@davesheffer/hunch 1.8.2 → 1.9.2

package/dist/integrations/gitignore.js

@@ -9,8 +9,9 @@
  * Idempotent + merge-safe (con_8460b6770f): appends a single marked block and
  * never rewrites the user's existing entries; re-running is a no-op.
  */
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync, existsSync, lstatSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { writeFileAtomic } from "../core/io.js";
 const MARK = "# >>> hunch (derived runtime index — regenerable from .hunch/*.json) >>>";
 const END = "# <<< hunch <<<";
 const ENTRIES = [
@@ -50,14 +51,51 @@ const MEM_ENTRIES = [
     ".hunch/symbols/",
     ".hunch/edges/",
 ];
+function pathIsWithin(path, parent) {
+    const rel = relative(parent, path);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+/** Defense in depth for integration files written automatically after a clone.
+ * Refuse symlinks, directories/devices, and hard links; require the canonical
+ * target to be the expected top-level file inside the canonical repository root. */
+export function assertSafeTopLevelConfigFile(root, name) {
+    const lexicalRoot = resolve(root);
+    const rootStat = lstatSync(lexicalRoot);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+        throw new Error(`refusing to write integration config through unsafe repository root: ${root}`);
+    }
+    if (name !== ".gitignore" && name !== ".gitattributes") {
+        throw new Error(`refusing unexpected integration config path: ${name}`);
+    }
+    const canonicalRoot = realpathSync(lexicalRoot);
+    const path = join(lexicalRoot, name);
+    let stat;
+    try {
+        stat = lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return path;
+        throw error;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) {
+        throw new Error(`refusing to write unsafe integration config: ${path}`);
+    }
+    const canonicalPath = realpathSync(path);
+    if (!pathIsWithin(canonicalPath, canonicalRoot) || canonicalPath !== join(canonicalRoot, name)) {
+        throw new Error(`refusing integration config outside repository root: ${path}`);
+    }
+    return path;
+}
 /** Idempotent + merge-safe append of one marked block (con_8460b6770f): never
  *  rewrites the user's existing entries, and re-running is a no-op once the block
  *  (or an equivalent hand-written set of the same patterns) is present. */
 function appendBlock(root, mark, entries, end) {
-    const path = join(root, ".gitignore");
+    const path = assertSafeTopLevelConfigFile(root, ".gitignore");
     const block = [mark, ...entries, end].join("\n");
     if (!existsSync(path)) {
-        writeFileSync(path, block + "\n");
+        assertSafeTopLevelConfigFile(root, ".gitignore");
+        writeFileAtomic(path, block + "\n");
         return { path, action: "created" };
     }
     const cur = readFileSync(path, "utf8");
@@ -70,7 +108,8 @@ function appendBlock(root, mark, entries, end) {
     if (entries.every((e) => lines.has(e)))
         return { path, action: "unchanged" };
     const sep = cur.endsWith("\n") || cur.length === 0 ? "" : "\n";
-    writeFileSync(path, `${cur}${sep}${block}\n`);
+    assertSafeTopLevelConfigFile(root, ".gitignore");
+    writeFileAtomic(path, `${cur}${sep}${block}\n`);
     return { path, action: "appended" };
 }
 export function ensureGitignore(root) {

package/dist/integrations/mergeDriver.js

@@ -6,15 +6,30 @@
  */
 import { execFileSync } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
 import { writeFileAtomic } from "../core/io.js";
+import { assertSafeTopLevelConfigFile } from "./gitignore.js";
 // Route the .hunch JSON records through the structured driver — but NOT the
 // manifest (an id-less `{schema_version}` object the driver can't merge by id; a
 // normal text merge with conflict markers is the right behavior for it).
 const ATTR_LINES = [".hunch/**/*.json merge=hunch", ".hunch/manifest.json merge=text"];
+function targetRepositoryEnv() {
+    const env = { ...process.env };
+    for (const key of [
+        "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_CONFIG", "GIT_CONFIG_PARAMETERS", "GIT_CONFIG_COUNT",
+        "GIT_OBJECT_DIRECTORY", "GIT_DIR", "GIT_WORK_TREE", "GIT_IMPLICIT_WORK_TREE", "GIT_GRAFT_FILE",
+        "GIT_INDEX_FILE", "GIT_NO_REPLACE_OBJECTS", "GIT_REPLACE_REF_BASE", "GIT_PREFIX",
+        "GIT_INTERNAL_SUPER_PREFIX", "GIT_SHALLOW_FILE", "GIT_COMMON_DIR",
+    ])
+        delete env[key];
+    for (const key of Object.keys(env)) {
+        if (/^GIT_CONFIG_(?:KEY|VALUE)_\d+$/.test(key))
+            delete env[key];
+    }
+    return env;
+}
 export function installMergeDriver(root, invShell) {
     // 1. .gitattributes — committed, shared with the team so the routing travels.
-    const attrPath = join(root, ".gitattributes");
+    const attrPath = assertSafeTopLevelConfigFile(root, ".gitattributes");
     let text = existsSync(attrPath) ? readFileSync(attrPath, "utf8") : "";
     let attrAction = "present";
     for (const line of ATTR_LINES) {
@@ -24,14 +39,17 @@ export function installMergeDriver(root, invShell) {
             attrAction = "written";
         }
     }
-    if (attrAction === "written")
+    if (attrAction === "written") {
+        assertSafeTopLevelConfigFile(root, ".gitattributes");
         writeFileAtomic(attrPath, text);
+    }
     // 2. Local git config — the driver definition is per-clone (it references this
     //    machine's node + cli path), so it is NOT committed; teammates re-run init.
     const driver = `${invShell} merge-driver "%O" "%A" "%B" "%P"`;
+    const env = targetRepositoryEnv();
     try {
-        execFileSync("git", ["config", "merge.hunch.name", "hunch structured JSON merge"], { cwd: root });
-        execFileSync("git", ["config", "merge.hunch.driver", driver], { cwd: root });
+        execFileSync("git", ["config", "merge.hunch.name", "hunch structured JSON merge"], { cwd: root, env });
+        execFileSync("git", ["config", "merge.hunch.driver", driver], { cwd: root, env });
     }
     catch {
         return { action: `${attrAction} .gitattributes — but \`git config\` failed (not a git repo?)` };

package/dist/integrations/sync.js

@@ -10,11 +10,60 @@
 import { dirname } from "node:path";
 import { commitAndPushHunch } from "../extractors/git.js";
 import { refreshCommittableGrounding } from "./providers.js";
+import { advertisedTeamRemoteContract } from "./team.js";
+const pinnedSharedRoutes = new WeakMap();
+/** Bind one command/server Store instance to the graph epoch that admitted it.
+ * Every later flush from that instance reuses the same verifying contract. */
+export function pinSharedRemote(store, remote) {
+    pinnedSharedRoutes.set(store, remote);
+}
+/** Return the route admitted for this Store instance. Command paths that flush
+ * directly (rather than through flushCapture) must use this accessor too, or a
+ * coherent team.json/origin rewrite could switch graphs mid-command. */
+export function sharedRemoteFor(store) {
+    if (store.mode !== "shared" || !store.privateDir)
+        return undefined;
+    return pinnedSharedRoutes.get(store)
+        ?? advertisedTeamRemoteContract(store.publicRoot, dirname(store.privateDir));
+}
+/** Flush one exact artifact home. Constitution repositories can explicitly
+ * choose public even in unified mode, so this must not infer routing through
+ * captureHome(isPrivate). The caller supplies the repository's actual home. */
+export function flushMemoryHome(store, publicHunchDir, home, message, remoteOverride) {
+    if (home === "private") {
+        if (!store.privateAutoCommit || !store.privateDir)
+            return null;
+        return commitAndPushHunch(store.privateDir, message, {
+            push: true,
+            protectedRepoRoot: store.publicRoot,
+            remote: remoteOverride ?? sharedRemoteFor(store),
+        });
+    }
+    if (!store.autoCommit)
+        return null;
+    const grounding = refreshCommittableGrounding(dirname(publicHunchDir), store);
+    return commitAndPushHunch(publicHunchDir, message, { push: false, alsoStage: grounding });
+}
+/** One completion flush per touched home. A mixed ingest/bootstrap can write
+ * both homes; unchanged homes are cheap no-ops after the memory-only stage
+ * check, while each real home becomes durable exactly once. */
+export function flushMemoryHomes(store, publicHunchDir, homes, message, remoteOverride) {
+    const results = {};
+    for (const home of new Set(homes)) {
+        results[home] = flushMemoryHome(store, publicHunchDir, home, message, remoteOverride);
+    }
+    return results;
+}
 /** Auto-commit + push the overlay after a private write, when auto-commit is on. No-op
  *  otherwise (manual `hunch private --sync` still works). Never throws. */
 export function flushPrivate(store, message) {
-    if (store.privateAutoCommit && store.privateDir)
-        commitAndPushHunch(store.privateDir, message);
+    if (store.privateAutoCommit && store.privateDir) {
+        commitAndPushHunch(store.privateDir, message, {
+            push: true,
+            protectedRepoRoot: store.publicRoot,
+            remote: sharedRemoteFor(store),
+        });
+    }
 }
 /** Auto-commit the store a capture landed in. Returns what ACTUALLY happened so callers
  *  never report a commit that was skipped: "pushed" (overlay committed + pushed),
@@ -22,12 +71,19 @@ export function flushPrivate(store, message) {
  *  overlay commit whose merge/push failed retries on the next flush), or null (auto-commit
  *  off, no overlay for a private record, or the commit was skipped — lock held, safety
  *  backstop, nothing staged; the record stays on disk and the next flush sweeps it up). */
-export function flushCapture(store, publicHunchDir, isPrivate, message) {
+export function flushCapture(store, publicHunchDir, isPrivate, message, 
+/** Long-lived callers can pin the route snapshot that admitted the write. */
+remoteOverride) {
     // Follow the same routing as HunchStore.captureHome: unified ("shared") mode homes
     // EVERY capture in the overlay, so the flush must go there too — one source of truth.
     if (store.captureHome(isPrivate) === "private") {
-        if (store.privateAutoCommit && store.privateDir)
-            return commitAndPushHunch(store.privateDir, message);
+        if (store.privateAutoCommit && store.privateDir) {
+            return commitAndPushHunch(store.privateDir, message, {
+                push: true,
+                protectedRepoRoot: store.publicRoot,
+                remote: remoteOverride ?? sharedRemoteFor(store),
+            });
+        }
         return null;
     }
     if (!store.autoCommit)