@davesheffer/hunch 1.45.2 → 1.46.0

package/dist/extractors/git.js

@@ -7,6 +7,7 @@ import { isAbsolute, resolve, join, basename, dirname, relative, sep, posix } fr
 import { mkdtempSync, openSync, closeSync, readSync, mkdirSync, rmSync, statSync, lstatSync, realpathSync, readFileSync, renameSync, readdirSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { MEMLOG_FORMAT } from "../core/memorylog.js";
+import { boundedExecFileSync } from "../core/boundedSpawn.js";
 import { writeFileAtomic } from "../core/io.js";
 import { hunchAttributesAreSafe, hunchTreeAttributesAreSafe, safeOverlayTree } from "../core/overlaySafety.js";
 import { createRepoFileReader } from "../core/safeRepoFile.js";
@@ -580,6 +581,8 @@ function observeGit(observer, event) {
     catch { /* observation cannot change a Git outcome */ }
 }
 const CAPTURE_REMOTE_TIMEOUT_MS = 15_000;
+/** A user's whole branch can be large, so `hunch push` gets far longer than a memory capture push. */
+const BRANCH_PUSH_TIMEOUT_MS = 300_000;
 export const DEFAULT_READ_REMOTE_TIMEOUT_MS = 5_000;
 // A capture can spend roughly 90s in commit + bounded merge/push/retry seams.
 // A contending writer waits beyond that proven ceiling, then takes the lock and
@@ -1193,16 +1196,13 @@ function contractRemoteHeads(hunchDir, contract, direction, env, timeoutMs) {
     if (!hooksDir)
         return null;
     try {
-        const out = execFileSync("git", [
+        // Network git runs under boundedExecFileSync: execFileSync's timeout kills only
+        // the root, orphaning git-remote-https.exe on Windows (issue #498).
+        const out = boundedExecFileSync("git", [
             "-C", hunchDir,
             "-c", `core.hooksPath=${hooksDir}`,
             "ls-remote", "--refs", "--heads", "--upload-pack=git-upload-pack", url,
-        ], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "pipe"],
-            env: boundedTeamEnv(env),
-            timeout: timeoutMs,
-        });
+        ], { env: boundedTeamEnv(env), timeout: timeoutMs });
         if (!contractReady(contract))
             return null;
         const heads = [];
@@ -1226,12 +1226,12 @@ function fetchContractRef(hunchDir, contract, env, timeoutMs) {
     if (!hooksDir)
         return "";
     try {
-        execFileSync("git", [
+        boundedExecFileSync("git", [
             "-C", hunchDir,
             "-c", `core.hooksPath=${hooksDir}`,
             "fetch", "--no-tags", "--no-write-fetch-head", "--upload-pack=git-upload-pack",
             contract.fetchUrl, `+${contract.ref}:${TEAM_FETCH_REF}`,
-        ], { stdio: ["ignore", "ignore", "pipe"], env: boundedTeamEnv(env), timeout: timeoutMs });
+        ], { stdout: "ignore", env: boundedTeamEnv(env), timeout: timeoutMs });
         if (!contractReady(contract))
             return "";
         const oid = execFileSync("git", ["-C", hunchDir, "rev-parse", "--verify", TEAM_FETCH_REF], {
@@ -1391,17 +1391,21 @@ function mergeRemote(hunchDir, env, timeoutMs, contract, allowUnrelatedHistories
     const tryGit = (args, timeout = timeoutMs) => {
         const startedAt = Date.now();
         lastPullGitError = undefined;
+        const argv = [
+            "-C", hunchDir,
+            "-c", `core.hooksPath=${hooksDir}`,
+            "-c", `core.attributesFile=${gitNullDevice()}`,
+            "-c", "core.autocrlf=false",
+            "-c", "commit.gpgsign=false",
+            ...args,
+        ];
         try {
-            execFileSync("git", [
-                "-C", hunchDir,
-                "-c", `core.hooksPath=${hooksDir}`,
-                "-c", `core.attributesFile=${gitNullDevice()}`,
-                "-c", "core.autocrlf=false",
-                "-c", "commit.gpgsign=false",
-                ...args,
-            ], {
-                stdio: ["ignore", "ignore", "pipe"], env, timeout,
-            });
+            // Only the network call pays for the tree-killing supervisor (#498); the
+            // merge of an already-fetched sha and rev-parse/abort stay local.
+            if (args[0] === "fetch")
+                boundedExecFileSync("git", argv, { stdout: "ignore", env, timeout });
+            else
+                execFileSync("git", argv, { stdio: ["ignore", "ignore", "pipe"], env, timeout });
             return true;
         }
         catch (error) {
@@ -1496,7 +1500,7 @@ function upstreamSha(hunchDir, env) {
  * and discard oversized/unavailable output without changing its exit result. */
 function runObservedPush(args, env, timeoutMs, observe) {
     if (!observe) {
-        execFileSync("git", args, { stdio: "ignore", env, timeout: timeoutMs });
+        boundedExecFileSync("git", args, { stdout: "ignore", env, timeout: timeoutMs });
         return null;
     }
     let directory, descriptor;
@@ -1511,11 +1515,11 @@ function runObservedPush(args, env, timeoutMs, observe) {
             }
             catch { }
         }
-        execFileSync("git", args, { stdio: "ignore", env, timeout: timeoutMs });
+        boundedExecFileSync("git", args, { stdout: "ignore", env, timeout: timeoutMs });
         return null;
     }
     try {
-        execFileSync("git", args, { stdio: ["ignore", descriptor, "ignore"], env, timeout: timeoutMs });
+        boundedExecFileSync("git", args, { stdout: descriptor, env, timeout: timeoutMs });
         try {
             const buffer = Buffer.alloc(1_000_001);
             const bytes = readSync(descriptor, buffer, 0, buffer.length, 0);
@@ -1563,8 +1567,8 @@ function observePushResult(hunchDir, env, output, observer) {
         if (!destination || /[\x00-\x1f\x7f]/.test(destination) || Date.now() >= deadline)
             continue;
         try {
-            const result = execFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", "--exit-code", "--", destination, ref], {
-                env, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: Math.max(1, deadline - Date.now()), maxBuffer: 16_384,
+            const result = boundedExecFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", "--exit-code", "--", destination, ref], {
+                env, timeout: Math.max(1, deadline - Date.now()), maxBuffer: 16_384,
             }).trim();
             const rows = result.split("\n").filter(row => row.split("\t")[1] === ref);
             const commitSha = rows.length === 1 ? rows[0].split("\t")[0] : "";
@@ -1656,12 +1660,7 @@ function establishEmptyRemoteUpstream(hunchDir, env, protectedRepoRoot, timeoutM
     if (!before)
         return false;
     try {
-        const refs = execFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", remote], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-            env,
-            timeout: timeoutMs,
-        }).trim();
+        const refs = boundedExecFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", remote], { env, timeout: timeoutMs }).trim();
         if (refs)
             return false;
     }
@@ -2332,7 +2331,9 @@ export function memoryMoveDiff(sha, root) {
  *  false when there is no upstream / offline / not a repo. */
 export function pushCurrentBranch(root) {
     try {
-        execFileSync("git", ["-C", root, "push"], { stdio: "ignore" });
+        // Bounded so an unreachable remote can't hang the caller, and a timeout
+        // kills git's whole tree, not just the root (#498).
+        boundedExecFileSync("git", ["-C", root, "push"], { stdout: "ignore", timeout: BRANCH_PUSH_TIMEOUT_MS });
         return true;
     }
     catch {

package/dist/extractors/indexer.js

@@ -10,7 +10,7 @@
  */
 import { readFileSync } from "node:fs";
 import { dirname, join, posix } from "node:path";
-import { parseSource, attributeCalls, attributeRelations, MAX_BODY_TEXT_CHARS } from "./parse.js";
+import { parseSource, attributeCalls, attributeQualifiedCalls, attributeRelations, MAX_BODY_TEXT_CHARS } from "./parse.js";
 import { isParserLoadError } from "./nativeTreeSitter.js";
 import { extractHelmDirectives } from "./helm.js";
 import { extractK8sManifest, extractKustomization, isKustomizationFile, kustomizeNamespaces, namespacesCompatible } from "./k8sManifest.js";
@@ -332,7 +332,7 @@ export function scanRepo(store, root, opts = {}) {
         }
         fileSymbols.set(rel, idsInFile);
         fileSymbolIndexId.set(rel, symbolIndexId);
-        perFileCalls.push({ file: rel, bySym: attributeCalls(parsed) });
+        perFileCalls.push({ file: rel, bySym: attributeCalls(parsed), qualified: attributeQualifiedCalls(parsed) });
         perFileImports.push({ file: rel, imports: parsed.imports });
         perFileRelations.push({ file: rel, bySym: attributeRelations(parsed) });
         if (languageFor(rel)?.id === "php") {
@@ -359,7 +359,7 @@ export function scanRepo(store, root, opts = {}) {
         if (langId === "php") {
             return resolvePhpImportTargets(file, spec, phpNamespaces.get(file) ?? null, phpUseDeclarations.get(file) ?? [], phpPsr4, trackedFiles);
         }
-        return [resolveImport(file, spec, fileSymbols)].filter((target) => !!target);
+        return [resolveImport(file, spec, trackedFiles)].filter((target) => !!target);
     };
     const importedFiles = new Map(perFileImports.map(({ file, imports }) => {
         const targets = new Set(imports.flatMap((specifier) => resolveImportTargets(file, specifier)));
@@ -381,7 +381,7 @@ export function scanRepo(store, root, opts = {}) {
         edgeSeen.add(e.id);
         edges.push(e);
     };
-    for (const { file, bySym } of perFileCalls) {
+    for (const { file, bySym, qualified } of perFileCalls) {
         // Most languages leave this unset and get "calls" — YAML's alias->anchor
         // references aren't function calls, so its LanguageSpec declares "references".
         const edgeType = languageFor(file)?.referenceEdgeType ?? "calls";
@@ -423,6 +423,42 @@ export function scanRepo(store, root, opts = {}) {
                 });
             }
         }
+        // Calls pinned to one imported module (`ns.fn()`, aliased `g()`): the member
+        // gate above drops them, so resolve the name ONLY inside that module's files —
+        // a unique match there is the binding; zero or several -> no edge.
+        // A module binding exposes top-level exports, so `U.helper()` prefers a function
+        // `helper` over a same-named class method `Foo.helper`; a sole method match still
+        // binds, since `module.exports = { helper() {} }` parses as a method too.
+        const moduleFiles = new Map(); // resolve each module once per file
+        for (const [callerIndex, targets] of qualified) {
+            const callerId = indexToId.get(callerIndex);
+            if (!callerId)
+                continue;
+            const callerName = byId.get(callerId)?.name ?? "?";
+            for (const { callee, module } of targets) {
+                let files = moduleFiles.get(module);
+                if (!files)
+                    moduleFiles.set(module, files = new Set(resolveImportTargets(file, module)));
+                const inModule = (nameIndex.get(callee) ?? []).filter((id) => {
+                    const sym = byId.get(id);
+                    return !!sym && files.has(sym.file);
+                });
+                const nonMethods = inModule.filter((id) => byId.get(id).kind !== "method");
+                const matches = nonMethods.length > 0 ? nonMethods : inModule;
+                if (matches.length !== 1 || matches[0] === callerId)
+                    continue;
+                const calleeId = matches[0];
+                addEdge({
+                    schema: "hunch.edge/1",
+                    id: edgeId(callerId, calleeId, edgeType),
+                    from: callerId, to: calleeId, type: edgeType,
+                    reason: `${callerName} ${edgeType} ${callee}`, strength: 0.8,
+                    provenance: extracted(0.8, [file]),
+                    environment: null,
+                    metadata: {},
+                });
+            }
+        }
     }
     // ---- K8s manifest cross-resource references (Phase 1: name-keyed) --------
     // Own resolver, not resolveName(): resolveName() indexes by bare symbol name
@@ -747,8 +783,8 @@ function resolveName(name, file, importedFiles, nameIndex, byId) {
     return imported.length === 1 ? imported[0] : null;
 }
 /** Resolve a relative import specifier to a concrete tracked file path. */
-function resolveImport(fromFile, spec, fileSymbols) {
-    return resolveRelativeImport(fromFile, spec, fileSymbols.keys()).path;
+function resolveImport(fromFile, spec, trackedFiles) {
+    return resolveRelativeImport(fromFile, spec, trackedFiles).path;
 }
 /** First of `${modulePath}.py` / `${modulePath}/__init__.py` that's a tracked file,
  *  or null — the shared "module file vs. package __init__" candidate check used by

package/dist/extractors/languages.d.ts

@@ -17,6 +17,15 @@ export interface LanguageSpec {
     defKindOf: Record<string, ParsedSymbolKind>;
     /** Query capture-name (ending in ".name") -> the matching ".def" capture-name. */
     nameToDef: Record<string, string>;
+    /** Optional query binding a local name to an imported module, run with
+     *  matches() so captures pair up: @bind.src (module specifier), @bind.local
+     *  (local name), @bind.name (an imported member, `from X import name`). Feeds
+     *  qualified calls (`ns.fn()`), resolved only inside the bound module's files. */
+    bindingQuery?: string;
+    /** Local name an import binds when @bind.local is absent (Go `"a/geo"` -> geo). */
+    defaultBindingLocal?(src: string): string | null;
+    /** Module path of `from <src> import <name>` when name is itself a submodule. */
+    joinSubmodule?(src: string, name: string): string;
     /** Optional semantic relationship captures. The generic parser/indexer emit
      * these through the normal graph path; languages only describe syntax. */
     relationKindOf?: Record<string, {

package/dist/extractors/languages.js

@@ -17,7 +17,14 @@ const TS_QUERY = `
   (variable_declarator
      name: (identifier) @arrow.name
      value: [(arrow_function) (function_expression)]) @arrow.def
+  ;; Class-field arrows (\`handler = () => {}\`) are methods in every way that matters.
+  (public_field_definition
+     name: (property_identifier) @method.name
+     value: [(arrow_function) (function_expression)]) @method.def
   (import_statement source: (string) @import.src)
+  ;; require("./x") and dynamic import("./x") are imports too, when the specifier is literal.
+  (call_expression function: (identifier) @_require arguments: (arguments . (string) @import.src .) (#eq? @_require "require"))
+  (call_expression function: (import) arguments: (arguments . (string) @import.src .))
   (call_expression function: (identifier) @call.id)
   (call_expression function: (member_expression property: (property_identifier) @call.member))
   ;; Construction IS a call. Without these, \`new Foo()\` produced no edge at all, so
@@ -27,6 +34,24 @@ const TS_QUERY = `
   (new_expression constructor: (identifier) @call.id)
   (new_expression constructor: (member_expression property: (property_identifier) @call.member))
 `;
+/** Rendering a component IS a call; lowercase tags are intrinsic elements, not symbols. */
+const TSX_QUERY = `${TS_QUERY}
+  (jsx_opening_element name: (identifier) @call.id (#match? @call.id "^[A-Z]"))
+  (jsx_self_closing_element name: (identifier) @call.id (#match? @call.id "^[A-Z]"))
+  (jsx_opening_element name: (member_expression property: (property_identifier) @call.member))
+  (jsx_self_closing_element name: (member_expression property: (property_identifier) @call.member))
+`;
+/** Module-object bindings: \`import * as ns\`, \`const m = require()\`, \`const m = await import()\`. */
+const TS_BINDING_QUERY = `
+  (import_statement (import_clause (namespace_import (identifier) @bind.local)) source: (string) @bind.src)
+  (variable_declarator
+     name: (identifier) @bind.local
+     value: (call_expression function: (identifier) @_require arguments: (arguments . (string) @bind.src .))
+     (#eq? @_require "require"))
+  (variable_declarator
+     name: (identifier) @bind.local
+     value: (await_expression (call_expression function: (import) arguments: (arguments . (string) @bind.src .))))
+`;
 const TS_BUILTIN_METHODS = new Set([
     "map", "filter", "forEach", "reduce", "find", "findIndex", "some", "every", "includes",
     "push", "pop", "shift", "unshift", "slice", "splice", "concat", "join", "split", "flat", "flatMap",
@@ -45,6 +70,7 @@ const TS_SHARED = {
     defNodeTypes: new Set([
         "function_declaration", "generator_function_declaration", "method_definition",
         "class_declaration", "interface_declaration", "type_alias_declaration", "variable_declarator",
+        "public_field_definition",
     ]),
     defKindOf: {
         "fn.def": "function", "method.def": "method", "class.def": "class",
@@ -55,6 +81,7 @@ const TS_SHARED = {
         "iface.name": "iface.def", "type.name": "type.def", "arrow.name": "arrow.def",
     },
     builtinMethods: TS_BUILTIN_METHODS,
+    bindingQuery: TS_BINDING_QUERY,
     // ES2018 relaxed template literals: an INVALID escape (`\x` with no hex, `\u`
     // short, `\u{` unterminated) is legal inside a TAGGED template — the cooked
     // value is undefined and the raw text survives, which is the entire point of
@@ -81,6 +108,7 @@ const TSX = {
     extensions: [".tsx", ".jsx"],
     grammarKey: "tsx",
     loadGrammar: () => loadNativeTreeSitter().tsx,
+    query: TSX_QUERY,
     // tree-sitter-javascript rejects a bare ampersand in JSX text even though JSX
     // accepts it (tree-sitter-javascript#366). The ERROR is a direct jsx_element
     // child and its text begins at the ampersand. Require both facts plus text that

package/dist/extractors/parse.d.ts

@@ -15,6 +15,20 @@ export interface ParsedCall {
     endByte: number;
     /** true for `x.foo()` (property access), false for a direct `foo()` call. */
     member: boolean;
+    /** For a member call on a plain identifier (`x.foo()`), that identifier. */
+    qualifier?: string;
+}
+/** A local name bound by an import: a module object (`imported` null — `import *
+ *  as ns`, `require()`, Go package alias) or one aliased member of a module. */
+export interface ParsedBinding {
+    local: string;
+    module: string;
+    imported: string | null;
+}
+/** A call whose target is pinned to one imported module (`ns.fn()`, aliased `g()`). */
+export interface QualifiedCall {
+    callee: string;
+    module: string;
 }
 export interface ParsedRelation {
     target: string;
@@ -28,6 +42,7 @@ export interface ParsedFile {
     imports: string[];
     calls: ParsedCall[];
     relations: ParsedRelation[];
+    bindings: ParsedBinding[];
     namespace: string | null;
     parseable: boolean;
 }
@@ -50,6 +65,11 @@ export declare function parseSource(file: string, source: string, opts?: {
  *  `memberOnly` (true iff every occurrence was a `x.foo()` member call, never
  *  a direct `foo()`), so the indexer can resolve member calls conservatively. */
 export declare function attributeCalls(parsed: ParsedFile): Map<number, Map<string, boolean>>;
+/** Map each call bound to an imported module — `ns.fn()` through a module-object
+ *  binding, or `g()` through an aliased member import — to the innermost symbol
+ *  containing it (same index identity as attributeCalls). A local bound to two
+ *  different modules is ambiguous and dropped: never guess a binding. */
+export declare function attributeQualifiedCalls(parsed: ParsedFile): Map<number, QualifiedCall[]>;
 /** Map static semantic relationships (extends/implements/trait use) to the
  * innermost enclosing declaration using the same stable symbol-index identity
  * as call attribution. */

package/dist/extractors/parse.js

@@ -14,7 +14,8 @@ function bundleFor(spec) {
         const grammar = spec.loadGrammar();
         parser.setLanguage(grammar);
         const query = new Parser.Query(grammar, spec.query);
-        b = { parser, query };
+        const bindingQuery = spec.bindingQuery ? new Parser.Query(grammar, spec.bindingQuery) : null;
+        b = { parser, query, bindingQuery };
         cache.set(spec.grammarKey, b);
     }
     return b;
@@ -41,7 +42,7 @@ export function parseSource(file, source, opts = {}) {
     // statefulness here even if it forgets to keep its pattern flag-free.
     const templated = (spec.alwaysTemplatedExtensions?.some((ext) => file.endsWith(ext)) ?? false)
         || (spec.templatingMarkers?.some((marker) => source.search(marker) !== -1) ?? false);
-    const { parser, query } = bundleFor(spec);
+    const { parser, query, bindingQuery } = bundleFor(spec);
     // The native binding caps its scratch buffer at 32 KB unless bufferSize is
     // given — without this, any source >= 32768 bytes throws "Invalid argument"
     // and would abort the whole index run. Guard with try/catch as a backstop.
@@ -81,6 +82,7 @@ export function parseSource(file, source, opts = {}) {
     const imports = [];
     const calls = [];
     const relations = [];
+    const bindings = [];
     let namespace = null;
     const originalText = (node) => usingRecoveredTree
         ? source.slice(node.startIndex, node.endIndex)
@@ -125,8 +127,11 @@ export function parseSource(file, source, opts = {}) {
         else if (cname === "call.member") {
             // skip builtin method names to avoid false edges to similarly-named symbols
             const text = originalText(node);
-            if (!spec.builtinMethods.has(text))
-                calls.push({ callee: text, atByte: node.startIndex, endByte: node.endIndex, member: true });
+            if (!spec.builtinMethods.has(text)) {
+                const object = node.parent?.childForFieldName("object") ?? node.parent?.childForFieldName("operand");
+                const qualifier = object?.type === "identifier" ? originalText(object) : undefined;
+                calls.push({ callee: text, atByte: node.startIndex, endByte: node.endIndex, member: true, qualifier });
+            }
         }
         else if (spec.relationKindOf?.[cname]) {
             const relation = spec.relationKindOf[cname];
@@ -139,6 +144,29 @@ export function parseSource(file, source, opts = {}) {
             });
         }
     }
+    for (const match of bindingQuery?.matches(tree.rootNode) ?? []) {
+        const text = (capture) => {
+            const node = match.captures.find((c) => c.name === capture)?.node;
+            return node ? originalText(node) : null;
+        };
+        const src = text("bind.src")?.replace(STR_QUOTES, "");
+        if (!src)
+            continue;
+        const imported = text("bind.name");
+        if (imported) {
+            const local = text("bind.local") ?? imported;
+            // `from X import Y [as Z]`: Y may be a submodule or a member; record both
+            // readings — only the one that resolves to a tracked file/symbol yields an edge.
+            if (spec.joinSubmodule)
+                bindings.push({ local, module: spec.joinSubmodule(src, imported), imported: null });
+            bindings.push({ local, module: src, imported });
+        }
+        else {
+            const local = text("bind.local") ?? spec.defaultBindingLocal?.(src) ?? null;
+            if (local)
+                bindings.push({ local, module: src, imported: null });
+        }
+    }
     for (const { kind, def, name } of pendingDefs.values()) {
         const resolvedName = name ?? spec.fallbackDefName?.(file);
         if (!resolvedName)
@@ -167,7 +195,7 @@ export function parseSource(file, source, opts = {}) {
         });
     }
     symbols.sort((a, b) => a.startByte - b.startByte);
-    return { symbols, imports, calls, relations, namespace, parseable: templated || parseable };
+    return { symbols, imports, calls, relations, bindings, namespace, parseable: templated || parseable };
 }
 /** True when every ERROR/MISSING node in the tree sits in an ancestor shape this
  *  language declares as a known grammar limitation (LanguageSpec.toleratedErrorScopes).
@@ -259,6 +287,54 @@ export function attributeCalls(parsed) {
     }
     return out;
 }
+/** Map each call bound to an imported module — `ns.fn()` through a module-object
+ *  binding, or `g()` through an aliased member import — to the innermost symbol
+ *  containing it (same index identity as attributeCalls). A local bound to two
+ *  different modules is ambiguous and dropped: never guess a binding. */
+export function attributeQualifiedCalls(parsed) {
+    const unique = (entries) => {
+        const out = new Map();
+        for (const [local, target] of entries) {
+            const prev = out.get(local);
+            out.set(local, prev === undefined || (prev && prev.module === target.module && prev.callee === target.callee) ? target : null);
+        }
+        return out;
+    };
+    const modules = unique(parsed.bindings.filter((b) => b.imported === null).map((b) => [b.local, { callee: "", module: b.module }]));
+    const aliases = unique(parsed.bindings.filter((b) => b.imported !== null).map((b) => [b.local, { callee: b.imported, module: b.module }]));
+    const out = new Map();
+    if (modules.size === 0 && aliases.size === 0)
+        return out;
+    for (const call of parsed.calls) {
+        let target = null;
+        if (call.member && call.qualifier) {
+            const binding = modules.get(call.qualifier);
+            if (binding)
+                target = { callee: call.callee, module: binding.module };
+        }
+        else if (!call.member) {
+            target = aliases.get(call.callee) ?? null;
+        }
+        if (!target)
+            continue;
+        let best = null;
+        let bestIndex = -1;
+        for (let i = 0; i < parsed.symbols.length; i++) {
+            const s = parsed.symbols[i];
+            if (call.atByte >= s.startByte && call.atByte < s.endByte && (!best || s.endByte - s.startByte < best.endByte - best.startByte)) {
+                best = s;
+                bestIndex = i;
+            }
+        }
+        if (bestIndex < 0)
+            continue;
+        const list = out.get(bestIndex) ?? [];
+        if (!list.some((t) => t.callee === target.callee && t.module === target.module))
+            list.push(target);
+        out.set(bestIndex, list);
+    }
+    return out;
+}
 /** Map static semantic relationships (extends/implements/trait use) to the
  * innermost enclosing declaration using the same stable symbol-index identity
  * as call attribution. */

package/dist/extractors/workspaces.js

@@ -12,6 +12,7 @@ import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, realpathSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { foreignRepoEnv, gitCommonDir, mainWorktreeRoot, stableRepositoryName } from "./git.js";
+import { boundedSpawnSync } from "../core/boundedSpawn.js";
 import { extracted } from "../core/types.js";
 import { CONTROL_CHARS, MAX_BRANCHES, MAX_WORKTREES, WORKSPACE_SCHEMA_VERSION, WorkspaceSchema, isSafeBranchName, workspaceId, worktreeId, } from "../core/workspace.js";
 const SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
@@ -353,8 +354,9 @@ function fetchedAt(root) {
 export function snapshotWorkspace(root, opts) {
     const now = opts.now ?? new Date();
     const main = mainWorktreeRoot(root);
+    // Network fetch: bounded so a timeout kills git's whole tree, not just the root (#498).
     if (opts.fetch)
-        run(main, ["fetch", "--prune", "--quiet"], 120_000);
+        boundedSpawnSync("git", ["fetch", "--prune", "--quiet"], { cwd: main, env: env(), stdout: "ignore", timeout: 120_000 });
     const def = defaultBranch(main);
     const searched = opts.squashSearchCommits ?? DEFAULT_SQUASH_SEARCH_COMMITS;
     let patchIds = null;

package/dist/integrations/health.d.ts

@@ -40,6 +40,12 @@ export declare const HARNESSES: {
     };
 };
 export type Harness = keyof typeof HARNESSES;
+/** Devin Desktop (formerly Windsurf) reads workspace hooks from .devin/hooks.json
+ * and falls back to the legacy .windsurf/hooks.json only when that file is absent
+ * or defines no hooks (docs.devin.ai/desktop/cascade/hooks, #494). */
+export declare const DEVIN_HOOKS = ".devin/hooks.json";
+/** The hooks file the host actually reads, so doctor inspects the active one. */
+export declare function activeHooksFile(root: string, harness: Harness): string;
 export interface HealthIssue {
     file: string;
     code: string;

package/dist/integrations/health.js

@@ -29,6 +29,26 @@ export const HARNESSES = {
     windsurf: { mcp: ".windsurf/mcp_config.json", hooks: ".windsurf/hooks.json", key: "mcpServers", events: ["", "pre_write_code", "post_run_command", ""] },
     antigravity: { mcp: ".agents/mcp_config.json", hooks: ".agents/hooks.json", key: "mcpServers", events: ["PreInvocation", "PreToolUse", "", ""] },
 };
+/** Devin Desktop (formerly Windsurf) reads workspace hooks from .devin/hooks.json
+ * and falls back to the legacy .windsurf/hooks.json only when that file is absent
+ * or defines no hooks (docs.devin.ai/desktop/cascade/hooks, #494). */
+export const DEVIN_HOOKS = ".devin/hooks.json";
+/** The hooks file the host actually reads, so doctor inspects the active one. */
+export function activeHooksFile(root, harness) {
+    const legacy = HARNESSES[harness].hooks;
+    if (harness !== "windsurf" || !existsSync(join(root, DEVIN_HOOKS)))
+        return legacy;
+    try {
+        const hooks = parseJsonc(readFileSync(join(root, DEVIN_HOOKS), "utf8"))?.hooks;
+        if (hooks && typeof hooks === "object" && Object.values(hooks).some(v => Array.isArray(v) && v.length > 0))
+            return DEVIN_HOOKS;
+        return legacy;
+    }
+    catch {
+        // An unparseable .devin/hooks.json is reported against itself, not masked.
+        return DEVIN_HOOKS;
+    }
+}
 const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const pinPattern = /@davesheffer\/hunch@([^\s"'\],;]+)/g;
 const object = (v) => {
@@ -160,12 +180,13 @@ export function inspectIntegrations(root, selected) {
     }
     for (const harness of selected ? [selected] : Object.keys(HARNESSES)) {
         const spec = HARNESSES[harness];
-        if (!selected && !existsSync(join(root, spec.mcp)) && (!spec.hooks || !existsSync(join(root, spec.hooks))))
+        const hooksFile = activeHooksFile(root, harness);
+        if (!selected && !existsSync(join(root, spec.mcp)) && (!hooksFile || !existsSync(join(root, hooksFile))))
             continue;
         const capabilities = Object.fromEntries(CAPABILITIES.map(c => [c, { status: "untested", detail: "No runtime evidence" }]));
         report.harnesses.push({ harness, capabilities });
         const mcpPath = join(root, spec.mcp);
-        const hooksFileExists = Boolean(spec.hooks && existsSync(join(root, spec.hooks)));
+        const hooksFileExists = Boolean(hooksFile && existsSync(join(root, hooksFile)));
         let mcpEntryAbsent = false;
         try {
             lstatSync(mcpPath);
@@ -203,22 +224,22 @@ export function inspectIntegrations(root, selected) {
         // A hooks file that was never written is a coverage gap (the adapter is
         // not installed), not configuration drift: report it, never fail on it.
         // `--require` still refuses, because nothing unverified counts.
-        const hooksAbsent = !!spec.hooks && !existsSync(join(root, spec.hooks));
-        if (spec.hooks && !hooksAbsent) {
+        const hooksAbsent = !!hooksFile && !existsSync(join(root, hooksFile));
+        if (hooksFile && !hooksAbsent) {
             try {
-                const config = object(parseJsonc(readFileSync(join(root, spec.hooks), "utf8")));
+                const config = object(parseJsonc(readFileSync(join(root, hooksFile), "utf8")));
                 disabled = config.disableAllHooks === true;
                 events = object(harness === "antigravity" ? config.hunch : config.hooks);
                 const commands = Object.values(events).flatMap(v => hookCommands(v));
-                recordPins(spec.hooks, commands);
+                recordPins(hooksFile, commands);
                 if (commands.some(misroutedHook))
                     report.issues.push({
-                        file: spec.hooks, code: "hook-command",
+                        file: hooksFile, code: "hook-command",
                         detail: "Hunch hooks invoke the MCP subcommand instead of the hook handler; run hunch integrations repair-pins",
                     });
             }
             catch (e) {
-                report.issues.push({ file: spec.hooks, code: "hook-config", detail: e.message });
+                report.issues.push({ file: hooksFile, code: "hook-config", detail: e.message });
             }
         }
         for (const [i, capability] of ["context", "edit-blocking", "failure-capture", "compaction"].entries()) {
@@ -235,7 +256,7 @@ export function inspectIntegrations(root, selected) {
                 status.detail = capability === "context" ? "Hunch relies on instructions and voluntary MCP calls on this adapter" : "No Hunch lifecycle adapter for this capability";
             }
             else if (hooksAbsent) {
-                status.detail = `No ${spec.hooks}; run hunch init to install this host's lifecycle hooks`;
+                status.detail = `No ${hooksFile}; run hunch init to install this host's lifecycle hooks`;
             }
             else if (disabled || firmness === "off" || ((capability === "failure-capture") && process.env.HUNCH_PIPELINE === "0")) {
                 status.status = "unsupported";
@@ -248,7 +269,7 @@ export function inspectIntegrations(root, selected) {
                 }
                 else {
                     status.detail = `Missing Hunch ${event} handler`;
-                    report.issues.push({ file: spec.hooks, code: "missing-hook", detail: status.detail });
+                    report.issues.push({ file: hooksFile, code: "missing-hook", detail: status.detail });
                 }
             }
             else if (capability === "edit-blocking" && firmness !== "strict") {
@@ -302,7 +323,7 @@ export function repairIntegrationPins(root, opts = {}) {
     const version = expectedVersion(root);
     const pending = [];
     for (const [name, spec] of Object.entries(HARNESSES)) {
-        for (const file of [spec.mcp, spec.hooks].filter(Boolean)) {
+        for (const file of [spec.mcp, spec.hooks, ...(name === "windsurf" ? [DEVIN_HOOKS] : [])].filter(Boolean)) {
             const path = join(root, file);
             if (!existsSync(path) || opts.skip?.(file))
                 continue;
@@ -342,7 +363,7 @@ export function repairIntegrationPins(root, opts = {}) {
                 const replacements = new Map(values.map(v => {
                     // Every recognized npm token is shell-safe. Bare tokens also repair
                     // the legacy quoted executable, which PowerShell treats as a string.
-                    const published = file === spec.hooks ? publishedHookCommand(v) : undefined;
+                    const published = file === spec.hooks || file === DEVIN_HOOKS ? publishedHookCommand(v) : undefined;
                     const repaired = published?.replace(" hunch mcp hook", " hunch hook") ?? v;
                     return [v, replace(repaired)];
                 }).filter(([a, b]) => a !== b));

package/dist/integrations/hooks.d.ts

@@ -16,8 +16,10 @@ export interface HookInstall {
      *  managed-elsewhere: a hook manager owns the hook — nothing was written.
      *  unreachable: the existing hook ends in exec/exit before our block, or the
      *  block in it has no closing marker and so cannot be replaced in place —
-     *  nothing was written. */
-    action: "created" | "appended" | "updated" | "unchanged" | "kept-shared" | "managed-elsewhere" | "unreachable";
+     *  nothing was written.
+     *  opted-out: the main checkout opted out (#488) and git hooks live in the
+     *  common dir every worktree shares — nothing was written, on purpose. */
+    action: "created" | "appended" | "updated" | "unchanged" | "kept-shared" | "managed-elsewhere" | "unreachable" | "opted-out";
     manager?: HookManagerKind;
     /** Why nothing was written (non-writing actions only). */
     reason?: string;