Live Action Capture

Hunch discovers and executes website actions through a four-layer architecture. Each layer is independent — not a fallback chain. The widget routes every action through the optimal path automatically.

The Four Layers

Layer	Name	Trust Level	How It Works
0	DOM-Native Execution	Always on	Dispatches real DOM events in the page's JavaScript context
1	Platform Official APIs	High	Uses documented APIs for Shopify, WooCommerce, and other platforms
2	Owner-Declared Manifest	Highest	Site owner declares endpoints in hunch-actions.json
3	Passive Live Capture	Grows with usage	Observes real network requests from user sessions

How Actions Are Dispatched

When a visitor asks the chatbot to do something — book a meeting, submit a form, add to cart — the widget resolves the best execution path:

1. Check the manifest (Layer 2). If the site owner declared an endpoint for this action, use it. Owner-declared endpoints have confidence 1.0 — the owner knows their own API best.

2. Check platform APIs (Layer 1). If the site runs on Shopify or WooCommerce, use the documented platform API. No reverse-engineering, no fragile scraping.

3. Check passive capture (Layer 3). If a previous real user session triggered this endpoint, the widget knows its URL pattern, method, and field structure. Confidence grows with repeated observations.

4. Fall back to DOM-native execution (Layer 0). Dispatch real input, change, and submit events directly on the page. Works on any website, any framework, any SPA.

Each layer is tried in priority order. The first match wins.

Privacy Boundaries

Live capture observes structure only — never values:

• Captures URL patterns, HTTP methods, and field names
• Never stores request bodies, response contents, cookies, or tokens
• Excludes analytics, advertising, telemetry, and error-tracking domains
• Strips sensitive fields (passwords, tokens, card numbers, CVVs) from any observed payloads
• Widget's own requests are excluded from observation
• Audit log is capped at 100 entries per session

Mutation Confirmation

POST, PUT, DELETE, and PATCH requests that touch money, account data, or personal information always require explicit user confirmation before execution. The widget shows a confirmation dialog with the action details.

Read-only requests (GET) execute without confirmation.

Staleness Detection

The widget tracks endpoint health. If a passively-captured endpoint fails 3+ times within an hour, it is marked stale and confidence is demoted by 0.3 per failure. Stale endpoints are automatically re-observed from the next real user interaction — the system self-heals.

Configuration

Live action capture is enabled by default. No configuration required. The widget starts observing when it loads and stops when the page unloads.

Disabling Capture

To disable passive capture for a specific website, add to your embed configuration:

<script
  data-website-id="your-id"
  data-disable-network-observation="true"
  src="https://cdn.hunchbank.com/embed.js"
></script>

Related

• Tools — Manage discovered and enabled tools
• DOM-Native Execution — Layer 0 deep dive
• Action Manifest — Layer 2 deep dive
• Privacy and Compliance — Data handling policies