@davesheffer/hunch 1.45.2 → 1.47.0

package/dist/core/migrate.js

@@ -31,6 +31,7 @@ export const MIGRATIONS = [
         // losslessly — no record is dropped, and `valid_from` is populated BEFORE the
         // Zod pass. Defensive: input is untrusted JSON.
         version: 2,
+        kinds: ["decisions", "constraints"],
         description: "Add valid_from/valid_to/superseded_by/retired (decisions) and status/valid_from/valid_to (constraints)",
         up(kind, raw) {
             if (kind === "decisions") {
@@ -64,6 +65,7 @@ export const MIGRATIONS = [
         // relationship schema is validated; newly written resource relationships use
         // hunch.resource-relationship/1 and keep their currentness/metadata.
         version: 3,
+        kinds: ["edges"],
         description: "Version existing graph edges before adding Engineering Landscape resources and relationships",
         up(kind, raw) {
             if (kind === "edges") {
@@ -98,15 +100,24 @@ export function writeManifest(paths, version = SCHEMA_VERSION) {
     writeFileAtomic(paths.manifest, JSON.stringify({ schema_version: version }, null, 2) + "\n");
 }
 /** Apply every migration in (fromVersion, toVersion] to a single raw record. Skips
- *  non-object input untouched (the loader's Zod pass will reject it). */
+ *  non-object input untouched (the loader's Zod pass will reject it). All-or-nothing:
+ *  the steps run on a deep copy, so `raw` is never mutated and a caller that rejects
+ *  the result (or a step that throws) keeps the original record intact — never a
+ *  half-migrated one. */
 export function migrateRaw(kind, raw, fromVersion, migrations = MIGRATIONS, toVersion = SCHEMA_VERSION) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw))
         return raw;
-    let rec = raw;
-    for (const m of [...migrations].sort((a, b) => a.version - b.version)) {
-        if (m.version > fromVersion && m.version <= toVersion)
-            rec = m.up(kind, rec);
-    }
+    const steps = migrations.filter((m) => m.version > fromVersion && m.version <= toVersion);
+    if (steps.length === 0)
+        return raw; // nothing to apply: no copy needed
+    let rec = structuredClone(raw);
+    for (const m of steps.sort((a, b) => a.version - b.version))
+        rec = m.up(kind, rec);
     return rec;
 }
+/** Whether some migration in (fromVersion, toVersion] may change a record of
+ *  `kind` — i.e. whether re-running migrations could ever fix a failed one. */
+export function hasPendingMigration(kind, fromVersion, migrations = MIGRATIONS, toVersion = SCHEMA_VERSION) {
+    return migrations.some((m) => m.version > fromVersion && m.version <= toVersion && (!m.kinds || m.kinds.includes(kind)));
+}
 //# sourceMappingURL=migrate.js.map

package/dist/core/paths.d.ts

@@ -1,10 +1,9 @@
 export declare const HUNCH_DIR = ".hunch";
-/** Canonicalize a free-form path/target to forward-slash form (Hunch stores every
- *  path with "/" — git emits it on all OSes — so any user- or agent-supplied
- *  target must be normalized before comparison, otherwise a Windows caller passing
- *  `src\auth\session.ts` never matches the stored `src/auth/session.ts`). Safe on
- *  symbol names too: they contain no backslashes. This does NOT make a path
- *  repo-relative — an absolute path passes through with its separators flipped,
+/** Convert a user- or agent-supplied path/target to forward-slash form. Hunch
+ *  stores every path with "/" (git emits it on every OS), so a Windows-style
+ *  backslash path would otherwise never match the stored form. Harmless on
+ *  symbol names, which carry no backslashes. It does NOT make a path
+ *  repo-relative: an absolute path only has its separators flipped and is left
  *  unchanged otherwise; use `repoRelativeTarget` for that.
  *
  *  Inherently ambiguous for a string like `docs/notes\notes.md`: it could be a
@@ -15,25 +14,19 @@ export declare const HUNCH_DIR = ".hunch";
  *  needs the correct answer for a real file should decide from that evidence
  *  instead of trusting this blindly. */
 export declare function toPosixTarget(target: string): string;
-/** realpath a path even if it doesn't exist yet (e.g. a new file an agent is about
- *  to Write, or a glob whose concrete segments aren't literal): resolve the longest
- *  existing ancestor, then re-append the missing tail. Idempotent on an
- *  already-resolved path. */
+/** Canonical real path of `p`, tolerant of paths that do not exist yet (a file
+ *  about to be written, a glob with non-literal segments): the longest existing
+ *  ancestor is resolved through the native realpath and the missing trailing
+ *  segments are re-appended unchanged. Terminates at the filesystem root,
+ *  is idempotent on a resolved path and never throws for a missing one. */
 export declare function realpathNorm(p: string): string;
-/** Rewrite an ABSOLUTE target to repo-relative POSIX form when it falls inside
- *  `root`. Hunch's stored paths (symbols, constraint scopes, ...) are always
- *  repo-relative, so a caller that hands over an absolute edit-payload path
- *  matched nothing (issue #296: hunch_check_constraints / hunch_blast_radius
- *  returned empty for an absolute target that plainly had a matching rule). A
- *  relative target, a glob, or an absolute path outside `root` passes through
- *  unchanged (toPosixTarget'd) — there is nothing safe to rewrite it to.
- *
- *  BOTH ends are realpath-normalized before the relative-path computation: on
- *  macOS `process.cwd()` (hence `findRoot`) resolves /var → /private/var, but a
- *  hook event's `file_path` arrives UN-resolved, so a naive `relative()` yields a
- *  bogus "../" path under a symlinked root (/var, /tmp, symlinked $HOME) and the
- *  caller treats the file as outside the repo, silently dropping all context
- *  (dec_e0a36efbf5). */
+/** Rewrite an ABSOLUTE `target` to repo-relative forward-slash form when it lies
+ *  inside `root`. Stored Hunch paths are always repo-relative, so an absolute
+ *  path lifted from an edit payload otherwise matches nothing (issue #296).
+ *  Both ends go through `realpathNorm`, so a symlinked root (macOS /var vs
+ *  /private/var, /tmp, a symlinked home) cancels out (dec_e0a36efbf5). Anything
+ *  with no safe repo-relative form (the root itself, an escape, a drive-letter
+ *  remainder) is returned in its normalized form unchanged. */
 export declare function repoRelativeTarget(target: string, root: string): string;
 /** True when `target` (already repo-relative POSIX form) names a regular FILE
  *  that really exists inside `root`. The LAST-RESORT half of the "is this a real

package/dist/core/paths.js

@@ -3,12 +3,11 @@ import { join } from "node:path";
 import { existsSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 export const HUNCH_DIR = ".hunch";
-/** Canonicalize a free-form path/target to forward-slash form (Hunch stores every
- *  path with "/" — git emits it on all OSes — so any user- or agent-supplied
- *  target must be normalized before comparison, otherwise a Windows caller passing
- *  `src\auth\session.ts` never matches the stored `src/auth/session.ts`). Safe on
- *  symbol names too: they contain no backslashes. This does NOT make a path
- *  repo-relative — an absolute path passes through with its separators flipped,
+/** Convert a user- or agent-supplied path/target to forward-slash form. Hunch
+ *  stores every path with "/" (git emits it on every OS), so a Windows-style
+ *  backslash path would otherwise never match the stored form. Harmless on
+ *  symbol names, which carry no backslashes. It does NOT make a path
+ *  repo-relative: an absolute path only has its separators flipped and is left
  *  unchanged otherwise; use `repoRelativeTarget` for that.
  *
  *  Inherently ambiguous for a string like `docs/notes\notes.md`: it could be a
@@ -21,47 +20,42 @@ export const HUNCH_DIR = ".hunch";
 export function toPosixTarget(target) {
     return target.replace(/\\/g, "/").replace(/^\.\//, "");
 }
-/** realpath a path even if it doesn't exist yet (e.g. a new file an agent is about
- *  to Write, or a glob whose concrete segments aren't literal): resolve the longest
- *  existing ancestor, then re-append the missing tail. Idempotent on an
- *  already-resolved path. */
+/** Canonical real path of `p`, tolerant of paths that do not exist yet (a file
+ *  about to be written, a glob with non-literal segments): the longest existing
+ *  ancestor is resolved through the native realpath and the missing trailing
+ *  segments are re-appended unchanged. Terminates at the filesystem root,
+ *  is idempotent on a resolved path and never throws for a missing one. */
 export function realpathNorm(p) {
-    try {
-        return realpathSync.native(p);
-    }
-    catch {
-        const parent = dirname(p);
-        if (parent === p)
-            return p; // hit the root; nothing more to resolve
-        return join(realpathNorm(parent), basename(p));
+    const tail = [];
+    let cur = p;
+    for (;;) {
+        try {
+            const real = realpathSync.native(cur);
+            return tail.length ? join(real, ...tail.reverse()) : real;
+        }
+        catch {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return p;
+            tail.push(basename(cur));
+            cur = parent;
+        }
     }
 }
-/** Rewrite an ABSOLUTE target to repo-relative POSIX form when it falls inside
- *  `root`. Hunch's stored paths (symbols, constraint scopes, ...) are always
- *  repo-relative, so a caller that hands over an absolute edit-payload path
- *  matched nothing (issue #296: hunch_check_constraints / hunch_blast_radius
- *  returned empty for an absolute target that plainly had a matching rule). A
- *  relative target, a glob, or an absolute path outside `root` passes through
- *  unchanged (toPosixTarget'd) — there is nothing safe to rewrite it to.
- *
- *  BOTH ends are realpath-normalized before the relative-path computation: on
- *  macOS `process.cwd()` (hence `findRoot`) resolves /var → /private/var, but a
- *  hook event's `file_path` arrives UN-resolved, so a naive `relative()` yields a
- *  bogus "../" path under a symlinked root (/var, /tmp, symlinked $HOME) and the
- *  caller treats the file as outside the repo, silently dropping all context
- *  (dec_e0a36efbf5). */
+/** Rewrite an ABSOLUTE `target` to repo-relative forward-slash form when it lies
+ *  inside `root`. Stored Hunch paths are always repo-relative, so an absolute
+ *  path lifted from an edit payload otherwise matches nothing (issue #296).
+ *  Both ends go through `realpathNorm`, so a symlinked root (macOS /var vs
+ *  /private/var, /tmp, a symlinked home) cancels out (dec_e0a36efbf5). Anything
+ *  with no safe repo-relative form (the root itself, an escape, a drive-letter
+ *  remainder) is returned in its normalized form unchanged. */
 export function repoRelativeTarget(target, root) {
-    const t = toPosixTarget(target);
-    const looksAbsolute = isAbsolute(t) || /^[a-zA-Z]:/.test(t);
-    if (!looksAbsolute)
-        return t;
-    // `root` is posix'd too, not just `target`: realpathNorm's fallback walk decomposes
-    // by "/" (via node:path, which on a POSIX host does NOT treat "\" as a separator),
-    // so an un-posix'd root and a posix'd target would decompose into differently-shaped
-    // ancestor chains and never share a common realpath'd prefix.
-    const rel = toPosixTarget(relative(realpathNorm(toPosixTarget(root)), realpathNorm(t)));
-    if (!rel || rel === ".." || rel.startsWith("../") || isAbsolute(rel) || /^[a-zA-Z]:/.test(rel))
-        return t;
+    const norm = toPosixTarget(target);
+    if (!isAbsolute(norm) && !/^[A-Za-z]:/.test(norm))
+        return norm;
+    const rel = relative(realpathNorm(toPosixTarget(root)), realpathNorm(norm)).replace(/\\/g, "/");
+    if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute(rel) || /^[A-Za-z]:/.test(rel))
+        return norm;
     return rel;
 }
 /** True when `target` (already repo-relative POSIX form) names a regular FILE

package/dist/core/projectDna.js

@@ -81,7 +81,17 @@ function gitText(root, args) {
 function exactCommit(root, ref) {
     if (!ref.trim() || /[\0\r\n]/.test(ref) || ref.length > 1_024)
         throw new Error("Git revision is invalid");
-    const revision = gitText(root, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`]);
+    let revision;
+    try {
+        revision = gitText(root, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`]);
+    }
+    catch (error) {
+        // Git's own text ("fatal: Needed a single revision") never names the ref (#493);
+        // any other failure keeps its original message.
+        if (!/Needed a single revision|unknown revision|bad revision/i.test(error.message))
+            throw error;
+        throw new Error(`Git revision ${JSON.stringify(ref)} does not name a commit in this repository`);
+    }
     if (!GIT_OBJECT.test(revision))
         throw new Error("Git did not return an exact commit object");
     return revision;

package/dist/core/refrepair.d.ts

@@ -12,10 +12,11 @@ export interface DecisionReferenceRepair {
     relatedFiles: number;
     evidence: number;
 }
-export declare function replaceExact(values: string[], from: string, to: string): {
+export type ExactReplacement = {
     values: string[];
     changed: number;
 };
+export declare function replaceExact(refs: string[], target: string, replacement: string): ExactReplacement;
 /**
  * Return a corrected copy of a decision, or `null` when the source reference is
  * not present. The decision's semantic content and verification timestamp are

package/dist/core/refrepair.js

@@ -1,10 +1,10 @@
-export function replaceExact(values, from, to) {
+export function replaceExact(refs, target, replacement) {
     let changed = 0;
-    const replaced = values.map((value) => {
-        if (value !== from)
+    const replaced = refs.map((value) => {
+        if (value !== target)
             return value;
         changed++;
-        return to;
+        return replacement;
     });
     // A decision may already cite the destination. Keep the reference list a set
     // after the repair so a correction cannot create duplicate scope/evidence.

package/dist/core/relativeImports.js

@@ -26,8 +26,12 @@ export function relativeImportCandidates(fromFile, specifier) {
  * indexer compatibility; callers that need ambiguity metadata can inspect the
  * returned matches instead of guessing a different target. */
 export function resolveRelativeImport(fromFile, specifier, availableFiles) {
-    const available = new Set(availableFiles);
-    const matches = relativeImportCandidates(fromFile, specifier).filter((candidate) => available.has(candidate));
+    // Bare/non-relative specifiers have no candidates: skip the O(N) file-set copy.
+    const candidates = relativeImportCandidates(fromFile, specifier);
+    if (candidates.length === 0)
+        return { path: null, matches: [] };
+    const available = availableFiles instanceof Set ? availableFiles : new Set(availableFiles);
+    const matches = candidates.filter((candidate) => available.has(candidate));
     return { path: matches[0] ?? null, matches };
 }
 //# sourceMappingURL=relativeImports.js.map

package/dist/core/repairqueue.d.ts

@@ -1,40 +1,23 @@
-import { type CommitRewrite, type DroppedRewrite } from "./commitrepair.js";
-/** Tolerant read: a missing or corrupt queue file is treated as empty — this
- *  is local scratch state, never a source of truth worth failing loudly over. */
+import type { CommitRewrite, DroppedRewrite } from "./commitrepair.js";
+/** The raw queue. Missing, corrupt or non-array files read as `[]`; never throws. */
 export declare function readPendingRepairs(root: string): CommitRewrite[];
+/** Atomically replace the queue. Writing `[]` clears it. */
 export declare function writePendingRepairs(root: string, rewrites: readonly CommitRewrite[]): void;
-/** Tolerant read, same discipline as readPendingRepairs. */
+/** The tombstones of rewrites rejected with `--drop`. Same tolerance as the queue. */
 export declare function readDroppedRepairs(root: string): DroppedRewrite[];
+/** Atomically replace the tombstone file. Writing `[]` clears it. */
 export declare function writeDroppedRepairs(root: string, dropped: readonly DroppedRewrite[]): void;
-/** The queue as every READ-ONLY consumer should see it: raw entries minus
- *  anything a human already rejected via `--drop`, regardless of how a
- *  tombstoned entry ended up back in the raw queue file (e.g. the post-merge
- *  hook's backgrounded detection racing a `--drop`). A read-time filter, not
- *  a mutation — the raw queue file is untouched.
- *
- *  `repair-provenance`'s own action is the one exception: it needs the RAW
- *  read (via readPendingRepairs) because it diffs raw-vs-swept to report what
- *  it cleaned up, and it persists the sweep back to disk. Every other
- *  reader — `hunch escalations`, SessionStart orientation, the `hunch_now`
- *  and `hunch_escalations` MCP tools — must call this instead, or a
- *  tombstoned entry that hasn't yet been swept by a `repair-provenance` run
- *  re-surfaces as if the human never answered it. */
+/**
+ * The raw queue minus anything tombstoned. Read-only: it never changes either
+ * file. Every read-only consumer uses this -- `hunch escalations`, SessionStart
+ * orientation, and the `hunch_now` and `hunch_escalations` MCP tools. Only
+ * `repair-provenance` itself reads the raw queue.
+ */
 export declare function readActivePendingRepairs(root: string): CommitRewrite[];
-/** The `queued` entries whose proposed `to` doesn't resolve to a real commit
- *  in this repository — the same withheldForUnresolvableTo gate
- *  `repair-provenance --apply` itself runs before writing, surfaced here so
- *  a READ-ONLY consumer (hunch escalations, hunch_now/hunch_escalations,
- *  SessionStart orientation) can tell a permanently-stuck entry apart from
- *  one `--apply` can still resolve, instead of advertising a
- *  `--apply --only <id>` that's guaranteed to no-op forever. `null` from
- *  commitsExist (the check itself failed to run) is treated as fail-open —
- *  same discipline as the apply path — so nothing is misreported as
- *  withheld just because the check couldn't run.
- *
- *  Returns the OBJECTS, not their ids, and every caller must pass the exact
- *  same `queued` array into both this function and whatever it hands the
- *  result to (commitRepairEscalations) — an id-keyed set would collapse a
- *  corrupted queue's two same-id entries (one resolvable, one not) into one
- *  unit, exactly the identity confusion withheldForUnresolvableTo's own
- *  docstring warns about. */
+/**
+ * The queued entries whose proposed `to` does not resolve in this repository.
+ * Fails open (nothing withheld) when git cannot answer. The set holds the
+ * caller's own objects, so callers must pass the same `queued` array here and to
+ * whatever consumes the result.
+ */
 export declare function withheldRewrites(root: string, queued: readonly CommitRewrite[]): Set<CommitRewrite>;

package/dist/core/repairqueue.js

@@ -1,131 +1,81 @@
 /**
- * Local-only queue of commit-provenance repairs detected opportunistically
- * (typically by the post-merge hook, src/integrations/hooks.ts) but not yet
- * applied. `.hunch/pending-commit-repairs.json` is gitignored the same way
- * `.hunch/local.json` is — never committed, never pushed. It exists because
- * the opportunistic detection window is narrow: `ORIG_HEAD` gets overwritten
- * by the next merge, and the matched-away commit can eventually be gc'd —
- * queuing the exact {id, from, to} triple here lets a human confirm the match
- * later (`hunch repair-provenance --apply`) without losing it.
+ * Local-only queue of detected-but-not-yet-applied commit-provenance repairs.
  *
- * `.hunch/dropped-commit-repairs.json` is the sibling tombstone file: a human
- * rejecting a queued match via `--drop` records the exact {id, from, to}
- * triple here, durably, so detection re-deriving the identical match on a
- * later merge doesn't re-queue what was already rejected — a genuinely
- * different replacement (`to`) for the same still-orphaned commit is a new
- * proposal and still surfaces (see commitrepair.ts's withoutDropped). Same
- * local-only, gitignored discipline as the queue.
+ * It is filled opportunistically, usually by the post-merge hook, and is
+ * gitignored like `.hunch/local.json` -- never committed. It exists because the
+ * detection window is narrow: `ORIG_HEAD` gets overwritten and the matched-away
+ * commit can be garbage-collected. A human confirms later with
+ * `hunch repair-provenance --apply`. A sibling tombstone file records the exact
+ * `{id, from, to}` triples rejected with `--drop`, so re-detection does not
+ * re-queue them.
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./io.js";
 import { withoutDropped, withheldForUnresolvableTo } from "./commitrepair.js";
 import { commitsExist } from "../extractors/git.js";
-function queuePath(root) {
-    return join(root, ".hunch", "pending-commit-repairs.json");
-}
-function droppedPath(root) {
-    return join(root, ".hunch", "dropped-commit-repairs.json");
-}
-function isCommitRewrite(value) {
-    if (!value || typeof value !== "object")
+const queuePath = (root) => join(root, ".hunch", "pending-commit-repairs.json");
+const droppedPath = (root) => join(root, ".hunch", "dropped-commit-repairs.json");
+const nonEmpty = (v) => typeof v === "string" && v.length > 0;
+/**
+ * Shape-only validation: non-empty string id/from/to, and `to !== from` (a no-op
+ * is rejected). There is deliberately no hex check -- a bad `to` is caught later
+ * by the apply-time existence check, so this loader stays shape-only.
+ */
+function isRewrite(v) {
+    if (typeof v !== "object" || v === null)
         return false;
-    const { id, from, to } = value;
-    // Non-empty, and to !== from — an empty target is never a useful rewrite,
-    // and a no-op entry would apply "successfully" while accomplishing nothing.
-    // Deliberately NOT a hex-shape check: from/to are opaque strings elsewhere
-    // in this codebase's test fixtures, and repairDecisionCommit's own
-    // `d.commit === mine.from` guard already makes a garbage `from` inert (it
-    // can never match a real decision). A garbage `to` is caught elsewhere,
-    // not here: `hunch repair-provenance --apply` runs commitsExist against
-    // every `to` it's actually about to act on (the whole queue, or just the
-    // one entry `--only <id>` targets) before repairDecisionCommit ever sees
-    // it, and leaves a non-resolving entry queued rather than applying it
-    // (withheldForUnresolvableTo, src/core/commitrepair.ts) — with the caveat
-    // that commitsExist itself fails OPEN if the check can't run at all (not a
-    // git repo, git missing, timeout), same as drift.ts's own use of it. This
-    // filter stays shape-only on purpose — the existence check needs a
-    // repository to run against, which this read-only queue loader doesn't
-    // have.
-    return typeof id === "string" && !!id
-        && typeof from === "string" && !!from
-        && typeof to === "string" && !!to
-        && to !== from;
+    const r = v;
+    return nonEmpty(r.id) && nonEmpty(r.from) && nonEmpty(r.to) && r.to !== r.from;
 }
-function isDroppedRewrite(value) {
-    if (!value || typeof value !== "object")
+function isDropped(v) {
+    if (typeof v !== "object" || v === null)
         return false;
-    const { id, from, to } = value;
-    return typeof id === "string" && !!id
-        && typeof from === "string" && !!from
-        && typeof to === "string" && !!to;
+    const r = v;
+    return nonEmpty(r.id) && nonEmpty(r.from) && nonEmpty(r.to);
 }
-/** Tolerant read: a missing or corrupt queue file is treated as empty — this
- *  is local scratch state, never a source of truth worth failing loudly over. */
-export function readPendingRepairs(root) {
-    const path = queuePath(root);
-    if (!existsSync(path))
+function readList(file, guard) {
+    if (!existsSync(file))
         return [];
     try {
-        const parsed = JSON.parse(readFileSync(path, "utf8"));
-        return Array.isArray(parsed) ? parsed.filter(isCommitRewrite) : [];
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return Array.isArray(parsed) ? parsed.filter(guard) : [];
     }
     catch {
         return [];
     }
 }
+/** The raw queue. Missing, corrupt or non-array files read as `[]`; never throws. */
+export function readPendingRepairs(root) {
+    return readList(queuePath(root), isRewrite);
+}
+/** Atomically replace the queue. Writing `[]` clears it. */
 export function writePendingRepairs(root, rewrites) {
     writeFileAtomic(queuePath(root), JSON.stringify(rewrites, null, 2) + "\n");
 }
-/** Tolerant read, same discipline as readPendingRepairs. */
+/** The tombstones of rewrites rejected with `--drop`. Same tolerance as the queue. */
 export function readDroppedRepairs(root) {
-    const path = droppedPath(root);
-    if (!existsSync(path))
-        return [];
-    try {
-        const parsed = JSON.parse(readFileSync(path, "utf8"));
-        return Array.isArray(parsed) ? parsed.filter(isDroppedRewrite) : [];
-    }
-    catch {
-        return [];
-    }
+    return readList(droppedPath(root), isDropped);
 }
+/** Atomically replace the tombstone file. Writing `[]` clears it. */
 export function writeDroppedRepairs(root, dropped) {
     writeFileAtomic(droppedPath(root), JSON.stringify(dropped, null, 2) + "\n");
 }
-/** The queue as every READ-ONLY consumer should see it: raw entries minus
- *  anything a human already rejected via `--drop`, regardless of how a
- *  tombstoned entry ended up back in the raw queue file (e.g. the post-merge
- *  hook's backgrounded detection racing a `--drop`). A read-time filter, not
- *  a mutation — the raw queue file is untouched.
- *
- *  `repair-provenance`'s own action is the one exception: it needs the RAW
- *  read (via readPendingRepairs) because it diffs raw-vs-swept to report what
- *  it cleaned up, and it persists the sweep back to disk. Every other
- *  reader — `hunch escalations`, SessionStart orientation, the `hunch_now`
- *  and `hunch_escalations` MCP tools — must call this instead, or a
- *  tombstoned entry that hasn't yet been swept by a `repair-provenance` run
- *  re-surfaces as if the human never answered it. */
+/**
+ * The raw queue minus anything tombstoned. Read-only: it never changes either
+ * file. Every read-only consumer uses this -- `hunch escalations`, SessionStart
+ * orientation, and the `hunch_now` and `hunch_escalations` MCP tools. Only
+ * `repair-provenance` itself reads the raw queue.
+ */
 export function readActivePendingRepairs(root) {
     return withoutDropped(readPendingRepairs(root), readDroppedRepairs(root));
 }
-/** The `queued` entries whose proposed `to` doesn't resolve to a real commit
- *  in this repository — the same withheldForUnresolvableTo gate
- *  `repair-provenance --apply` itself runs before writing, surfaced here so
- *  a READ-ONLY consumer (hunch escalations, hunch_now/hunch_escalations,
- *  SessionStart orientation) can tell a permanently-stuck entry apart from
- *  one `--apply` can still resolve, instead of advertising a
- *  `--apply --only <id>` that's guaranteed to no-op forever. `null` from
- *  commitsExist (the check itself failed to run) is treated as fail-open —
- *  same discipline as the apply path — so nothing is misreported as
- *  withheld just because the check couldn't run.
- *
- *  Returns the OBJECTS, not their ids, and every caller must pass the exact
- *  same `queued` array into both this function and whatever it hands the
- *  result to (commitRepairEscalations) — an id-keyed set would collapse a
- *  corrupted queue's two same-id entries (one resolvable, one not) into one
- *  unit, exactly the identity confusion withheldForUnresolvableTo's own
- *  docstring warns about. */
+/**
+ * The queued entries whose proposed `to` does not resolve in this repository.
+ * Fails open (nothing withheld) when git cannot answer. The set holds the
+ * caller's own objects, so callers must pass the same `queued` array here and to
+ * whatever consumes the result.
+ */
 export function withheldRewrites(root, queued) {
     const existing = commitsExist(queued.map((r) => r.to), root);
     return new Set(withheldForUnresolvableTo(queued, existing).withheld);

package/dist/core/taskSelection.js

@@ -190,6 +190,39 @@ function scanIdentifiers(text) {
 export function identifierTokens(text) {
     return new Set(scanIdentifiers(text).keys());
 }
+/** Word -> the `id:` terms of the camel compounds the prompt splits it out of (PowerShell ->
+ *  power, shell; GitHubActions -> git, hub, actions), sorted so prompt word order never matters.
+ *  A word the prompt also uses on its own belongs to no compound. */
+function camelCompoundGroups(text) {
+    const groups = new Map();
+    const compounds = text.match(CAMEL_IDENTIFIER) ?? [];
+    if (!compounds.length)
+        return groups;
+    const standalone = lexicalTokens(text.replace(CAMEL_IDENTIFIER, " "));
+    for (const m of compounds) {
+        const key = ID_PREFIX + m.toLowerCase();
+        for (const word of lexicalTokens(m)) {
+            if (standalone.has(word))
+                continue;
+            const keys = groups.get(word) ?? [];
+            if (!keys.includes(key))
+                keys.push(key);
+            groups.set(word, keys.sort());
+        }
+    }
+    return groups;
+}
+/** A pasted stack frame: `at fn (file:line:col)`, `at file:line:col`, `at X (<anonymous>)`, `at X (node:...)`.
+ *  Prose that merely starts with "at" ("at startup the lock goes stale") has no such tail. */
+const FRAME_LINE = /^\s*at\s+\S+.*(?::\d+:\d+\)?|\(<anonymous>\)|\(node:[^)]*\))\s*$/;
+/** Text whose words count: every line, unless the prompt holds an actual trace (2+ frame
+ *  lines), whose frames name library internals (process, tick, sync), not the task. A Node
+ *  warning's `(node:<pid>)` prefix is noise either way; the words after it stay. */
+function promptWordText(prompt) {
+    const lines = prompt.split(/\r?\n/);
+    const trace = lines.filter((line) => FRAME_LINE.test(line)).length >= 2;
+    return (trace ? lines.filter((line) => !FRAME_LINE.test(line)) : lines).join("\n").replace(/\(node:\d+\)/g, " ");
+}
 const termTokens = (text) => new Set([...lexicalTokens(text), ...identifierTokens(text)]);
 /** Score live records against one prompt. Text fields per kind (title + rationale):
  *  decision title/context/decision; bug title/symptom/root_cause; constraint
@@ -199,9 +232,9 @@ const termTokens = (text) => new Set([...lexicalTokens(text), ...identifierToken
 export function selectForTask(records, promptText, opts = {}) {
     const k = Math.max(0, opts.k ?? DEFAULT_K);
     // Stack-frame lines name library APIs (writeFileSync, processTicksAndRejections), not the task:
-    // keep their words, but extract no identifiers from them.
-    const promptIdentifiers = (promptText ?? "").split(/\r?\n/).filter((line) => !/^\s*at\s+\S/.test(line) && !/node:internal|\(node:/.test(line)).join("\n");
-    const taskTerms = new Set([...lexicalTokens(promptText ?? ""), ...identifierTokens(promptIdentifiers)]);
+    // when the prompt holds a real trace, neither their words nor their identifiers count.
+    const promptIdentifiers = promptWordText(promptText ?? "");
+    const taskTerms = new Set([...lexicalTokens(promptIdentifiers), ...identifierTokens(promptIdentifiers)]);
     // Without an existence check (pure/offline) only a slashed token is trusted as a
     // path: "e.g.", "Node.js" or "v1.2" would otherwise match a broad glob.
     const paths = promptPaths(promptText ?? "", opts.root).filter((p) => opts.pathExists ? opts.pathExists(p) : p.includes("/"));
@@ -230,6 +263,15 @@ export function selectForTask(records, promptText, opts = {}) {
     for (const c of candidates)
         for (const term of c.tokens)
             df.set(term, (df.get(term) ?? 0) + 1);
+    // A camel compound in many records is a brand (GitHub, PowerShell, GitHubActions): in a record
+    // holding it, its parts count as one word. A near-unique one (df <= MIN_DF_CAP, e.g. QuotaReaper)
+    // names this project, and in a record without the compound a part is an ordinary word.
+    const wordGroups = new Map();
+    for (const [word, keys] of camelCompoundGroups(promptIdentifiers)) {
+        const common = keys.filter((key) => (df.get(key) ?? 0) > MIN_DF_CAP);
+        if (common.length)
+            wordGroups.set(word, common);
+    }
     const strongIds = new Set([...scanIdentifiers(promptIdentifiers)].filter(([, strong]) => strong).map(([term]) => term));
     const rareTerms = new Map();
     for (const term of taskTerms) {
@@ -247,7 +289,7 @@ export function selectForTask(records, promptText, opts = {}) {
     }
     const scored = [];
     for (const { tokens, anchors, ...rest } of candidates) {
-        let words = 0;
+        const words = new Set();
         let identifiers = 0;
         let termScore = 0;
         for (const [term, { weight, strong }] of rareTerms) {
@@ -256,12 +298,12 @@ export function selectForTask(records, promptText, opts = {}) {
             if (strong)
                 identifiers++;
             else
-                words++;
+                words.add(wordGroups.get(term)?.find((key) => tokens.has(key)) ?? term);
             termScore += weight;
         }
         const pathHits = paths.filter((p) => anchors.some((anchor) => pathMatchesGlob(p, anchor))).length;
         // One rare identifier alone qualifies (it counts double); a lone rare word does not.
-        if (pathHits > 0 || words + IDENTIFIER_WEIGHT * identifiers >= MIN_DISTINCT_TERMS)
+        if (pathHits > 0 || words.size + IDENTIFIER_WEIGHT * identifiers >= MIN_DISTINCT_TERMS)
             scored.push({ ...rest, pathHits, termScore });
     }
     // A record anchored to more of the files the prompt names outranks one that