@davesheffer/hunch 1.45.2 → 1.46.0

package/dist/store/jsonStore.js

@@ -8,7 +8,7 @@ import { randomBytes } from "node:crypto";
 import { hostname } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ENTITY_KINDS, SCHEMAS } from "../core/types.js";
-import { BASELINE_VERSION, migrateRaw, SCHEMA_VERSION } from "../core/migrate.js";
+import { BASELINE_VERSION, hasPendingMigration, migrateRaw, SCHEMA_VERSION } from "../core/migrate.js";
 import { writeFileAtomic } from "../core/io.js";
 import { readStoreArtifact } from "../core/storeArtifact.js";
 import { createdAfterLock, heldLockNonces, judgeSameHostOwner, processStartedAt, selfStartToken, startTokenOf } from "../core/procstart.js";
@@ -942,19 +942,29 @@ export class JsonStore {
         return names.length;
     }
     /** Persist a schema migration: rewrite every LOADABLE record in its current shape.
-     *  A record that still fails validation after migration is kept untouched (never
-     *  deleted) and counted as `skipped`, so migration can't lose data. The caller
-     *  bumps the manifest afterward. */
+     *  A record that still fails validation after migration (or whose migration
+     *  throws) is kept in its ORIGINAL shape (never deleted, never half-migrated) and
+     *  counted as `skipped`, so migration can't lose data. The caller stamps the
+     *  manifest at the returned `version`: SCHEMA_VERSION only when nothing was
+     *  skipped, else the FROM version, so a manual fix plus a rerun re-applies the
+     *  (idempotent) migrations to the skipped records instead of skipping them.
+     *  A bad record of a kind NO pending migration touches can't be fixed by a
+     *  rerun, so it is counted as `invalid` instead and doesn't hold the version. */
     persistMigration() {
         let migrated = 0;
         let skipped = 0;
+        let invalid = 0;
         this.cache.clear(); // every record is rewritten; drop all memoized loads
         const version = this.schemaVersion(); // read once; we're migrating FROM this
         for (const kind of ENTITY_KINDS) {
             const directory = this.safeKindDirectory(kind, false);
             if (!directory)
                 continue;
-            const schema = SCHEMAS[kind];
+            const pending = hasPendingMigration(kind, version);
+            const fail = () => { if (pending)
+                skipped++;
+            else
+                invalid++; };
             const single = SINGLE_FILE[kind];
             if (single) {
                 const f = join(directory.lexical, single);
@@ -966,23 +976,23 @@ export class JsonStore {
                     arr = JSON.parse(text);
                 }
                 catch {
-                    skipped++;
+                    fail();
                     continue;
                 }
                 if (!Array.isArray(arr)) {
-                    skipped++;
+                    fail();
                     continue;
                 }
                 const kept = [];
                 for (const raw of arr) {
-                    const r = schema.safeParse(this.migrate(kind, raw, version));
+                    const r = this.tryMigrate(kind, raw, version);
                     if (r.success) {
                         kept.push(r.data);
                         migrated++;
                     }
                     else {
                         kept.push(raw); // preserve unmigratable records rather than drop them
-                        skipped++;
+                        fail();
                     }
                 }
                 this.writeContainedFile(directory, f, encode(kept), this.maxBytes(kind));
@@ -995,24 +1005,38 @@ export class JsonStore {
                         const text = this.readContainedFile(directory, p, this.maxBytes(kind));
                         if (text === null)
                             continue;
+                        // A 0-byte merge-driver tombstone holds no record (issue #37) — the
+                        // loader's rule; counting it would pin the manifest version forever.
+                        if (text.trim() === "")
+                            continue;
                         raw = JSON.parse(text);
                     }
                     catch {
-                        skipped++;
+                        fail();
                         continue;
                     }
-                    const r = schema.safeParse(this.migrate(kind, raw, version));
+                    const r = this.tryMigrate(kind, raw, version);
                     if (r.success) {
                         this.writeContainedFile(directory, p, encode(r.data), this.maxBytes(kind));
                         migrated++;
                     }
                     else {
-                        skipped++; // leave the file as-is
+                        fail(); // leave the file as-is
                     }
                 }
             }
         }
-        return { migrated, skipped };
+        return { migrated, skipped, invalid, version: skipped ? version : SCHEMA_VERSION };
+    }
+    /** Migrate + validate one raw record for persistMigration; a throwing migration
+     *  step counts as a failure, so the record stays in its original shape. */
+    tryMigrate(kind, raw, version) {
+        try {
+            return SCHEMAS[kind].safeParse(this.migrate(kind, raw, version));
+        }
+        catch {
+            return { success: false };
+        }
     }
 }
 //# sourceMappingURL=jsonStore.js.map

package/dist/store/stateBinding.js

@@ -795,15 +795,21 @@ function writeStateAuthorized(store, input, opts, access) {
         // land its `superseded` event in THIS ledger, invisible to that partition's subscribers.
         if (!inScope(supersededRecord))
             throw new StateRefusal("conflict", `supersedes ${request.supersedes} is on record in ${scopePath(recordScope(supersededRecord, repo))}, not ${scopePath(request.scope)}: a write supersedes only a record in its own partition`, { incumbent_id: String(supersededRecord.id), reason: "supersede target in another partition" });
+        const matches = typeof request.expected_version === 'number'
+            ? latestSeqFor(ledger, String(supersededRecord.id)) === request.expected_version
+            : request.expected_version === stateHash(supersededRecord);
         if (stateHash(supersededVisibility ?? null) !== stateHash(nextVisibility ?? null)) {
             if (supersededVisibility ? supersededVisibility.owner !== request.principal.id : request.principal.kind !== 'human')
                 deny();
-            const matches = typeof request.expected_version === 'number'
-                ? latestSeqFor(readLedger(hunchDir, request.scope), String(supersededRecord.id)) === request.expected_version
-                : request.expected_version === stateHash(supersededRecord);
-            if (!matches)
+            if (request.expected_version === null)
                 throw new StateRefusal('malformed', 'changing visibility during supersession requires the predecessor expected_version');
         }
+        // A supersession's expected_version names the predecessor (#510): a stale one is a conflict.
+        if (request.expected_version !== null && !matches)
+            throw new StateRefusal("conflict", `expected_version does not match the superseded ${supersededRecord.id}`, { incumbent_id: String(supersededRecord.id), reason: "expected_version mismatch" });
+    }
+    else if (request.supersedes && request.expected_version !== null) {
+        throw new StateRefusal("conflict", `expected_version names ${request.supersedes}, which is not on record`, { incumbent_id: request.supersedes, reason: "expected_version without incumbent" });
     }
     if (!incumbent && !supersededRecord && nextVisibility?.owner !== undefined && nextVisibility.owner !== request.principal.id)
         deny();
@@ -873,6 +879,13 @@ function writeStateAuthorized(store, input, opts, access) {
         if (!ok)
             throw new StateRefusal("conflict", `expected_version does not match the incumbent ${id}`, { incumbent_id: id, reason: "expected_version mismatch" });
     }
+    // Compare-and-swap with no incumbent (#510): a writer naming a version believes a record exists,
+    // so a fresh create under it is a stale read, never silently accepted. Numeric 0 is the ledger's
+    // "never seen" and asserts absence; a supersession's expected_version names its predecessor.
+    if (!existing && request.expected_version !== null && !request.supersedes
+        && !(typeof request.expected_version === "number" && latestSeqFor(ledger, id) === request.expected_version)) {
+        throw new StateRefusal("conflict", `expected_version ${JSON.stringify(request.expected_version)} names a version, but ${id} has none on record: pass null to create it (0 asserts the id was never written)`, { incumbent_id: id, reason: "expected_version without incumbent" });
+    }
     if (replayLink) {
         const recordHash = stateHash(replayLink);
         appendChanges(hunchDir, request.scope, missingEventFor(ledger, facet, replayLink, request.principal.id), { key: request.idempotency_key, entry: { record_id: replayLink.id, record_hash: recordHash, payload_hash: hash, facet } }, now, opts.ledgerCache?.ledger);

package/dist/synthesis/provider.js

@@ -23,11 +23,11 @@
  * Every provider returns the same shape so the rest of the system never knows
  * (or cares) which one ran.
  */
-import { execFile, spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { isIP } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import { boundedSpawn } from "../core/boundedSpawn.js";
 import { writeFileAtomic } from "../core/io.js";
 import { summarizeDiff } from "../extractors/diff.js";
 import { languageFor } from "../extractors/languages.js";
@@ -45,84 +45,32 @@ const IS_WIN = process.platform === "win32";
  *      win32 routes through cmd.exe so the shim resolves. Safe here because
  *      every argv we pass is a trusted, space-free flag (the prompt is stdin).
  */
-export function pexecIn(cmd, args, opts = {}) {
-    return new Promise((resolve, reject) => {
-        // Windows: launch through cmd.exe so the `claude` .cmd/.ps1 shim resolves,
-        // and pass the whole line as ONE shell string (args are trusted, space-free
-        // flags) — avoids Node's DEP0190 warning for `args + shell:true`. The prompt
-        // is never here; it goes via stdin below. POSIX: no shell, argv as-is.
-        const child = IS_WIN
-            ? spawn([cmd, ...args].join(" "), {
-                shell: true,
-                env: initiatorChildEnv(opts.env ?? process.env),
-                cwd: opts.cwd,
-                windowsHide: true,
-            })
-            : spawn(cmd, args, {
-                env: initiatorChildEnv(opts.env ?? process.env),
-                cwd: opts.cwd,
-                windowsHide: true,
-            });
-        const max = opts.maxBuffer ?? 16 * 1024 * 1024;
-        let out = "";
-        let err = "";
-        let outLen = 0;
-        let settled = false;
-        // Windows spawns through a cmd.exe wrapper (shell:true), and child.kill()
-        // terminates only that wrapper — the actual agent CLI survives as an orphan,
-        // still burning the user's subscription after every timeout, accumulating
-        // with each post-commit hook fire (issue #44). taskkill /T fells the tree.
-        // Best-effort by design: the wrapper kill below still runs either way.
-        const killTree = () => {
-            if (IS_WIN && child.pid) {
-                try {
-                    execFile("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true }, () => { });
-                }
-                catch { /* taskkill unavailable — fall through to the wrapper kill */ }
-            }
-            child.kill();
-        };
-        const done = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timer)
-                clearTimeout(timer);
-            fn();
-        };
-        const timer = opts.timeout
-            ? setTimeout(() => {
-                killTree();
-                done(() => reject(new Error(`"${cmd}" timed out after ${opts.timeout}ms`)));
-            }, opts.timeout)
-            : null;
-        child.on("error", (e) => done(() => reject(e)));
-        child.stdout.on("data", (d) => {
-            outLen += d.length;
-            if (outLen > max) {
-                killTree();
-                done(() => reject(new Error(`"${cmd}" exceeded maxBuffer (${max} bytes)`)));
-                return;
-            }
-            out += d.toString();
-        });
-        child.stderr.on("data", (d) => {
-            err += d.toString();
-        });
-        child.on("close", (code) => {
-            done(() => {
-                if (code === 0)
-                    resolve({ stdout: out });
-                else
-                    reject(new Error(`"${cmd}" exited ${code}: ${err.slice(0, 300)}`));
-            });
-        });
-        // Feed stdin (the prompt) then close it; commands with no input just get EOF.
-        if (opts.input != null)
-            child.stdin.write(opts.input);
-        child.stdin.on("error", () => { }); // ignore EPIPE if the child exits early
-        child.stdin.end();
+export async function pexecIn(cmd, args, opts = {}) {
+    // Windows: launch through cmd.exe so the `claude` .cmd/.ps1 shim resolves,
+    // and pass the whole line as ONE shell string (args are trusted, space-free
+    // flags) — avoids Node's DEP0190 warning for `args + shell:true`. The prompt
+    // is never here; it goes via stdin. POSIX: no shell, argv as-is.
+    // boundedSpawn owns the timer and, on timeout or overflow, kills the WHOLE
+    // tree while the root is alive: on Windows child.kill() alone ends only the
+    // cmd.exe wrapper and orphans the agent CLI, still burning the user's
+    // subscription after every timeout (issues #44, #489).
+    const result = await boundedSpawn(IS_WIN ? [cmd, ...args].join(" ") : cmd, IS_WIN ? [] : args, {
+        shell: IS_WIN,
+        env: initiatorChildEnv(opts.env ?? process.env),
+        cwd: opts.cwd,
+        input: opts.input,
+        timeoutMs: opts.timeout,
+        maxBuffer: opts.maxBuffer ?? 16 * 1024 * 1024,
     });
+    if (result.error)
+        throw result.error;
+    if (result.timedOut)
+        throw new Error(`"${cmd}" timed out after ${opts.timeout}ms`);
+    if (result.overflowed)
+        throw new Error(`"${cmd}" exceeded maxBuffer (${opts.maxBuffer ?? 16 * 1024 * 1024} bytes)`);
+    if (result.status !== 0)
+        throw new Error(`"${cmd}" exited ${result.status}: ${result.stderr.slice(0, 300)}`);
+    return { stdout: result.stdout };
 }
 /** Every selectable synthesis mode. `auto` is a preference value rather than a
  * provider: it resolves the invocation's origin without choosing by availability.

package/dist/synthesis/synthesize.js

@@ -12,7 +12,7 @@ import { isSubstantive } from "../extractors/languages.js";
 const SKIP_SUBJECT = /^(merge|revert|bump|format|lint|wip)\b|^chore\(deps\):/i;
 // Below this many changed code lines, a commit with no structural change and no
 // explanatory body isn't worth a paid LLM call. Tunable via HUNCH_SIG_MIN_LINES.
-const SIG_MIN_LINES = Number(process.env.HUNCH_SIG_MIN_LINES) || 12;
+const SIG_MIN_LINES = ((raw) => Number.isFinite(raw) && raw > 0 ? raw : 12)(Number(process.env.HUNCH_SIG_MIN_LINES));
 const SIG_MIN_BODY = 40;
 /** Trivial-subject commits (merge/revert/bump/format/...) are noise UNLESS the body
  *  carries real content — a squash/PR description often lands there, not on the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.45.2",
+  "version": "1.46.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
@@ -103,7 +103,7 @@
     "tree-sitter-php": "0.23.12",
     "tree-sitter-python": "0.23.4",
     "tree-sitter-typescript": "^0.23.2",
-    "zod": "^4.4.3"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@types/cross-spawn": "^6.0.6",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.45.2",
+  "version": "1.46.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.45.2",
+      "version": "1.46.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {