@plumpslabs/kuma 2.3.20 → 2.3.23

package/dist/chunk-E2KFPEBT.js

@@ -1,183 +0,0 @@
-// src/utils/pathValidator.ts
-import path from "path";
-import fs from "fs";
-function validateFilePath(filePath, projectRoot) {
-  try {
-    const root = projectRoot ?? getProjectRoot();
-    const resolvedRoot = path.resolve(root);
-    const normalizedRoot = path.normalize(resolvedRoot).toLowerCase();
-    let resolvedPath;
-    if (!path.isAbsolute(filePath)) {
-      const cwdPath = path.resolve(process.cwd(), filePath);
-      const normalizedCwdPath = path.normalize(cwdPath).toLowerCase();
-      if (fs.existsSync(cwdPath) && normalizedCwdPath.startsWith(normalizedRoot)) {
-        resolvedPath = cwdPath;
-      } else {
-        resolvedPath = path.resolve(resolvedRoot, filePath);
-      }
-    } else {
-      resolvedPath = path.resolve(resolvedRoot, filePath);
-    }
-    const normalizedPath = path.normalize(resolvedPath).toLowerCase();
-    if (!normalizedPath.startsWith(normalizedRoot)) {
-      return {
-        valid: false,
-        error: new Error(
-          `PATH_TRAVERSAL: Access denied. Path "${filePath}" resolves outside project root "${resolvedRoot}".`
-        )
-      };
-    }
-    if (normalizedPath.includes("..")) {
-      return {
-        valid: false,
-        error: new Error(
-          `PATH_TRAVERSAL: Path traversal detected in "${filePath}". Relative paths with ".." are not allowed.`
-        )
-      };
-    }
-    const blockedPatterns = [
-      "/etc/",
-      "/sys/",
-      "/proc/",
-      "/dev/",
-      "/boot/",
-      "/usr/",
-      "C:\\Windows",
-      "C:\\Program Files",
-      "C:\\Program Files (x86)",
-      "C:\\System32",
-      "~/.ssh",
-      "/root/"
-    ];
-    for (const pattern of blockedPatterns) {
-      if (normalizedPath.includes(pattern.toLowerCase())) {
-        return {
-          valid: false,
-          error: new Error(
-            `PATH_TRAVERSAL: Access to system directory "${pattern}" is blocked.`
-          )
-        };
-      }
-    }
-    try {
-      if (fs.existsSync(resolvedPath)) {
-        const realPath = fs.realpathSync(resolvedPath);
-        const normalizedRealPath = path.normalize(realPath).toLowerCase();
-        if (!normalizedRealPath.startsWith(normalizedRoot)) {
-          return {
-            valid: false,
-            error: new Error(
-              `PATH_TRAVERSAL: Symlink escape detected. Path "${filePath}" resolves to "${realPath}" which is outside project root "${resolvedRoot}".`
-            )
-          };
-        }
-      }
-    } catch {
-    }
-    if (normalizedPath.includes("node_modules")) {
-      return {
-        valid: true,
-        resolvedPath
-        // Warning will be handled by caller
-      };
-    }
-    return { valid: true, resolvedPath };
-  } catch (err) {
-    return {
-      valid: false,
-      error: err instanceof Error ? err : new Error(`Path validation error: ${String(err)}`)
-    };
-  }
-}
-function validateFileExtension(filePath) {
-  const allowedExtensions = [
-    ".ts",
-    ".tsx",
-    ".js",
-    ".jsx",
-    ".mjs",
-    ".cjs",
-    ".json",
-    ".md",
-    ".css",
-    ".html",
-    ".htm",
-    ".env",
-    ".env.example",
-    ".env.local",
-    ".yml",
-    ".yaml",
-    ".toml",
-    ".svg",
-    ".png",
-    ".jpg",
-    ".gif",
-    ".sh",
-    ".bat",
-    ".ps1",
-    ".sql",
-    ".graphql",
-    ".gql",
-    ".vue",
-    ".svelte",
-    ".astro",
-    ".prisma",
-    ".proto",
-    ".txt",
-    ".log"
-  ];
-  const ext = path.extname(filePath).toLowerCase();
-  return allowedExtensions.includes(ext);
-}
-function getProjectRoot() {
-  return process.env.AGENT_PROJECT_ROOT ?? process.cwd();
-}
-function isReadable(filePath) {
-  try {
-    fs.accessSync(filePath, fs.constants.R_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isWritable(dirPath) {
-  try {
-    fs.accessSync(dirPath, fs.constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function getBackupPath(filePath, timestamp) {
-  const ts = timestamp ?? Date.now();
-  const root = getProjectRoot();
-  const relativePath = path.relative(root, filePath);
-  return path.join(root, ".kuma", "backups", String(ts), relativePath);
-}
-function ensureBackupDir() {
-  const root = getProjectRoot();
-  const backupDir = path.join(root, ".kuma", "backups");
-  if (!fs.existsSync(backupDir)) {
-    fs.mkdirSync(backupDir, { recursive: true });
-  }
-  return backupDir;
-}
-function getKumaDir() {
-  const root = getProjectRoot();
-  return path.join(root, ".kuma");
-}
-function getKumaBackupsDir() {
-  return path.join(getKumaDir(), "backups");
-}
-
-export {
-  validateFilePath,
-  validateFileExtension,
-  getProjectRoot,
-  isReadable,
-  isWritable,
-  getBackupPath,
-  ensureBackupDir,
-  getKumaDir,
-  getKumaBackupsDir
-};

package/dist/chunk-FKRSI5U5.js

@@ -1,282 +0,0 @@
-import {
-  sessionMemory
-} from "./chunk-LVKOGXLC.js";
-import {
-  getProjectRoot
-} from "./chunk-E2KFPEBT.js";
-
-// src/engine/domainRules.ts
-import fs from "fs";
-import path from "path";
-var LAYER_FILES = {
-  domain_rules: { filename: "DOMAIN_RULES.md", label: "Domain & Business Rules" },
-  arch_flow: { filename: "ARCHITECTURE_FLOW.md", label: "Architecture & Sequence Flow" },
-  gotcha: { filename: "KNOWN_GOTCHAS.md", label: "Known Code Gotchas" }
-};
-var DOMAIN_RULES_TEMPLATE = `# Domain & Business Rules (Layer 1)
-
-Auto-generated by Kuma 3-Layer Memory Engine.
-Update this file with core business logic, workflows, and boundary rules.
-
-## Who
-<!-- Who are the users/actors? -->
-
-## What
-<!-- What are the core features and business capabilities? -->
-
-## When
-<!-- What are the time-based rules, schedules, deadlines? -->
-
-## Where
-<!-- Where does the business operate (environments, regions)? -->
-
-## Why
-<!-- Why were key architectural decisions made? -->
-
-## How
-<!-- How do core workflows execute? -->
-
-## Business Rules
-<!-- Critical business logic constraints -->
-- Rule 1:
-- Rule 2:
-
-## Workflows
-<!-- Ordered sequence of operations -->
-1.
-2.
-
-## Boundary Conditions
-<!-- Edge cases, error states, validation rules -->
--
-`;
-var ARCH_FLOW_TEMPLATE = `# Architecture & Sequence Flow Map (Layer 2)
-
-Auto-generated by Kuma 3-Layer Memory Engine.
-Document execution call chains and architectural dependencies.
-
-## System Overview
-<!-- High-level description of the system architecture -->
-
-## Entry Points
-<!-- Main entry points for the application -->
-- 
-
-## Execution Chains
-<!-- Route -> Middleware -> Controller -> Service -> DB -->
-\`\`\`
-Request Flow:
-  1. [Entry] -> [Middleware] -> [Handler] -> [Service] -> [DB]
-\`\`\`
-
-## Module Dependency Map
-<!-- How modules depend on each other -->
-- Module A depends on: Module B, Module C
-- Module B depends on: Module D
-
-## Data Flow
-<!-- How data flows through the system -->
-1. Input: 
-2. Process: 
-3. Storage: 
-4. Output: 
-
-## External Integrations
-<!-- External services, APIs, databases -->
-- 
-`;
-var GOTCHAS_TEMPLATE = `# Known Code Gotchas (Layer 3)
-
-Auto-generated by Kuma 3-Layer Memory Engine.
-Catalog of fragile legacy contracts, edge cases, and unexpected framework quirks.
-
-## How to Add a Gotcha
-
-\`\`\`
-kuma_memory({
-  action: 'gotcha',
-  scope: 'auth_middleware',
-  content: 'The auth middleware expects req.user after JWT decode. Missing middleware causes silent 500.',
-  filePath: 'src/middleware/auth.ts'
-})
-\`\`\`
-
-## Active Gotchas
-
-<!-- Format:
-### [File Path] \u2014 [Short Description]
-- **Issue**: [What happens]
-- **Fix**: [How to handle it correctly]
-- **Severity**: [low | medium | high | critical]
-- **Added**: [Date]
--->
-
-`;
-function layerFilePath(layer) {
-  return path.join(getProjectRoot(), ".kuma", LAYER_FILES[layer].filename);
-}
-function ensureLayerFile(layer) {
-  const fp = layerFilePath(layer);
-  if (!fs.existsSync(fp)) {
-    const template = layer === "domain_rules" ? DOMAIN_RULES_TEMPLATE : layer === "arch_flow" ? ARCH_FLOW_TEMPLATE : GOTCHAS_TEMPLATE;
-    const dir = path.dirname(fp);
-    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(fp, template, "utf-8");
-    console.error(`[DomainRules] Auto-created ${LAYER_FILES[layer].filename}`);
-  }
-  return fp;
-}
-function readLayer(layer) {
-  try {
-    const fp = ensureLayerFile(layer);
-    return fs.readFileSync(fp, "utf-8");
-  } catch (err) {
-    return `Error reading ${layer}: ${err}`;
-  }
-}
-function writeLayer(layer, content) {
-  try {
-    const fp = ensureLayerFile(layer);
-    fs.writeFileSync(fp, content, "utf-8");
-    const label = LAYER_FILES[layer].label;
-    sessionMemory.recordToolCall("kuma_memory", { action: `write_${layer}` });
-    return `\u2705 **${label}** updated successfully.`;
-  } catch (err) {
-    return `\u274C Failed to update ${layer}: ${err}`;
-  }
-}
-function appendToLayer(layer, entry) {
-  try {
-    const fp = ensureLayerFile(layer);
-    const existing = fs.readFileSync(fp, "utf-8");
-    const newContent = existing.trimEnd() + "\n\n" + entry.trim() + "\n";
-    fs.writeFileSync(fp, newContent, "utf-8");
-    return `\u2705 Entry added to **${LAYER_FILES[layer].label}**.`;
-  } catch (err) {
-    return `\u274C Failed to append: ${err}`;
-  }
-}
-function getLayersSummary() {
-  const lines = ["\u{1F4DA} **3-Layer Memory Engine**", "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501"];
-  for (const layer of ["domain_rules", "arch_flow", "gotcha"]) {
-    const fp = layerFilePath(layer);
-    const exists = fs.existsSync(fp);
-    const label = LAYER_FILES[layer].label;
-    if (exists) {
-      try {
-        const content = fs.readFileSync(fp, "utf-8");
-        const lineCount = content.split("\n").length;
-        const sizeKB = Math.round(Buffer.byteLength(content) / 1024);
-        lines.push(`  ${layer === "domain_rules" ? "\u{1F4CB}" : layer === "arch_flow" ? "\u{1F3D7}\uFE0F" : "\u26A0\uFE0F"} **${label}** \u2014 ${lineCount} lines, ${sizeKB}KB`);
-      } catch {
-        lines.push(`  \u2753 **${label}** \u2014 could not read`);
-      }
-    } else {
-      lines.push(`  \u{1F4C4} **${label}** \u2014 not yet created`);
-    }
-  }
-  return lines.join("\n");
-}
-function getActiveGotchas() {
-  const results = [];
-  try {
-    const fp = ensureLayerFile("gotcha");
-    const content = fs.readFileSync(fp, "utf-8");
-    const lines = content.split("\n");
-    let currentSection = "";
-    let currentFilePath = "";
-    let currentDesc = "";
-    let currentSeverity = "";
-    for (const line of lines) {
-      const fileMatch = line.match(/^###\s+(.+?)\s*[—–-]+\s*(.+)/);
-      if (fileMatch) {
-        if (currentFilePath) {
-          results.push({ filePath: currentFilePath, description: currentDesc, severity: currentSeverity, content: currentSection });
-        }
-        currentFilePath = fileMatch[1].trim();
-        currentDesc = fileMatch[2].trim();
-        currentSeverity = "medium";
-        currentSection = line + "\n";
-        continue;
-      }
-      const sevMatch = line.match(/- \*\*Severity\*\*:\s*(\w+)/);
-      if (sevMatch) currentSeverity = sevMatch[1].toLowerCase();
-      currentSection += line + "\n";
-    }
-    if (currentFilePath) {
-      results.push({ filePath: currentFilePath, description: currentDesc, severity: currentSeverity, content: currentSection });
-    }
-  } catch {
-  }
-  return results;
-}
-function checkFileGotchas(filePath) {
-  const gotchas = getActiveGotchas();
-  const warnings = [];
-  for (const g of gotchas) {
-    if (filePath.includes(g.filePath) || g.filePath.includes(filePath)) {
-      const icon = g.severity === "critical" ? "\u{1F534}" : g.severity === "high" ? "\u{1F7E0}" : g.severity === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
-      warnings.push(`${icon} **Gotcha**: ${g.description} (${g.severity})`);
-    }
-  }
-  return warnings;
-}
-function generateDigest() {
-  const lines = [
-    "\u{1F4CB} **Kuma Project Digest**",
-    "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501",
-    ""
-  ];
-  try {
-    const fp1 = ensureLayerFile("domain_rules");
-    const content = fs.readFileSync(fp1, "utf-8");
-    const rules = [];
-    const workflows = [];
-    for (const line of content.split("\n")) {
-      const r = line.match(/^- Rule \d+:?\s*(.+)/);
-      if (r) rules.push(r[1].substring(0, 60));
-      const w = line.match(/^\d+\.\s*(.+)/);
-      if (w) workflows.push(w[1].substring(0, 60));
-    }
-    if (rules.length > 0) lines.push(`\u{1F4CB} **Domain Rules** (${rules.length}): ${rules.slice(0, 3).join("; ")}`);
-    if (workflows.length > 0) lines.push(`\u{1F504} **Workflows**: ${workflows.slice(0, 3).join(" \u2192 ")}`);
-  } catch {
-    lines.push("\u{1F4CB} **Domain Rules**: not set");
-  }
-  try {
-    const fp2 = ensureLayerFile("arch_flow");
-    const content = fs.readFileSync(fp2, "utf-8");
-    const chains = [];
-    for (const line of content.split("\n")) {
-      if (line.includes("->") && line.includes("[")) chains.push(line.trim());
-    }
-    if (chains.length > 0) lines.push(`\u{1F3D7}\uFE0F **Architecture**: ${chains[0].substring(0, 80)}`);
-    else lines.push("\u{1F3D7}\uFE0F **Architecture**: see .kuma/ARCHITECTURE_FLOW.md");
-  } catch {
-    lines.push("\u{1F3D7}\uFE0F **Architecture**: not documented");
-  }
-  const gotchas = getActiveGotchas();
-  if (gotchas.length > 0) {
-    const highCount = gotchas.filter((g) => g.severity === "high" || g.severity === "critical").length;
-    lines.push(`\u26A0\uFE0F **Gotchas**: ${gotchas.length} active (${highCount} high/critical)`);
-    for (const g of gotchas.slice(0, 3)) {
-      lines.push(`  \u2022 ${g.filePath}: ${g.description.substring(0, 60)}`);
-    }
-  } else {
-    lines.push("\u26A0\uFE0F **Gotchas**: none recorded");
-  }
-  const summary = sessionMemory.getSummary();
-  lines.push(`\u{1F3AF} **Goal**: ${summary.currentGoal?.substring(0, 60) || "not set"}`);
-  lines.push(`\u{1F4DD} **Modified**: ${summary.modifiedFiles?.length || 0} files | \u{1F6E0}\uFE0F ${summary.toolCallCount} calls`);
-  return lines.join("\n");
-}
-
-export {
-  readLayer,
-  writeLayer,
-  appendToLayer,
-  getLayersSummary,
-  getActiveGotchas,
-  checkFileGotchas,
-  generateDigest
-};

package/dist/chunk-GFLSAXAH.js

@@ -1,155 +0,0 @@
-import {
-  getDb,
-  saveDb
-} from "./chunk-3BRBJZ7P.js";
-
-// src/engine/safetyAudit.ts
-var SCHEMA_SQL = `
-  CREATE TABLE IF NOT EXISTS safety_audit (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    timestamp INTEGER NOT NULL,
-    tool_name TEXT NOT NULL,
-    action TEXT NOT NULL,
-    file_path TEXT,
-    risk_level TEXT NOT NULL DEFAULT 'low',
-    policy_violations INTEGER DEFAULT 0,
-    allowed INTEGER NOT NULL DEFAULT 1,
-    duration_ms INTEGER DEFAULT 0,
-    metadata TEXT DEFAULT '{}'
-  );
-  CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON safety_audit(timestamp);
-  CREATE INDEX IF NOT EXISTS idx_audit_tool ON safety_audit(tool_name);
-  CREATE INDEX IF NOT EXISTS idx_audit_risk ON safety_audit(risk_level);
-  CREATE INDEX IF NOT EXISTS idx_audit_allowed ON safety_audit(allowed);
-`;
-var schemaEnsured = false;
-async function ensureSchema() {
-  if (schemaEnsured) return;
-  try {
-    const db = await getDb();
-    db.exec(SCHEMA_SQL);
-    saveDb();
-    schemaEnsured = true;
-  } catch (err) {
-    console.error(`[SafetyAudit] Failed to ensure schema: ${err}`);
-  }
-}
-async function recordAudit(entry) {
-  try {
-    await ensureSchema();
-    const db = await getDb();
-    db.run(`
-      INSERT INTO safety_audit (timestamp, tool_name, action, file_path, risk_level, policy_violations, allowed, duration_ms, metadata)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `, [
-      entry.timestamp,
-      entry.toolName,
-      entry.action,
-      entry.filePath || null,
-      entry.riskLevel,
-      entry.policyViolations,
-      entry.allowed ? 1 : 0,
-      entry.durationMs,
-      JSON.stringify(entry.metadata || {})
-    ]);
-    saveDb();
-  } catch (err) {
-    console.error(`[SafetyAudit] Failed to record audit: ${err}`);
-  }
-}
-async function queryAudit(params) {
-  try {
-    await ensureSchema();
-    const db = await getDb();
-    const { toolName, riskLevel, allowed, limit = 20, since } = params;
-    let sql = "SELECT * FROM safety_audit WHERE 1=1";
-    const bindParams = [];
-    if (toolName) {
-      sql += " AND tool_name = ?";
-      bindParams.push(toolName);
-    }
-    if (riskLevel) {
-      sql += " AND risk_level = ?";
-      bindParams.push(riskLevel);
-    }
-    if (allowed !== void 0) {
-      sql += " AND allowed = ?";
-      bindParams.push(allowed ? 1 : 0);
-    }
-    if (since) {
-      sql += " AND timestamp >= ?";
-      bindParams.push(since);
-    }
-    sql += " ORDER BY timestamp DESC LIMIT ?";
-    bindParams.push(limit);
-    const stmt = db.prepare(sql);
-    stmt.bind(bindParams);
-    const results = [];
-    while (stmt.step()) {
-      results.push(stmt.getAsObject());
-    }
-    stmt.free();
-    if (results.length === 0) {
-      return "\u{1F4CB} **Safety Audit** \u2014 No records found for the given filters.";
-    }
-    const lines = [
-      `\u{1F4CB} **Safety Audit** \u2014 ${results.length} record(s)`,
-      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
-      ""
-    ];
-    for (const r of results) {
-      const riskIcon = r.risk_level === "critical" ? "\u{1F534}" : r.risk_level === "high" ? "\u{1F7E0}" : r.risk_level === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
-      const allowIcon = r.allowed ? "\u2705" : "\u26D4";
-      const time = new Date(r.timestamp * 1e3).toLocaleTimeString();
-      lines.push(`${allowIcon} ${riskIcon} **${r.tool_name}** \u2014 ${r.action}`);
-      if (r.file_path) lines.push(`   \u{1F4CD} ${r.file_path}`);
-      lines.push(`   \u{1F550} ${time} | ${r.duration_ms}ms | ${r.policy_violations} policy violation(s)`);
-      lines.push("");
-    }
-    return lines.join("\n");
-  } catch (err) {
-    return `Error querying audit: ${err}`;
-  }
-}
-async function auditStats() {
-  try {
-    await ensureSchema();
-    const db = await getDb();
-    const total = db.exec("SELECT COUNT(*) as c FROM safety_audit")[0]?.values[0][0] ?? 0;
-    const blocked = db.exec("SELECT COUNT(*) as c FROM safety_audit WHERE allowed = 0")[0]?.values[0][0] ?? 0;
-    const critical = db.exec("SELECT COUNT(*) as c FROM safety_audit WHERE risk_level IN ('high','critical')")[0]?.values[0][0] ?? 0;
-    let topBlocked = [];
-    try {
-      const stmt = db.prepare("SELECT tool_name, COUNT(*) as cnt FROM safety_audit WHERE allowed = 0 GROUP BY tool_name ORDER BY cnt DESC LIMIT 5");
-      while (stmt.step()) {
-        topBlocked.push(stmt.getAsObject());
-      }
-      stmt.free();
-    } catch {
-    }
-    const lines = [
-      `\u{1F4CA} **Safety Audit Stats**`,
-      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
-      "",
-      `\u{1F4DD} Total operations: ${total}`,
-      `\u26D4 Blocked: ${blocked} (${total > 0 ? (blocked / total * 100).toFixed(1) : 0}%)`,
-      `\u{1F534} High/Critical risk: ${critical}`,
-      ""
-    ];
-    if (topBlocked.length > 0) {
-      lines.push("**Most blocked tools:**");
-      for (const t of topBlocked) {
-        lines.push(`  \u2022 ${t.tool_name}: ${t.cnt}x blocked`);
-      }
-    }
-    return lines.join("\n");
-  } catch (err) {
-    return `Error getting audit stats: ${err}`;
-  }
-}
-
-export {
-  recordAudit,
-  queryAudit,
-  auditStats
-};