@davesheffer/hunch 1.9.4 → 1.10.1

package/dist/cli/index.js

@@ -222,12 +222,26 @@ program
     if (opts.autoCommit === false) {
         const localFile = join(paths.hunch, "local.json");
         let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(localFile, "utf8"));
+        if (existsSync(localFile)) {
+            // Same contract as every other writer of this file (issue #40): an
+            // unparseable or non-object local.json may hold the private-overlay
+            // pointer — rewriting it from a swallowed parse failure silently
+            // re-routes private captures into the committed public store.
+            try {
+                const parsed = JSON.parse(readFileSync(localFile, "utf8"));
+                existing = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+            }
+            catch {
+                existing = null;
+            }
+        }
+        if (existing === null) {
+            console.warn(`  ⚠ refusing to rewrite ${localFile}: it is not a JSON object and may hold your private-overlay pointer. Fix or remove it, then re-run \`hunch init --no-auto-commit\`.`);
+        }
+        else {
+            writeFileAtomic(localFile, JSON.stringify({ ...existing, autoCommit: false }, null, 2) + "\n");
+            console.log("  ✓ auto-commit OFF (captures stay uncommitted; commit .hunch/ yourself)");
         }
-        catch { /* absent/invalid → fresh */ }
-        writeFileAtomic(localFile, JSON.stringify({ ...existing, autoCommit: false }, null, 2) + "\n");
-        console.log("  ✓ auto-commit OFF (captures stay uncommitted; commit .hunch/ yourself)");
     }
     if (isGitRepo(root)) {
         const syncToOverlay = !!(opts.privateSync || opts.sharedSync);
@@ -259,7 +273,10 @@ program
         console.log(`  ⚠ skipped .mcp.json: ${e.message}`);
     }
     const cmds = writeSlashCommands(root);
-    console.log(`  ✓ wrote ${cmds.length} slash commands (/hunch-why, /hunch-fix, /hunch-fragile)`);
+    console.log(`  ✓ wrote ${cmds.written.length} slash commands (/hunch-why, /hunch-fix, /hunch-fragile, /capture, /heal, /audit)`);
+    for (const s of cmds.skipped) {
+        console.log(`  ⚠ kept your existing ${rel(root, s)} (no hunch:generated marker — delete the file and re-run init to adopt Hunch's version)`);
+    }
     const cmd = updateClaudeMd(root, store);
     console.log(`  ✓ updated ${rel(root, cmd)} with ambient Hunch context`);
     // Firmness: stamp .hunch/config.json (default advisory) so `hunch hook` reads a
@@ -374,7 +391,11 @@ program
     // commit is drafted — not per-commit, and not under --deep (an ensemble may
     // fan out to several distinct workers, each with its own configuration).
     if (!opts.deep && commits.length > 0) {
-        const ctxProvider = await selectProvider();
+        // { root }: the advisory must resolve the SAME provider the synthesis
+        // inside syncCommit resolves (persisted local.json preference included) —
+        // rootless resolution could grade a different provider and swallow the
+        // num_ctx warning for an actual Ollama run (issue #46).
+        const ctxProvider = await selectProvider({ root });
         const ctxWarning = await maybeWarnOllamaContext(ctxProvider.name, process.env);
         if (ctxWarning)
             console.log(ctxWarning);
@@ -3354,6 +3375,13 @@ const vetoCmd = program
         store.close();
         return fail(`--base ref "${opts.base}" does not resolve. In CI, fetch the base branch first (git fetch origin <branch>).`);
     }
+    // Same guard for --commit: an unfetched/mistyped sha would enumerate zero
+    // files and exit 0 — a vacuous pass where CI expects the Decision Guard
+    // to have actually looked (issue #45).
+    if (opts.commit && !revExists(opts.commit, root)) {
+        store.close();
+        return fail(`--commit sha "${opts.commit}" does not resolve. In CI, ensure the commit is fetched (git fetch --depth=... or fetch-depth: 0).`);
+    }
     store.reindex();
     const files = opts.commit ? commitFiles(opts.commit, root)
         : opts.base ? rangeFiles(opts.base, root)
@@ -3593,7 +3621,7 @@ program
         firm: "surfaces + warns on a violating edit",
         strict: "edit-time DENY + CI guard — the teeth are on",
     };
-    console.log(`\nHunch — enforcement status (${root.split("/").pop()})\n`);
+    console.log(`\nHunch — enforcement status (${basename(root)})\n`);
     console.log(`  firmness: ${firmness}   ← ${fnote[firmness] ?? ""}\n`);
     console.log(`  ✓ ARMED        ${blocking.length} confirmed blocking invariant(s) — held against every assistant`);
     if (blocking.length) {
@@ -3855,7 +3883,7 @@ program
         // from this file. No diff exists yet, so this is context — "don't re-add X" —
         // not a block; the commit-time `hunch check` does the actual gating.
         const retired = store.retiredForFile(target).filter((r) => r.symbols.length || r.deps.length);
-        const hasContent = ctx.constraints.length || ctx.decisions.length || ctx.bugs.length || ctx.blast_radius.length || retired.length || docGround;
+        const hasContent = ctx.constraints.length || ctx.decisions.length || ctx.bugs.length || ctx.blast_radius.length || ctx.findings.length || retired.length || docGround;
         if (!hasContent)
             return; // no noise on files Hunch hasn't learned yet
         let text = formatContext(ctx).trim();
@@ -4538,6 +4566,34 @@ program
         store.close();
     }
 });
+// ---- findings (the open-observations ledger) --------------------------------
+program
+    .command("findings")
+    .description("LIVE findings — observed gaps/debt with no fix landed yet (audits, measurements, incidents; anchored to a date + evidence, not a commit). Same store method as the hunch_findings MCP tool. Read-only, advisory.")
+    .argument("[scope]", "a path, glob, or symbol (e.g. src/procs/** or dbo.GetOrders); omit for all")
+    .option("--all", "include resolved/stale findings (the full history)")
+    .action((scope, opts) => {
+    const { store } = storeFor();
+    try {
+        const live = (f) => f.triage === "open" || f.triage === "accepted-risk" || f.triage === "scheduled";
+        const list = (scope ? store.liveFindingsFor(scope) : store.recs("findings").filter(opts.all ? () => true : live))
+            .filter(opts.all ? () => true : live);
+        if (!list.length) {
+            console.log(`No ${opts.all ? "" : "live "}findings${scope ? ` for "${scope}"` : ""}. Record one after an audit: /audit (or hunch_record_finding via MCP).`);
+            return;
+        }
+        for (const f of list) {
+            const links = [f.violates_constraint ? `violates ${f.violates_constraint}` : "", f.method ? `re-verify via ${f.method}` : "", f.resolved_commit ? `fixed in ${f.resolved_commit.slice(0, 9)}` : ""].filter(Boolean).join(" · ");
+            console.log(`• [${f.triage}/${f.severity}] ${f.title} (${f.id}, observed ${f.observed_at.slice(0, 10)})`);
+            console.log(`    ${f.observation}`);
+            console.log(`    concerns: ${[...f.affected_files, ...f.affected_symbols].join(", ") || "(unscoped)"}${links ? `\n    ${links}` : ""}`);
+        }
+        console.log(`\n${list.length} finding(s).`);
+    }
+    finally {
+        store.close();
+    }
+});
 // ---- path (shortest dependency chain) --------------------------------------
 program
     .command("path")

package/dist/core/drift.js

@@ -13,7 +13,7 @@
  *                 `hunch wiki --heal`, never a gate.
  */
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { toPosixTarget } from "./paths.js";
 import { currentForTopic, isLive } from "./topics.js";
 import { parseDocAnchors } from "./docanchors.js";
@@ -118,6 +118,31 @@ export function computeDrift(store, root) {
     //    component vanished). Deterministic hash comparison against the manifest;
     //    fires only when a wiki was adopted. Advisory like every other kind here.
     findings.push(...computeWikiDrift(store, root));
+    // 7. FINDING-STALE — a LIVE finding (observation, no diff) whose anchor evaporated:
+    //    an affected file that no longer exists, or a violates_constraint pointing at a
+    //    retired/missing rule. Deterministic + advisory (never the exit-code class):
+    //    the observation may be fixed, moved, or moot — re-verify (re-run its method)
+    //    and re-record with triage resolved/stale, or refresh its paths.
+    for (const f of store.recs("findings")) {
+        if (f.triage === "resolved" || f.triage === "stale")
+            continue;
+        for (const file of f.affected_files) {
+            if (!file || file.includes("*"))
+                continue; // globs can't dead-ref
+            if (!existsSync(join(root, file))) {
+                findings.push({ kind: "finding-stale", id: f.id, detail: `live finding "${f.title}" references missing file "${file}" — re-verify${f.method ? ` (${f.method})` : ""} and re-record, or mark it stale` });
+            }
+        }
+        if (f.violates_constraint) {
+            const con = store.getRec("constraints", f.violates_constraint);
+            if (!con) {
+                findings.push({ kind: "finding-stale", id: f.id, detail: `live finding "${f.title}" claims to violate ${f.violates_constraint}, which does not exist — link the real rule or record it (hunch_record_correction)` });
+            }
+            else if (con.status === "retired") {
+                findings.push({ kind: "finding-stale", id: f.id, detail: `live finding "${f.title}" violates ${f.violates_constraint}, but that constraint is RETIRED — resolve the finding or re-link it` });
+            }
+        }
+    }
     return { findings };
 }
 /** Resolve a decision file reference without making private-memory paths depend on
@@ -138,7 +163,10 @@ function referenceExists(store, root, decisionId, ref) {
     // A private-scoped reference is an overlay-repo-relative path, not an escape
     // hatch into arbitrary local files.
     const rel = relative(privateRoot, candidate);
-    if (rel === "" || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\\\" : "/"}`) || isAbsolute(rel))
+    // NOTE: sep, not an escaped literal — `"\\\\"` in a template is the TWO-char
+    // string `\\`, which `relative()` never produces, silently disabling the
+    // containment check on Windows (issue #31).
+    if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
         return false;
     return existsSync(candidate);
 }

package/dist/core/format.js

@@ -21,6 +21,12 @@ export function formatContext(ctx) {
         for (const b of ctx.bugs)
             out.push(`- [${b.status}/${b.severity}] ${b.title} — root cause: ${b.root_cause}${prov(b.provenance)}`);
     }
+    if (ctx.findings.length) {
+        out.push(`\n## 🔍 Known findings (observed, unresolved — no fix landed yet)`);
+        for (const f of ctx.findings) {
+            out.push(`- [${f.triage}/${f.severity}] ${f.title} — ${f.observation}${prov(f.provenance)}\n  (${f.id}; observed ${f.observed_at.slice(0, 10)}${f.violates_constraint ? `; violates ${f.violates_constraint}` : ""}${f.method ? `; re-verify via ${f.method}` : ""})`);
+        }
+    }
     if (ctx.blast_radius.length) {
         out.push(`\n## 💥 Blast radius (transitive dependents)`);
         out.push(ctx.blast_radius.map((d) => `- [d${d.depth}] ${d.via}`).join("\n"));

package/dist/core/ids.js

@@ -43,4 +43,10 @@ export function runbookId(seed) {
 export function constraintId(statement) {
     return "con_" + shortHash(statement.trim().toLowerCase());
 }
+/** Finding id seeded by its title (trim + lowercase, same idiom as constraints):
+ *  re-recording the same observation UPDATES it (e.g. a triage change) instead of
+ *  minting a duplicate. A genuinely new observation deserves a new title. */
+export function findingId(title) {
+    return "fnd_" + shortHash(title.trim().toLowerCase());
+}
 //# sourceMappingURL=ids.js.map

package/dist/core/io.js

@@ -1,5 +1,6 @@
 /** Durable file writes for the Hunch. */
-import { linkSync, writeFileSync, renameSync, rmSync } from "node:fs";
+import { closeSync, fsyncSync, linkSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
 let counter = 0;
 const renameRetryDelaysMs = [10, 20, 40, 80];
 const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
@@ -7,6 +8,13 @@ const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_
  * Write `data` to `file` via a temp file + rename, so an interrupted write can't
  * leave the target truncated (the symbols/edges index is the worst to half-write).
  *
+ * Durability (issue #34): the temp file is fsync'd BEFORE the rename, and the
+ * parent directory best-effort after it. A process kill was always safe (page
+ * cache preserves ordering), but on power loss / OS crash the rename's metadata
+ * could reach disk before the temp file's data blocks — leaving the target
+ * present but truncated or garbage, the exact state the atomic-write invariant
+ * (con_902759b3dc) exists to prevent.
+ *
  * Windows caveat: renameSync can't REPLACE a file another process holds open (even
  * for read) — it throws EPERM/EBUSY/EACCES, exactly when the MCP server is reading
  * while a CLI writes. Retry that atomic replacement with bounded backoff. If the
@@ -17,19 +25,42 @@ const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_
 export function writeFileAtomic(file, data) {
     const tmp = `${file}.tmp${process.pid}.${counter++}`;
     try {
-        writeFileSync(tmp, data);
+        const fd = openSync(tmp, "w");
+        try {
+            writeSync(fd, data);
+            fsyncSync(fd); // data blocks reach disk before the rename's metadata can
+        }
+        finally {
+            closeSync(fd);
+        }
     }
     catch (e) {
-        safeRm(tmp);
+        cleanupTmp(tmp);
         throw e;
     }
     try {
         renameWithContentionRetry(tmp, file);
     }
     catch (e) {
-        safeRm(tmp);
+        cleanupTmp(tmp);
         throw e;
     }
+    fsyncDirBestEffort(dirname(file));
+}
+/** Persist the rename itself (the directory entry). POSIX semantics; Windows
+ *  cannot open directories for fsync, so this is a silent no-op there — NTFS
+ *  journals the metadata on its own schedule. */
+function fsyncDirBestEffort(dir) {
+    try {
+        const fd = openSync(dir, "r");
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch { /* platform without directory fsync — best effort by contract */ }
 }
 function renameWithContentionRetry(from, to) {
     for (let attempt = 0;; attempt++) {
@@ -55,7 +86,7 @@ function isRenameContention(error) {
 export function writeFileAtomicIfAbsent(file, data) {
     const tmp = `${file}.tmp${process.pid}.${counter++}`;
     try {
-        writeFileSync(tmp, data);
+        writeFileAtomicTmp(tmp, data);
         linkSync(tmp, file);
         return true;
     }
@@ -65,15 +96,39 @@ export function writeFileAtomicIfAbsent(file, data) {
         throw error;
     }
     finally {
-        safeRm(tmp);
+        // Not silently best-effort (issue #38): after linkSync succeeds the target
+        // shares the temp inode, so a swallowed unlink failure (a Windows AV scanner
+        // or indexer briefly holding tmp) leaves the published file with nlink=2 —
+        // which validateExistingFile rejects as hard-linked — plus a stray .tmp.
+        cleanupTmp(tmp);
     }
 }
-function safeRm(p) {
+/** Write + fsync a fresh temp file (shared by both atomic writers). */
+function writeFileAtomicTmp(tmp, data) {
+    const fd = openSync(tmp, "w");
+    try {
+        writeSync(fd, data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Remove a temp file, riding out a transient external hold (AV/indexer) with one
+ *  short retry; a persistent failure is REPORTED, never swallowed — a leaked tmp
+ *  beside a hard-link-published target keeps that target at nlink=2. */
+function cleanupTmp(p) {
     try {
         rmSync(p, { force: true });
+        return;
     }
-    catch {
-        /* best effort */
+    catch { /* transient hold — retry once below */ }
+    Atomics.wait(renameRetryWaiter, 0, 0, 50);
+    try {
+        rmSync(p, { force: true });
+    }
+    catch (e) {
+        console.warn(`[hunch] temp file left behind (its published target keeps nlink=2 until it is removed): ${p} (${e.message})`);
     }
 }
 //# sourceMappingURL=io.js.map

package/dist/core/types.js

@@ -218,8 +218,31 @@ export const RunbookSchema = z.object({
     provenance: ProvenanceSchema,
     date: z.string(),
 });
+/** An OBSERVATION — audited knowledge with no diff (the anchor is a date + evidence,
+ *  not a commit). Fills the gap between Bug (broke and got fixed) and Decision (chose
+ *  and changed code): "we looked, we found, we haven't acted yet". Examples: an audit
+ *  that surfaced unscoped tenant queries, a measured perf number, a vendor limit, an
+ *  incident with no code fix. ADVISORY retrieval context (pre-edit grounding + MCP);
+ *  never enters any block path. Lifecycle is `triage`, not valid-time: a finding is
+ *  resolved/stale-marked, never superseded. */
+export const FindingSchema = z.object({
+    id: z.string().describe("fnd_*"),
+    title: z.string(),
+    observation: z.string().default("").describe("what was observed, in plain words"),
+    evidence: z.array(z.string()).default([]).describe("the query/command run + representative output — a finding without evidence is an opinion"),
+    method: z.string().nullable().default(null).describe("rb_* runbook that re-runs the audit (makes the finding re-verifiable)"),
+    severity: z.enum(["low", "medium", "high", "critical"]).default("medium"),
+    triage: z.enum(["open", "accepted-risk", "scheduled", "resolved", "stale"]).default("open"),
+    affected_files: z.array(z.string()).default([]).describe("concrete paths or globs the observation concerns"),
+    affected_symbols: z.array(z.string()).default([]).describe("symbols/objects concerned (e.g. dbo.GetOrders)"),
+    violates_constraint: z.string().nullable().default(null).describe("con_* this finding is a known violation of"),
+    spawned_decision: z.string().nullable().default(null).describe("dec_* recorded in response to this finding"),
+    observed_at: z.string().describe("ISO instant the observation was made — the anchor (findings have no commit)"),
+    resolved_commit: z.string().nullable().default(null).describe("the commit that fixed it (set when triage becomes resolved)"),
+    provenance: ProvenanceSchema,
+});
 /** The entity collections, keyed by their on-disk directory name. */
-export const ENTITY_KINDS = ["components", "edges", "symbols", "decisions", "bugs", "constraints", "runbooks"];
+export const ENTITY_KINDS = ["components", "edges", "symbols", "decisions", "bugs", "constraints", "runbooks", "findings"];
 export const SCHEMAS = {
     components: ComponentSchema,
     edges: EdgeSchema,
@@ -228,6 +251,7 @@ export const SCHEMAS = {
     bugs: BugSchema,
     constraints: ConstraintSchema,
     runbooks: RunbookSchema,
+    findings: FindingSchema,
 };
 /** Default provenance helper for deterministic (extracted) records. */
 export function extracted(confidence, evidence = []) {

package/dist/extractors/git.js

@@ -166,6 +166,39 @@ function canonicalPath(path) {
 export function gitNullDevice() {
     return process.platform === "win32" ? "NUL" : devNull;
 }
+/** How long a live gitindex.lock can plausibly be held: every Hunch git spawn
+ *  carries a timeout well under this, so an OLDER lock provably has no living
+ *  owner in any Hunch flow. */
+const STALE_INDEX_LOCK_MS = 30_000;
+/** Heal a stranded `.git/index.lock` (issue #53). Two ways one appears:
+ *  (a) THIS call's git was timeout-killed — TerminateProcess on Windows skips
+ *      git's cleanup, so a lock created at/after this attempt started is ours;
+ *  (b) a PREVIOUS run crashed/was killed — git then fails FAST forever after,
+ *      and the best-effort flush paths swallow it, so captures keep "succeeding"
+ *      while nothing commits. A pre-existing lock older than any live git's
+ *      possible hold time has no living owner and is safe to remove.
+ *  Returns true when a lock was removed (a retry is then sensible). */
+function clearStrandedIndexLock(repoDir, env, sinceMs, error) {
+    const killed = error?.code === "ETIMEDOUT" || !!error?.signal;
+    try {
+        const rel = execFileSync("git", ["-C", repoDir, "rev-parse", "--git-path", "index.lock"], {
+            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], env, timeout: 5_000,
+        }).trim();
+        const lockPath = isAbsolute(rel) ? rel : join(repoDir, rel);
+        const mtimeMs = statSync(lockPath).mtimeMs;
+        const stranded = killed
+            ? mtimeMs >= sinceMs // created by the git we just killed
+            : mtimeMs <= Date.now() - STALE_INDEX_LOCK_MS; // left behind long before this attempt
+        if (!stranded)
+            return false;
+        rmSync(lockPath, { force: true });
+        console.error(`hunch: removed a stranded index.lock at "${repoDir}" (${killed ? "this git operation timed out" : "left by an earlier interrupted git"}); retrying.`);
+        return true;
+    }
+    catch {
+        return false; // no lock present, or git itself unavailable — nothing to heal
+    }
+}
 /** Compare physical directory identity before path text. Git for Windows can
  * return an 8.3/short or differently-cased spelling for the same top-level
  * directory that Node reached through its long path. A nonzero file ID keeps
@@ -515,13 +548,21 @@ export function commitAndPushHunch(hunchDir, message, opts) {
             GIT_ATTR_NOSYSTEM: "1",
         });
         const run = (args) => {
-            try {
-                execFileSync("git", ["-C", hunchDir, ...args], { stdio: "ignore", env });
-                return true;
-            }
-            catch {
-                return false; // best-effort: nothing staged / not a repo / offline
+            for (let attempt = 0; attempt < 2; attempt++) {
+                const startedAt = Date.now();
+                try {
+                    execFileSync("git", ["-C", hunchDir, ...args], { stdio: "ignore", env });
+                    return true;
+                }
+                catch (error) {
+                    // best-effort: nothing staged / not a repo / offline — EXCEPT a
+                    // stranded index.lock, which would otherwise fail every future
+                    // flush silently (issue #53); heal it and retry once.
+                    if (!clearStrandedIndexLock(hunchDir, env, startedAt, error))
+                        return false;
+                }
             }
+            return false;
         };
         if (opts.push !== false) {
             if (!overlayAttributeSourcesAreSafe(hunchDir, env)) {
@@ -535,7 +576,7 @@ export function commitAndPushHunch(hunchDir, message, opts) {
             // remote .gitignore, local info/exclude, or ambient excludesFile must not
             // be able to silently stop the shared graph's heartbeat.
             for (let index = 0; index < paths.length; index += 128) {
-                if (!run(["-c", `core.attributesFile=${gitNullDevice()}`, "add", "-f", "--", ...paths.slice(index, index + 128)])) {
+                if (!run(["-c", `core.attributesFile=${gitNullDevice()}`, "-c", "core.autocrlf=false", "add", "-f", "--", ...paths.slice(index, index + 128)])) {
                     run(["reset", "-q", "--", "."]);
                     return null;
                 }
@@ -573,9 +614,12 @@ export function commitAndPushHunch(hunchDir, message, opts) {
         // docs the caller verified git-clean BEFORE rewriting, so it can neither weaken the
         // bug_overlay_clobber detection above nor sweep user edits.
         for (const file of opts.alsoStage ?? []) {
+            // core.autocrlf=false on every memory add/checkout: the Git-for-Windows
+            // installer default (system gitconfig autocrlf=true) would re-encode the
+            // graph's JSON bytes in transit, breaking byte-exact content hashes.
             run(opts.push === false
-                ? ["add", "--", file]
-                : ["-c", `core.attributesFile=${gitNullDevice()}`, "add", "--", file]);
+                ? ["-c", "core.autocrlf=false", "add", "--", file]
+                : ["-c", `core.attributesFile=${gitNullDevice()}`, "-c", "core.autocrlf=false", "add", "--", file]);
         }
         // Only sync+push when a memory commit was actually created — never run pull/push against the
         // enclosing repo on an empty stage. Two-way sync: MERGE the remote BEFORE pushing so a push
@@ -595,17 +639,29 @@ export function commitAndPushHunch(hunchDir, message, opts) {
         if (!hooksDir)
             return null;
         const commitPaths = [...memoryPaths, ...(opts.alsoStage ?? [])];
-        try {
-            execFileSync("git", [
-                "-C", hunchDir,
-                "-c", `core.hooksPath=${hooksDir}`,
-                ...(opts.push === false ? [] : ["-c", `core.attributesFile=${gitNullDevice()}`]),
-                "-c", "commit.gpgsign=false",
-                "commit", "--no-gpg-sign", "--only", "-m", message, "--", ...commitPaths,
-            ], { stdio: "ignore", env, timeout: 15_000 });
-            committed = true;
+        // One retry after healing a stranded index.lock (issue #53): a lock left by
+        // a timeout-killed or crashed git otherwise fails EVERY later flush fast and
+        // silently — captures keep reporting success while nothing commits.
+        for (let attempt = 0; attempt < 2 && !committed; attempt++) {
+            const commitStartedAt = Date.now();
+            try {
+                execFileSync("git", [
+                    "-C", hunchDir,
+                    "-c", `core.hooksPath=${hooksDir}`,
+                    ...(opts.push === false ? [] : ["-c", `core.attributesFile=${gitNullDevice()}`]),
+                    "-c", "core.autocrlf=false",
+                    "-c", "commit.gpgsign=false",
+                    "commit", "--no-gpg-sign", "--only", "-m", message, "--", ...commitPaths,
+                ], { stdio: "ignore", env, timeout: 15_000 });
+                committed = true;
+            }
+            catch (error) {
+                // Nothing staged / not a repo stays quiet, as before; only a healed
+                // stranded lock earns the single retry.
+                if (!clearStrandedIndexLock(hunchDir, env, commitStartedAt, error))
+                    break;
+            }
         }
-        catch { /* nothing staged / not a repo */ }
         if (!committed)
             return null;
         if (opts.push !== false) {
@@ -1072,6 +1128,7 @@ function adoptContractHead(hunchDir, fetchedHead, contract, env, fingerprint) {
             "-C", hunchDir,
             "-c", `core.hooksPath=${hooksDir}`,
             "-c", `core.attributesFile=${gitNullDevice()}`,
+            "-c", "core.autocrlf=false",
             "reset", "--hard", fetchedHead,
         ], {
             stdio: "ignore", env, timeout: 5_000,
@@ -1118,11 +1175,13 @@ function mergeRemote(hunchDir, env, timeoutMs, contract, allowUnrelatedHistories
     if (!hooksDir)
         return "failed";
     const tryGit = (args, timeout = timeoutMs) => {
+        const startedAt = Date.now();
         try {
             execFileSync("git", [
                 "-C", hunchDir,
                 "-c", `core.hooksPath=${hooksDir}`,
                 "-c", `core.attributesFile=${gitNullDevice()}`,
+                "-c", "core.autocrlf=false",
                 "-c", "commit.gpgsign=false",
                 ...args,
             ], {
@@ -1130,7 +1189,10 @@ function mergeRemote(hunchDir, env, timeoutMs, contract, allowUnrelatedHistories
             });
             return true;
         }
-        catch {
+        catch (error) {
+            // Same stranding class as the commit path: a timeout-killed merge/fetch
+            // leaves index.lock behind and wedges every later sync (issue #53).
+            clearStrandedIndexLock(hunchDir, env, startedAt, error);
             return false;
         }
     };
@@ -1516,6 +1578,13 @@ function waitForCommitLockHandoff(lock, first, timeoutMs) {
         Atomics.wait(sleeper, 0, 0, Math.min(25, deadline - Date.now()));
         attempt = acquireCommitLock(lock);
     }
+    // The deadline can expire DURING the final wait+acquire; without this check an
+    // acquire that succeeded on that last iteration returned false while this
+    // process's owner directory held the lock — never released (the caller bails
+    // before its try/finally), wedging every flush in every process until this one
+    // exited (issue #48).
+    if (attempt.state === "acquired")
+        return true;
     return false;
 }
 export function headSha(cwd) {
@@ -1589,7 +1658,7 @@ export function currentBranch(cwd) {
 /** Files changed in a single commit. `--root` makes the initial commit (which
  *  has no parent) report its files as additions instead of returning nothing. */
 export function commitFiles(sha, cwd) {
-    const out = gitSafe(["diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
 /** Raw `git log` over `.hunch/`, paired with parseMemoryLog — the memory-move
@@ -2005,7 +2074,7 @@ export function fileGitMetrics(cwd, want, days = 90) {
         return out;
     // churn — one windowed log; tally each wanted path's appearances (= commits).
     if (days > 0) {
-        const raw = gitSafe(["log", `--since=${days}.days.ago`, "--name-only", "--format="], cwd);
+        const raw = gitSafe(["-c", "core.quotePath=false", "log", `--since=${days}.days.ago`, "--name-only", "--format="], cwd);
         if (raw) {
             for (const line of raw.split("\n")) {
                 const e = line && out.get(line);
@@ -2017,7 +2086,7 @@ export function fileGitMetrics(cwd, want, days = 90) {
     // last commit — one newest-first log; the FIRST time a path appears is its most
     // recent commit. NUL-prefixed lines mark commit boundaries; the rest are paths.
     // 256MB buffer for the all-history name-only stream on large repos.
-    const raw = gitSafe(["log", "--name-only", "--format=%x00%h"], cwd, 256 * 1024 * 1024);
+    const raw = gitSafe(["-c", "core.quotePath=false", "log", "--name-only", "--format=%x00%h"], cwd, 256 * 1024 * 1024);
     if (raw) {
         let remaining = out.size;
         let sha = "";
@@ -2038,17 +2107,23 @@ export function fileGitMetrics(cwd, want, days = 90) {
     }
     return out;
 }
-/** Files staged for commit (for `hunch check` pre-commit enforcement). */
+/** Files staged for commit (for `hunch check` pre-commit enforcement).
+ *
+ *  Every path enumerator here pins `core.quotePath=false` (issue #50): with
+ *  git's default quotePath, any path holding bytes > 0x7F comes back
+ *  octal-quoted (`"src/caf\303\251.ts"`), which matches neither the store's
+ *  POSIX paths nor constraint scope globs — a blocking constraint over such a
+ *  file graded as a vacuous PASS, and its churn/last-commit metrics read zero. */
 export function stagedFiles(cwd) {
-    const out = gitSafe(["diff", "--cached", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "diff", "--cached", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
 /** Files changed anywhere in the working tree compared with HEAD: both staged
  * and unstaged tracked files, plus untracked files. This powers the local,
  * pre-commit Change Gate; it never mutates the index or asks an agent/model. */
 export function workingFiles(cwd) {
-    const changed = gitSafe(["diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean);
-    const untracked = gitSafe(["ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter(Boolean);
+    const changed = gitSafe(["-c", "core.quotePath=false", "diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean);
+    const untracked = gitSafe(["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter(Boolean);
     return [...new Set([...changed, ...untracked])].sort();
 }
 /** Does a ref resolve to a commit in this repo? Lets `--base` fail LOUDLY on an
@@ -2060,7 +2135,7 @@ export function revExists(ref, cwd) {
 /** Files a PR/branch changes vs `base` (3-dot: changes on HEAD since the merge-base,
  *  i.e. exactly the PR's own commits — the CI Constraint Guard's surface). */
 export function rangeFiles(base, cwd, head = "HEAD") {
-    const out = gitSafe(["diff", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR", `${base}...${head}`], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "diff", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR", `${base}...${head}`], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
 /** Commit subjects on `head` since `base` (2-dot: commits added by the task),
@@ -2089,8 +2164,8 @@ export function stagedDiff(cwd, maxBytes = 60_000) {
  * intentionally contribute no synthetic content to regression analysis. */
 export function workingDiff(cwd, maxBytes = 60_000) {
     let out = gitSafe(["diff", "HEAD", "--no-ext-diff", "--no-textconv", "--no-color", "--unified=2", "--", ...DIFF_NOISE], cwd);
-    const tracked = new Set(gitSafe(["diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean));
-    const untracked = gitSafe(["ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter((f) => f && !tracked.has(f));
+    const tracked = new Set(gitSafe(["-c", "core.quotePath=false", "diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean));
+    const untracked = gitSafe(["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter((f) => f && !tracked.has(f));
     const readWorkingFile = createRepoFileReader(cwd);
     for (const file of untracked) {
         try {
@@ -2140,7 +2215,7 @@ export function fixCommits(spec, cwd, max = 200) {
 }
 /** All tracked files matching the given extensions. */
 export function trackedFiles(cwd, exts) {
-    const out = gitSafe(["ls-files"], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "ls-files"], cwd);
     const all = out ? out.split("\n").filter(Boolean) : [];
     return all.filter((f) => exts.some((e) => f.endsWith(e)));
 }

package/dist/extractors/nativeTreeSitter.js

@@ -64,7 +64,12 @@ function copyNativeBinding(packageName, copyRoot, nodeGypBuild) {
 export function loadNativeTreeSitter() {
     if (runtime)
         return runtime;
-    const preloaded = Object.keys(runtimeRequire.cache).filter((path) => /tree-sitter(?:-typescript|-python)?\.node$/.test(path)
+    // Both binding spellings: prebuilds ship as tree-sitter[-typescript|-python].node,
+    // while from-source builds are named after the binding.gyp target with
+    // underscores (tree_sitter_runtime_binding.node, tree_sitter_python_binding.node,
+    // …). Missing the underscore names let an already-loaded source-built addon slip
+    // past this guard and defeat the file-lock isolation entirely (issue #52).
+    const preloaded = Object.keys(runtimeRequire.cache).filter((path) => /(?:tree-sitter(?:-typescript|-python)?|tree_sitter(?:_[a-z]+)*_binding)\.node$/.test(path)
         && !new RegExp(`(?:^|[\\\\/])${COPY_PREFIX}\\d+-`).test(path));
     if (preloaded.length) {
         throw new Error(`tree-sitter native addon was loaded before Hunch could isolate it: ${preloaded.join(", ")}`);