fix(distribution): pin exact npm package launchers

[davesheffer]

What changed

• derive one exact @davesheffer/hunch@<version> package spec from package.json
• use an npm alias for committed MCP/provider launchers so npx cannot fall through to a stale global binary
• reuse the exact package spec in generated CI
• pin the Claude plugin MCP launcher and document the exact package
• add regression coverage for generated provider, hook, plugin, and CI commands

Why

Hunch 1.8.4 was consumed through a GitHub release tarball. Hunch 1.9.3 is published through the npm registry with OIDC provenance, and the old GitHub tarball URL no longer exists. Merely replacing the version in the old URL shape would break MCP, hooks, and CI.

Inside a Hunch source checkout, a direct exact-package npx command could also treat the local package name as satisfying the request and execute an older global hunch. The distinct npm alias forces resolution of the exact published package.

Impact

Committed MCP/provider configuration, generated lifecycle hooks, and Hunch Guard workflows now execute the same deterministic package version that generated them. A future release bump updates the shared version source and the regression tests force all distribution surfaces to advance together.

Validation

• npm run typecheck
• npm run build
• npx tsx --test test/version.test.ts test/providers.test.ts test/antigravity.test.ts test/ci-action.test.ts (20 passed)
• npx -y --package=hunch-exact@npm:@davesheffer/hunch@1.9.3 hunch --version → 1.9.3
• Hunch intent conformance: 4/4 satisfied
• Hunch merge verdict: WARN only for the advisory client-agnostic MCP blast-radius invariant; no blocking invariant

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hunch	Ready	Preview, Comment	Jul 26, 2026 10:18am

[github-actions]

🧠 Hunch — Engineering Memory Guard

✅ This PR touches no recorded invariants (directly or via blast radius) and re-introduces nothing deliberately retired across 15 changed file(s).

📜 Hunch Constitution — 2 policy receipt(s)

• ✅ pol_01cf084e1e satisfied — symbol:renderAdoptedDoc does not reach symbol:writeFileAtomic
  • receipt: sha1:c555f61124dcc87dbcd0c621a7e184745d2f81a6
• ✅ pol_3f3aee11ad satisfied — symbol:src/store/db.ts:openDb does not reach external:better-sqlite3
  • receipt: sha1:58273e78ce0960462653939194b46c81dacdc863