@plumpslabs/kuma 2.3.0 → 2.3.2

package/dist/index.js

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import {
+  ALL_CONFIG_TYPES,
+  formatInitResults,
+  runInit
+} from "./chunk-L5WU2HTN.js";
 import {
   analyzeImpact,
   autoHeal,
@@ -9,39 +14,52 @@ import {
   getGraphStats,
   searchGraph,
   traceFlow
-} from "./chunk-IMO4QAFJ.js";
+} from "./chunk-EQ2CE4UC.js";
 import {
+  buildDriftMessages,
+  getGitDiffStat,
+  getSessionStats,
+  getUnresolvedCount
+} from "./chunk-JIL533AM.js";
+import {
+  addContextNote,
+  addSecurityFinding,
+  addTodo,
+  checkPortability,
+  ensureGitignore,
+  getBenchmarkDiff,
   getChanges,
   getDb,
   getResearchCache,
+  getSecurityFindings,
+  listContextNotes,
+  listDecisionLog,
+  listResearchCache,
+  listTodos,
+  recordDecisionLog,
+  rollbackChange,
+  runDoctor,
+  runGarbageCollection,
+  saveBenchmark,
   saveDb,
   saveHealthSnapshot,
-  saveResearchCache
-} from "./chunk-6NEMSUKP.js";
+  saveResearchCache,
+  updateDecisionStatus,
+  updateTodoStatus
+} from "./chunk-5N6KXACT.js";
 import {
   formatDecisionTemplate,
   getProactiveMemories,
   recordDecision,
   scoreMemoryRelevance
-} from "./chunk-OUPFJQKW.js";
-import {
-  buildDriftMessages,
-  getGitDiffStat,
-  getSessionStats,
-  getUnresolvedCount
-} from "./chunk-WP3WRPDC.js";
+} from "./chunk-EIK7T746.js";
 import {
   sessionMemory
-} from "./chunk-TT37TE4P.js";
-import {
-  ALL_CONFIG_TYPES,
-  formatInitResults,
-  runInit
-} from "./chunk-5A6AKUJZ.js";
+} from "./chunk-SU7BTOND.js";
 import {
   getProjectRoot,
   validateFilePath
-} from "./chunk-IXMWW5WA.js";
+} from "./chunk-E2KFPEBT.js";
 
 // src/index.ts
 import { readFileSync } from "fs";
@@ -69,10 +87,14 @@ async function handleContext(params) {
       return handleNavigate(params);
     case "changes":
       return handleChanges(params);
+    case "rollback":
+      return handleRollback(params);
+    case "researches":
+      return handleResearches(params);
     case "health":
       return handleHealth(params);
     default:
-      return `Unknown action "${action}". Use: init, research, impact, navigate, changes, health`;
+      return `Unknown action "${action}". Use: init, research, impact, navigate, changes, rollback, researches, health`;
   }
 }
 async function handleInit(_params) {
@@ -132,6 +154,17 @@ async function handleInit(_params) {
   lines.push(`  \u{1F3AF} Goal: ${summary.currentGoal || "not set"}`);
   lines.push(`  \u{1F4DD} Modified: ${summary.modifiedFiles?.length || 0} file(s)`);
   lines.push(`  \u{1F6E0}\uFE0F Tool calls: ${summary.toolCallCount}`);
+  try {
+    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-QX2LBJ7H.js");
+    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-RC2EO3OB.js");
+    const score = await computeSafetyScore(_params.goal);
+    const checksStr = JSON.stringify(score.checks);
+    await saveHealthSnapshot2(score.score, score.risk, checksStr, score.summary);
+    lines.push("");
+    lines.push("**Health Score**");
+    lines.push(formatSafetyScore(score));
+  } catch {
+  }
   lines.push("", "\u{1F4A1} Call kuma_context({ action: 'research', scope: '<area>' }) to research a specific area.");
   return lines.join("\n");
 }
@@ -154,8 +187,15 @@ async function handleResearch(params) {
     }
   }
   if (record) {
-    const age = Math.floor((Date.now() - (record.validatedAt ? new Date(record.validatedAt).getTime() : 0)) / 1e3);
-    lines.push(`  \u2705 Found cached research (${age > 86400 ? `${Math.floor(age / 86400)}d` : `${Math.floor(age / 3600)}h`} old)`);
+    const ageSeconds = Math.floor((Date.now() - (record.validatedAt ? new Date(record.validatedAt).getTime() : 0)) / 1e3);
+    const ageStr = ageSeconds > 86400 ? `${Math.floor(ageSeconds / 86400)}d` : ageSeconds > 3600 ? `${Math.floor(ageSeconds / 3600)}h` : `${Math.floor(ageSeconds / 60)}m`;
+    lines.push(`  \u2705 Found cached research (${ageStr} old)`);
+    if (ageSeconds > 86400) {
+      lines.push(`  ${ageSeconds > 604800 ? "\u{1F534}" : "\u{1F7E1}"} **Staleness:** Cache is ${ageStr} old \u2014 may be stale`);
+      if (ageSeconds > 604800) {
+        lines.push("  \u{1F4A1} Consider re-researching: cache is over a week old");
+      }
+    }
   } else {
     lines.push("  \u23F3 No cached research \u2014 starting fresh");
   }
@@ -182,13 +222,30 @@ async function handleResearch(params) {
   try {
     const graphResult = await searchGraph(scope, 15);
     const graphLines = graphResult.split("\n");
-    if (graphLines.length > 1) {
+    if (graphLines.length > 1 && !graphResult.includes("No results")) {
       lines.push(`  \u{1F4CA} ${graphLines.filter((l) => l.includes("\u2022")).length} relevant node(s) found`);
       for (const l of graphLines.slice(0, 8)) {
         if (l.includes("\u2022")) lines.push(`  ${l}`);
       }
     } else {
-      lines.push("  \u23F3 No graph data yet \u2014 build by using more tools");
+      lines.push("  \u23F3 No graph data \u2014 searching codebase...");
+      try {
+        const fg = (await import("fast-glob")).default;
+        const root = getProjectRoot();
+        const ignorePatterns = ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/build/**", "**/.kuma/**"];
+        const files = await fg([`**/*${scope}*`], { cwd: root, ignore: ignorePatterns, onlyFiles: true, deep: 6 });
+        if (files.length > 0) {
+          lines.push(`  \u{1F4C1} Found ${files.length} file(s) in codebase matching "${scope}":`);
+          for (const f of files.slice(0, 8)) {
+            lines.push(`    \u{1F4C4} ${f}`);
+          }
+          if (files.length > 8) lines.push(`    ... and ${files.length - 8} more`);
+        } else {
+          lines.push("  \u23F3 No codebase matches \u2014 build graph by using more tools");
+        }
+      } catch {
+        lines.push("  \u23F3 No graph data yet \u2014 build by using more tools");
+      }
     }
   } catch {
     lines.push("  \u26A0\uFE0F Graph query failed");
@@ -257,11 +314,23 @@ async function handleChanges(params) {
   const since = params.since;
   return await getChanges({ filePath, since });
 }
+async function handleRollback(params) {
+  const target = params.target;
+  if (!target) return "\u26A0\uFE0F target parameter required (change ID, e.g. '5').";
+  const changeId = parseInt(target, 10);
+  if (isNaN(changeId)) return `\u26A0\uFE0F Invalid change ID: "${target}". Use a numeric ID from kuma_context({ action: 'changes' }).`;
+  sessionMemory.recordToolCall("kuma_context_rollback", { changeId });
+  return await rollbackChange(changeId);
+}
+async function handleResearches(_params) {
+  sessionMemory.recordToolCall("kuma_context_researches", {});
+  return await listResearchCache();
+}
 async function handleHealth(_params) {
   sessionMemory.recordToolCall("kuma_context_health", {});
   try {
-    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-7FU7XSY5.js");
-    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-KN7Z4B5V.js");
+    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-QX2LBJ7H.js");
+    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-RC2EO3OB.js");
     const score = await computeSafetyScore();
     const checksStr = JSON.stringify(score.checks);
     await saveHealthSnapshot2(score.score, score.risk, checksStr, score.summary);
@@ -298,6 +367,8 @@ async function handleMemory(params) {
   switch (action) {
     case "decision":
       return handleDecision(params);
+    case "mine":
+      return handleMine(params);
     case "research_save":
       return handleResearchSave(params);
     case "session":
@@ -308,8 +379,16 @@ async function handleMemory(params) {
       return handleSearch(params);
     case "changes":
       return handleChanges2(params);
+    case "todo":
+      return handleTodo(params);
+    case "context":
+      return handleContext2(params);
+    case "benchmark":
+      return handleBenchmark(params);
+    case "decision_log":
+      return handleDecisionLog(params);
     default:
-      return `Unknown action "${action}". Use: decision, research_save, session, heal, search, changes`;
+      return `Unknown action "${action}".`;
   }
 }
 async function handleDecision(params) {
@@ -318,15 +397,13 @@ async function handleDecision(params) {
     case "template":
       return formatDecisionTemplate();
     case "suggest": {
-      const { shouldRecordDecision } = await import("./kumaMemory-IO7TVE7W.js");
+      const { shouldRecordDecision } = await import("./kumaMemory-ME4XWD5Z.js");
       const check = shouldRecordDecision();
       return check.worth ? `\u{1F4A1} Decision suggested: "${check.title}"
 Use kuma_memory({ action: 'decision', title: '...', context: '...', rationale: '...', outcome: '...' }) to record.` : "\u2705 No decision needed at this time.";
     }
     case "record":
-      if (!params.title || !params.rationale) {
-        return "\u26A0\uFE0F title and rationale are required. Optionally: context, outcome.";
-      }
+      if (!params.title || !params.rationale) return "\u26A0\uFE0F title and rationale are required.";
       return recordDecision({
         title: params.title,
         context: params.context || "",
@@ -350,68 +427,44 @@ async function handleResearchSave(params) {
   await saveResearchCache(scope, record, void 0, params.confidence);
   try {
     const researchDir = path2.join(getProjectRoot(), ".kuma", "research");
-    if (!fs2.existsSync(researchDir)) {
-      fs2.mkdirSync(researchDir, { recursive: true });
-    }
-    fs2.writeFileSync(
-      path2.join(researchDir, `${scope}.json`),
-      JSON.stringify(JSON.parse(record), null, 2),
-      "utf-8"
-    );
+    if (!fs2.existsSync(researchDir)) fs2.mkdirSync(researchDir, { recursive: true });
+    fs2.writeFileSync(path2.join(researchDir, `${scope}.json`), JSON.stringify(JSON.parse(record), null, 2), "utf-8");
   } catch {
   }
-  return `\u2705 Research "${scope}" saved to cache and .kuma/research/${scope}.json`;
+  return `\u2705 Research "${scope}" saved.`;
 }
 async function handleSession(params) {
   const topic = params.topic;
   const summary = sessionMemory.getSummary(topic);
-  if (topic) {
-    return typeof summary.content === "string" ? summary.content : JSON.stringify(summary, null, 2);
-  }
+  if (topic) return typeof summary.content === "string" ? summary.content : JSON.stringify(summary, null, 2);
   const modifiedFiles = summary.modifiedFiles || [];
   const failures = summary.unresolvedFailures || [];
   const lines = [
-    "\u{1F4CB} **Session Summary**",
-    `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
-    "",
+    "\u{1F4CB} **Session Summary**\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n",
     `\u{1F3AF} Goal: ${summary.currentGoal || "not set"}`,
     `\u{1F550} Duration: ${summary.sessionDuration}`,
-    `\u{1F6E0}\uFE0F Tool calls: ${summary.toolCallCount}`,
-    ""
+    `\u{1F6E0}\uFE0F Tool calls: ${summary.toolCallCount}
+`
   ];
   if (modifiedFiles.length > 0) {
     lines.push(`**Modified Files** (${modifiedFiles.length}):`);
     for (const f of modifiedFiles.slice(0, 10)) {
-      const icon = f.status === "created" ? "\u2728" : f.status === "modified" ? "\u{1F4DD}" : "\u274C";
-      lines.push(`  ${icon} ${f.filePath}`);
-    }
-    if (modifiedFiles.length > 10) {
-      lines.push(`  ... and ${modifiedFiles.length - 10} more`);
+      lines.push(`  ${f.status === "created" ? "\u2728" : f.status === "modified" ? "\u{1F4DD}" : "\u274C"} ${f.filePath}`);
     }
+    if (modifiedFiles.length > 10) lines.push(`  ... and ${modifiedFiles.length - 10} more`);
     lines.push("");
   }
   if (failures.length > 0) {
     lines.push(`**Unresolved Issues** (${failures.length}):`);
-    for (const f of failures.slice(0, 5)) {
-      lines.push(`  \u274C ${f.task}: ${f.error.substring(0, 80)}`);
-    }
-    lines.push("");
-  }
-  const completed = summary.completedSteps || [];
-  if (completed.length > 0) {
-    lines.push(`**Completed Steps**:`);
-    for (const s of completed) {
-      lines.push(`  \u2705 ${s}`);
-    }
+    for (const f of failures.slice(0, 5)) lines.push(`  \u274C ${f.task}: ${f.error.substring(0, 80)}`);
     lines.push("");
   }
-  lines.push("\u{1F4A1} Use kuma_memory({ action: 'decision', decisionAction: 'record', ... }) to document decisions.");
   return lines.join("\n");
 }
 async function handleHeal(params) {
   if (params.healAction === "check") {
     const stale = await detectStaleNodes();
-    if (stale.length === 0) return "\u2705 No stale entries found in knowledge graph.";
+    if (stale.length === 0) return "\u2705 No stale entries found.";
     return `\u{1F50D} ${stale.length} stale entr${stale.length > 1 ? "ies" : "y"} found. Use kuma_memory({ action: 'heal' }) to repair.`;
   }
   const result = await autoHeal();
@@ -422,31 +475,88 @@ async function handleSearch(params) {
   if (!query) return "\u26A0\uFE0F query or scope parameter required.";
   const limit = params.limit || 20;
   const memResults = sessionMemory.searchMemory(query, limit);
-  const { searchGraph: searchGraph2 } = await import("./kumaGraph-GW5SWOHQ.js");
+  const { searchGraph: searchGraph2 } = await import("./kumaGraph-5IZ4FDZA.js");
   const graphResults = await searchGraph2(query, Math.min(limit, 10));
-  const lines = [
-    `\u{1F50D} **Search Results** \u2014 "${query}"`,
-    `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
-    ""
-  ];
+  const lines = [`\u{1F50D} **Search Results** \u2014 "${query}"
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+`];
   if (memResults.length > 0) {
     lines.push(`**Session Memory** (${memResults.length}):`);
-    for (const r of memResults.slice(0, 5)) {
-      lines.push(`  \u2022 ${r.content.substring(0, 120)}`);
-    }
+    for (const r of memResults.slice(0, 5)) lines.push(`  \u2022 ${r.content.substring(0, 120)}`);
     lines.push("");
   }
-  lines.push("**Knowledge Graph:**");
-  lines.push(graphResults);
-  if (memResults.length === 0 && graphResults.includes("No results")) {
-    lines.push("", "\u{1F4A1} No results found. Try a different query or research the topic first.");
-  }
+  lines.push("**Knowledge Graph:**\n" + graphResults);
   return lines.join("\n");
 }
 async function handleChanges2(params) {
-  const filePath = params.target;
-  const since = params.since;
-  return await getChanges({ filePath, since });
+  const sinceNum = typeof params.since === "number" ? params.since : typeof params.since === "string" ? parseInt(params.since, 10) || void 0 : void 0;
+  return await getChanges({ filePath: params.target, since: sinceNum });
+}
+async function handleTodo(params) {
+  if (params.todoId && params.status) {
+    return await updateTodoStatus(params.todoId, params.status);
+  }
+  if (params.title) {
+    return await addTodo({
+      title: params.title,
+      description: params.description,
+      scope: params.scope,
+      deps: params.deps,
+      successCriteria: params.success_criteria
+    });
+  }
+  return await listTodos(params.scope, params.status);
+}
+async function handleContext2(params) {
+  if (params.content && params.source) {
+    return await addContextNote({
+      source: params.source,
+      content: params.content,
+      scope: params.scope,
+      filePaths: params.target ? JSON.stringify([params.target]) : void 0
+    });
+  }
+  return await listContextNotes(params.scope);
+}
+async function handleBenchmark(params) {
+  if (params.label) {
+    if (params.metrics) {
+      try {
+        const metrics = JSON.parse(params.metrics);
+        return await saveBenchmark(params.label, metrics);
+      } catch {
+        return `\u26A0\uFE0F Invalid metrics JSON: "${params.metrics.substring(0, 100)}"`;
+      }
+    }
+    return await getBenchmarkDiff(params.label, params.labelB);
+  }
+  return `\u26A0\uFE0F label required. Use: kuma_memory({ action: 'benchmark', label: 'phase-3', metrics: '{"tsc_errors": 245}' })`;
+}
+async function handleDecisionLog(params) {
+  if (params.target && params.status) {
+    const id = parseInt(params.target, 10);
+    if (!isNaN(id)) return await updateDecisionStatus(id, params.status);
+  }
+  if (params.title && params.rationale) {
+    return await recordDecisionLog({
+      title: params.title,
+      context: params.context,
+      rationale: params.rationale,
+      outcome: params.outcome,
+      status: params.status
+    });
+  }
+  return await listDecisionLog(params.status);
+}
+async function handleMine(params) {
+  sessionMemory.recordToolCall("kuma_memory_mine", { scope: params.scope });
+  const { mineHistoricalDecisions } = await import("./kumaMiner-GFEGUWGH.js");
+  return await mineHistoricalDecisions({
+    scope: params.scope,
+    since: typeof params.since === "string" ? params.since : void 0,
+    confirm: params.confirm,
+    limit: params.limit
+  });
 }
 
 // src/engine/kumaLock.ts
@@ -1011,6 +1121,58 @@ async function safetyCheck(action, filePath, command) {
     } catch {
       checks.push({ name: "Knowledge Graph Health", passed: true, detail: "\u26A0\uFE0F Could not check" });
     }
+    if (filePath) {
+      try {
+        const fs7 = await import("fs");
+        const path7 = await import("path");
+        const root = process.cwd();
+        const fullPath = path7.resolve(root, filePath);
+        if (fs7.existsSync(fullPath)) {
+          const stat = fs7.statSync(fullPath);
+          const sizeKB = Math.round(stat.size / 1024);
+          if (sizeKB > 500) {
+            checks.push({
+              name: "File Size Warning",
+              passed: false,
+              detail: `\u{1F4CF} File is ${sizeKB}KB \u2014 large file edits are risky`
+            });
+          }
+          if (filePath.endsWith(".ts") || filePath.endsWith(".js")) {
+            const baseName = path7.basename(filePath, path7.extname(filePath));
+            const testPatterns = [
+              filePath.replace(/\.(ts|js)$/, ".test.$1"),
+              filePath.replace(/\.(ts|js)$/, ".spec.$1"),
+              filePath.replace(/^src\//, "tests/").replace(/\.(ts|js)$/, ".test.$1"),
+              `**/__tests__/**/${baseName}.test.${path7.extname(filePath).slice(1)}`
+            ];
+            let hasTests = false;
+            const fg = await import("fast-glob");
+            for (const pattern of testPatterns) {
+              const matches = await fg.default(pattern, { cwd: root, ignore: ["**/node_modules/**"] });
+              if (matches.length > 0) {
+                hasTests = true;
+                break;
+              }
+            }
+            if (!hasTests) {
+              checks.push({
+                name: "Tests Check",
+                passed: true,
+                // Not a blocker, just informative
+                detail: `\u{1F9EA} No test file found for "${path7.basename(filePath)}" \u2014 consider adding tests`
+              });
+            } else {
+              checks.push({
+                name: "Tests Check",
+                passed: true,
+                detail: "\u2705 Test file found"
+              });
+            }
+          }
+        }
+      } catch {
+      }
+    }
     const failed = checks.filter((c) => !c.passed);
     const riskLevel = failed.length >= 3 ? "critical" : failed.length >= 2 ? "high" : failed.length >= 1 ? "medium" : "low";
     const allowed = failed.length === 0;
@@ -1458,6 +1620,8 @@ async function handleSafety(params) {
   switch (action) {
     case "guard":
       return handleGuard(params);
+    case "verify":
+      return handleVerify(params);
     case "check":
       return handleCheck(params);
     case "audit":
@@ -1468,8 +1632,18 @@ async function handleSafety(params) {
       return handleHealth2(params);
     case "override":
       return handleOverride(params);
+    case "security":
+      return handleSecurity(params);
+    case "gc":
+      return handleGc(params);
+    case "doctor":
+      return handleDoctor(params);
+    case "portability":
+      return handlePortability(params);
+    case "gitignore":
+      return handleGitignore(params);
     default:
-      return `Unknown action "${action}". Use: guard, check, audit, lock, health, override`;
+      return `Unknown action "${action}".`;
   }
 }
 async function handleGuard(params) {
@@ -1479,15 +1653,10 @@ async function handleGuard(params) {
   });
 }
 async function handleCheck(params) {
-  const action = "check";
-  const filePath = params.filePath;
-  const command = params.command;
-  return await safetyCheck(action, filePath, command);
+  return await safetyCheck("check", params.filePath, params.command);
 }
 async function handleAudit(params) {
-  if (params.limit === 0) {
-    return await auditStats();
-  }
+  if (params.limit === 0) return await auditStats();
   return await queryAudit({
     toolName: params.toolName,
     riskLevel: params.riskLevel,
@@ -1516,18 +1685,86 @@ async function handleLock(params) {
 }
 async function handleHealth2(_params) {
   try {
-    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-7FU7XSY5.js");
+    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-QX2LBJ7H.js");
     const score = await computeSafetyScore();
-    const checksStr = JSON.stringify(score.checks);
-    await saveHealthSnapshot(score.score, score.risk, checksStr, score.summary);
+    await saveHealthSnapshot(score.score, score.risk, JSON.stringify(score.checks), score.summary);
     return formatSafetyScore(score);
   } catch (err) {
     return `Error computing health: ${err}`;
   }
 }
 function handleOverride(params) {
-  const tool = params.toolName || "unknown";
-  return safetyOverride(tool, params.reason);
+  return safetyOverride(params.toolName || "unknown", params.reason);
+}
+async function handleSecurity(params) {
+  sessionMemory.recordToolCall("kuma_safety_security", {});
+  if (params.filePath) {
+    try {
+      const fs7 = await import("fs");
+      const path7 = await import("path");
+      const root = process.cwd();
+      const fullPath = path7.resolve(root, params.filePath);
+      if (fs7.existsSync(fullPath) && fs7.statSync(fullPath).isFile()) {
+        const content = fs7.readFileSync(fullPath, "utf-8");
+        const lines = content.split("\n");
+        const findings = [];
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          const lc = line.toLowerCase();
+          if (lc.includes("credentials: true")) {
+            findings.push({ line: i + 1, pattern: "credentials-leak", severity: "high", message: "`credentials: true` in Prisma select may leak sensitive fields" });
+          }
+          if (lc.includes("console.log") && (lc.includes("token") || lc.includes("secret") || lc.includes("key") || lc.includes("password"))) {
+            findings.push({ line: i + 1, pattern: "console-log-secret", severity: "high", message: "Potential secret logged to console" });
+          }
+          if (lc.includes("process.env") && (lc.includes("api_key") || lc.includes("secret") || lc.includes("token"))) {
+            findings.push({ line: i + 1, pattern: "env-in-code", severity: "medium", message: "process.env.KEY referenced in code \u2014 ensure not in client bundle" });
+          }
+        }
+        for (const f of findings) {
+          await addSecurityFinding({
+            filePath: params.filePath,
+            lineNumber: f.line,
+            pattern: f.pattern,
+            severity: f.severity,
+            message: f.message
+          });
+        }
+        if (findings.length === 0) {
+          return `\u{1F512} No security issues found in "${params.filePath}".`;
+        }
+        return `\u{1F512} **Security Scan** \u2014 ${findings.length} finding(s) in "${params.filePath}":
+${findings.map((f) => `  ${f.severity === "high" ? "\u{1F534}" : "\u{1F7E1}"} L${f.line}: ${f.message}`).join("\n")}`;
+      }
+    } catch {
+    }
+  }
+  return await getSecurityFindings();
+}
+async function handleGc(_params) {
+  sessionMemory.recordToolCall("kuma_safety_gc", {});
+  return await runGarbageCollection();
+}
+async function handleDoctor(_params) {
+  sessionMemory.recordToolCall("kuma_safety_doctor", {});
+  return await runDoctor();
+}
+async function handlePortability(_params) {
+  sessionMemory.recordToolCall("kuma_safety_portability", {});
+  return await checkPortability();
+}
+async function handleGitignore(_params) {
+  sessionMemory.recordToolCall("kuma_safety_gitignore", {});
+  return await ensureGitignore();
+}
+async function handleVerify(params) {
+  sessionMemory.recordToolCall("kuma_safety_verify", { scope: params.scope || params.filePath });
+  const { runAutoVerification } = await import("./kumaVerifier-VYW5WH6V.js");
+  return await runAutoVerification({
+    scope: params.scope || params.filePath,
+    force: params.force,
+    timeoutMs: 3e4
+  });
 }
 
 // src/manifest.ts
@@ -1536,7 +1773,7 @@ function registerAllTools(server) {
     "kuma_context",
     "**Call FIRST every session.** Understand your project before making changes. Actions: init (load project brief), research (5-step pipeline: cache\u2192staleness\u2192graph\u2192impact\u2192decision), impact (analyze change effects), navigate (trace code flow), changes (view change log), health (project health score 0-100). RESEARCH IS REQUIRED before editing unfamiliar code.",
     {
-      action: z.enum(["init", "research", "impact", "navigate", "changes", "health"]).describe("Action: init=project brief, research=5-step research pipeline (REQUIRED before edits), impact=analyze change effects, navigate=trace code flow, changes=view change log, health=project health score"),
+      action: z.enum(["init", "research", "impact", "navigate", "changes", "health", "rollback", "researches"]).describe("Action: init=project brief, research=5-step research pipeline (REQUIRED before edits), impact=analyze change effects, navigate=trace code flow, changes=view change log, rollback=undo a change by ID, researches=list all cached research, health=project health score"),
       scope: z.string().optional().describe("Research scope for research action (e.g. 'auth', 'database', 'api')"),
       target: z.string().optional().describe("Target symbol/file for impact/navigate/changes"),
       goal: z.string().optional().describe("Current goal (for init/health)"),
@@ -1561,17 +1798,18 @@ function registerAllTools(server) {
   );
   server.tool(
     "kuma_memory",
-    "Record and retrieve project knowledge. Actions: decision (ADR-style record/template/suggest), research_save (save research results), session (current session summary), heal (self-heal knowledge graph), search (search memory + graph), changes (view change log for selective undo).",
+    "Record and retrieve project knowledge. Actions: decision (ADR-style record/template/suggest), mine (mine historical decisions from git log & code comments), research_save (save research), session (session summary), heal (graph repair), search (search all), changes (change log), todo (persistent todo CRUD), context (inject context notes), benchmark (capture/diff metrics), decision_log (living document with status tracking).",
     {
-      action: z.enum(["decision", "research_save", "session", "heal", "search", "changes"]).describe("Memory action: decision=record ADR, research_save=save research, session=session summary, heal=graph repair, search=search all, changes=change log"),
-      scope: z.string().optional().describe("Scope for research_save/search"),
+      action: z.enum(["decision", "mine", "research_save", "session", "heal", "search", "changes", "todo", "context", "benchmark", "decision_log"]).describe("Memory action: decision=ADR, mine=mine git log & comments, research_save=save, session=summary, heal=repair, search=search, changes=log, todo=manage todos, context=inject notes, benchmark=capture/diff, decision_log=manage decisions"),
+      scope: z.string().optional().describe("Scope for research_save/search/todo/context/mine"),
       query: z.string().optional().describe("Search query for search action"),
-      content: z.string().optional().describe("Content/notes for research_save"),
+      content: z.string().optional().describe("Content/notes for research_save / context"),
       record: z.string().optional().describe("JSON record string for research_save"),
       confidence: z.number().min(0).max(1).optional().describe("Confidence for research_save (0-1)"),
+      confirm: z.boolean().optional().describe("Confirm and record candidates automatically for mine action"),
       // Decision params
       decisionAction: z.enum(["template", "suggest", "record"]).optional().describe("Decision sub-action"),
-      title: z.string().optional().describe("Decision title"),
+      title: z.string().optional().describe("Decision/todo/benchmark title"),
       context: z.string().optional().describe("Decision context"),
       rationale: z.string().optional().describe("Decision rationale"),
       outcome: z.string().optional().describe("Decision outcome"),
@@ -1579,9 +1817,21 @@ function registerAllTools(server) {
       healAction: z.enum(["check", "heal"]).optional().describe("Heal sub-action"),
       topic: z.string().optional().describe("Memory topic for session"),
       limit: z.number().min(1).max(100).optional().describe("Result limit"),
-      target: z.string().optional().describe("File path for changes"),
+      target: z.string().optional().describe("File path for changes / decision_log ID"),
       since: z.number().optional().describe("Timestamp filter for changes"),
-      compact: z.boolean().optional().default(false).describe("Compact output mode")
+      compact: z.boolean().optional().default(false).describe("Compact output mode"),
+      // Todo params
+      description: z.string().optional().describe("Todo description"),
+      deps: z.string().optional().describe("Todo dependencies (JSON array)"),
+      success_criteria: z.string().optional().describe("Todo success criteria"),
+      status: z.string().optional().describe("Status for todo/decision_log"),
+      todoId: z.number().optional().describe("Todo ID for status update"),
+      // Context params
+      source: z.string().optional().describe("Context source (e.g. 'slack', 'jira', 'meeting')"),
+      // Benchmark params
+      label: z.string().optional().describe("Benchmark label"),
+      metrics: z.string().optional().describe("Benchmark metrics JSON"),
+      labelB: z.string().optional().describe("Second benchmark label for diff")
     },
     async (params) => {
       try {
@@ -1592,6 +1842,7 @@ function registerAllTools(server) {
           content: params.content,
           record: params.record,
           confidence: params.confidence,
+          confirm: params.confirm,
           decisionAction: params.decisionAction,
           title: params.title,
           context: params.context,
@@ -1611,14 +1862,16 @@ function registerAllTools(server) {
   );
   server.tool(
     "kuma_safety",
-    "Safety checks, policy enforcement, and multi-agent coordination. Actions: guard (anti-pattern detection), check (pre-exec safety check), audit (query audit trail), lock (multi-agent file lock), health (project health score), override (logged bypass).",
+    "Safety checks, policy enforcement, security scanning, integrated auto-verification, and project hygiene. Actions: guard (anti-pattern detection), verify (auto-run scoped tests), check (pre-exec safety), audit (query trail), lock (multi-agent), health (score), security (scan for leaks), gc (garbage collection), doctor (health check), portability (path check), gitignore (auto-config), override (bypass).",
     {
-      action: z.enum(["guard", "check", "audit", "lock", "health", "override"]).describe("Safety action: guard=anti-patterns, check=pre-exec safety, audit=query trail, lock=multi-agent, health=score, override=logged bypass"),
+      action: z.enum(["guard", "verify", "check", "audit", "lock", "health", "override", "security", "gc", "doctor", "portability", "gitignore"]).describe("Safety action: guard=anti-patterns, verify=auto-run scoped tests, check=pre-exec safety, audit=query trail, lock=multi-agent, health=score, security=scan leaks, gc=garbage collect, doctor=health check, portability=paths, gitignore=config, override=bypass"),
+      // Verify params
+      scope: z.string().optional().describe("Scope for verify or context (e.g. 'auth', file path)"),
       // Guard params
       guardGoal: z.string().optional().describe("Goal for guard check"),
       guardCheck: z.enum(["all", "anti-pattern", "loop", "drift", "context"]).optional().describe("Guard check type"),
       // Check params
-      filePath: z.string().optional().describe("File path for check/lock"),
+      filePath: z.string().optional().describe("File path for check/lock/security scan"),
       command: z.string().optional().describe("Command for check"),
       // Audit params
       toolName: z.string().optional().describe("Filter audit by tool name"),
@@ -1641,6 +1894,7 @@ function registerAllTools(server) {
           guardGoal: params.guardGoal,
           guardCheck: params.guardCheck,
           filePath: params.filePath,
+          scope: params.scope,
           command: params.command,
           toolName: params.toolName,
           riskLevel: params.riskLevel,
@@ -1788,7 +2042,7 @@ async function main() {
   });
   (async () => {
     try {
-      const { generateInitMdContent } = await import("./init-O4MBXFZL.js");
+      const { generateInitMdContent } = await import("./init-AJAESUZZ.js");
       const fs7 = await import("fs");
       const path7 = await import("path");
       const initMdPath = path7.resolve(process.cwd(), ".kuma/init.md");
@@ -1804,7 +2058,7 @@ async function main() {
   })();
   (async () => {
     try {
-      const { detectAgent, getSkillPath, getAgentLabel } = await import("./agentDetector-FDRVUNJY.js");
+      const { detectAgent, getSkillPath, getAgentLabel } = await import("./agentDetector-G4RBMZ6X.js");
       const { generateSkill, getSecondaryFiles } = await import("./skillGenerator-F6YO4H5D.js");
       const fs7 = await import("fs");
       const path7 = await import("path");
@@ -1838,6 +2092,38 @@ async function main() {
       console.error(`[${SERVER_NAME}] Failed to auto-create skill file: ${err}`);
     }
   })();
+  (async () => {
+    try {
+      console.error(`[${SERVER_NAME}] \u{1F504} Running cold start bootstrap...`);
+      const sessionInfo = sessionMemory.loadSession();
+      if (sessionInfo.hasPrevSession) {
+        console.error(`[${SERVER_NAME}] \u2705 Restored session (${sessionInfo.toolCallCount} previous tool calls)`);
+      }
+      try {
+        const { buildFromSessionMemory } = await import("./kumaGraph-5IZ4FDZA.js");
+        const edgeCount = await buildFromSessionMemory();
+        if (edgeCount > 0) {
+          console.error(`[${SERVER_NAME}] \u2705 Graph auto-populated with ${edgeCount} entries from session memory`);
+        }
+      } catch (err) {
+        console.error(`[${SERVER_NAME}] \u26A0\uFE0F Graph auto-population: ${err}`);
+      }
+      try {
+        const { getDb: getDb2, saveDb: saveDb2 } = await import("./kumaDb-RC2EO3OB.js");
+        const db = await getDb2();
+        db.run(
+          `INSERT INTO sessions (started_at, goal, tool_calls) VALUES (?, ?, ?)`,
+          [Math.floor(Date.now() / 1e3), sessionMemory.getSummary().currentGoal || "Session start", sessionInfo.toolCallCount]
+        );
+        saveDb2(db);
+      } catch (err) {
+        console.error(`[${SERVER_NAME}] \u26A0\uFE0F Session DB record: ${err}`);
+      }
+      console.error(`[${SERVER_NAME}] \u2705 Cold start bootstrap complete`);
+    } catch (err) {
+      console.error(`[${SERVER_NAME}] \u26A0\uFE0F Cold start bootstrap error: ${err}`);
+    }
+  })();
   const server = new McpServer(
     {
       name: SERVER_NAME,