@plumpslabs/kuma 2.1.1 → 2.1.3

package/dist/index.js

@@ -2057,6 +2057,24 @@ function truncateOutput(output, maxChars) {
 }
 
 // src/tools/safeTerminalExec.ts
+function stripShellObfuscation(cmd) {
+  let result = cmd;
+  let prev;
+  do {
+    prev = result;
+    result = result.replace(/\$\([^()]*\)/g, "");
+  } while (result !== prev);
+  do {
+    prev = result;
+    result = result.replace(/\$\(\([^()]*\)\)/g, "");
+  } while (result !== prev);
+  result = result.replace(/\$\{[^}]*\}/g, " ");
+  result = result.replace(/\$'[^']*'/g, "");
+  result = result.replace(/\$"[^"]*"/g, "");
+  result = result.replace(/\$[a-zA-Z_][a-zA-Z0-9_]*/g, " ");
+  result = result.replace(/\s+/g, " ").trim();
+  return result;
+}
 function buildTaskCommand(task, cwd) {
   const pm = detectPackageManagerForDir(cwd);
   const prefix = pm === "pnpm" ? "pnpm" : pm === "yarn" ? "yarn" : pm === "bun" ? "bun" : "npm";
@@ -2075,24 +2093,59 @@ function buildTaskCommand(task, cwd) {
   }
 }
 var DANGEROUS_PATTERNS = [
+  // RM variants
   "rm -rf",
   "rm -fr",
+  "rm --recursive",
+  "rm --force",
   "del /f",
   "rd /s",
   "rmdir /s",
+  // Git dangerous
   "git push",
   "git commit",
+  "git reset --hard",
+  "git clean -fd",
+  "git checkout -- .",
+  // Publish to registries
   "npm publish",
   "npx publish",
   "yarn publish",
   "pnpm publish",
+  // System destruction
   "> /dev/sda",
-  "format",
   "mkfs",
   "dd if=",
+  "dd of=",
+  "fdisk",
+  "parted",
+  "mkswap",
+  // Fork bomb
   ":(){ :|:& };:",
-  "curl ",
-  "wget "
+  ":(){",
+  // Pipe to shell (remote code execution vector)
+  "| bash",
+  "| sh",
+  // Dangerous eval/exec
+  "eval ",
+  "exec ",
+  "source /dev/stdin",
+  ". /dev/stdin",
+  // Find destruction
+  "find . -delete",
+  "find / -delete",
+  "find . -exec rm",
+  "find / -exec rm",
+  // Chmod abuse
+  "chmod -R 777",
+  "chmod 777 /",
+  "chmod 000",
+  // Alias hijacking
+  "alias rm=",
+  "alias cd=",
+  "alias sudo=",
+  // Overwrite protection
+  "shred"
 ];
 async function handleSafeTerminalExec(params) {
   const { task, customCommand, timeout = 60, cwd: inputCwd, workspace } = params;
@@ -2134,7 +2187,10 @@ Available workspaces: ${workspaces?.map((w) => `"${w.name}" (${w.path})`).join("
 
 Fix the code first before running the task again.`;
   }
-  const dangerousPattern = DANGEROUS_PATTERNS.find((p) => command.toLowerCase().includes(p.toLowerCase()));
+  const deobfuscated = stripShellObfuscation(command);
+  const dangerousPattern = DANGEROUS_PATTERNS.find(
+    (p) => deobfuscated.toLowerCase().includes(p.toLowerCase())
+  );
   if (dangerousPattern) {
     return `\u{1F6AB} BLOCKED: Command contains a dangerous pattern: "${dangerousPattern}".
 This command is not permitted.`;
@@ -2247,7 +2303,7 @@ function getGitChangedFiles() {
   }
 }
 async function handleCodeReviewer(params) {
-  const { files: inputFiles, focus = "correctness", customCriteria, format = "text" } = params;
+  const { files: inputFiles, focus = "correctness", customCriteria, format = "text", convention } = params;
   let files = inputFiles ?? [];
   let isAutoDetected = false;
   if (files.length === 0) {
@@ -2306,6 +2362,9 @@ Pass an explicit 'files' array to review specific files.`;
           checkOverEngineering(filePath, content, allIssues);
           break;
       }
+      if (convention === "matcha") {
+        checkMatchaConventions(filePath, content, allIssues);
+      }
     } catch (err) {
       allIssues.push({
         file: filePath,
@@ -2333,6 +2392,7 @@ Pass an explicit 'files' array to review specific files.`;
       filesReviewed,
       filesRequested: files.length,
       focus,
+      convention,
       autoDetected: isAutoDetected,
       ...customCriteria ? { customCriteria } : {}
     };
@@ -2859,8 +2919,8 @@ function collectBlockLines(lines, startIdx) {
   let depth = 0;
   let started = false;
   const block = [];
-  for (let j = startIdx; j < lines.length; j++) {
-    const line = lines[j];
+  for (let i = startIdx; i < lines.length; i++) {
+    const line = lines[i];
     block.push(line);
     for (const ch of line) {
       if (ch === "{") {
@@ -2877,6 +2937,73 @@ function extractBodyAfter(lines, match) {
   if (startIdx < 0) return "";
   return collectBlockLines(lines, startIdx).join("\n");
 }
+function checkMatchaConventions(filePath, content, issues) {
+  const lines = content.split("\n");
+  const text = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  for (let i = 0; i < lines.length; i++) {
+    const line = stripCommentsAndStrings(lines[i]);
+    const lineNum = i + 1;
+    if (/\b(?:const|let|var)\s+\w+\s*=\s*(?:[2-9]|\d{2,})\b/.test(line)) {
+      if (!/eslint-disable/.test(lines[i])) {
+        issues.push({
+          file: filePath,
+          line: lineNum,
+          severity: "info",
+          rule: "matcha/no-hardcoded-values",
+          message: "Possible hardcoded numeric value (magic number)",
+          suggestion: "Extract to a named constant"
+        });
+      }
+    }
+    const envMatch = line.match(/process\.env\.([A-Z0-9_]+)/);
+    if (envMatch) {
+      const envName = envMatch[1];
+      if (!envName.includes("_")) {
+        issues.push({
+          file: filePath,
+          line: lineNum,
+          severity: "warning",
+          rule: "matcha/env-prefix",
+          message: `Environment variable "${envName}" doesn't seem to have a prefix`,
+          suggestion: "Use an APPNAME_ prefix for environment variables"
+        });
+      }
+    }
+  }
+  const interfaceNames = [];
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^\s*(export\s+)?interface\s+(\w+)/);
+    if (m) interfaceNames.push(m[2]);
+  }
+  for (const iface of interfaceNames) {
+    const implCount = (text.match(new RegExp(`implements\\s+.*\\b${iface}\\b`, "g")) || []).length;
+    if (implCount <= 1) {
+      const lineNum = lines.findIndex((l) => l.includes(`interface ${iface}`)) + 1;
+      issues.push({
+        file: filePath,
+        line: lineNum,
+        severity: "info",
+        rule: "matcha/no-premature-abstraction",
+        message: `Interface "${iface}" has only 1 implementation \u2014 premature abstraction?`,
+        suggestion: "Wait for a 2nd use case before abstracting"
+      });
+    }
+  }
+  const funcBodies = findBlockBodies(lines, /^\s*(export\s+)?(async\s+)?function\s+\w+/);
+  for (const { body, nameLine, name } of funcBodies) {
+    const nonEmptyLines = body.split("\n").filter((l) => l.trim()).length;
+    if (nonEmptyLines > 40) {
+      issues.push({
+        file: filePath,
+        line: nameLine,
+        severity: "warning",
+        rule: "matcha/single-responsibility",
+        message: `Function "${name}" is ${nonEmptyLines} lines long \u2014 might be doing >1 thing`,
+        suggestion: "Extract into smaller, focused functions"
+      });
+    }
+  }
+}
 function formatReviewOutput(issues, filesReviewed, totalFiles, focus, customCriteria, autoDetected) {
   const errors = issues.filter((i) => i.severity === "error");
   const warnings = issues.filter((i) => i.severity === "warning");
@@ -5917,9 +6044,9 @@ function handleCodewhaleSecondary(root, results) {
     });
   }
 }
-function runInit(types, projectRoot) {
-  const root = projectRoot ?? getProjectRoot();
-  const selected = types.length > 0 ? types : ALL_CONFIG_TYPES;
+function runInit(options) {
+  const root = options.projectRoot ?? getProjectRoot();
+  const selected = options.types.length > 0 ? options.types : ALL_CONFIG_TYPES;
   const results = [];
   const selectedSet = new Set(selected);
   const agentsMdSelected = AGENTS_MD_TYPES.filter((t) => selectedSet.has(t));
@@ -5933,12 +6060,16 @@ function runInit(types, projectRoot) {
         agentsMdHandled = true;
         const combinedContent = getCombinedAgentsMd(new Set(agentsMdSelected));
         if (fs16.existsSync(fullPath)) {
-          const existingContent = fs16.readFileSync(fullPath, "utf-8");
-          if (existingContent.includes("_Generated by Kuma MCP_")) {
+          if (options.skipExisting) {
             results.push({ type, filePath: relativePath, action: "skipped" });
           } else {
-            fs16.writeFileSync(fullPath, existingContent.trimEnd() + "\n\n" + combinedContent, "utf-8");
-            results.push({ type, filePath: relativePath, action: "appended" });
+            const existingContent = fs16.readFileSync(fullPath, "utf-8");
+            if (existingContent.includes("_Generated by Kuma MCP_")) {
+              results.push({ type, filePath: relativePath, action: "skipped" });
+            } else {
+              fs16.writeFileSync(fullPath, existingContent.trimEnd() + "\n\n" + combinedContent, "utf-8");
+              results.push({ type, filePath: relativePath, action: "appended" });
+            }
           }
         } else {
           const dir = path16.dirname(fullPath);
@@ -5955,6 +6086,10 @@ function runInit(types, projectRoot) {
       } else {
         const template = getTemplate();
         if (fs16.existsSync(fullPath)) {
+          if (options.skipExisting) {
+            results.push({ type, filePath: relativePath, action: "skipped" });
+            continue;
+          }
           const existingContent = fs16.readFileSync(fullPath, "utf-8");
           if (existingContent.includes("_Generated by Kuma MCP_")) {
             if (type === "antigravity") {
@@ -6054,6 +6189,8 @@ Usage:
   npx @plumpslabs/kuma              Start MCP server (default)
   npx @plumpslabs/kuma init         Generate AI agent config files
   npx @plumpslabs/kuma init --all   Generate ALL config files
+  npx @plumpslabs/kuma init --merge Append to existing files (default)
+  npx @plumpslabs/kuma init --skip-existing Skip generation if file exists
   npx @plumpslabs/kuma init --claude --cursor  Generate specific files
   npx @plumpslabs/kuma init --help  Show this help
 
@@ -6127,9 +6264,20 @@ async function main() {
         }
       }
     }
-    const results = runInit(selectedTypes, process.cwd());
+    const skipExisting = requestedFlags.includes("--skip-existing");
+    const merge = requestedFlags.includes("--merge");
+    const results = runInit({ types: selectedTypes, projectRoot: process.cwd(), skipExisting });
     const output = formatInitResults(results);
     console.log(output);
+    const fs17 = await import("fs");
+    const path17 = await import("path");
+    const matchaSkills = path17.resolve(process.cwd(), "skills/matcha/SKILL.md");
+    const matchaAgents = path17.resolve(process.cwd(), ".agents/skills/matcha/SKILL.md");
+    const matchaCursor = path17.resolve(process.cwd(), ".cursor/rules/matcha.mdc");
+    const matchaWindsurf = path17.resolve(process.cwd(), ".windsurf/rules/matcha.md");
+    if (fs17.existsSync(matchaSkills) || fs17.existsSync(matchaAgents) || fs17.existsSync(matchaCursor) || fs17.existsSync(matchaWindsurf)) {
+      console.error("\n\u{1F375} Hey, I see matcha is installed \u2014 they pair well together!");
+    }
     process.exit(0);
   }
   sessionMemory.init({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumpslabs/kuma",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Zero-setup safety toolkit for AI coding agents. MCP server with code review, git analysis, file editing, session memory, and static analysis — works with Claude Code, Cursor, Gemini CLI.",
   "type": "module",
   "main": "dist/index.js",
@@ -56,7 +56,7 @@
     "git-diff",
     "cli"
   ],
-"repository": {
+  "repository": {
     "type": "git",
     "url": "git+https://github.com/plumpslabs/kuma.git"
   },
@@ -65,4 +65,4 @@
   },
   "homepage": "https://github.com/plumpslabs/kuma#readme",
   "license": "MIT"
-}
+}