@davesheffer/hunch 1.7.0 → 1.8.0

package/dist/extractors/git.js

@@ -3,6 +3,7 @@
 import { execFileSync } from "node:child_process";
 import { isAbsolute, resolve, join, basename, dirname } from "node:path";
 import { mkdirSync, rmSync, statSync, realpathSync, readFileSync } from "node:fs";
+import { MEMLOG_FORMAT } from "../core/memorylog.js";
 function git(args, cwd, maxBuffer = 64 * 1024 * 1024) {
     // stdio: capture stdout, silence stderr (so "no commits yet" etc. don't leak).
     return execFileSync("git", args, {
@@ -18,6 +19,17 @@ function gitSafe(args, cwd, maxBuffer) {
         return "";
     }
 }
+function gitRawSafe(args, cwd, maxBuffer = 64 * 1024 * 1024) {
+    try {
+        return execFileSync("git", args, {
+            cwd, encoding: "utf8", maxBuffer,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        return null;
+    }
+}
 export function isGitRepo(cwd) {
     return gitSafe(["rev-parse", "--is-inside-work-tree"], cwd) === "true";
 }
@@ -82,6 +94,14 @@ export function commitAndPushHunch(hunchDir, message, opts = {}) {
             }
             return null;
         }
+        // Grounding docs refreshed by this capture ride the same memory commit, so committed record
+        // counts can never go stale (the refresh-counts treadmill: every capture commit bumped the
+        // count and re-staled the docs for the next release-gate clean-tree check). Staged AFTER the
+        // memory-only backstop on purpose: alsoStage is a code-controlled list of generated grounding
+        // docs the caller verified git-clean BEFORE rewriting, so it can neither weaken the
+        // bug_overlay_clobber detection above nor sweep user edits.
+        for (const file of opts.alsoStage ?? [])
+            run(["add", "--", file]);
         // Only sync+push when a memory commit was actually created — never run pull/push against the
         // enclosing repo on an empty stage. Two-way sync: MERGE the remote BEFORE pushing so a push
         // can't be rejected non-fast-forward; the .hunch merge driver resolves same-record conflicts
@@ -112,6 +132,16 @@ export function commitAndPushHunch(hunchDir, message, opts = {}) {
         catch { /* released best-effort */ }
     }
 }
+/** True when `rel` is tracked with no staged or unstaged changes (untracked counts as
+ *  dirty, so a doc the user never committed is never swept into a memory commit). */
+export function isGitCleanPath(root, rel) {
+    try {
+        return execFileSync("git", ["-C", root, "status", "--porcelain", "--", rel], { encoding: "utf8" }).trim() === "";
+    }
+    catch {
+        return false;
+    }
+}
 /** Is the staged set a clean, MEMORY-ONLY change — only JSON record adds/updates, nothing else?
  *  The overlay store is entirely JSON (decisions/, bugs/, …, manifest.json). A real memory sync
  *  is purely additive; a DELETION, rename, or any non-.json staged path means hunchDir is NOT a
@@ -266,6 +296,44 @@ export function commitFiles(sha, cwd) {
     const out = gitSafe(["diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
+/** Raw `git log` over `.hunch/`, paired with parseMemoryLog — the memory-move
+ *  timeline (each commit that changed the graph). Newest first; empty on any error
+ *  (no repo / no history), so the caller degrades to an empty timeline. */
+export function gitMemoryLog(root, limit = 200) {
+    return gitSafe(["log", `--max-count=${limit}`, "--no-color", `--format=${MEMLOG_FORMAT}`, "--name-status", "--", ".hunch/"], root);
+}
+/** The diff of a single commit restricted to `.hunch/` — what one memory move
+ *  actually changed, for the click-through popup. Empty on error. */
+export function memoryMoveDiff(sha, root) {
+    return gitSafe(["show", "--no-color", "--format=%H%n%an%n%cI%n%s%n", sha, "--", ".hunch/"], root);
+}
+/** Push the current branch to its remote (the "approve-to-push" step — public
+ *  memory rides the repo, so this is a plain branch push). Returns true on success;
+ *  false when there is no upstream / offline / not a repo. */
+export function pushCurrentBranch(root) {
+    try {
+        execFileSync("git", ["-C", root, "push"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Revert a single memory move locally (no push). Returns true on success. A
+ *  conflicting revert is aborted so the working tree is never left half-reverted. */
+export function revertMemoryMove(sha, root) {
+    try {
+        execFileSync("git", ["-C", root, "revert", "--no-edit", sha], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        try {
+            execFileSync("git", ["-C", root, "revert", "--abort"], { stdio: "ignore" });
+        }
+        catch { /* nothing to abort */ }
+        return false;
+    }
+}
 /** Full metadata + changed files for a commit. */
 export function commitMeta(sha, cwd) {
     const raw = gitSafe(["show", "-s", "--format=%H%x1f%h%x1f%s%x1f%b%x1f%an%x1f%aI", sha], cwd);
@@ -274,6 +342,46 @@ export function commitMeta(sha, cwd) {
     const [full = "", short = "", subject = "", body = "", author = "", date = ""] = raw.split("\x1f");
     return { sha: full, shortSha: short, subject, body, author, date, files: commitFiles(sha, cwd) };
 }
+/** First-parent and exact blob seams for deterministic before/after analysis.
+ * They never check out a ref or mutate the active worktree. */
+export function firstParent(sha, cwd) {
+    const row = gitSafe(["rev-list", "--parents", "-n", "1", sha], cwd);
+    const parts = row.split(/\s+/).filter(Boolean);
+    return parts.length > 1 ? parts[1] : null;
+}
+export function fileAtRef(ref, file, cwd) {
+    return gitRawSafe(["show", `${ref}:${file}`], cwd);
+}
+/** Name-status records for one commit, rename-aware and NUL-delimited so paths
+ * with whitespace cannot corrupt the parser. */
+export function commitChanges(sha, cwd) {
+    const raw = gitRawSafe(["diff-tree", "--root", "--no-commit-id", "--name-status", "-r", "-M", "-z", sha], cwd);
+    if (raw == null)
+        return [];
+    const fields = raw.split("\0").filter((v) => v !== "");
+    const out = [];
+    for (let i = 0; i < fields.length;) {
+        const code = fields[i++];
+        const kind = code[0];
+        if (kind === "R" || kind === "C") {
+            const before = fields[i++] ?? null;
+            const after = fields[i++] ?? null;
+            if (before && after)
+                out.push({ status: kind === "R" ? "renamed" : "copied", before, after });
+            continue;
+        }
+        const file = fields[i++] ?? null;
+        if (!file)
+            continue;
+        if (kind === "A")
+            out.push({ status: "added", before: null, after: file });
+        else if (kind === "D")
+            out.push({ status: "deleted", before: file, after: null });
+        else
+            out.push({ status: "modified", before: file, after: file });
+    }
+    return out;
+}
 /** Machine-generated paths that carry no design "why" — lockfiles, build output,
  *  vendored deps, snapshots, source maps. Excluded from synthesis diffs via git
  *  pathspec BEFORE git assembles/orders the patch: a huge lockfile sorts ahead of
@@ -320,6 +428,18 @@ export function lastCommitForFile(file, cwd) {
     const sha = gitSafe(["log", "-1", "--format=%h", "--", file], cwd);
     return sha ? `commit:${sha}` : "";
 }
+/** Full SHA of the commit that introduced a path. Unlike lastCommitForFile this
+ * remains stable when lifecycle/proof updates later touch the same policy file. */
+export function firstCommitForFile(file, cwd) {
+    // Deliberately do NOT use --follow: content-similar, immutable-ID JSON policy
+    // files can be misclassified as renames of one another, moving valid_from to a
+    // different policy's introduction commit.
+    const added = gitSafe(["log", "--diff-filter=A", "--format=%H", "--", file], cwd)
+        .split("\n").find(Boolean);
+    if (added)
+        return added;
+    return gitSafe(["log", "--reverse", "--format=%H", "--", file], cwd).split("\n").find(Boolean) ?? "";
+}
 /** ISO author-date of the most recent commit touching a file ("" if none). */
 export function lastChangeDate(file, cwd) {
     return gitSafe(["log", "-1", "--format=%aI", "--", file], cwd);

package/dist/extractors/indexer.js

@@ -8,9 +8,11 @@
  * then runs HunchStore.reindex() to refresh the SQLite index.
  */
 import { readFileSync, statSync, readdirSync } from "node:fs";
-import { join, relative, dirname, posix } from "node:path";
+import { join, relative, posix } from "node:path";
 import { parseSource, attributeCalls } from "./parse.js";
 import { symbolId, componentId, edgeId, sha1 } from "../core/ids.js";
+import { externalImportNodeId, externalPackage } from "../core/externalImports.js";
+import { resolveRelativeImport } from "../core/relativeImports.js";
 import { extracted, inferred } from "../core/types.js";
 import { isGitRepo, trackedFiles, fileGitMetrics } from "./git.js";
 const CODE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
@@ -82,6 +84,10 @@ export function indexRepo(store, root, opts = {}) {
         perFileImports.push({ file: rel, imports: parsed.imports });
     }
     const byId = new Map(symbols.map((s) => [s.id, s]));
+    const importedFiles = new Map(perFileImports.map(({ file, imports }) => [
+        file,
+        new Set(imports.map((specifier) => resolveImport(file, specifier, fileSymbols)).filter((target) => !!target)),
+    ]));
     // ---- pass 2: resolve calls -> symbol-level edges -------------------------
     const edges = [];
     const edgeSeen = new Set();
@@ -100,7 +106,7 @@ export function indexRepo(store, root, opts = {}) {
                 continue;
             const callerName = byId.get(callerId)?.name ?? "?";
             for (const [calleeName, memberOnly] of callees) {
-                const calleeId = resolveName(calleeName, file, nameIndex, byId);
+                const calleeId = resolveName(calleeName, file, importedFiles.get(file) ?? new Set(), nameIndex, byId);
                 if (!calleeId || calleeId === callerId)
                     continue;
                 // A member call `x.foo()` only yields an edge when `foo` resolves to a
@@ -146,17 +152,31 @@ export function indexRepo(store, root, opts = {}) {
             continue;
         for (const spec of imports) {
             const target = resolveImport(file, spec, fileSymbols);
-            if (!target)
+            if (target) {
+                const toCmp = fileToComponent.get(target);
+                if (!toCmp || toCmp === fromCmp)
+                    continue;
+                addEdge({
+                    id: edgeId(fromCmp, toCmp, "depends_on"),
+                    from: fromCmp, to: toCmp, type: "depends_on",
+                    reason: `${file} imports ${target}`, strength: 0.6,
+                    provenance: extracted(0.9, [`${file}:imports:${spec}`]),
+                });
                 continue;
-            const toCmp = fileToComponent.get(target);
-            if (!toCmp || toCmp === fromCmp)
+            }
+            const dependency = externalPackage(spec);
+            const external = externalImportNodeId(spec);
+            const anchors = [...(fileSymbols.get(file) ?? [])].sort();
+            if (!dependency || !external || !anchors.length)
                 continue;
-            addEdge({
-                id: edgeId(fromCmp, toCmp, "depends_on"),
-                from: fromCmp, to: toCmp, type: "depends_on",
-                reason: `${file} imports ${target}`, strength: 0.6,
-                provenance: extracted(0.9, [`${file}:imports:${spec}`]),
-            });
+            for (const anchor of anchors) {
+                addEdge({
+                    id: edgeId(anchor, external, "imports"),
+                    from: anchor, to: external, type: "imports",
+                    reason: `${file} imports external package ${dependency}`, strength: 1,
+                    provenance: extracted(1, [`${file}:imports:${spec}`]),
+                });
+            }
         }
     }
     // persist
@@ -215,8 +235,11 @@ function listCodeFiles(root) {
     walk(root);
     return out;
 }
-/** Resolve a callee name to a symbol id: prefer same-file, else unique global. */
-function resolveName(name, file, nameIndex, byId) {
+/** Resolve a callee name to a symbol id: prefer same-file, otherwise require a
+ * unique symbol in a statically imported local file. A unique repository-wide
+ * name is not evidence of a binding: callback parameters and built-ins often
+ * share names with unrelated exported symbols. */
+function resolveName(name, file, importedFiles, nameIndex, byId) {
     const candidates = nameIndex.get(name);
     if (!candidates || candidates.length === 0)
         return null;
@@ -225,34 +248,12 @@ function resolveName(name, file, nameIndex, byId) {
         return sameFile[0];
     if (sameFile.length > 1)
         return null; // ambiguous within the file — don't guess
-    if (candidates.length === 1)
-        return candidates[0];
-    // ambiguous across files — skip to avoid wrong edges (keeps the graph clean)
-    return null;
+    const imported = candidates.filter((id) => importedFiles.has(byId.get(id)?.file ?? ""));
+    return imported.length === 1 ? imported[0] : null;
 }
 /** Resolve a relative import specifier to a concrete tracked file path. */
 function resolveImport(fromFile, spec, fileSymbols) {
-    if (!spec.startsWith("."))
-        return null; // external package
-    const base = toPosix(join(dirname(fromFile), spec));
-    // Prefer TS source rewrites over the literal `.js` specifier: in a TS repo an
-    // import of "./db.js" resolves to db.ts. Only fall back to the literal path.
-    const candidates = [
-        base.replace(/\.js$/, ".ts"),
-        base.replace(/\.js$/, ".tsx"),
-        base.replace(/\.jsx$/, ".tsx"),
-        base + ".ts",
-        base + ".tsx",
-        base,
-        base + ".js",
-        toPosix(join(base, "index.ts")),
-        toPosix(join(base, "index.tsx")),
-        toPosix(join(base, "index.js")),
-    ];
-    for (const c of candidates)
-        if (fileSymbols.has(c))
-            return c;
-    return null;
+    return resolveRelativeImport(fromFile, spec, fileSymbols.keys()).path;
 }
 /** Derive components from the directory layout: the directory immediately under
  *  `src/` (or the top-level dir) groups files into a module component. */

package/dist/extractors/nativeTreeSitter.js

@@ -0,0 +1,108 @@
+import { createRequire } from "node:module";
+import { copyFileSync, mkdirSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+const runtimeRequire = createRequire(import.meta.url);
+const COPY_PREFIX = "hunch-tree-sitter-";
+const NATIVE_PACKAGES = ["tree-sitter", "tree-sitter-typescript"];
+let runtime = null;
+function processIsAlive(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function removeStaleCopies() {
+    let entries;
+    try {
+        entries = readdirSync(tmpdir(), { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const match = new RegExp(`^${COPY_PREFIX}(\\d+)-`).exec(entry.name);
+        if (!match || processIsAlive(Number(match[1])))
+            continue;
+        try {
+            rmSync(join(tmpdir(), entry.name), { recursive: true, force: true, maxRetries: 2 });
+        }
+        catch {
+            // Another process may have won the cleanup race, or Windows may still be
+            // releasing a just-exited native module. A later process can retry.
+        }
+    }
+}
+function environmentKey(packageName) {
+    return `${packageName.toUpperCase().replaceAll("-", "_")}_PREBUILD`;
+}
+function copyNativeBinding(packageName, copyRoot, nodeGypBuild) {
+    const packageRoot = dirname(runtimeRequire.resolve(`${packageName}/package.json`));
+    const source = nodeGypBuild.path(packageRoot);
+    const packageCopy = join(copyRoot, packageName);
+    const normalized = source.replaceAll("\\", "/");
+    const prebuild = /\/prebuilds\/([^/]+)\/[^/]+$/.exec(normalized);
+    const destination = prebuild
+        ? join(packageCopy, "prebuilds", prebuild[1], basename(source))
+        : join(packageCopy, "build", "Release", basename(source));
+    mkdirSync(dirname(destination), { recursive: true });
+    copyFileSync(source, destination);
+    return packageCopy;
+}
+/** Load both native tree-sitter addons from process-owned temp copies. Windows
+ * keeps loaded `.node` files locked for the process lifetime; redirecting the
+ * upstream loaders means npm can replace the installed package during an active
+ * MCP session without killing that session or falling back to a stale binary. */
+export function loadNativeTreeSitter() {
+    if (runtime)
+        return runtime;
+    const preloaded = Object.keys(runtimeRequire.cache).filter((path) => /tree-sitter(?:-typescript)?\.node$/.test(path)
+        && !new RegExp(`(?:^|[\\\\/])${COPY_PREFIX}\\d+-`).test(path));
+    if (preloaded.length) {
+        throw new Error(`tree-sitter native addon was loaded before Hunch could isolate it: ${preloaded.join(", ")}`);
+    }
+    removeStaleCopies();
+    const copyRoot = mkdtempSync(join(tmpdir(), `${COPY_PREFIX}${process.pid}-`));
+    const nodeGypBuild = runtimeRequire("node-gyp-build");
+    const previous = new Map();
+    try {
+        for (const packageName of NATIVE_PACKAGES) {
+            const key = environmentKey(packageName);
+            previous.set(key, process.env[key]);
+            process.env[key] = copyNativeBinding(packageName, copyRoot, nodeGypBuild);
+        }
+        const Parser = runtimeRequire("tree-sitter");
+        const languages = runtimeRequire("tree-sitter-typescript");
+        runtime = { Parser, typescript: languages.typescript, tsx: languages.tsx };
+    }
+    catch (error) {
+        try {
+            rmSync(copyRoot, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+        throw error;
+    }
+    finally {
+        for (const [key, value] of previous) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+    process.once("exit", () => {
+        try {
+            rmSync(copyRoot, { recursive: true, force: true });
+        }
+        catch { /* next process prunes it */ }
+    });
+    return runtime;
+}
+//# sourceMappingURL=nativeTreeSitter.js.map

package/dist/extractors/parse.js

@@ -1,15 +1,5 @@
-/**
- * Deterministic tree-sitter parsing (no LLM). Extracts, per file:
- *   - symbols: functions, methods, classes, interfaces, types, arrow-fn consts
- *   - imports: module specifiers (for dependency edges)
- *   - calls:   callee names + byte offset (mapped to the enclosing symbol)
- *
- * Uses NATIVE tree-sitter (synchronous, prebuilt for Node 20 — see decision in
- * the commit history; web-tree-sitter's WASM grammars had an incompatible ABI).
- */
-import Parser from "tree-sitter";
-import TS from "tree-sitter-typescript";
-const { typescript, tsx } = TS;
+import { loadNativeTreeSitter } from "./nativeTreeSitter.js";
+const { Parser, typescript, tsx } = loadNativeTreeSitter();
 /** Extremely common builtin/array/object/string/promise method names. Member
  *  calls to these (e.g. `arr.map(...)`) must NOT create call edges to unrelated
  *  repo symbols that happen to share the name (DESIGN: keep the graph clean). */
@@ -112,12 +102,12 @@ export function parseSource(file, source) {
             imports.push(node.text.replace(STR_QUOTES, ""));
         }
         else if (cname === "call.id") {
-            calls.push({ callee: node.text, atByte: node.startIndex, member: false });
+            calls.push({ callee: node.text, atByte: node.startIndex, endByte: node.endIndex, member: false });
         }
         else if (cname === "call.member") {
             // skip builtin method names to avoid false edges to similarly-named symbols
             if (!BUILTIN_METHODS.has(node.text))
-                calls.push({ callee: node.text, atByte: node.startIndex, member: true });
+                calls.push({ callee: node.text, atByte: node.startIndex, endByte: node.endIndex, member: true });
         }
     }
     for (const { kind, def, name } of pendingDefs.values()) {
@@ -131,7 +121,7 @@ export function parseSource(file, source) {
         });
     }
     symbols.sort((a, b) => a.startByte - b.startByte);
-    return { symbols, imports, calls };
+    return { symbols, imports, calls, parseable: !tree.rootNode.hasError };
 }
 /** Walk up to the nearest node whose type is a definition we recognize. */
 function ascendToDef(node) {

package/dist/integrations/claudemd.js

@@ -6,6 +6,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { wikiSummary } from "../wiki/wiki.js";
+import { PolicyRepository } from "../constitution/repository.js";
 const START = "<!-- HUNCH:START — auto-generated, do not edit by hand -->";
 const END = "<!-- HUNCH:END -->";
 export function renderHunchSection(store, root) {
@@ -18,6 +19,7 @@ export function renderHunchSection(store, root) {
         bugs: store.json.loadAll("bugs").length,
         constraints: store.json.loadAll("constraints").length,
         components: store.json.loadAll("components").length,
+        policies: root ? new PolicyRepository(root, store).listPolicies({ publicOnly: true }).length : 0,
     };
     const lines = [];
     lines.push(START);
@@ -25,7 +27,7 @@ export function renderHunchSection(store, root) {
     lines.push("");
     lines.push("This repo has **Hunch** — a curated graph of *why* the code is the way it is " +
         "(decisions, bug history, invariants). It currently holds " +
-        `**${counts.decisions} decisions, ${counts.bugs} bugs, ${counts.constraints} constraints, ${counts.components} components**.`);
+        `**${counts.decisions} decisions, ${counts.bugs} bugs, ${counts.constraints} constraints, ${counts.components} components, ${counts.policies} policies**.`);
     lines.push("");
     lines.push("**Consult Hunch via the `hunch_*` MCP tools — pick by MOMENT, not from memory:**");
     lines.push("");
@@ -47,8 +49,13 @@ export function renderHunchSection(store, root) {
     lines.push("");
     lines.push("**Before committing / merging:**");
     lines.push("- `hunch_conformance()` — does the code still SATISFY recorded intent? Run before and after a refactor.");
+    lines.push("- `hunch_policy_evaluate(policy_id?, active_only?)` / `hunch_policy_plan(policy_id)` / `hunch_policy_card(policy_id)` / `hunch_policy_proof(policy_id)` — evaluate canonical policy, inspect the planned corpus, review the evidence/uncertainty card, and inspect raw replay receipts; only an explicit human activation grants authority.");
     lines.push("- `hunch_pr_impact(base?)` / `hunch_merge_verdict(...)` — a change's memory surface; would it re-open a closed bug?");
     lines.push("");
+    lines.push("**Build the Constitution review queue:**");
+    lines.push("- `hunch constitution bootstrap --since 90d --max-candidates 3` (CLI) — normalize recent structured human evidence into at most three non-active policy candidates; add `--history` for exact, human-identifier-grounded fix/revert deltas or explicit dependency retirements. Coincidence/ambiguity stays uncompilable; neither path grants authority.");
+    lines.push("- `hunch constitution ingest --since 90d [--instructions] [--from export.json]` (CLI) — normalize corrections/failures plus bounded committed instructions/ADRs and strict local review/conversation/PR exports into Git-native evidence; raw prose is hash-only, unsupported intent remains uncompilable, and no policy is minted.");
+    lines.push("");
     lines.push("**After deciding / when corrected:**");
     lines.push("- `hunch_capture_decision(topic?)` → `hunch_record_decision(...)` — interview first, then write; status `proposed` = roadmap intent (shows in `hunch now`).");
     lines.push("- `hunch_record_correction(...)` — a human correction becomes an ENFORCED rule (Never Twice), not a one-session memory.");

package/dist/integrations/gitignore.js

@@ -19,6 +19,7 @@ const ENTRIES = [
     ".hunch/*.sqlite-wal",
     ".hunch/*.sqlite-journal",
     ".hunch/**/*.tmp*",
+    ".hunch-cache/",
     // Per-machine private-overlay pointer written by `hunch private` (holds the local
     // path to the private store) — never committed.
     ".hunch/local.json",
@@ -39,6 +40,13 @@ const MEM_ENTRIES = [
     ".hunch/bugs/",
     ".hunch/constraints/",
     ".hunch/components/",
+    ".hunch/evidence/",
+    ".hunch/corpora/",
+    ".hunch/policies/",
+    ".hunch/proofs/",
+    ".hunch/plans/",
+    ".hunch/dispositions/",
+    ".hunch/shadow/",
     ".hunch/symbols/",
     ".hunch/edges/",
 ];

package/dist/integrations/providers.js

@@ -21,6 +21,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { renderHunchSection, upsertSection, updateClaudeMd } from "./claudemd.js";
+import { isGitCleanPath } from "../extractors/git.js";
 /** Strip // line and block comments + trailing commas (JSONC → JSON). String-aware
  *  (double-quoted, with escapes) so a // inside a value isn't mangled. VS Code's
  *  .vscode/mcp.json is JSONC, so we must tolerate comments. */
@@ -405,23 +406,24 @@ export function regenerateGrounding(root, store) {
         writeWindsurfRule(root, store),
     ];
 }
-/** Self-heal: refresh the Hunch section in each grounding doc that ALREADY exists,
- *  and report which ones actually changed. Unlike regenerateGrounding it NEVER creates
- *  a file (so it can't scaffold grounding into a project that opted out of an
- *  assistant). Run by `hunch index` and non-hook `hunch sync` so a project silently
- *  picks up generator fixes (e.g. corrected MCP tool param names) and fresh record
- *  counts on the next refresh — no manual `hunch init`. Not run from the commit hook,
- *  which deliberately avoids dirtying the working tree on every commit. */
-export function refreshExistingGrounding(root, store) {
-    const targets = [
+function groundingTargets(root, store) {
+    return [
         ["CLAUDE.md", () => updateClaudeMd(root, store)],
         ["AGENTS.md", () => writeAgentsMd(root, store)],
         [join(".github", "copilot-instructions.md"), () => writeCopilotInstructions(root, store)],
         [join(".cursor", "rules", "hunch.mdc"), () => writeCursorRule(root, store)],
         [join(".windsurf", "rules", "hunch.md"), () => writeWindsurfRule(root, store)],
     ];
+}
+/** Self-heal: refresh the Hunch section in each grounding doc that ALREADY exists,
+ *  and report which ones actually changed. Unlike regenerateGrounding it NEVER creates
+ *  a file (so it can't scaffold grounding into a project that opted out of an
+ *  assistant). Run by `hunch index` and non-hook `hunch sync` so a project silently
+ *  picks up generator fixes (e.g. corrected MCP tool param names) and fresh record
+ *  counts on the next refresh — no manual `hunch init`. */
+export function refreshExistingGrounding(root, store) {
     const changed = [];
-    for (const [rel, write] of targets) {
+    for (const [rel, write] of groundingTargets(root, store)) {
         const file = join(root, rel);
         if (!existsSync(file))
             continue; // refresh-only: never scaffold a doc the project doesn't have
@@ -432,6 +434,26 @@ export function refreshExistingGrounding(root, store) {
     }
     return changed;
 }
+/** Capture-commit refresh: rewrite ONLY grounding docs that are git-clean, and return the
+ *  absolute paths of the ones that changed so the caller folds them into the memory commit
+ *  (commitAndPushHunch alsoStage). This keeps committed record counts permanently true —
+ *  every capture used to bump the count and re-stale the committed docs, failing the
+ *  release gate's clean-tree check on the next CI index (the refresh-counts treadmill).
+ *  A user-dirty or untracked doc is left completely untouched (never refreshed, never
+ *  staged); it heals on the next manual `hunch sync` or `hunch index`. */
+export function refreshCommittableGrounding(root, store) {
+    const changed = [];
+    for (const [rel, write] of groundingTargets(root, store)) {
+        const file = join(root, rel);
+        if (!existsSync(file) || !isGitCleanPath(root, rel))
+            continue;
+        const before = readFileSync(file, "utf8");
+        write();
+        if (readFileSync(file, "utf8") !== before)
+            changed.push(file);
+    }
+    return changed;
+}
 /** A malformed configuration for one surface (for example an MCP file) must not
  * prevent the same assistant's rule or lifecycle hook from being installed. */
 function runProvider(writers) {

package/dist/integrations/sync.js

@@ -1,4 +1,15 @@
+/**
+ * The single funnel for auto-committing memory after a capture, so memory never has to be
+ * committed by hand — in EVERY mode (auto-commit is ON by default; `--no-auto-commit` opts out).
+ * A private record commits + two-way-syncs (merge remote, then push) its dedicated overlay repo.
+ * A public record commits the repo-tracked .hunch/ WITHOUT pushing — an automatic pull/push on
+ * the user's CODE repo would merge the remote into their working branch and publish unpushed
+ * commits (bug_overlay_clobber); the memory commit rides their next push instead.
+ * Used by every CLI/MCP path that writes a record.
+ */
+import { dirname } from "node:path";
 import { commitAndPushHunch } from "../extractors/git.js";
+import { refreshCommittableGrounding } from "./providers.js";
 /** Auto-commit + push the overlay after a private write, when auto-commit is on. No-op
  *  otherwise (manual `hunch private --sync` still works). Never throws. */
 export function flushPrivate(store, message) {
@@ -21,6 +32,10 @@ export function flushCapture(store, publicHunchDir, isPrivate, message) {
     }
     if (!store.autoCommit)
         return null;
-    return commitAndPushHunch(publicHunchDir, message, { push: false });
+    // A public capture changes record counts, so refresh git-clean grounding docs and fold
+    // them into the SAME memory commit — otherwise every capture re-stales the committed
+    // counts and the release gate's clean-tree check fails on the next CI index.
+    const grounding = refreshCommittableGrounding(dirname(publicHunchDir), store);
+    return commitAndPushHunch(publicHunchDir, message, { push: false, alsoStage: grounding });
 }
 //# sourceMappingURL=sync.js.map