@plumpslabs/kuma 2.1.5 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -46,6 +46,35 @@ Or add Kuma MCP server manually to any MCP client:
46
46
 
47
47
  ---
48
48
 
49
+ ## Unified Tool Router (10 Groups)
50
+
51
+ > **Kuma consolidates 46+ individual operations into 10 grouped tools.** AI agents scan 10 groups instead of 46 tools — simpler, faster, less context.
52
+
53
+ | Group | Actions | When to call |
54
+ |-------|---------|-------------|
55
+ | 🔵 `kuma_init` | `init`, `conventions`, `structure` | **Call first** every session |
56
+ | 🟢 `kuma_core` | `grep`, `read`, `edit`, `batch`, `lsp` | During active coding |
57
+ | 🟡 `kuma_verify` | `test`, `review`, `lint` | After every edit |
58
+ | 🔴 `kuma_safety` | `guard` (anti-patterns, loops, drift), `score` (0-100 health), `check` (pre-exec safety), `policy` (`.kuma/policy.yml`), `risk` (impact prediction), `dependency` (native JS alternatives), `audit` (safety audit trail), `stats` (audit statistics), `override` (bypass safety) | Before risky ops |
59
+ | 🟣 `kuma_graph` | `query` (nodes/edges/stats/search), `navigate`, `diagram`, `investigate`, `arch` (capture/diff/diagram/fs/graph/profiles), `experience` (suggest/errors/prune), `intent` (suggest/patterns) | Codebase understanding — powered by **SQLite knowledge graph** |
60
+ | 🧠 `kuma_memory` | `get`, `search`, `write`, `decision`, `context`, `heal` | Persist/retrieve context |
61
+ | 📊 `kuma_analytics` | `reflect`, `analytics`, `health`, `replay`, `heatmap`, `learn`, `predict`, `confidence`, `dna` | Session review |
62
+ | ⏳ `kuma_history` | `timeline`, `log`, `diff` | Git/time analysis |
63
+ | 🔒 `kuma_lock` | `acquire`, `release`, `list`, `clean` | Multi-agent coordination |
64
+ | ⚙️ `kuma_advanced` | `failure`, `compress`, `shadow`, `collective` (sync patterns to VPS), `marketplace` (install templates) | Maintenance |
65
+
66
+ ```bash
67
+ # Example workflow
68
+ kuma_init({ action: "init" }) # Load project context
69
+ kuma_core({ action: "grep", query: "handleAuth" }) # Find code
70
+ kuma_core({ action: "edit", filePath: "auth.ts", ... }) # Edit safely
71
+ kuma_verify({ action: "test" }) # Verify didn't break
72
+ kuma_safety({ action: "guard", goal: "refactor auth" }) # Safety check
73
+ kuma_analytics({ action: "reflect" }) # Reflect on progress
74
+ ```
75
+
76
+ ---
77
+
49
78
  ## Supported Agents
50
79
 
51
80
  `kuma init` generates native config files for **13 AI coding agents** — no manual hunting for file formats:
@@ -80,16 +109,19 @@ Every tool in Kuma has a safety net built-in — not as an afterthought, but as
80
109
  | # | When this happens... | Kuma does this... |
81
110
  |---|---|---|
82
111
  | 1 | LSP server is not installed | **Falls back to regex** — never hard fails |
83
- | 2 | An edit breaks something | **Rollback to any version** — versioned backups |
84
- | 3 | AI loops on a test failure | **Circuit breaker stops it** — prevents infinite retries |
85
- | 4 | A file path doesn't resolve | **Shows where it looked** — CWD vs project root |
86
- | 5 | A command is dangerous | **Blocks it** — `rm -rf`, `git push --force`, `curl \| bash` |
112
+ | 2 | An edit breaks something | **Rollback to any version** — versioned backups, dry-run preview, version list |
113
+ | 3 | AI loops on a test failure | **Circuit breaker stops it** — prevents infinite retries after 3 identical failures |
114
+ | 4 | A file path doesn't resolve | **Shows where it looked** — CWD vs project root with resolved paths |
115
+ | 5 | A command is dangerous | **Blocks it** — `rm -rf`, `git push --force`, `curl \| bash`, plus shell obfuscation detection |
116
+ | 6 | AI keeps repeating the same tool | **Tool-loop detection** — flags if same tool called 4+ times in last 10 calls |
117
+ | 7 | You need to undo an edit | **Versioned rollback** — `action: "rollback"` with `version: N` or `version: "list"` |
118
+ | 8 | A diff doesn't match | **Fuzzy fallback** — exact → whitespace-normalized → fuzzy match with configurable threshold |
87
119
 
88
120
  Most tools make AI smarter. **Kuma makes AI not break things.**
89
121
 
90
122
  ---
91
123
 
92
- ## Tools (17)
124
+ ## Tools (19)
93
125
 
94
126
  ### 🔍 Context — Understand the codebase
95
127
 
@@ -99,15 +131,16 @@ Most tools make AI smarter. **Kuma makes AI not break things.**
99
131
  | `smart_file_picker` | Read files with smart chunking: `full` (entire file), `smart` (signatures + tail), `outline` (exports only). |
100
132
  | `project_structure` | Tree view of project layout. Depth control, folder-only mode, include/exclude patterns. |
101
133
  | `git_log` | Structured commit history with optional file filter. |
102
- | `git_diff` | Structured diff output. Supports staged/unstaged, file filter, ref ranges. |
103
- | `lsp_query` | Go-to-definition, find references, get type info, or rename symbols via TypeScript Language Server. **Falls back to regex when LSP unavailable.** |
134
+ | `git_diff` | Structured diff output. Supports staged/unstaged, file filter, ref ranges, and context line control. |
135
+ | `lsp_query` | Go-to-definition, find references, get type info, **or rename symbols** via TypeScript Language Server. **Falls back to regex when LSP unavailable.** |
104
136
  | `project_conventions` | Auto-detect framework, test runner, package manager, import aliases, **monorepo workspaces**. |
137
+ | `kuma_init` | **Call FIRST** every session. Loads `.kuma/init.md` rules, `.kuma/memories/`, previous session state, and **knowledge graph** from SQLite DB. After this, you can work without re-detecting conventions. |
105
138
 
106
139
  ### ✏️ Execution — Make changes safely
107
140
 
108
141
  | Tool | Description |
109
142
  |------|-------------|
110
- | `precise_diff_editor` | Search-and-replace with exact → whitespace → fuzzy fallback. **Auto-backup before every edit.** Use `action: "rollback"` to undo. |
143
+ | `precise_diff_editor` | Search-and-replace with exact → whitespace → fuzzy fallback. **Auto-backup before every edit.** Supports **dry-run preview**, **versioned rollback** (`version: N`, `version: "list"`), and **batch edits** (up to 10 at once). |
111
144
  | `batch_file_writer` | Create up to 15 files in one call. Validates paths before writing. |
112
145
  | `static_analysis` | Run ESLint / TypeScript / Prettier / Ruff and **parse output into structured results.** Auto-detects tools from project config. |
113
146
 
@@ -115,8 +148,8 @@ Most tools make AI smarter. **Kuma makes AI not break things.**
115
148
 
116
149
  | Tool | Description |
117
150
  |------|-------------|
118
- | `execute_safe_test` | Run `test`/`build`/`lint`/`typecheck` with **timeout, circuit breaker, and process tree kill.** |
119
- | `code_reviewer` | Senior-level static analysis. Focus modes: correctness, conventions, security, performance, and **over-engineering detection.** |
151
+ | `execute_safe_test` | Run `test`/`build`/`lint`/`typecheck`/`custom` with **timeout, circuit breaker, and process tree kill.** Supports **monorepo workspaces** via `workspace` param or relative `cwd`. |
152
+ | `code_reviewer` | Senior-level static analysis. Focus modes: correctness, conventions, security, performance, and **over-engineering detection.** Supports JSON output. |
120
153
 
121
154
  ### 🧠 Memory — Know what happened
122
155
 
@@ -128,6 +161,13 @@ Most tools make AI smarter. **Kuma makes AI not break things.**
128
161
  | `kuma_reflect` | **Reflection tool** — checks if you're on track, detects drift (edits without tests, loops, unresolved failures), and suggests the next action. |
129
162
  | `kuma_context` | **Snapshot manager** — save/restore project state (modified files, errors, git diff) before risky operations. |
130
163
 
164
+ ### 🛡️ Safety — Stay on track
165
+
166
+ | Tool | Description |
167
+ |------|-------------|
168
+ | `kuma_guard` | **Context safety net.** Detects anti-patterns (script patching, bash grep), tool loops, drift (edits without tests, unresolved failures). Run this after every few edits. Checks: `all`, `anti-pattern`, `loop`, `drift`, `context`. |
169
+ | `kuma_safety` | **Safety AI Layer.** Actions: `audit` (query trail), `stats` (audit statistics), `override` (bypass safety, logged). `precise_diff_editor` auto-wrapped with safety proxy. |
170
+
131
171
  ---
132
172
 
133
173
  ## Safety
@@ -135,37 +175,311 @@ Most tools make AI smarter. **Kuma makes AI not break things.**
135
175
  | Feature | What it does |
136
176
  |---------|-------------|
137
177
  | **Sandboxed** | All file operations locked to project directory. Path traversal blocked. System dirs protected. |
138
- | **Auto-backup** | `.agent-backups/<timestamp>/` snapshot before every edit. Rollback to any version. |
178
+ | **Auto-backup** | `.kuma/backups/<timestamp>/` snapshot before every `precise_diff_editor` edit. Rollback to any version. |
139
179
  | **Circuit breaker** | Stops after 3 identical failures. Prevents AI loops. |
140
180
  | **Timeout** | All commands have configurable timeout (max 180s). Process tree kill on timeout. |
141
181
  | **Command whitelist** | Only `test`, `build`, `lint`, `typecheck`, and explicit custom commands. |
142
- | **Dangerous pattern blocking** | `rm -rf`, `git push --force`, `npm publish`, `curl \| bash` blocked by default. |
182
+ | **Dangerous pattern blocking** | `rm -rf`, `git push --force`, `npm publish`, `curl \| bash` blocked by default. **Shell obfuscation detection** catches hidden dangerous commands. |
143
183
  | **LSP graceful degradation** | When TypeScript Language Server is not installed, LSP tools **fall back to regex** instead of hard failing. |
184
+ | **Multi-agent lock** | File-level locks prevent multiple AI agents from editing the same file simultaneously. |
185
+ | **Safety score** | Aggregate 0-100 score across 9 dimensions: git status, backups, LSP, tests, modified files, loops, failures, conventions, goal. |
144
186
 
145
187
  ---
146
188
 
147
189
  ## What Makes Kuma Unique
148
190
 
149
- - **Workflow combo** — `project_conventions + smart_grep + smart_file_picker + precise_diff_editor + execute_safe_test + code_reviewer` as a seamless pipeline.
191
+ - **Router groups** — 46+ operations consolidated into 10 grouped tools. AI scans 10 groups instead of 46 tools.
192
+ - **Workflow combo** — `kuma_init → kuma_core → kuma_verify → kuma_safety → kuma_analytics` as a seamless pipeline.
193
+ - **Knowledge Graph (SQLite)** — Built-in SQLite database via `sql.js` (pure WASM, zero native build). Tracks nodes (functions, files, API routes, tests) + edges (calls, imports, defines, tests) + experience patterns + sessions. FTS5 full-text search with graceful fallback.
150
194
  - **Safety is default, not optional** — Rollback, circuit breaker, sandbox, timeout, dangerous pattern blocking are built into every tool.
151
- - **Graceful degradation** — When dependencies are missing (LSP, linters), Kuma falls back instead of crashing.
195
+ - **Graceful degradation** — When dependencies are missing (LSP, linters, FTS5), Kuma falls back instead of crashing.
152
196
  - **Over-engineering detection** — `code_reviewer` with `focus: "over-engineering"` catches unnecessary abstractions.
153
- - **Drift detection** — `kuma_reflect` catches edits without tests, tool-call loops, unresolved failures.
154
- - **Persistent memory** — Knowledge survives across sessions via `.kuma/memories/`. Auto-generates architecture & conventions docs.
197
+ - **Drift detection** — `kuma_guard` catches edits without tests, tool-call loops, unresolved failures.
198
+ - **Impact prediction** — `kuma_risk` tells you how many files reference a symbol before you change it.
199
+ - **Dependency guard** — Before adding npm packages, checks for native JS alternatives and existing similar packages.
200
+ - **Persistent memory** — Knowledge survives across sessions via `.kuma/memories/` + `.kuma/kuma.db`. Auto-generates architecture & conventions docs.
155
201
  - **Monorepo awareness** — Detects workspaces, scans `apps/*`, `packages/*`, `services/*`, and pnpm/yarn/npm workspaces.
156
202
 
203
+ ### Storage Layout
204
+
205
+ ```
206
+ .kuma/
207
+ ├── kuma.db # SQLite database (knowledge graph, sessions, experiences)
208
+ ├── init.md # Behavioral rules for AI agents (auto-generated)
209
+ ├── config.json # Per-project config (collective endpoint, autoSync, etc.)
210
+ ├── memory.json # Session state (modified files, failures, tool history)
211
+ └── memories/ # Persistent knowledge files
212
+ ├── architecture.md
213
+ ├── conventions.md
214
+ ├── decisions.md
215
+ ├── glossary.md
216
+ └── known-issues.md
217
+
218
+ .kuma/backups/ # Versioned backups from precise_diff_editor
219
+ └── <timestamp>/ # One backup snapshot per edit
220
+ └── <relative-file-path>
221
+ ```
222
+
157
223
  ---
158
224
 
159
225
  ## Kuma's DNA
160
226
 
161
227
  1. **Zero setup, zero friction** — Built-in tools that work without config. No DB, no API key.
162
228
  2. **Safety first** — Every tool has a safety net: timeout, circuit breaker, rollback, sandbox.
163
- 3. **Graceful degradation, not crash** — Every tool has a fallback before it fails. LSP unavailable? Regex. File not found? Show resolved paths. Diff mismatch? Whitespace→fuzzy retry. Test fails? Circuit breaker stops the loop.
164
- 4. **Opinionated workflow** — Tools designed to be used together: `conventionsgreppickdifftest → review`.
165
- 5. **Minimal surface** — 17 focused tools. Each tool has one job and does it well. No overlap, no confusion.
229
+ 3. **Graceful degradation, not crash** — Every tool has a fallback before it fails. LSP unavailable? Regex. File not found? Show resolved paths. Diff mismatch? Whitespace→fuzzy retry. Test fails? Circuit breaker stops the loop. FTS5 unavailable? Full-text search disabled gracefully.
230
+ 4. **Opinionated workflow** — Tools designed to be used together: `kuma_initkuma_corekuma_verifykuma_safetykuma_analytics`.
231
+ 5. **Minimal surface** — 19 focused tools. Each tool has one job and does it well. No overlap, no confusion.
166
232
 
167
233
  ---
168
234
 
235
+ ## 🐻 Kolektif — Collective Intelligence
236
+
237
+ Kolektif allows Kuma instances across different projects to share anonymized patterns. Data is sent to **your own VPS server** — not to a public server.
238
+
239
+ ### Architecture
240
+
241
+ ```
242
+ Project A (Laptop) ──────┐
243
+ ├──► Your VPS (Hono + better-sqlite3)
244
+ Project B (Laptop) ──────┘ Port 3001
245
+ ```
246
+
247
+ **Data sent (safe):**
248
+ - `errorType`: "type_error" / "build_error" — generic category
249
+ - `tools`: ["smart_grep", "lsp_query"] — tool names only
250
+ - `language`: "typescript" — programming language
251
+ - `count`, `successRate` — anonymous numbers
252
+
253
+ **Data NEVER sent:**
254
+ - ❌ Source code
255
+ - ❌ File names / function names
256
+ - ❌ Raw error messages
257
+ - ❌ Git history / commit messages
258
+ - ❌ User identity
259
+
260
+ ### Quick Deploy (VPS)
261
+
262
+ Requires a VPS (1GB RAM is enough) with Node.js 18+.
263
+
264
+ ```bash
265
+ # 1. Clone repo
266
+ ssh user@vps-ip
267
+ git clone https://github.com/plumpslabs/kuma.git kolektif
268
+ cd kolektif/server
269
+
270
+ # 2. Install + build
271
+ npm install
272
+ npx tsc
273
+
274
+ # 3. Start via PM2
275
+ pm2 start dist/index.js --name kuma-server
276
+ pm2 save
277
+
278
+ # 4. Open firewall
279
+ sudo ufw allow 3001/tcp
280
+ ```
281
+
282
+ Or use the one-command deploy script:
283
+ ```bash
284
+ ssh user@vps-ip 'bash -s' < server/deploy.sh
285
+ ```
286
+
287
+ ### Client Setup
288
+
289
+ Set the environment variable on your laptop:
290
+ ```bash
291
+ export KUMA_COLLECTIVE_URL=http://<vps-ip>:3001
292
+ ```
293
+
294
+ Or via `.kuma/config.json`:
295
+ ```json
296
+ {
297
+ "collective": {
298
+ "url": "http://<vps-ip>:3001",
299
+ "autoSync": true,
300
+ "syncIntervalMinutes": 60
301
+ }
302
+ }
303
+ ```
304
+
305
+ ### API Endpoints
306
+
307
+ | Method | Endpoint | Description |
308
+ |--------|----------|-------------|
309
+ | `GET` | `/health` | Health check |
310
+ | `POST` | `/api/v1/patterns` | Submit anonymized patterns |
311
+ | `GET` | `/api/v1/patterns?lang=go` | Get global patterns by language |
312
+ | `GET` | `/api/v1/stats` | Dashboard statistics |
313
+
314
+ ### Usage from Kuma
315
+
316
+ ```bash
317
+ # Sync patterns to your VPS
318
+ kuma_advanced({ action: "collective", collectiveAction: "sync" })
319
+
320
+ # Export anonymized preview
321
+ kuma_advanced({ action: "collective", collectiveAction: "export" })
322
+
323
+ # Discover patterns from VPS
324
+ kuma_advanced({ action: "collective" })
325
+ ```
326
+
327
+ ---
328
+
329
+ ## 📦 Knowledge Marketplace
330
+
331
+ Marketplace provides **pre-built knowledge graph templates** for popular frameworks. Installing a template means Kuma instantly understands the framework's structure without having to learn from scratch.
332
+
333
+ ### What happens when you install a template?
334
+
335
+ Templates inject nodes (modules, files, functions) and edges (depends_on, imports) into Kuma's SQLite graph. Results:
336
+
337
+ | Before Installing | After Installing `graph:laravel` |
338
+ |-------------------|----------------------------------|
339
+ | Kuma doesn't know if `User.php` is a Model or Controller | Kuma knows `User.php` extends `Authenticatable` → Model |
340
+ | `kuma_graph({ action: "navigate", query: "find controllers" })` fails | Can answer: "AuthController, UserController in app/Http/Controllers/" |
341
+ | Empty graph — Kuma starts from zero | Graph knows Laravel MVC architecture from the start |
342
+ | Intent prediction is less accurate | Predictions improve — knows Controller → Service → Repository patterns |
343
+
344
+ ### Usage
345
+
346
+ ```bash
347
+ # List all templates
348
+ kuma_advanced({ action: "marketplace" })
349
+
350
+ # Install Laravel template — Kuma instantly understands Laravel MVC
351
+ kuma_advanced({ action: "marketplace", marketplaceAction: "install", template: "graph:laravel" })
352
+ ```
353
+
354
+ ### Available Templates
355
+
356
+ #### 🔷 TypeScript / JavaScript
357
+
358
+ | Template | Framework | Knows | Nodes | Edges |
359
+ |----------|-----------|-------|-------|-------|
360
+ | `graph:hono` | Hono | Middleware chain, RPC mode, typed routes, HonoX, JSX middleware | 35 | 90 |
361
+ | `graph:fastify` | Fastify | Plugin system, hooks lifecycle, schema validation, encapsulation | 40 | 100 |
362
+ | `graph:elysia` | Elysia (Bun) | Plugin system, Eden Treaty, schema validation, state/derive pattern | 28 | 70 |
363
+ | `graph:nextjs` | Next.js App Router | App Router, Server Components, layout structure, route groups | 45 | 120 |
364
+ | `graph:nextjs-pages` | Next.js Pages Router | Pages Router, getServerSideProps, API routes, ISR pattern | 38 | 95 |
365
+ | `graph:remix` | Remix | Loaders, actions, forms pattern, nested routes, resource routes | 32 | 80 |
366
+ | `graph:express` | Express.js | Middleware chain, route handlers, error patterns, app structure | 30 | 85 |
367
+
368
+ #### ⚛️ React Ecosystem
369
+
370
+ | Template | Library | Knows | Nodes | Edges |
371
+ |----------|---------|-------|-------|-------|
372
+ | `graph:tanstack-query` | TanStack Query | Query/mutation pattern, cache invalidation, optimistic updates, infinite queries | 36 | 88 |
373
+ | `graph:tanstack-router` | TanStack Router | File-based routing, loaders, search params, route guards, devtools | 30 | 75 |
374
+ | `graph:tanstack-table` | TanStack Table | Column definitions, sorting, filtering, pagination, row selection | 22 | 55 |
375
+ | `graph:zustand` | Zustand | Store pattern, middleware (persist, devtools, immer), subscribe, slice pattern | 18 | 42 |
376
+ | `graph:shadcn` | shadcn/ui | Component structure, Radix primitives, tailwind classes, registry pattern | 50 | 130 |
377
+
378
+ #### 🗄️ Database (JS/TS)
379
+
380
+ | Template | ORM | Knows | Nodes | Edges |
381
+ |----------|-----|-------|-------|-------|
382
+ | `graph:prisma` | Prisma | Schema models, relations, migrations, client queries, middleware hooks | 35 | 85 |
383
+ | `graph:drizzle` | Drizzle | Schema definition, relations, SQL-like queries, migrations, Drizzle Kit | 30 | 72 |
384
+
385
+ #### Other Languages
386
+
387
+ | Template | Framework | Knows | Nodes | Edges |
388
+ |----------|-----------|-------|-------|-------|
389
+ | `graph:laravel` | Laravel (PHP) | Controllers, Services, Repositories, Middleware, Blade, Eloquent | 50 | 140 |
390
+ | `graph:spring` | Spring Boot (Java) | Controllers, Services, JPA Repositories, Entities, Config | 55 | 150 |
391
+ | `graph:django` | Django (Python) | Views, Models, Serializers, URLs, Admin | 40 | 110 |
392
+ | `graph:gin` | Gin (Go) | Handlers, Services, Repositories, Middleware, Models | 25 | 65 |
393
+ | `graph:axum` | Axum (Rust) | Handlers, Extractors, Services, Repositories, State | 20 | 55 |
394
+
395
+ ### Distribution via npm
396
+
397
+ Templates can also be installed via npm to persist across projects:
398
+ ```bash
399
+ npm install @kuma-templates/laravel-graph
400
+ ```
401
+
402
+ ---
403
+
404
+ ## 🔄 Self-Healing (3.4)
405
+
406
+ Kuma automatically detects and repairs issues in the knowledge graph:
407
+
408
+ ```bash
409
+ # Check for stale entries
410
+ kuma_memory({ action: "heal", healAction: "check" })
411
+
412
+ # Auto-heal — remove stale nodes/edges
413
+ kuma_memory({ action: "heal" })
414
+ ```
415
+
416
+ | Feature | Description |
417
+ |---------|-------------|
418
+ | **Content Hash** | Detects files that changed since last scan |
419
+ | **All-Node Scan** | Scans all nodes, not just modified ones |
420
+ | **Cascading Edges** | Removes edges when their source node is deleted (cascade) |
421
+ | **Incremental Heal** | Batch processing — 50 nodes per cycle, non-blocking |
422
+ | **Auto-Heal Hook** | Runs automatically after edits — no manual action needed |
423
+
424
+ ---
425
+
426
+ ## 🛡️ Safety AI Layer
427
+
428
+ The Safety layer sits between AI agents and the filesystem. Every tool call goes through: policy check, path validation, audit logging.
429
+
430
+ ### Features
431
+
432
+ | Feature | Description |
433
+ |---------|-------------|
434
+ | **Safety Audit** | Every tool call is recorded in SQLite (`safety_audit`). Queryable. |
435
+ | **Safety Proxy** | `precise_diff_editor` is auto-wrapped — runs preCheck before execution. |
436
+ | **Risk Assessment** | Path validation, policy checks, dangerous command detection. |
437
+ | **Override Logging** | Safety bypasses are logged with reasons — audit trail stays clean. |
438
+
439
+ ### Usage
440
+
441
+ ```bash
442
+ # Query audit trail (20 most recent entries)
443
+ kuma_safety({ action: "audit", limit: 20 })
444
+
445
+ # Audit statistics
446
+ kuma_safety({ action: "stats" })
447
+
448
+ # Bypass safety (logged with reason)
449
+ kuma_safety({ action: "override", tool: "precise_diff_editor", reason: "trusted edit" })
450
+ ```
451
+
452
+ ### Full Safety Check
453
+ ```bash
454
+ # Full safety check before execution
455
+ kuma_safety({ action: "check", actionCheck: "edit", filePath: "config.ts" })
456
+ ```
457
+
458
+ ---
459
+
460
+ ## 🍵 Pair with Matcha
461
+
462
+ **Kuma keeps AI agents safe. Matcha keeps AI agents deliberate.**
463
+
464
+ [Matcha](https://github.com/plumpslabs/matcha) is an engineering philosophy
465
+ ruleset that enforces deliberate thinking before, during, and after coding:
466
+
467
+ - **5W1H Gate** — Why are we doing this? Is there a simpler path?
468
+ - **Reuse Before Write** — Never write what already exists
469
+ - **Clean Finish** — No temp, no debug, no unused code
470
+
471
+ Where Kuma provides **runtime safety** (rollback, circuit breaker, sandbox),
472
+ Matcha provides **session discipline** (planning gate, cleanup scan, intensity levels).
473
+
474
+ ```bash
475
+ # Try them together
476
+ npx @plumpslabs/matcha init # Install matcha philosophy
477
+ npx @plumpslabs/kuma init --all # Install kuma safety tools
478
+ ```
479
+
480
+ Both tools are designed to complement each other — Kuma handles the
481
+ "can't break things" layer while Matcha handles the "think before you act" layer.
482
+
169
483
  ## Contributing
170
484
 
171
485
  See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.
@@ -180,6 +494,6 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.
180
494
 
181
495
  **Made with 🐻 for AI agents everywhere**
182
496
 
183
- [Report Bug](https://github.com/farhank15/kuma/issues) · [Request Feature](https://github.com/farhank15/kuma/issues)
497
+ [Report Bug](https://github.com/plumpslabs/kuma/issues) · [Request Feature](https://github.com/plumpslabs/kuma/issues)
184
498
 
185
499
  </div>
@@ -0,0 +1,186 @@
1
+ import {
2
+ getProjectRoot
3
+ } from "./chunk-7Q3YUJSM.js";
4
+
5
+ // src/utils/agentDetector.ts
6
+ import fs from "fs";
7
+ import path from "path";
8
+ var AGENT_DETECTORS = [
9
+ {
10
+ type: "cursor",
11
+ checkFiles: [],
12
+ checkDirs: [".cursor"],
13
+ priority: 90,
14
+ label: "Cursor (.cursor/)"
15
+ },
16
+ {
17
+ type: "claude",
18
+ checkFiles: ["CLAUDE.md"],
19
+ checkDirs: [".claude"],
20
+ priority: 85,
21
+ label: "Claude Code (CLAUDE.md / .claude/)"
22
+ },
23
+ {
24
+ type: "cline",
25
+ checkFiles: [],
26
+ checkDirs: [".clinerules"],
27
+ priority: 80,
28
+ label: "Cline (.clinerules/)"
29
+ },
30
+ {
31
+ type: "antigravity",
32
+ checkFiles: [],
33
+ checkDirs: [".agents"],
34
+ priority: 75,
35
+ label: "Antigravity CLI (.agents/)"
36
+ },
37
+ {
38
+ type: "windsurf",
39
+ checkFiles: [".windsurfrules"],
40
+ checkDirs: [],
41
+ priority: 70,
42
+ label: "Windsurf (.windsurfrules)"
43
+ },
44
+ {
45
+ type: "opencode",
46
+ checkFiles: ["opencode.json"],
47
+ checkDirs: [],
48
+ priority: 65,
49
+ label: "OpenCode (opencode.json)"
50
+ },
51
+ {
52
+ type: "kiro",
53
+ checkFiles: [],
54
+ checkDirs: [".kiro"],
55
+ priority: 60,
56
+ label: "Kiro (.kiro/)"
57
+ },
58
+ {
59
+ type: "aider",
60
+ checkFiles: [".aider.conf.yml", ".aider.conf.yaml"],
61
+ checkDirs: [],
62
+ priority: 55,
63
+ label: "Aider (.aider.conf.yml)"
64
+ },
65
+ {
66
+ type: "copilot",
67
+ checkFiles: [],
68
+ checkDirs: [".github/skills"],
69
+ priority: 50,
70
+ label: "GitHub Copilot Editor (.github/skills/)"
71
+ },
72
+ {
73
+ type: "codex",
74
+ checkFiles: [".codex/config.toml"],
75
+ checkDirs: [".codex"],
76
+ priority: 45,
77
+ label: "Codex CLI (.codex/)"
78
+ },
79
+ {
80
+ type: "qwen",
81
+ checkFiles: ["settings.json"],
82
+ checkDirs: [],
83
+ priority: 40,
84
+ label: "Qwen Code (settings.json)"
85
+ },
86
+ {
87
+ type: "openclaw",
88
+ checkFiles: ["skills/kuma/SKILL.md"],
89
+ checkDirs: ["skills"],
90
+ priority: 35,
91
+ label: "OpenClaw (skills/kuma/SKILL.md)"
92
+ },
93
+ {
94
+ type: "codewhale",
95
+ checkFiles: [],
96
+ checkDirs: [".codewhale"],
97
+ priority: 30,
98
+ label: "CodeWhale (.codewhale/)"
99
+ }
100
+ ];
101
+ function checkFile(root, filePath) {
102
+ try {
103
+ return fs.existsSync(path.join(root, filePath));
104
+ } catch {
105
+ return false;
106
+ }
107
+ }
108
+ function checkDir(root, dirPath) {
109
+ try {
110
+ const fullPath = path.join(root, dirPath);
111
+ return fs.existsSync(fullPath) && fs.statSync(fullPath).isDirectory();
112
+ } catch {
113
+ return false;
114
+ }
115
+ }
116
+ function detectAgent(projectRoot) {
117
+ const root = projectRoot ?? getProjectRoot();
118
+ const detected = [];
119
+ for (const detector of AGENT_DETECTORS) {
120
+ const hasFile = detector.checkFiles.some((f) => checkFile(root, f));
121
+ const hasDir = detector.checkDirs.some((d) => checkDir(root, d));
122
+ if (hasFile || hasDir) {
123
+ detected.push(detector.type);
124
+ }
125
+ }
126
+ const sorted = detected.map((t) => ({ type: t, priority: AGENT_DETECTORS.find((d) => d.type === t)?.priority ?? 0 })).sort((a, b) => b.priority - a.priority);
127
+ const primary = sorted.length > 0 ? sorted[0].type : null;
128
+ let confidence = "low";
129
+ if (sorted.length > 0) {
130
+ const topPriority = sorted[0].priority;
131
+ if (topPriority >= 70) confidence = "high";
132
+ else if (topPriority >= 50) confidence = "medium";
133
+ else confidence = "low";
134
+ }
135
+ return {
136
+ detected: sorted.map((s) => s.type),
137
+ primary,
138
+ confidence
139
+ };
140
+ }
141
+ function getSkillPath(type) {
142
+ switch (type) {
143
+ case "claude":
144
+ return ".claude/skills/kuma/SKILL.md";
145
+ case "cursor":
146
+ return ".cursor/rules/kuma.mdc";
147
+ case "cline":
148
+ return ".clinerules/kuma.md";
149
+ case "antigravity":
150
+ return ".agents/skills/kuma/SKILL.md";
151
+ case "codex":
152
+ return ".agents/skills/kuma/SKILL.md";
153
+ // Same path as Antigravity
154
+ case "opencode":
155
+ return "opencode.json";
156
+ case "aider":
157
+ return "CONVENTIONS.md";
158
+ case "windsurf":
159
+ return ".windsurfrules";
160
+ case "copilot":
161
+ return ".github/skills/kuma/SKILL.md";
162
+ case "qwen":
163
+ return "AGENTS.md";
164
+ case "kiro":
165
+ return ".kiro/steering/kuma.md";
166
+ case "openclaw":
167
+ return "skills/kuma/SKILL.md";
168
+ case "codewhale":
169
+ return "skills/kuma/SKILL.md";
170
+ }
171
+ }
172
+ function getAgentLabel(type) {
173
+ const detector = AGENT_DETECTORS.find((d) => d.type === type);
174
+ return detector?.label ?? type;
175
+ }
176
+ function skillExists(type, projectRoot) {
177
+ const root = projectRoot ?? getProjectRoot();
178
+ const skillPath = getSkillPath(type);
179
+ return fs.existsSync(path.join(root, skillPath));
180
+ }
181
+ export {
182
+ detectAgent,
183
+ getAgentLabel,
184
+ getSkillPath,
185
+ skillExists
186
+ };