@davesheffer/hunch 1.6.0 → 1.7.1

package/dist/core/dupdetect.js

@@ -68,6 +68,15 @@ export function commitCoveredBy(codeFiles, subject, existing, nowMs) {
     }
     return best;
 }
+/** Only a finalized, still-live human decision can justify deleting a draft as
+ *  redundant. Proposed records may resemble one another, but choosing which one
+ *  survives is review judgment—not deterministic hygiene. */
+export function isAcceptedDuplicateAnchor(d) {
+    return d.status === "accepted"
+        && d.provenance.source.includes("human_confirmed")
+        && !d.superseded_by
+        && !d.valid_to;
+}
 /** Is an existing DRAFT a near-duplicate of an accepted record? Review-time
  *  flag; threshold callers use 0.35 (batch-reject) — conservative on purpose. */
 export function draftDuplicateOf(draft, existing) {
@@ -77,9 +86,7 @@ export function draftDuplicateOf(draft, existing) {
     for (const d of existing) {
         if (d.id === draft.id)
             continue;
-        if (!d.provenance.source.includes("human_confirmed"))
-            continue;
-        if (d.status === "superseded" || d.status === "rejected" || d.superseded_by || d.valid_to)
+        if (!isAcceptedDuplicateAnchor(d))
             continue;
         const termSim = jaccard(draftTerms, dupTerms(`${d.title} ${d.decision}`));
         let fileBoost = 0;

package/dist/core/events.js

@@ -0,0 +1,61 @@
+/** The catch-log: an append-only, git-tracked JSONL trail of enforcement events
+ *  (`.hunch/events.log`). Every time the deterministic gate actually BLOCKS an
+ *  edit — a blocking invariant hit, or the Veto Guard reversing a rejected
+ *  approach — one line is appended here. Without this trail "the graph caught 37
+ *  violations" is an assertion; with it, it is a measurement (dec_6253f7e6d6).
+ *
+ *  WHY append-only (not temp-file+rename like the JSON index, con_902759b3dc):
+ *  the atomicity invariant exists so an interrupted write can never TRUNCATE the
+ *  index. A single-line append can never truncate what is already on disk — it
+ *  only ever extends it — so it honors that invariant's spirit without the O(n)
+ *  read-modify-write a rewrite would cost per event. The log is a derived audit
+ *  trail, never a source of truth: a lost or malformed line loses one catch's
+ *  provenance, never a decision.
+ *
+ *  HONESTY (dec_6253f7e6d6): a constraint/veto block carries NO subject/object/
+ *  assert — those are conformance-only predicates checked by a different gate
+ *  (`hunch conform`), not the edit hook. This schema records only what each gate
+ *  actually knows; it never fabricates the conformance shape for a plain block. */
+import { appendFileSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export function eventsLogPath(paths) {
+    return join(paths.hunch, "events.log");
+}
+/** Append one event as a JSONL line. Best-effort and never throws: the primary
+ *  call site is the edit hook, which MUST NEVER break an agent on failure
+ *  (con_03a0b94b2e). A dropped catch-log line is an acceptable loss. */
+export function appendEvent(paths, event) {
+    try {
+        appendFileSync(eventsLogPath(paths), `${JSON.stringify(event)}\n`);
+    }
+    catch {
+        /* best effort — a lost audit line must never surface to the agent */
+    }
+}
+/** Read + parse the catch-log. Malformed lines are skipped, not fatal (the log is
+ *  derived; one bad line never poisons the aggregation). Missing log → []. */
+export function readEvents(paths) {
+    let raw;
+    try {
+        raw = readFileSync(eventsLogPath(paths), "utf8");
+    }
+    catch {
+        return []; // no catches recorded yet
+    }
+    const out = [];
+    for (const line of raw.split("\n")) {
+        const s = line.trim();
+        if (!s)
+            continue;
+        try {
+            const e = JSON.parse(s);
+            if (e && typeof e.at === "string" && typeof e.kind === "string")
+                out.push(e);
+        }
+        catch {
+            /* skip a corrupt line */
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=events.js.map

package/dist/core/externalImports.js

@@ -0,0 +1,24 @@
+import { shortHash } from "./ids.js";
+/** Canonical package identity for a static module specifier. Relative, absolute,
+ * package-import-map (#), and URL-like specifiers are repository/runtime-local
+ * and deliberately outside the external-dependency evaluator. */
+export function externalPackage(specifier) {
+    const value = specifier.trim();
+    if (!value || value.startsWith(".") || value.startsWith("/") || value.startsWith("#") || /^[a-z]+:\/\//i.test(value))
+        return null;
+    if (value.startsWith("node:"))
+        return /^node:[A-Za-z0-9_./-]+$/.test(value) ? value : null;
+    if (value.startsWith("@")) {
+        const [scope, name] = value.split("/");
+        return scope && name ? `${scope}/${name}` : null;
+    }
+    return value.split("/")[0] || null;
+}
+/** Virtual graph target for an external package. It is intentionally not a
+ * Component record: package facts stay a bounded evaluator layer and do not
+ * inflate the human-curated component graph. */
+export function externalImportNodeId(specifier) {
+    const dependency = externalPackage(specifier);
+    return dependency ? `ext_${shortHash(dependency)}` : null;
+}
+//# sourceMappingURL=externalImports.js.map

package/dist/core/hookpolicy.js

@@ -16,6 +16,7 @@ export function blockingInScope(store, file, proposedAddedLines = []) {
             continue;
         return {
             reason: `Hunch: editing ${file} would touch a BLOCKING invariant — "${c.statement}" (${c.id}). Do not proceed unless this change is meant to modify that invariant; otherwise preserve it.`,
+            event: { kind: "constraint", constraint: c.id },
         };
     }
     for (const b of store.blastRadiusFiles(file)) {
@@ -29,6 +30,7 @@ export function blockingInScope(store, file, proposedAddedLines = []) {
                 continue;
             return {
                 reason: `Hunch: ${file} is in the blast radius of a BLOCKING invariant — "${c.statement}" (${c.id}; via ${b.file}, ${b.via} depth ${b.depth}). Verify the invariant still holds before editing.`,
+                event: { kind: "constraint", constraint: c.id },
             };
         }
     }
@@ -53,6 +55,7 @@ export function vetoInScope(store, file, proposedAddedLines) {
         return null;
     return {
         reason: `Hunch: editing ${file} would REVERSE decision ${hit.decision} — you rejected "${hit.alternative}" and chose "${hit.chosen}". Do not re-introduce the rejected approach; preserve the chosen design.`,
+        event: { kind: "veto", decision: hit.decision },
     };
 }
 //# sourceMappingURL=hookpolicy.js.map

package/dist/core/relativeImports.js

@@ -0,0 +1,33 @@
+import { dirname, join, posix } from "node:path";
+function toPosix(path) {
+    return path.split(/[\\/]/).join(posix.sep);
+}
+/** Candidate source files for one static relative JS/TS import, in the same
+ * deterministic precedence order used by the indexer. Bare packages, URLs,
+ * absolute paths, and import-map aliases are deliberately unsupported. */
+export function relativeImportCandidates(fromFile, specifier) {
+    if (!specifier.startsWith(".") || specifier.includes("\0"))
+        return [];
+    const base = toPosix(join(dirname(fromFile), specifier));
+    return [...new Set([
+            base.replace(/\.js$/, ".ts"),
+            base.replace(/\.js$/, ".tsx"),
+            base.replace(/\.jsx$/, ".tsx"),
+            base + ".ts",
+            base + ".tsx",
+            base,
+            base + ".js",
+            toPosix(join(base, "index.ts")),
+            toPosix(join(base, "index.tsx")),
+            toPosix(join(base, "index.js")),
+        ])];
+}
+/** Resolve against an exact file set. The first candidate preserves existing
+ * indexer compatibility; callers that need ambiguity metadata can inspect the
+ * returned matches instead of guessing a different target. */
+export function resolveRelativeImport(fromFile, specifier, availableFiles) {
+    const available = new Set(availableFiles);
+    const matches = relativeImportCandidates(fromFile, specifier).filter((candidate) => available.has(candidate));
+    return { path: matches[0] ?? null, matches };
+}
+//# sourceMappingURL=relativeImports.js.map

package/dist/core/stats.js

@@ -0,0 +1,115 @@
+/** A constraint that actually has teeth: active, blocking, and human-vouched — the
+ *  same "ARMED" definition `hunch status` uses. Draft/advisory rules don't count as
+ *  locked stock. */
+function isLocked(c) {
+    const src = c.provenance?.source;
+    const vouched = !!src && (src.includes("human_confirmed") || src === "derived");
+    return c.status === "active" && c.severity === "blocking" && vouched;
+}
+function eventMs(e) {
+    const t = Date.parse(e.at);
+    return Number.isNaN(t) ? 0 : t;
+}
+/** Tally the four return metrics over a set of events. `bugs_reprevented` is the
+ *  strict, deterministic claim: a blocked edit whose enforcing decision was caused
+ *  by a bug that has DEMONSTRABLY regressed (came back once already). No event ever
+ *  fabricates that shape — it's a real join over the graph. */
+function tallyReturn(events, decById, bugById) {
+    let caught = 0, drifts = 0, reprevented = 0, vetoes = 0;
+    for (const e of events) {
+        if (e.kind === "constraint" || e.kind === "veto" || e.kind === "conformance")
+            caught++;
+        if (e.kind === "veto")
+            vetoes++;
+        if (e.kind === "drift")
+            drifts++;
+        if (e.decision) {
+            const d = decById.get(e.decision);
+            const bug = d?.caused_by_bug ? bugById.get(d.caused_by_bug) : undefined;
+            if (bug && bug.status === "regressed")
+                reprevented++;
+        }
+    }
+    return { violations_caught: caught, drifts_flagged: drifts, bugs_reprevented: reprevented, vetoes_fired: vetoes };
+}
+export function computeStats(input) {
+    const { decisions, constraints, bugs, componentIds, events } = input;
+    const byStatus = (recs, s) => recs.filter((r) => r.status === s).length;
+    const activeConstraints = constraints.filter((c) => c.status === "active");
+    const locked = activeConstraints.filter(isLocked).length;
+    // Coverage: distinct components named by at least one decision, over total. Only
+    // component ids that actually EXIST count (a dangling ref isn't coverage).
+    const compSet = new Set(componentIds);
+    const touched = new Set();
+    for (const d of decisions)
+        for (const c of d.related_components)
+            if (compSet.has(c))
+                touched.add(c);
+    const componentsTotal = componentIds.length;
+    const pct = componentsTotal ? touched.size / componentsTotal : 0;
+    const decById = new Map(decisions.map((d) => [d.id, d]));
+    const bugById = new Map(bugs.map((b) => [b.id, b]));
+    const inWindow = events.filter((e) => eventMs(e) >= input.windowStart);
+    const lifetime = tallyReturn(events, decById, bugById);
+    const windowReturn = tallyReturn(inWindow, decById, bugById);
+    const rulesRecorded = locked;
+    const catchesLifetime = lifetime.violations_caught;
+    return {
+        schema: "hunch.stats/1",
+        generated_at: new Date(input.now).toISOString(),
+        window: { since: input.windowLabel, from: new Date(input.windowStart).toISOString(), to: new Date(input.now).toISOString() },
+        stock: {
+            decisions: {
+                total: decisions.length,
+                accepted: byStatus(decisions, "accepted"),
+                superseded: byStatus(decisions, "superseded"),
+                proposed: byStatus(decisions, "proposed"),
+                rejected: byStatus(decisions, "rejected"),
+            },
+            invariants: { total: activeConstraints.length, locked, advisory: activeConstraints.length - locked, stale: input.staleConstraints },
+            components: componentsTotal,
+            bugs: {
+                total: bugs.length,
+                open: byStatus(bugs, "open"),
+                investigating: byStatus(bugs, "investigating"),
+                fixed: byStatus(bugs, "fixed"),
+                regressed: byStatus(bugs, "regressed"),
+            },
+            runbooks: input.runbooksCount,
+            coverage: { components_with_decision: touched.size, components_total: componentsTotal, pct: Math.round(pct * 100) / 100 },
+        },
+        return: { window: windowReturn, lifetime },
+        compounding: {
+            rules_recorded: rulesRecorded,
+            catches_lifetime: catchesLifetime,
+            payback_ratio: rulesRecorded ? Math.round((catchesLifetime / rulesRecorded) * 10) / 10 : 0,
+        },
+    };
+}
+/** Human-readable receipt for the terminal (the CLI's default, non-`--json` output).
+ *  Same three blocks as the JSON: stock → return → compounding. Honest zeros are
+ *  shown plainly, never hidden — a young graph reads as young, not as broken. */
+export function formatStats(s) {
+    const L = [];
+    const pct = Math.round(s.stock.coverage.pct * 100);
+    L.push(`\n🧠 Hunch — engineering-memory stats\n`);
+    L.push(`  STOCK (accumulated)`);
+    L.push(`    decisions:  ${s.stock.decisions.total}  (${s.stock.decisions.accepted} accepted · ${s.stock.decisions.proposed} proposed · ${s.stock.decisions.superseded} superseded)`);
+    L.push(`    invariants: ${s.stock.invariants.total}  (${s.stock.invariants.locked} locked · ${s.stock.invariants.advisory} advisory${s.stock.invariants.stale ? ` · ${s.stock.invariants.stale} stale` : ""})`);
+    L.push(`    components: ${s.stock.components}   ·   bugs: ${s.stock.bugs.total}   ·   runbooks: ${s.stock.runbooks}`);
+    L.push(`    coverage:   ${pct}% of components explained by ≥1 decision  (${s.stock.coverage.components_with_decision}/${s.stock.coverage.components_total})`);
+    L.push(`\n  RETURN (what the stock caught)`);
+    const r = s.return.lifetime, w = s.return.window;
+    L.push(`    this ${s.window.since}:  ${w.violations_caught} caught · ${w.drifts_flagged} drift · ${w.bugs_reprevented} re-prevented`);
+    L.push(`    lifetime:    ${r.violations_caught} caught · ${r.bugs_reprevented} re-prevented`);
+    L.push(`\n  COMPOUNDING`);
+    if (s.compounding.rules_recorded && s.compounding.catches_lifetime) {
+        L.push(`    ${s.compounding.rules_recorded} locked rule(s) → ${s.compounding.catches_lifetime} catch(es)  ·  each rule pays back ${s.compounding.payback_ratio}×`);
+    }
+    else {
+        L.push(`    ${s.compounding.rules_recorded} locked rule(s), ${s.compounding.catches_lifetime} catch(es) so far — the catch-log grows as the gate fires (nothing to inflate).`);
+    }
+    L.push("");
+    return L.join("\n");
+}
+//# sourceMappingURL=stats.js.map

package/dist/extractors/git.js

@@ -18,6 +18,17 @@ function gitSafe(args, cwd, maxBuffer) {
         return "";
     }
 }
+function gitRawSafe(args, cwd, maxBuffer = 64 * 1024 * 1024) {
+    try {
+        return execFileSync("git", args, {
+            cwd, encoding: "utf8", maxBuffer,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        return null;
+    }
+}
 export function isGitRepo(cwd) {
     return gitSafe(["rev-parse", "--is-inside-work-tree"], cwd) === "true";
 }
@@ -82,6 +93,14 @@ export function commitAndPushHunch(hunchDir, message, opts = {}) {
             }
             return null;
         }
+        // Grounding docs refreshed by this capture ride the same memory commit, so committed record
+        // counts can never go stale (the refresh-counts treadmill: every capture commit bumped the
+        // count and re-staled the docs for the next release-gate clean-tree check). Staged AFTER the
+        // memory-only backstop on purpose: alsoStage is a code-controlled list of generated grounding
+        // docs the caller verified git-clean BEFORE rewriting, so it can neither weaken the
+        // bug_overlay_clobber detection above nor sweep user edits.
+        for (const file of opts.alsoStage ?? [])
+            run(["add", "--", file]);
         // Only sync+push when a memory commit was actually created — never run pull/push against the
         // enclosing repo on an empty stage. Two-way sync: MERGE the remote BEFORE pushing so a push
         // can't be rejected non-fast-forward; the .hunch merge driver resolves same-record conflicts
@@ -112,6 +131,16 @@ export function commitAndPushHunch(hunchDir, message, opts = {}) {
         catch { /* released best-effort */ }
     }
 }
+/** True when `rel` is tracked with no staged or unstaged changes (untracked counts as
+ *  dirty, so a doc the user never committed is never swept into a memory commit). */
+export function isGitCleanPath(root, rel) {
+    try {
+        return execFileSync("git", ["-C", root, "status", "--porcelain", "--", rel], { encoding: "utf8" }).trim() === "";
+    }
+    catch {
+        return false;
+    }
+}
 /** Is the staged set a clean, MEMORY-ONLY change — only JSON record adds/updates, nothing else?
  *  The overlay store is entirely JSON (decisions/, bugs/, …, manifest.json). A real memory sync
  *  is purely additive; a DELETION, rename, or any non-.json staged path means hunchDir is NOT a
@@ -274,6 +303,46 @@ export function commitMeta(sha, cwd) {
     const [full = "", short = "", subject = "", body = "", author = "", date = ""] = raw.split("\x1f");
     return { sha: full, shortSha: short, subject, body, author, date, files: commitFiles(sha, cwd) };
 }
+/** First-parent and exact blob seams for deterministic before/after analysis.
+ * They never check out a ref or mutate the active worktree. */
+export function firstParent(sha, cwd) {
+    const row = gitSafe(["rev-list", "--parents", "-n", "1", sha], cwd);
+    const parts = row.split(/\s+/).filter(Boolean);
+    return parts.length > 1 ? parts[1] : null;
+}
+export function fileAtRef(ref, file, cwd) {
+    return gitRawSafe(["show", `${ref}:${file}`], cwd);
+}
+/** Name-status records for one commit, rename-aware and NUL-delimited so paths
+ * with whitespace cannot corrupt the parser. */
+export function commitChanges(sha, cwd) {
+    const raw = gitRawSafe(["diff-tree", "--root", "--no-commit-id", "--name-status", "-r", "-M", "-z", sha], cwd);
+    if (raw == null)
+        return [];
+    const fields = raw.split("\0").filter((v) => v !== "");
+    const out = [];
+    for (let i = 0; i < fields.length;) {
+        const code = fields[i++];
+        const kind = code[0];
+        if (kind === "R" || kind === "C") {
+            const before = fields[i++] ?? null;
+            const after = fields[i++] ?? null;
+            if (before && after)
+                out.push({ status: kind === "R" ? "renamed" : "copied", before, after });
+            continue;
+        }
+        const file = fields[i++] ?? null;
+        if (!file)
+            continue;
+        if (kind === "A")
+            out.push({ status: "added", before: null, after: file });
+        else if (kind === "D")
+            out.push({ status: "deleted", before: file, after: null });
+        else
+            out.push({ status: "modified", before: file, after: file });
+    }
+    return out;
+}
 /** Machine-generated paths that carry no design "why" — lockfiles, build output,
  *  vendored deps, snapshots, source maps. Excluded from synthesis diffs via git
  *  pathspec BEFORE git assembles/orders the patch: a huge lockfile sorts ahead of
@@ -320,6 +389,18 @@ export function lastCommitForFile(file, cwd) {
     const sha = gitSafe(["log", "-1", "--format=%h", "--", file], cwd);
     return sha ? `commit:${sha}` : "";
 }
+/** Full SHA of the commit that introduced a path. Unlike lastCommitForFile this
+ * remains stable when lifecycle/proof updates later touch the same policy file. */
+export function firstCommitForFile(file, cwd) {
+    // Deliberately do NOT use --follow: content-similar, immutable-ID JSON policy
+    // files can be misclassified as renames of one another, moving valid_from to a
+    // different policy's introduction commit.
+    const added = gitSafe(["log", "--diff-filter=A", "--format=%H", "--", file], cwd)
+        .split("\n").find(Boolean);
+    if (added)
+        return added;
+    return gitSafe(["log", "--reverse", "--format=%H", "--", file], cwd).split("\n").find(Boolean) ?? "";
+}
 /** ISO author-date of the most recent commit touching a file ("" if none). */
 export function lastChangeDate(file, cwd) {
     return gitSafe(["log", "-1", "--format=%aI", "--", file], cwd);

package/dist/extractors/indexer.js

@@ -8,9 +8,11 @@
  * then runs HunchStore.reindex() to refresh the SQLite index.
  */
 import { readFileSync, statSync, readdirSync } from "node:fs";
-import { join, relative, dirname, posix } from "node:path";
+import { join, relative, posix } from "node:path";
 import { parseSource, attributeCalls } from "./parse.js";
 import { symbolId, componentId, edgeId, sha1 } from "../core/ids.js";
+import { externalImportNodeId, externalPackage } from "../core/externalImports.js";
+import { resolveRelativeImport } from "../core/relativeImports.js";
 import { extracted, inferred } from "../core/types.js";
 import { isGitRepo, trackedFiles, fileGitMetrics } from "./git.js";
 const CODE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
@@ -82,6 +84,10 @@ export function indexRepo(store, root, opts = {}) {
         perFileImports.push({ file: rel, imports: parsed.imports });
     }
     const byId = new Map(symbols.map((s) => [s.id, s]));
+    const importedFiles = new Map(perFileImports.map(({ file, imports }) => [
+        file,
+        new Set(imports.map((specifier) => resolveImport(file, specifier, fileSymbols)).filter((target) => !!target)),
+    ]));
     // ---- pass 2: resolve calls -> symbol-level edges -------------------------
     const edges = [];
     const edgeSeen = new Set();
@@ -100,7 +106,7 @@ export function indexRepo(store, root, opts = {}) {
                 continue;
             const callerName = byId.get(callerId)?.name ?? "?";
             for (const [calleeName, memberOnly] of callees) {
-                const calleeId = resolveName(calleeName, file, nameIndex, byId);
+                const calleeId = resolveName(calleeName, file, importedFiles.get(file) ?? new Set(), nameIndex, byId);
                 if (!calleeId || calleeId === callerId)
                     continue;
                 // A member call `x.foo()` only yields an edge when `foo` resolves to a
@@ -146,17 +152,31 @@ export function indexRepo(store, root, opts = {}) {
             continue;
         for (const spec of imports) {
             const target = resolveImport(file, spec, fileSymbols);
-            if (!target)
+            if (target) {
+                const toCmp = fileToComponent.get(target);
+                if (!toCmp || toCmp === fromCmp)
+                    continue;
+                addEdge({
+                    id: edgeId(fromCmp, toCmp, "depends_on"),
+                    from: fromCmp, to: toCmp, type: "depends_on",
+                    reason: `${file} imports ${target}`, strength: 0.6,
+                    provenance: extracted(0.9, [`${file}:imports:${spec}`]),
+                });
                 continue;
-            const toCmp = fileToComponent.get(target);
-            if (!toCmp || toCmp === fromCmp)
+            }
+            const dependency = externalPackage(spec);
+            const external = externalImportNodeId(spec);
+            const anchors = [...(fileSymbols.get(file) ?? [])].sort();
+            if (!dependency || !external || !anchors.length)
                 continue;
-            addEdge({
-                id: edgeId(fromCmp, toCmp, "depends_on"),
-                from: fromCmp, to: toCmp, type: "depends_on",
-                reason: `${file} imports ${target}`, strength: 0.6,
-                provenance: extracted(0.9, [`${file}:imports:${spec}`]),
-            });
+            for (const anchor of anchors) {
+                addEdge({
+                    id: edgeId(anchor, external, "imports"),
+                    from: anchor, to: external, type: "imports",
+                    reason: `${file} imports external package ${dependency}`, strength: 1,
+                    provenance: extracted(1, [`${file}:imports:${spec}`]),
+                });
+            }
         }
     }
     // persist
@@ -215,8 +235,11 @@ function listCodeFiles(root) {
     walk(root);
     return out;
 }
-/** Resolve a callee name to a symbol id: prefer same-file, else unique global. */
-function resolveName(name, file, nameIndex, byId) {
+/** Resolve a callee name to a symbol id: prefer same-file, otherwise require a
+ * unique symbol in a statically imported local file. A unique repository-wide
+ * name is not evidence of a binding: callback parameters and built-ins often
+ * share names with unrelated exported symbols. */
+function resolveName(name, file, importedFiles, nameIndex, byId) {
     const candidates = nameIndex.get(name);
     if (!candidates || candidates.length === 0)
         return null;
@@ -225,34 +248,12 @@ function resolveName(name, file, nameIndex, byId) {
         return sameFile[0];
     if (sameFile.length > 1)
         return null; // ambiguous within the file — don't guess
-    if (candidates.length === 1)
-        return candidates[0];
-    // ambiguous across files — skip to avoid wrong edges (keeps the graph clean)
-    return null;
+    const imported = candidates.filter((id) => importedFiles.has(byId.get(id)?.file ?? ""));
+    return imported.length === 1 ? imported[0] : null;
 }
 /** Resolve a relative import specifier to a concrete tracked file path. */
 function resolveImport(fromFile, spec, fileSymbols) {
-    if (!spec.startsWith("."))
-        return null; // external package
-    const base = toPosix(join(dirname(fromFile), spec));
-    // Prefer TS source rewrites over the literal `.js` specifier: in a TS repo an
-    // import of "./db.js" resolves to db.ts. Only fall back to the literal path.
-    const candidates = [
-        base.replace(/\.js$/, ".ts"),
-        base.replace(/\.js$/, ".tsx"),
-        base.replace(/\.jsx$/, ".tsx"),
-        base + ".ts",
-        base + ".tsx",
-        base,
-        base + ".js",
-        toPosix(join(base, "index.ts")),
-        toPosix(join(base, "index.tsx")),
-        toPosix(join(base, "index.js")),
-    ];
-    for (const c of candidates)
-        if (fileSymbols.has(c))
-            return c;
-    return null;
+    return resolveRelativeImport(fromFile, spec, fileSymbols.keys()).path;
 }
 /** Derive components from the directory layout: the directory immediately under
  *  `src/` (or the top-level dir) groups files into a module component. */

package/dist/extractors/nativeTreeSitter.js

@@ -0,0 +1,108 @@
+import { createRequire } from "node:module";
+import { copyFileSync, mkdirSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+const runtimeRequire = createRequire(import.meta.url);
+const COPY_PREFIX = "hunch-tree-sitter-";
+const NATIVE_PACKAGES = ["tree-sitter", "tree-sitter-typescript"];
+let runtime = null;
+function processIsAlive(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function removeStaleCopies() {
+    let entries;
+    try {
+        entries = readdirSync(tmpdir(), { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const match = new RegExp(`^${COPY_PREFIX}(\\d+)-`).exec(entry.name);
+        if (!match || processIsAlive(Number(match[1])))
+            continue;
+        try {
+            rmSync(join(tmpdir(), entry.name), { recursive: true, force: true, maxRetries: 2 });
+        }
+        catch {
+            // Another process may have won the cleanup race, or Windows may still be
+            // releasing a just-exited native module. A later process can retry.
+        }
+    }
+}
+function environmentKey(packageName) {
+    return `${packageName.toUpperCase().replaceAll("-", "_")}_PREBUILD`;
+}
+function copyNativeBinding(packageName, copyRoot, nodeGypBuild) {
+    const packageRoot = dirname(runtimeRequire.resolve(`${packageName}/package.json`));
+    const source = nodeGypBuild.path(packageRoot);
+    const packageCopy = join(copyRoot, packageName);
+    const normalized = source.replaceAll("\\", "/");
+    const prebuild = /\/prebuilds\/([^/]+)\/[^/]+$/.exec(normalized);
+    const destination = prebuild
+        ? join(packageCopy, "prebuilds", prebuild[1], basename(source))
+        : join(packageCopy, "build", "Release", basename(source));
+    mkdirSync(dirname(destination), { recursive: true });
+    copyFileSync(source, destination);
+    return packageCopy;
+}
+/** Load both native tree-sitter addons from process-owned temp copies. Windows
+ * keeps loaded `.node` files locked for the process lifetime; redirecting the
+ * upstream loaders means npm can replace the installed package during an active
+ * MCP session without killing that session or falling back to a stale binary. */
+export function loadNativeTreeSitter() {
+    if (runtime)
+        return runtime;
+    const preloaded = Object.keys(runtimeRequire.cache).filter((path) => /tree-sitter(?:-typescript)?\.node$/.test(path)
+        && !new RegExp(`(?:^|[\\\\/])${COPY_PREFIX}\\d+-`).test(path));
+    if (preloaded.length) {
+        throw new Error(`tree-sitter native addon was loaded before Hunch could isolate it: ${preloaded.join(", ")}`);
+    }
+    removeStaleCopies();
+    const copyRoot = mkdtempSync(join(tmpdir(), `${COPY_PREFIX}${process.pid}-`));
+    const nodeGypBuild = runtimeRequire("node-gyp-build");
+    const previous = new Map();
+    try {
+        for (const packageName of NATIVE_PACKAGES) {
+            const key = environmentKey(packageName);
+            previous.set(key, process.env[key]);
+            process.env[key] = copyNativeBinding(packageName, copyRoot, nodeGypBuild);
+        }
+        const Parser = runtimeRequire("tree-sitter");
+        const languages = runtimeRequire("tree-sitter-typescript");
+        runtime = { Parser, typescript: languages.typescript, tsx: languages.tsx };
+    }
+    catch (error) {
+        try {
+            rmSync(copyRoot, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+        throw error;
+    }
+    finally {
+        for (const [key, value] of previous) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+    process.once("exit", () => {
+        try {
+            rmSync(copyRoot, { recursive: true, force: true });
+        }
+        catch { /* next process prunes it */ }
+    });
+    return runtime;
+}
+//# sourceMappingURL=nativeTreeSitter.js.map