        if (out.checkout) {
+            const root = findRoot();
+            const common = gitCommonDir(root);
+            // Only a real linked worktree shares a common dir with a main checkout; a submodule's
+            // common dir (super/.git/modules/x) must not pull the superproject's marker in.
+            if (common && mainWorktreeRoot(root) !== root)
+                outputs.push(overlayAnchor(root), resolve(root, common));
+        }
+    }
+    return { targets, outputs, cwd };
+}
 program.hook("preAction", (_thisCommand, actionCommand) => {
     let top = actionCommand;
     while (top.parent && top.parent !== program)
@@ -235,23 +336,26 @@ program.hook("preAction", (_thisCommand, actionCommand) => {
     const name = top.name();
     if (OPT_OUT_ALLOWED.has(name))
         return;
-    // Gate the repository the command acts on (#458): a `--root` names it (`hunch mcp
-    // --root`, `hunch serve ... --root`), so its real path is gated with every ancestor
-    // up to its store or repository and the cwd's repository is irrelevant; without
-    // one, the command acts on the cwd's repository. `serve init` also writes its
-    // config file (resolved against the cwd), so the directory it lands in gates it too.
-    const rootOpt = actionCommand.opts().root;
-    const rootGiven = typeof rootOpt === "string" && rootOpt.trim() !== "";
-    let gated = rootGiven ? optedOutAt(realpathNorm(resolve(rootOpt))) : isOptedOut(findRoot());
-    if (!gated && name === "serve" && actionCommand.name() === "init") {
-        const configOpt = top.opts().config ?? actionCommand.opts().config;
-        const configFile = resolve(typeof configOpt === "string" ? configOpt : SERVE_DEFAULT_CONFIG_FILE);
-        gated = optedOutAt(realpathNorm(dirname(configFile)));
-    }
-    if (!gated)
+    // Gate the repository each location acts on (#458, #488): its real path is walked up
+    // through its ancestors to its repository, past any nested `.hunch` store (fail
+    // closed, so a cwd inside a nested store is gated too), and the refusal names the
+    // marker that actually gates it.
+    const { targets, outputs, cwd } = optOutTargets(top, actionCommand);
+    let marker = cwd ? markerFor(process.cwd()) : null;
+    for (const target of targets) {
+        if (marker)
+            break;
+        marker = optOutMarkerAt(realpathNorm(target));
+    }
+    for (const target of outputs) {
+        if (marker)
+            break;
+        marker = markerFor(target);
+    }
+    if (!marker)
         return;
     if (name !== "hook")
-        console.error(optOutMessage());
+        console.error(optOutMessage(marker));
     process.exit(OPT_OUT_QUIET.has(name) ? 0 : 1);
 });
 // Read an already-known update and schedule any registry refresh in a detached
@@ -553,8 +657,8 @@ program
     }
     // Windows self-heal: if an earlier global `claude mcp add` left a drive-letter
     // case-split in ~/.claude.json, merge it so hunch resolves under either casing.
-    // No-op (silent) off Windows.
-    reportClaudeConfigHeal();
+    // No-op (silent) off Windows; the no-op line belongs to --details (#493).
+    reportClaudeConfigHeal(say);
     // Worktree-seamless: register any configured overlay at the git common dir so EVERY
     // worktree of this repo auto-discovers it (also backfills pre-0.32 single-worktree setups),
     // and note when we're initializing inside a linked worktree (memory is shared, not separate).
@@ -985,13 +1089,12 @@ function discoverSharedRemote(remoteUrl) {
                 && remoteUrl.startsWith(prefix))
                 return null;
         }
-        const listed = spawnSync("git", [
+        // Bounded so a timeout kills git's whole tree, not just the root (#498).
+        const listed = boundedSpawnSync("git", [
             "-C", probe,
             "-c", `core.hooksPath=${hooksDir}`,
             "ls-remote", "--refs", "--heads", "--upload-pack=git-upload-pack", remoteUrl,
         ], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
             env: boundedTeamGitEnv(),
             timeout: 15_000,
         });
@@ -1324,7 +1427,7 @@ function configureOverlay(dir, opts, mode) {
         // Anchor the default store at the MAIN worktree root: a linked worktree can be
         // `git worktree remove`d, which would take the store (and every other worktree's
         // absolute pointer to it) down with it. An explicit [dir] still resolves from here.
-        const anchor = mainWorktreeRoot(root);
+        const anchor = overlayAnchor(root);
         if (opts.repo) {
             const dest = join(anchor, ".hunch-private");
             // Canonicalize once in the invocation context so clone, attach, fetch, and
@@ -6094,12 +6197,15 @@ program
         return;
     }
     const res = target.persistMigration();
-    writeManifest(paths, SCHEMA_VERSION);
+    writeManifest(paths, res.version); // held at `from` while any record failed to migrate
     store.reindex();
-    pumpMemoryHome(store, root, store.unified ? "private" : "public", `hunch: migrate schema v${from} to v${SCHEMA_VERSION}`);
-    console.log(`✓ Migrated v${from} → v${SCHEMA_VERSION}: ${res.migrated} record(s) upgraded.`);
+    pumpMemoryHome(store, root, store.unified ? "private" : "public", `hunch: migrate schema v${from} to v${res.version}`);
+    console.log(`✓ Migrated v${from} → v${res.version}: ${res.migrated} record(s) upgraded.`);
     if (res.skipped) {
-        console.warn(`⚠ ${res.skipped} record(s) could NOT be migrated and will no longer load. They are preserved on disk in their old shape under .hunch/ for manual recovery.`);
+        console.warn(`⚠ ${res.skipped} record(s) could not be migrated. They are preserved on disk in their old shape under .hunch/ for manual recovery; the schema stays at v${res.version}, so re-running \`hunch migrate\` after a fix completes the migration to v${SCHEMA_VERSION}.`);
+    }
+    if (res.invalid) {
+        console.warn(`⚠ ${res.invalid} record(s) are invalid or unreadable and no pending migration applies to them. They were left untouched under .hunch/; fix them by hand.`);
     }
     store.close();
 });
@@ -7610,26 +7716,27 @@ function rel(root, p) {
 }
 /** Run the Windows ~/.claude.json drive-letter case-split heal and print what it
  *  did. Silent + no-op off Windows. A parse refusal is surfaced as a warning, never
- *  thrown out of doctor/init (those commands must still complete). */
-function reportClaudeConfigHeal() {
+ *  thrown out of doctor/init (those commands must still complete). `say` lets `init`
+ *  route the lines into its buffered output (shown with --details; warnings always). */
+function reportClaudeConfigHeal(say = (text) => console.log(text)) {
     let res;
     try {
         res = healClaudeConfigCaseSplit();
     }
     catch (e) {
-        console.log(`  ⚠ Claude config: ${e.message}`);
+        say(`  ⚠ Claude config: ${e.message}`);
         return;
     }
     if (!res.applicable)
         return; // non-Windows: the case-split bug can't occur
     if (!res.changed) {
-        console.log(dim(`Claude config: no drive-letter project split (${res.file})`));
+        say(dim(`Claude config: no drive-letter project split (${res.file})`));
         return;
     }
     for (const g of res.groups) {
-        console.log(`✓ healed Claude Code project case-split: mirrored [${g.servers.join(", ")}] across ${g.casings.join("  ·  ")}`);
+        say(`✓ healed Claude Code project case-split: mirrored [${g.servers.join(", ")}] across ${g.casings.join("  ·  ")}`);
     }
-    console.log(dim(`  ↳ backup: ${res.backup}`));
+    say(dim(`  ↳ backup: ${res.backup}`));
 }
 function fail(msg) {
     console.error(`error: ${msg}`);

package/dist/cli/invocation.d.ts

@@ -41,3 +41,17 @@ export declare function classifyEntry(entry: string): {
     installed: boolean;
 };
 export declare function resolveInvocation(): ResolvedInvocation;
+/** The command prefix for the git merge drivers. git runs a driver with the
+ *  repository being merged as its cwd, so the dev-mode `npx tsx <entry>` would
+ *  resolve tsx from THAT repo (or fetch it from the registry), not from Hunch's
+ *  own checkout (#492). In dev mode, launch the absolute node binary against
+ *  this checkout's tsx cli.mjs, the same shape selfBuildInvocation gives the
+ *  git hooks (src/integrations/hooks.ts); every other invocation (published,
+ *  dist, or a caller-supplied one) passes through unchanged. */
+export declare function mergeDriverShell(invShell: string): string;
+/** Filesystem paths, never a file URL: git expands `%`-escapes in the driver
+ *  command, so a percent-encoded URL (any non-ASCII checkout path) would be
+ *  corrupted. POSIX single quotes keep `$`, backticks and `"` literal under the
+ *  /bin/sh git runs drivers with on every platform, and a literal `%` in a path
+ *  is doubled so git expands it back to one. */
+export declare function devMergeDriverShell(execPath: string, tsxCli: string, entry: string): string;

package/dist/cli/invocation.js

@@ -125,4 +125,27 @@ export function resolveInvocation() {
         installed,
     };
 }
+/** The command prefix for the git merge drivers. git runs a driver with the
+ *  repository being merged as its cwd, so the dev-mode `npx tsx <entry>` would
+ *  resolve tsx from THAT repo (or fetch it from the registry), not from Hunch's
+ *  own checkout (#492). In dev mode, launch the absolute node binary against
+ *  this checkout's tsx cli.mjs, the same shape selfBuildInvocation gives the
+ *  git hooks (src/integrations/hooks.ts); every other invocation (published,
+ *  dist, or a caller-supplied one) passes through unchanged. */
+export function mergeDriverShell(invShell) {
+    const inv = resolveInvocation();
+    if (inv.installed || !inv.shell.startsWith("npx tsx ") || invShell !== inv.shell)
+        return invShell;
+    const entry = fileURLToPath(import.meta.url).replace(/invocation\.ts$/, "index.ts");
+    return devMergeDriverShell(process.execPath, fileURLToPath(import.meta.resolve("tsx/cli")), entry);
+}
+/** Filesystem paths, never a file URL: git expands `%`-escapes in the driver
+ *  command, so a percent-encoded URL (any non-ASCII checkout path) would be
+ *  corrupted. POSIX single quotes keep `$`, backticks and `"` literal under the
+ *  /bin/sh git runs drivers with on every platform, and a literal `%` in a path
+ *  is doubled so git expands it back to one. */
+export function devMergeDriverShell(execPath, tsxCli, entry) {
+    const quote = (s) => `'${s.replace(/'/g, "'\\''")}'`.replace(/%/g, "%%");
+    return [execPath, tsxCli, entry].map(quote).join(" ");
+}
 //# sourceMappingURL=invocation.js.map

package/dist/cli/verify.d.ts

@@ -0,0 +1,28 @@
+import type { Command } from "commander";
+import { type ImpactMap } from "../core/testSelection.js";
+export declare const DEFAULT_IMPACT_MAP = ".hunch-cache/test-impact.json";
+/** Split a command template into argv tokens; double/single quotes group. */
+export declare function tokenize(template: string): string[];
+/** The runner argv (never a shell). A configured template wins (`{files}` expands
+ *  to one argv entry per file); otherwise this repo's runner when present, else
+ *  `npm test` (full) / `npm test -- <files>`. */
+export declare function runnerArgv(root: string, template: string | undefined, files: string[], extra: string[], full: boolean): string[];
+/** Run each test in its own runner process under NODE_V8_COVERAGE (inherited
+ *  by spawned CLI/MCP children) and record the repo files each executed. An
+ *  entry is `complete` only when the test file passed and produced coverage;
+ *  failing tests still record their (partial) files. `only` merges into the
+ *  old map, keeping each untouched entry's own commit stamp. */
+export declare function refreshImpactMap(opts: {
+    root: string;
+    tests: string[];
+    files: string[];
+    template?: string;
+    mapPath: string;
+    only?: string[];
+    concurrency?: number;
+    log?: (line: string) => void;
+}): Promise<{
+    map: ImpactMap;
+    failed: string[];
+}>;
+export declare function registerVerifyCommand(program: Command): void;

package/dist/cli/verify.js

@@ -0,0 +1,265 @@
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { availableParallelism, tmpdir } from "node:os";
+import { dirname, isAbsolute, join, relative } from "node:path";
+import { readConfig } from "../core/config.js";
+import { writeFileAtomic } from "../core/io.js";
+import { hunchPaths } from "../core/paths.js";
+import { buildImportGraph, changedFiles, coverageFiles, discoverTests, listRepoFiles, loadImpactMap, selectTests, testDependencyModel, } from "../core/testSelection.js";
+export const DEFAULT_IMPACT_MAP = ".hunch-cache/test-impact.json";
+function testScript(root) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        return typeof pkg.scripts?.test === "string" ? pkg.scripts.test : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Split a command template into argv tokens; double/single quotes group. */
+export function tokenize(template) {
+    const out = [];
+    for (const m of template.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g))
+        out.push(m[1] ?? m[2] ?? m[3]);
+    return out;
+}
+/** npm without a shell: run npm-cli.js under this Node; POSIX may exec `npm`. */
+function npmArgv(args) {
+    const dir = dirname(process.execPath);
+    for (const cli of [join(dir, "node_modules/npm/bin/npm-cli.js"), join(dir, "../lib/node_modules/npm/bin/npm-cli.js")]) {
+        if (existsSync(cli))
+            return [process.execPath, cli, ...args];
+    }
+    if (process.platform === "win32")
+        throw new Error("cannot locate npm-cli.js; set verify.command in .hunch/config.json");
+    return ["npm", ...args];
+}
+/** The runner argv (never a shell). A configured template wins (`{files}` expands
+ *  to one argv entry per file); otherwise this repo's runner when present, else
+ *  `npm test` (full) / `npm test -- <files>`. */
+export function runnerArgv(root, template, files, extra, full) {
+    if (template) {
+        const tokens = tokenize(template);
+        const argv = tokens.includes("{files}") ? tokens.flatMap((t) => t === "{files}" ? files : [t]) : [...tokens, ...files];
+        if (argv[0] === "node")
+            argv[0] = process.execPath;
+        return [...argv, ...extra];
+    }
+    if (full && testScript(root))
+        return npmArgv(["test", ...(extra.length ? ["--", ...extra] : [])]);
+    if (existsSync(join(root, "tooling/run-tests.mjs")))
+        return [process.execPath, "tooling/run-tests.mjs", ...files, ...extra];
+    return npmArgv(["test", "--", ...files, ...extra]);
+}
+const display = (argv) => argv.map((a, i) => i === 0 && a === process.execPath ? "node" : /\s/.test(a) ? JSON.stringify(a) : a).join(" ");
+function printSelection(sel, total, note, hasMap) {
+    for (const line of note)
+        console.log(`  note: ${line}`);
+    if (sel.mode === "none") {
+        console.log("✓ no tests selected — nothing the changes can affect.");
+        return;
+    }
+    if (sel.mode === "full") {
+        console.log(`▶ FULL suite (${total} tests): ${sel.fullReason}`);
+        if (sel.unattributed.length)
+            console.log(`  unattributed: ${sel.unattributed.join(", ")}`);
+        // Only trusted map entries narrow spawning tests; triggers, non-code and unattributed changes stay FULL.
+        const spawnWide = /^selection too broad/.test(sel.fullReason ?? "") && Object.values(sel.reasons).some((r) => r.some((why) => why.includes("whole program")));
+        if (!hasMap && spawnWide)
+            console.log("  Run `hunch verify --refresh-map` once to enable narrow selection for CLI/MCP tests.");
+        return;
+    }
+    console.log(`▶ ${sel.tests.length} of ${total} tests selected:`);
+    for (const test of sel.tests)
+        console.log(`  ${test}  ← ${sel.reasons[test].join("; ")}`);
+}
+function headSha(root) {
+    try {
+        return execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] }).trim();
+    }
+    catch {
+        return "";
+    }
+}
+function readCoverageDir(dir) {
+    if (!existsSync(dir))
+        return [];
+    const reports = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith(".json"))
+            continue;
+        try {
+            reports.push(JSON.parse(readFileSync(join(dir, name), "utf8")));
+        }
+        catch { /* partial write → skip */ }
+    }
+    return reports;
+}
+/** Run each test in its own runner process under NODE_V8_COVERAGE (inherited
+ *  by spawned CLI/MCP children) and record the repo files each executed. An
+ *  entry is `complete` only when the test file passed and produced coverage;
+ *  failing tests still record their (partial) files. `only` merges into the
+ *  old map, keeping each untouched entry's own commit stamp. */
+export async function refreshImpactMap(opts) {
+    const { root, mapPath } = opts;
+    const log = opts.log ?? console.log;
+    const run = opts.only?.length ? opts.only.map((t) => t.replace(/\\/g, "/").replace(/^\.\//, "")) : opts.tests;
+    let previous = null;
+    if (opts.only?.length) {
+        try {
+            previous = loadImpactMap(mapPath);
+        }
+        catch {
+            previous = null;
+        }
+    }
+    const repoFiles = new Set(opts.files);
+    const commit = headSha(root);
+    const { closureHash } = testDependencyModel(root, opts.files, buildImportGraph(root, opts.files));
+    const covDir = mkdtempSync(join(tmpdir(), "hunch-verify-cov-"));
+    const map = { ...(previous?.map ?? {}) };
+    const failed = [];
+    const width = Math.max(1, opts.concurrency ?? availableParallelism() - 1);
+    const env = { ...process.env };
+    delete env.NODE_TEST_CONTEXT; // a parent test runner must not turn the child into a reporter
+    let next = 0;
+    const worker = async () => {
+        while (next < run.length) {
+            const index = next++;
+            const test = run[index];
+            const dir = join(covDir, String(index));
+            const argv = runnerArgv(root, opts.template, [test], [], false);
+            const status = await new Promise((done) => {
+                const child = spawn(argv[0], argv.slice(1), { cwd: root, stdio: "ignore", windowsHide: true, env: { ...env, NODE_V8_COVERAGE: dir } });
+                child.on("error", () => done(1));
+                child.on("close", (code) => done(code ?? 1));
+            });
+            const reports = readCoverageDir(dir);
+            if (status !== 0)
+                failed.push(test);
+            const files = coverageFiles(reports, root, repoFiles).filter((f) => f !== test);
+            map[test] = { files, complete: status === 0 && reports.length > 0, commit, closureHash };
+            log(`  ${status === 0 ? "✓" : "✗"} ${test}  (${files.length} files)`);
+        }
+    };
+    try {
+        await Promise.all(Array.from({ length: Math.min(width, run.length) }, worker));
+    }
+    finally {
+        // Coverage is scratch; a straggling child holding a handle must not fail the refresh.
+        try {
+            rmSync(covDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+        }
+        catch { /* best effort */ }
+    }
+    const sortedMap = {};
+    for (const test of Object.keys(map).sort())
+        sortedMap[test] = map[test];
+    const result = { version: 2, commit, generatedAt: new Date().toISOString(), closureHash, map: sortedMap };
+    mkdirSync(dirname(mapPath), { recursive: true });
+    writeFileAtomic(mapPath, JSON.stringify(result, null, 2) + "\n");
+    return { map: result, failed: failed.sort() };
+}
+export function registerVerifyCommand(program) {
+    program
+        .command("verify")
+        .description("Run only the tests the current change can affect (fail-closed: anything unattributed runs the full suite).")
+        .argument("[runnerArgs...]", "extra arguments for the test runner (after --)")
+        .option("--staged", "select from staged changes only")
+        .option("--base <ref>", "select from merge-base(<ref>, HEAD)..HEAD plus the working tree")
+        .option("--list", "print the selection with reasons; run nothing")
+        .option("--full", "run the full suite")
+        .option("--ci", "run the full suite (CI)")
+        .option("--json", "print the selection as JSON; run nothing")
+        .option("--map <path>", `test impact map (default ${DEFAULT_IMPACT_MAP})`)
+        .option("--refresh-map", "rebuild the impact map: run each test under V8 coverage")
+        .option("--only <tests...>", "with --refresh-map: refresh only these tests, merging into the existing map")
+        .action(async (runnerArgs, opts) => {
+        let root;
+        try {
+            root = execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] }).trim();
+        }
+        catch {
+            console.error("hunch verify must run inside a git repository");
+            process.exitCode = 1;
+            return;
+        }
+        const config = readConfig(hunchPaths(root)).verify ?? {};
+        const files = listRepoFiles(root);
+        const allTests = discoverTests(files, typeof config.tests === "string" ? config.tests : undefined);
+        const template = typeof config.command === "string" ? config.command : undefined;
+        const mapPath = opts.map ? (isAbsolute(opts.map) ? opts.map : join(root, opts.map)) : join(root, DEFAULT_IMPACT_MAP);
+        if (opts.refreshMap) {
+            const total = opts.only?.length ?? allTests.length;
+            console.log(`▶ refreshing impact map: ${total} test file(s) under V8 coverage`);
+            const { map, failed } = await refreshImpactMap({ root, tests: allTests, files, template, mapPath, only: opts.only });
+            const covered = new Set(Object.values(map.map).flatMap((e) => e.files)).size;
+            console.log(`✓ wrote ${opts.map ?? DEFAULT_IMPACT_MAP}: ${Object.keys(map.map).length} tests → ${covered} files @ ${map.commit.slice(0, 12) || "(no HEAD)"}`);
+            if (failed.length)
+                console.log(`  ${failed.length} test file(s) failed (partial coverage recorded, not trusted): ${failed.join(", ")}`);
+            return;
+        }
+        const note = [];
+        let sel;
+        let hasMap = false;
+        if (opts.full || opts.ci) {
+            sel = { mode: "full", tests: allTests, reasons: {}, fullReason: opts.ci ? "--ci" : "--full", unattributed: [], mapUsed: [] };
+        }
+        else {
+            const mode = opts.base ? { kind: "base", ref: opts.base } : opts.staged ? { kind: "staged" } : { kind: "worktree" };
+            let impactMap;
+            try {
+                impactMap = loadImpactMap(mapPath) ?? undefined;
+            }
+            catch (e) {
+                note.push(`${e.message}; ignoring it`);
+            }
+            if (!impactMap && !note.length)
+                note.push(`no impact map at ${opts.map ?? DEFAULT_IMPACT_MAP}; using the import graph (build one: hunch verify --refresh-map)`);
+            const model = testDependencyModel(root, files, buildImportGraph(root, files));
+            // The map itself is a derived cache; a not-yet-ignored copy is never a code change.
+            const mapRel = relative(root, mapPath).replace(/\\/g, "/");
+            const changed = changedFiles(root, mode).filter((f) => f !== mapRel);
+            sel = selectTests({
+                changedFiles: changed, allTests, impactMap, importGraph: model.dependencies,
+                testText: model.testText, spawning: model.spawning, closureHash: model.closureHash,
+                wholeProgram: [...model.wholeProgram, ...changed.filter((f) => f.startsWith("src/"))], testNamers: model.testNamers,
+            });
+            hasMap = !!impactMap;
+            if (impactMap) {
+                const head = headSha(root);
+                const stale = sel.mapUsed.filter((t) => impactMap.map[t].commit !== head);
+                if (stale.length)
+                    note.push(`${stale.length} impact-map entr${stale.length === 1 ? "y" : "ies"} used were recorded at another commit than HEAD ${head.slice(0, 12)} (${stale.join(", ")}); the map only adds tests`);
+                if (Object.values(impactMap.map).some((e) => e.closureHash !== model.closureHash)) {
+                    note.push("CLI/MCP/tooling import closure changed since some entries were recorded; those spawning tests use the whole program");
+                }
+            }
+        }
+        if (opts.json) {
+            console.log(JSON.stringify({ ...sel, total: allTests.length }, null, 2));
+            return;
+        }
+        printSelection(sel, allTests.length, note, hasMap);
+        if (opts.list || sel.mode === "none")
+            return;
+        let argv;
+        try {
+            argv = runnerArgv(root, template, sel.tests, runnerArgs, sel.mode === "full");
+        }
+        catch (e) {
+            console.error(e.message);
+            process.exitCode = 1;
+            return;
+        }
+        console.log(`▶ running: ${display(argv)}\n`);
+        const run = spawnSync(argv[0], argv.slice(1), { cwd: root, stdio: "inherit", windowsHide: true });
+        if (run.error) {
+            console.error(run.error.message);
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = run.status ?? 1;
+    });
+}
+//# sourceMappingURL=verify.js.map

package/dist/constitution/experiment.d.ts

@@ -237,8 +237,8 @@ export declare const ExperimentOutcomeSchema: z.ZodObject<{
         decision: z.ZodEnum<{
             rejected: "rejected";
             abandoned: "abandoned";
-            uncompilable: "uncompilable";
             timeout: "timeout";
+            uncompilable: "uncompilable";
             cannot_decide: "cannot_decide";
             accepted_precise: "accepted_precise";
             accepted_edited: "accepted_edited";