@davesheffer/hunch 1.9.4 → 1.10.1

package/dist/store/jsonStore.js

@@ -14,6 +14,9 @@ import { writeFileAtomic } from "../core/io.js";
  *  constraints) are one file per record so they're cleanly reviewable in PRs. */
 const SINGLE_FILE = { symbols: "index.json", edges: "index.json" };
 const encode = (v) => JSON.stringify(v, null, 2) + "\n";
+// Sleep primitive for the single-file RMW lock's bounded spin (issue #35);
+// same idiom as core/io.ts's rename backoff.
+const RMW_LOCK_WAITER = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 /** Curated entities are intentionally small, human-reviewable records. Symbols
  * and edges are dense indexes, so they get a much larger but still finite cap. */
 export const MAX_JSON_RECORD_BYTES = 8 * 1024 * 1024;
@@ -389,6 +392,14 @@ export class JsonStore {
                 const text = this.readContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
                 if (text === null)
                     continue;
+                // A 0-byte per-record file is a merge-driver TOMBSTONE, not a record:
+                // git cannot delete through a merge driver, so "both sides deleted" is
+                // materialized as an empty %A (issue #37). Human-approved refinement of
+                // con_947c578b2c's boundary (2026-08-04): an empty file holds no record
+                // to migrate or drop, and Hunch's own atomic writes (con_902759b3dc)
+                // never produce one — emptiness is unambiguous, so no warning.
+                if (text.trim() === "")
+                    continue;
                 raw = JSON.parse(text);
             }
             catch (e) {
@@ -403,6 +414,49 @@ export class JsonStore {
         }
         return out;
     }
+    /** Cross-process mutex for single-file index read-modify-write (issue #35).
+     *  The long-lived MCP server and CLI hooks write the same `.hunch/` concurrently;
+     *  two unsynchronized RMWs over index.json each read the same base array and the
+     *  second rename silently erases the first's record. `mkdirSync` is the atomic
+     *  acquire (EEXIST = held). A stale lock (killed process) is taken over by age;
+     *  against a live contender we wait briefly and then proceed WITH a warning —
+     *  never worse than the historical lockless behavior, and capture paths must not
+     *  start throwing on lock contention. */
+    withSingleFileLock(kind, directory, fn) {
+        const lock = join(directory.lexical, ".rmw-lock");
+        const deadline = Date.now() + 2_000;
+        for (;;) {
+            try {
+                mkdirSync(lock);
+                break;
+            }
+            catch {
+                try {
+                    if (Date.now() - lstatSync(lock).mtimeMs > 10_000) {
+                        rmSync(lock, { recursive: true, force: true }); // no live spawn holds a lock this old
+                        continue;
+                    }
+                }
+                catch {
+                    continue; /* vanished between attempts — retry the acquire */
+                }
+                if (Date.now() >= deadline) {
+                    console.warn(`[hunch] proceeding without the ${kind} index lock (still held: ${lock})`);
+                    return fn();
+                }
+                Atomics.wait(RMW_LOCK_WAITER, 0, 0, 25);
+            }
+        }
+        try {
+            return fn();
+        }
+        finally {
+            try {
+                rmSync(lock, { recursive: true, force: true });
+            }
+            catch { /* stale-takeover reclaims it */ }
+        }
+    }
     /** Write a single record (validated) to its JSON file / into the index array. */
     put(kind, record) {
         const schema = SCHEMAS[kind];
@@ -416,11 +470,14 @@ export class JsonStore {
             // record can't silently drop schema-invalid / future-schema siblings — the
             // same reason delete() reads raw. Keep the index sorted by id (stable diff,
             // and agrees with the merge driver so a re-index after a merge is a no-op).
-            const f = this.fileFor(kind, validated.id);
-            const arr = this.readRawArray(kind, directory, f).filter((r) => r?.id !== validated.id);
-            arr.push(validated);
-            arr.sort((a, b) => String(a?.id).localeCompare(String(b?.id)));
-            this.writeContainedFile(directory, f, encode(arr), this.maxBytes(kind));
+            // Locked: the read-modify-write below is what issue #35 races.
+            this.withSingleFileLock(kind, directory, () => {
+                const f = this.fileFor(kind, validated.id);
+                const arr = this.readRawArray(kind, directory, f).filter((r) => r?.id !== validated.id);
+                arr.push(validated);
+                arr.sort((a, b) => String(a?.id).localeCompare(String(b?.id)));
+                this.writeContainedFile(directory, f, encode(arr), this.maxBytes(kind));
+            });
         }
         else {
             this.writeContainedFile(directory, this.fileFor(kind, validated.id), encode(validated), this.maxBytes(kind));
@@ -446,19 +503,27 @@ export class JsonStore {
             this.writeContainedFile(directory, this.fileFor(kind, "index"), encode(validated), this.maxBytes(kind));
             return;
         }
-        // One file per record: preflight EVERY existing JSON file before deleting
+        // One file per record: preflight EVERY existing JSON file before touching
         // any, so one malicious symlink cannot cause a partially-cleared store.
         const existing = this.jsonFileNames(kind);
         for (const name of existing) {
             this.validateExistingFile(directory, join(directory.lexical, name), this.maxBytes(kind));
         }
-        for (const name of existing) {
-            this.removeContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
-        }
+        // WRITE-FIRST, delete-stale-LAST (issue #30). The old delete-all-then-rewrite
+        // sequence had a crash window in which the kind directory held nothing — and
+        // `hunch private --migrate` runs replaceAll on the OVERLAY, so that window
+        // covered private-only records existing nowhere else. Now a crash mid-write
+        // leaves old ∪ new (same id → same file, so no duplicates), and a crash
+        // mid-delete leaves only stale extras — no state loses records.
+        const keep = new Set(validated.map((r) => `${r.id}.json`));
         for (const r of validated) {
             const id = r.id;
             this.writeContainedFile(directory, this.fileFor(kind, id), encode(r), this.maxBytes(kind));
         }
+        for (const name of existing) {
+            if (!keep.has(name))
+                this.removeContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
+        }
     }
     /** Read a single-file index as a raw array (no validation). Missing/empty → [].
      *  A non-empty file that fails to parse THROWS — we must never silently treat a
@@ -482,6 +547,29 @@ export class JsonStore {
     get(kind, id) {
         return this.loadAll(kind).find((r) => r.id === id);
     }
+    /** On-disk record count, independent of validation: per-record kinds count
+     *  every non-tombstone .json file (a 0-byte merge tombstone is an intentional
+     *  absence), single-file kinds count raw array entries (a corrupt index file
+     *  throws readRawArray's own actionable refusal). Lets a caller about to
+     *  DELETE the kind — `hunch private --migrate` — prove the validating loader
+     *  dropped nothing first, instead of silently destroying the records loadAll
+     *  skipped (issue #29, the same never-silently-drop contract as
+     *  con_947c578b2c). */
+    rawRecordCount(kind) {
+        const directory = this.safeKindDirectory(kind, false);
+        if (!directory)
+            return 0;
+        const single = SINGLE_FILE[kind];
+        if (single)
+            return this.readRawArray(kind, directory, join(directory.lexical, single)).length;
+        let count = 0;
+        for (const name of this.jsonFileNames(kind)) {
+            const text = this.readContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
+            if (text !== null && text.trim() !== "")
+                count++;
+        }
+        return count;
+    }
     /** Remove a record (used by the curate/reject flow). Returns true if removed.
      *  For single-file kinds we operate on the RAW JSON array (not the validating
      *  loader) so deleting one record can't silently drop schema-invalid siblings. */
@@ -491,16 +579,20 @@ export class JsonStore {
             const directory = this.safeKindDirectory(kind, false);
             if (!directory)
                 return false;
-            const f = this.fileFor(kind, "index");
-            const arr = this.readRawArray(kind, directory, f);
-            if (!this.validateExistingFile(directory, f, this.maxBytes(kind)))
-                return false;
-            const next = arr.filter((r) => r?.id !== id);
-            if (next.length === arr.length)
-                return false;
-            this.writeContainedFile(directory, f, encode(next), this.maxBytes(kind));
-            this.invalidate(kind);
-            return true;
+            // Locked like put(): an unsynchronized delete racing a concurrent put
+            // over the same index would resurrect or drop records (issue #35).
+            return this.withSingleFileLock(kind, directory, () => {
+                const f = this.fileFor(kind, "index");
+                const arr = this.readRawArray(kind, directory, f);
+                if (!this.validateExistingFile(directory, f, this.maxBytes(kind)))
+                    return false;
+                const next = arr.filter((r) => r?.id !== id);
+                if (next.length === arr.length)
+                    return false;
+                this.writeContainedFile(directory, f, encode(next), this.maxBytes(kind));
+                this.invalidate(kind);
+                return true;
+            });
         }
         this.assertSafeRecordId(id);
         const directory = this.safeKindDirectory(kind, false);

package/dist/store/privateMigrate.js

@@ -21,6 +21,18 @@ export function movePublicMemoryToPrivate(pub, priv) {
     let total = 0;
     for (const kind of ENTITY_KINDS) {
         const pubRecs = pub.loadAll(kind);
+        // The validating loader SKIPS corrupt/invalid/future-schema records with a
+        // warning — but the CLI empties the public store right after this returns,
+        // which would silently DELETE exactly those skipped records (and then
+        // untrack + gitignore their only git history). Refuse instead: prove every
+        // on-disk record actually loaded before anything becomes deletable
+        // (issue #29). A kind whose only records are invalid also stops here, so
+        // the "0 loaded → skip merge" path below can never precede a wipe.
+        const rawCount = pub.rawRecordCount(kind);
+        if (rawCount !== pubRecs.length) {
+            throw new Error(`refusing to migrate ${kind}: ${rawCount - pubRecs.length} on-disk record(s) failed to load (see the warnings above) `
+                + `and would be deleted without ever reaching the overlay. Fix or remove them, then re-run \`hunch private --migrate\`.`);
+        }
         if (pubRecs.length === 0)
             continue;
         const privRecs = priv.loadAll(kind);

package/dist/store/schema.js

@@ -89,7 +89,7 @@ CREATE TABLE IF NOT EXISTS embeddings (
 export const FTS_SEARCH_SCHEMA_SQL = /* sql */ `
 CREATE VIRTUAL TABLE IF NOT EXISTS search USING fts5(
   ref UNINDEXED,   -- entity id
-  kind UNINDEXED,  -- components | edges | symbols | decisions | bugs | constraints
+  kind UNINDEXED,  -- components | edges | symbols | decisions | bugs | constraints | runbooks | findings
   title,
   body,
   tokenize = 'porter unicode61'

package/dist/synthesis/provider.js

@@ -24,7 +24,7 @@
  * Every provider returns the same shape so the rest of the system never knows
  * (or cares) which one ran.
  */
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { isIP } from "node:net";
 import { tmpdir } from "node:os";
@@ -66,6 +66,20 @@ export function pexecIn(cmd, args, opts = {}) {
         let err = "";
         let outLen = 0;
         let settled = false;
+        // Windows spawns through a cmd.exe wrapper (shell:true), and child.kill()
+        // terminates only that wrapper — the actual agent CLI survives as an orphan,
+        // still burning the user's subscription after every timeout, accumulating
+        // with each post-commit hook fire (issue #44). taskkill /T fells the tree.
+        // Best-effort by design: the wrapper kill below still runs either way.
+        const killTree = () => {
+            if (IS_WIN && child.pid) {
+                try {
+                    execFile("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true }, () => { });
+                }
+                catch { /* taskkill unavailable — fall through to the wrapper kill */ }
+            }
+            child.kill();
+        };
         const done = (fn) => {
             if (settled)
                 return;
@@ -76,7 +90,7 @@ export function pexecIn(cmd, args, opts = {}) {
         };
         const timer = opts.timeout
             ? setTimeout(() => {
-                child.kill();
+                killTree();
                 done(() => reject(new Error(`"${cmd}" timed out after ${opts.timeout}ms`)));
             }, opts.timeout)
             : null;
@@ -84,7 +98,7 @@ export function pexecIn(cmd, args, opts = {}) {
         child.stdout.on("data", (d) => {
             outLen += d.length;
             if (outLen > max) {
-                child.kill();
+                killTree();
                 done(() => reject(new Error(`"${cmd}" exceeded maxBuffer (${max} bytes)`)));
                 return;
             }
@@ -323,6 +337,18 @@ class ClaudeCliProvider extends PromptSynthProvider {
         const childEnv = { ...process.env };
         delete childEnv.ANTHROPIC_API_KEY;
         delete childEnv.ANTHROPIC_AUTH_TOKEN;
+        // Gateway ROUTING is metered per-token exactly like a raw API key: with
+        // CLAUDE_CODE_USE_BEDROCK/VERTEX set (common in enterprise shell profiles
+        // for interactive use), headless `claude -p` bills AWS/GCP on every
+        // significant commit — silently, from a post-commit hook (issue #39,
+        // con_2ce3f2a547). Strip the routing switches and their endpoint overrides
+        // so the CLI falls through to subscription auth here too.
+        delete childEnv.CLAUDE_CODE_USE_BEDROCK;
+        delete childEnv.CLAUDE_CODE_USE_VERTEX;
+        delete childEnv.ANTHROPIC_BEDROCK_BASE_URL;
+        delete childEnv.ANTHROPIC_VERTEX_BASE_URL;
+        delete childEnv.ANTHROPIC_VERTEX_PROJECT_ID;
+        delete childEnv.CLOUD_ML_REGION;
         // Single-shot text synthesis: no tools, no agentic loop. The prompt carries
         // all needed context inline, so run from a neutral cwd to avoid loading this
         // repo's own hunch MCP server / CLAUDE.md on every commit (cheaper, and no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.9.4",
+  "version": "1.10.1",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.",