@plumpslabs/kuma 2.3.3 → 2.3.4

package/README.md

@@ -134,7 +134,7 @@ Kuma consolidates everything into **3 coarse-grained tools**. Each action trigge
 | Action | Use case |
 |--------|----------|
 | `guard` | Anti-pattern, drift, tool-loop, and failure checks. |
-| `verify` | Integrated auto-verification — auto-detect runner & execute scoped tests. |
+| `verify` | **SAFETY-GUARDED** on-demand test verification — only runs via explicit tool call. Auto-detects runner (pnpm/npm/yarn/pytest/cargo/go), scopes to session changes, rate-limited (60s min interval), concurrency-locked (1 at a time), cached (< 5 min returns stale result), runaway-protected (> 3 calls in 5 min auto-blocks). ⚠️ NEVER auto-triggered — only via explicit `kuma_safety({ action: "verify" })`. |
 | `check` | Pre-execution safety: policy, path, lock, risk level. |
 | `audit` | Query audit trail + stats + override log. |
 | `lock` | Multi-agent file locking. |

package/dist/{chunk-RWPJ5RWM.js → chunk-4CZSPSDW.js}

@@ -1,6 +1,6 @@
 import {
   sessionMemory
-} from "./chunk-N6QMWZGQ.js";
+} from "./chunk-77G3APNG.js";
 import {
   getProjectRoot
 } from "./chunk-E2KFPEBT.js";
@@ -82,7 +82,7 @@ function recordDecision(decision) {
 }
 async function recordDecisionToGraph(decision) {
   try {
-    const { upsertNode, addEdge } = await import("./kumaGraph-NHEAXC2V.js");
+    const { upsertNode, addEdge } = await import("./kumaGraph-KXI3Q7QF.js");
     const decisionId = `decision::${decision.title.replace(/[^a-zA-Z0-9_\-\s]/g, "").trim().replace(/\s+/g, "-")}`;
     await upsertNode({
       id: decisionId,

package/dist/{chunk-FSDW4F3U.js → chunk-5YCQG7V7.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   saveDb
-} from "./chunk-MTH4DRP7.js";
+} from "./chunk-NKNXJG2E.js";
 import {
   getProjectRoot
 } from "./chunk-E2KFPEBT.js";
@@ -458,7 +458,7 @@ The two nodes may not be connected in the knowledge graph yet. Use more tools to
 }
 async function buildFromSessionMemory() {
   try {
-    const { sessionMemory } = await import("./sessionMemory-45V6XJRH.js");
+    const { sessionMemory } = await import("./sessionMemory-SKKYUGB6.js");
     const toolCalls = sessionMemory.getToolCallHistory(50);
     let edgeCount = 0;
     for (const call of toolCalls) {

package/dist/{chunk-N6QMWZGQ.js → chunk-77G3APNG.js}

@@ -320,7 +320,7 @@ No unresolved issues.`;
    */
   async autoTrackToDb(toolName, params, timestamp) {
     try {
-      const { getDb, saveDb } = await import("./kumaDb-7VSQ4QLW.js");
+      const { getDb, saveDb } = await import("./kumaDb-I4AJ5A7H.js");
       const db = await getDb();
       db.run(
         `INSERT INTO tool_calls (tool_name, params, success, duration_ms, created_at) VALUES (?, ?, 1, 0, ?)`,
@@ -597,7 +597,7 @@ No unresolved issues.`;
       this.addModifiedFile(filePath);
     }
     try {
-      const { recordChange } = await import("./kumaDb-7VSQ4QLW.js");
+      const { recordChange } = await import("./kumaDb-I4AJ5A7H.js");
       const gitHash = this.getGitHead();
       await recordChange({ filePath, changeType, symbol, gitCommitHash: gitHash || void 0 });
     } catch {

package/dist/{chunk-MSKQRKME.js → chunk-BKEDQFEH.js}

@@ -1,6 +1,6 @@
 import {
   sessionMemory
-} from "./chunk-N6QMWZGQ.js";
+} from "./chunk-77G3APNG.js";
 import {
   getProjectRoot
 } from "./chunk-E2KFPEBT.js";

package/dist/{chunk-MTH4DRP7.js → chunk-NKNXJG2E.js}

@@ -764,23 +764,92 @@ async function runGarbageCollection() {
 async function runDoctor() {
   try {
     const db = await getDb();
-    const checks = [];
+    const checks = [
+      "\u{1FA7A} **Kuma Doctor Report**",
+      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+      ""
+    ];
     try {
       const integrity = db.exec("PRAGMA integrity_check");
       const result = integrity[0]?.values[0]?.[0] || "ok";
-      checks.push(`Integrity: ${result === "ok" ? "\u2705" : "\u274C " + result}`);
+      checks.push(`**Database Integrity**: ${result === "ok" ? "\u2705" : "\u274C " + result}`);
     } catch {
-      checks.push("Integrity: \u274C check failed");
+      checks.push("**Database Integrity**: \u274C check failed");
     }
-    const tables = ["nodes", "edges", "sessions", "research_cache", "change_log", "safety_audit", "todos", "security_findings", "context_notes", "benchmarks", "decision_log", "file_summaries"];
+    const allTables = ["nodes", "edges", "sessions", "research_cache", "change_log", "safety_audit", "todos", "security_findings", "context_notes", "benchmarks", "decision_log", "file_summaries", "verifications", "health_snapshots", "tool_calls", "experiences", "experience_patterns", "patterns", "api_endpoints", "otel_config", "cost_tracking", "scratch_entries", "portability_entries"];
     let existing = 0;
-    for (const t of tables) {
+    for (const t of allTables) {
       try {
         if (db.exec(`SELECT name FROM sqlite_master WHERE type='table' AND name='${t}'`)[0]?.values?.length) existing++;
       } catch {
       }
     }
-    checks.push(`Schema: ${existing}/${tables.length} tables present`);
+    const schemaHealth = existing === allTables.length ? "\u2705" : existing >= allTables.length * 0.8 ? "\u26A0\uFE0F" : "\u274C";
+    checks.push(`**Schema Health**: ${schemaHealth} ${existing}/${allTables.length} tables present`);
+    try {
+      const verifStmt = db.exec("SELECT scope, passed, created_at, duration_ms FROM verifications ORDER BY created_at DESC LIMIT 5");
+      if (verifStmt[0]?.values?.length) {
+        checks.push("");
+        checks.push("**Recent Verifications:**");
+        for (const v of verifStmt[0].values) {
+          const icon = v[1] ? "\u2705" : "\u{1F534}";
+          const time = new Date(v[2] * 1e3).toLocaleTimeString();
+          checks.push(`  ${icon} ${v[0]} (${v[3]}ms) \u2014 ${time}`);
+        }
+      }
+    } catch {
+    }
+    try {
+      const { execSync } = await import("child_process");
+      const psOutput = execSync(
+        `ps -eo pid,ppid,command | grep -E "(jest|pnpm test|npm test|yarn test)" | grep -v grep | head -10`,
+        { encoding: "utf-8", timeout: 5e3 }
+      ).trim();
+      if (psOutput) {
+        const processes = psOutput.split("\n").filter(Boolean);
+        checks.push("");
+        checks.push(`**Running Test Processes**: ${processes.length} found`);
+        for (const p of processes) {
+          checks.push(`  \u26A1 ${p.substring(0, 120)}`);
+        }
+        checks.push("  \u{1F4A1} Run `kuma_safety({ action: 'gc' })` to clean up stale processes");
+      } else {
+        checks.push("");
+        checks.push("**Running Test Processes**: \u2705 None detected");
+      }
+    } catch {
+      checks.push("");
+      checks.push("**Running Test Processes**: \u26A0\uFE0F Could not check");
+    }
+    try {
+      const hourAgo = Math.floor((Date.now() - 36e5) / 1e3);
+      const recentVerifs = db.exec(`SELECT COUNT(*) as c FROM verifications WHERE created_at > ${hourAgo}`);
+      const count = recentVerifs[0]?.values[0]?.[0] || 0;
+      if (count > 10) {
+        checks.push("");
+        checks.push(`\u26A0\uFE0F **High Verification Rate**: ${count} verifications in the last hour \u2014 this is abnormal.`);
+        checks.push(`  \u{1F4A1} If you didn't request these, run \`pkill -f "pnpm test"\` to kill orphaned processes.`);
+      } else if (count > 0) {
+        checks.push("");
+        checks.push(`**Verification Rate**: ${count} verifications in the last hour (normal)`);
+      }
+    } catch {
+    }
+    try {
+      const { isVerificationRunning, msSinceLastVerification, getRecentCallCount } = await import("./kumaVerifier-SSS4ZTJY.js");
+      const running = isVerificationRunning();
+      const sinceLast = msSinceLastVerification();
+      const callCount = getRecentCallCount();
+      checks.push("");
+      checks.push("**Verifier Status:**");
+      checks.push(`  ${running ? "\u{1F504}" : "\u{1F4A4}"} Currently ${running ? "running" : "idle"}`);
+      checks.push(`  \u23F1\uFE0F Last run: ${sinceLast < 0 ? "never" : `${Math.floor(sinceLast / 1e3)}s ago`}`);
+      checks.push(`  \u{1F4CA} Calls in 5min: ${callCount} (threshold: 3)`);
+      if (callCount >= 3) {
+        checks.push(`  \u{1F534} **Runaway protection active** \u2014 verifier is blocking further calls`);
+      }
+    } catch {
+    }
     return checks.join("\n");
   } catch (err) {
     return `\u274C Doctor failed: ${err}`;

package/dist/index.js

@@ -14,13 +14,7 @@ import {
   getGraphStats,
   searchGraph,
   traceFlow
-} from "./chunk-FSDW4F3U.js";
-import {
-  buildDriftMessages,
-  getGitDiffStat,
-  getSessionStats,
-  getUnresolvedCount
-} from "./chunk-MSKQRKME.js";
+} from "./chunk-5YCQG7V7.js";
 import {
   addContextNote,
   addSecurityFinding,
@@ -46,16 +40,22 @@ import {
   saveResearchCache,
   updateDecisionStatus,
   updateTodoStatus
-} from "./chunk-MTH4DRP7.js";
+} from "./chunk-NKNXJG2E.js";
 import {
   formatDecisionTemplate,
   getProactiveMemories,
   recordDecision,
   scoreMemoryRelevance
-} from "./chunk-RWPJ5RWM.js";
+} from "./chunk-4CZSPSDW.js";
+import {
+  buildDriftMessages,
+  getGitDiffStat,
+  getSessionStats,
+  getUnresolvedCount
+} from "./chunk-BKEDQFEH.js";
 import {
   sessionMemory
-} from "./chunk-N6QMWZGQ.js";
+} from "./chunk-77G3APNG.js";
 import {
   getProjectRoot,
   validateFilePath
@@ -196,8 +196,8 @@ async function handleInit(_params) {
   lines.push(`  \u{1F4DD} Modified: ${summary.modifiedFiles?.length || 0} file(s)`);
   lines.push(`  \u{1F6E0}\uFE0F Tool calls: ${summary.toolCallCount}`);
   try {
-    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-GX2YMCQT.js");
-    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-7VSQ4QLW.js");
+    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-ZAOUPG6A.js");
+    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-I4AJ5A7H.js");
     const score = await computeSafetyScore(_params.goal);
     const checksStr = JSON.stringify(score.checks);
     await saveHealthSnapshot2(score.score, score.risk, checksStr, score.summary);
@@ -370,8 +370,8 @@ async function handleResearches(_params) {
 async function handleHealth(_params) {
   sessionMemory.recordToolCall("kuma_context_health", {});
   try {
-    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-GX2YMCQT.js");
-    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-7VSQ4QLW.js");
+    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-ZAOUPG6A.js");
+    const { saveHealthSnapshot: saveHealthSnapshot2 } = await import("./kumaDb-I4AJ5A7H.js");
     const score = await computeSafetyScore();
     const checksStr = JSON.stringify(score.checks);
     await saveHealthSnapshot2(score.score, score.risk, checksStr, score.summary);
@@ -501,7 +501,7 @@ async function handleDecision(params) {
     case "template":
       return formatDecisionTemplate();
     case "suggest": {
-      const { shouldRecordDecision } = await import("./kumaMemory-UFRSJTWL.js");
+      const { shouldRecordDecision } = await import("./kumaMemory-2HW4JLJU.js");
       const check = shouldRecordDecision();
       return check.worth ? `\u{1F4A1} Decision suggested: "${check.title}"
 Use kuma_memory({ action: 'decision', title: '...', context: '...', rationale: '...', outcome: '...' }) to record.` : "\u2705 No decision needed at this time.";
@@ -579,7 +579,7 @@ async function handleSearch(params) {
   if (!query) return "\u26A0\uFE0F query or scope parameter required.";
   const limit = params.limit || 20;
   const memResults = sessionMemory.searchMemory(query, limit);
-  const { searchGraph: searchGraph2 } = await import("./kumaGraph-NHEAXC2V.js");
+  const { searchGraph: searchGraph2 } = await import("./kumaGraph-KXI3Q7QF.js");
   const graphResults = await searchGraph2(query, Math.min(limit, 10));
   const lines = [`\u{1F50D} **Search Results** \u2014 "${query}"
 \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
@@ -654,7 +654,7 @@ async function handleDecisionLog(params) {
 }
 async function handleMine(params) {
   sessionMemory.recordToolCall("kuma_memory_mine", { scope: params.scope });
-  const { mineHistoricalDecisions } = await import("./kumaMiner-UFDDVBRP.js");
+  const { mineHistoricalDecisions } = await import("./kumaMiner-HZUBNYYP.js");
   return await mineHistoricalDecisions({
     scope: params.scope,
     since: typeof params.since === "string" ? params.since : void 0,
@@ -1791,7 +1791,7 @@ async function handleLock(params) {
 }
 async function handleHealth2(_params) {
   try {
-    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-GX2YMCQT.js");
+    const { computeSafetyScore, formatSafetyScore } = await import("./safetyScore-ZAOUPG6A.js");
     const score = await computeSafetyScore();
     await saveHealthSnapshot(score.score, score.risk, JSON.stringify(score.checks), score.summary);
     return formatSafetyScore(score);
@@ -1895,9 +1895,17 @@ async function handleClean(_params) {
   return `${result}
 \u{1F4A1} Drift warnings have been reset. Any temporary debug artifacts are now cleared.`;
 }
+var _lastVerifyCall = 0;
+var VERIFY_COOLDOWN_MS = 3e4;
 async function handleVerify(params) {
+  const now = Date.now();
+  if (_lastVerifyCall > 0 && now - _lastVerifyCall < VERIFY_COOLDOWN_MS) {
+    const remaining = Math.ceil((VERIFY_COOLDOWN_MS - (now - _lastVerifyCall)) / 1e3);
+    return `\u23F3 **Handler rate limit** \u2014 verify was just called ${Math.floor((now - _lastVerifyCall) / 1e3)}s ago. Please wait ${remaining}s before calling verify again.`;
+  }
+  _lastVerifyCall = now;
   sessionMemory.recordToolCall("kuma_safety_verify", { scope: params.scope || params.filePath });
-  const { runAutoVerification } = await import("./kumaVerifier-Y4FQ2LOD.js");
+  const { runAutoVerification } = await import("./kumaVerifier-SSS4ZTJY.js");
   return await runAutoVerification({
     scope: params.scope || params.filePath,
     force: params.force,
@@ -2091,6 +2099,71 @@ If no flags specified, you'll be prompted to select files interactively.
 }
 async function main() {
   const args = process.argv.slice(2);
+  if (args[0] === "stop" && (args[1] === "--force" || args[1] === "-f")) {
+    console.error(`\u{1F43B} Kuma v${SERVER_VERSION} \u2014 Kill Switch`);
+    console.error("");
+    try {
+      const { getRunningVerificationPid } = await import("./kumaVerifier-SSS4ZTJY.js");
+      const pid = getRunningVerificationPid();
+      if (pid) {
+        try {
+          process.kill(-pid, "SIGKILL");
+        } catch {
+        }
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+        console.error(`\u2705 Killed verification process (PID: ${pid})`);
+      }
+    } catch (err) {
+      console.error(`\u26A0\uFE0F Could not check verifier: ${err}`);
+    }
+    try {
+      const { execSync: execSync3 } = await import("child_process");
+      try {
+        execSync3("pkill -f 'jest' 2>/dev/null || true");
+      } catch {
+      }
+      try {
+        execSync3("pkill -f 'jest-worker' 2>/dev/null || true");
+      } catch {
+      }
+      try {
+        execSync3("pkill -f 'pnpm test' 2>/dev/null || true");
+      } catch {
+      }
+      try {
+        execSync3("pkill -f 'npm test' 2>/dev/null || true");
+      } catch {
+      }
+      try {
+        execSync3("pkill -f 'yarn test' 2>/dev/null || true");
+      } catch {
+      }
+      console.error("\u2705 Killed orphaned test processes");
+    } catch {
+      console.error("\u26A0\uFE0F Could not clean up orphaned processes \u2014 try `pkill -f jest` manually");
+    }
+    console.error("");
+    console.error(`\u{1F6E1}\uFE0F Kill switch complete. You can safely restart Kuma.`);
+    process.exit(0);
+  }
+  if (args[0] === "stop") {
+    console.error(`\u{1F43B} Kuma v${SERVER_VERSION} \u2014 Kill Switch`);
+    console.error("");
+    console.error("\u26A0\uFE0F  Use `kuma stop --force` to kill all child processes (verifier, tests).");
+    console.error("\u{1F4A1} This kills orphaned Jest/worker/test processes spawned by Kuma.");
+    console.error("");
+    process.exit(0);
+  }
+  if (args[0] === "kill") {
+    console.error(`\u{1F43B} Kuma v${SERVER_VERSION}`);
+    console.error("");
+    console.error("\u{1F4A1} Use `kuma stop --force` instead.");
+    console.error("");
+    process.exit(0);
+  }
   if (args[0] === "init") {
     const flags = args.slice(1);
     if (flags.includes("--help") || flags.includes("-h")) {
@@ -2238,7 +2311,7 @@ async function main() {
         console.error(`[${SERVER_NAME}] \u2705 Restored session (${sessionInfo.toolCallCount} previous tool calls)`);
       }
       try {
-        const { buildFromSessionMemory } = await import("./kumaGraph-NHEAXC2V.js");
+        const { buildFromSessionMemory } = await import("./kumaGraph-KXI3Q7QF.js");
         const edgeCount = await buildFromSessionMemory();
         if (edgeCount > 0) {
           console.error(`[${SERVER_NAME}] \u2705 Graph auto-populated with ${edgeCount} entries from session memory`);
@@ -2258,7 +2331,7 @@ async function main() {
         console.error(`[${SERVER_NAME}] \u26A0\uFE0F Scratch directory setup: ${err}`);
       }
       try {
-        const { getDb: getDb2, saveDb: saveDb2 } = await import("./kumaDb-7VSQ4QLW.js");
+        const { getDb: getDb2, saveDb: saveDb2 } = await import("./kumaDb-I4AJ5A7H.js");
         const db = await getDb2();
         db.run(
           `INSERT INTO sessions (started_at, goal, tool_calls) VALUES (?, ?, ?)`,

package/dist/{kumaDb-7VSQ4QLW.js → kumaDb-I4AJ5A7H.js}

@@ -28,7 +28,7 @@ import {
   saveVerification,
   updateDecisionStatus,
   updateTodoStatus
-} from "./chunk-MTH4DRP7.js";
+} from "./chunk-NKNXJG2E.js";
 import "./chunk-E2KFPEBT.js";
 export {
   addContextNote,

package/dist/{kumaGraph-NHEAXC2V.js → kumaGraph-KXI3Q7QF.js}

@@ -14,8 +14,8 @@ import {
   searchGraph,
   traceFlow,
   upsertNode
-} from "./chunk-FSDW4F3U.js";
-import "./chunk-MTH4DRP7.js";
+} from "./chunk-5YCQG7V7.js";
+import "./chunk-NKNXJG2E.js";
 import "./chunk-E2KFPEBT.js";
 export {
   addEdge,

package/dist/{kumaMemory-UFRSJTWL.js → kumaMemory-2HW4JLJU.js}

@@ -4,8 +4,8 @@ import {
   recordDecision,
   scoreMemoryRelevance,
   shouldRecordDecision
-} from "./chunk-RWPJ5RWM.js";
-import "./chunk-N6QMWZGQ.js";
+} from "./chunk-4CZSPSDW.js";
+import "./chunk-77G3APNG.js";
 import "./chunk-E2KFPEBT.js";
 export {
   formatDecisionTemplate,

package/dist/{kumaMiner-UFDDVBRP.js → kumaMiner-HZUBNYYP.js}

@@ -1,10 +1,10 @@
 import {
   recordDecisionLog
-} from "./chunk-MTH4DRP7.js";
+} from "./chunk-NKNXJG2E.js";
 import {
   recordDecision
-} from "./chunk-RWPJ5RWM.js";
-import "./chunk-N6QMWZGQ.js";
+} from "./chunk-4CZSPSDW.js";
+import "./chunk-77G3APNG.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/kumaMiner.ts

package/dist/kumaVerifier-SSS4ZTJY.js

@@ -0,0 +1,243 @@
+import {
+  getLatestVerifications,
+  saveVerification
+} from "./chunk-NKNXJG2E.js";
+import {
+  sessionMemory
+} from "./chunk-77G3APNG.js";
+import "./chunk-E2KFPEBT.js";
+
+// src/engine/kumaVerifier.ts
+import fs from "fs";
+import path from "path";
+import { exec } from "child_process";
+var _isRunning = false;
+var _lastCompletedAt = 0;
+var _callHistory = [];
+var RUNAWAY_WINDOW_MS = 5 * 60 * 1e3;
+var RUNAWAY_THRESHOLD = 3;
+var MIN_INTERVAL_MS = 6e4;
+var STALE_RESULT_MS = 3e5;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var _currentProcess = null;
+function getRunningVerificationPid() {
+  return _currentProcess?.pid ?? null;
+}
+function isVerificationRunning() {
+  return _isRunning;
+}
+function msSinceLastVerification() {
+  if (_lastCompletedAt === 0) return -1;
+  return Date.now() - _lastCompletedAt;
+}
+function getRecentCallCount() {
+  const cutoff = Date.now() - RUNAWAY_WINDOW_MS;
+  return _callHistory.filter((t) => t > cutoff).length;
+}
+function detectTestRunner(root = process.cwd()) {
+  const pkgPath = path.join(root, "package.json");
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+      if (pkg.scripts && pkg.scripts.test) {
+        if (fs.existsSync(path.join(root, "pnpm-lock.yaml"))) {
+          return { runner: "pnpm", baseCommand: "pnpm test" };
+        }
+        if (fs.existsSync(path.join(root, "yarn.lock"))) {
+          return { runner: "yarn", baseCommand: "yarn test" };
+        }
+        return { runner: "npm", baseCommand: "npm test" };
+      }
+    } catch {
+    }
+  }
+  if (fs.existsSync(path.join(root, "pytest.ini")) || fs.existsSync(path.join(root, "pyproject.toml"))) {
+    return { runner: "pytest", baseCommand: "pytest" };
+  }
+  if (fs.existsSync(path.join(root, "Cargo.toml"))) {
+    return { runner: "cargo", baseCommand: "cargo test" };
+  }
+  if (fs.existsSync(path.join(root, "go.mod"))) {
+    return { runner: "go", baseCommand: "go test ./..." };
+  }
+  if (fs.existsSync(path.join(root, "Makefile"))) {
+    return { runner: "make", baseCommand: "make test" };
+  }
+  if (fs.existsSync(path.join(root, "package.json"))) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf-8"));
+      if (pkg.dependencies || pkg.devDependencies) {
+        if (fs.existsSync(path.join(root, "tsconfig.json"))) {
+          return { runner: "tsc", baseCommand: "npx tsc --noEmit" };
+        }
+        const srcDir = path.join(root, "src");
+        if (fs.existsSync(srcDir)) {
+          return { runner: "node", baseCommand: `node -c "${srcDir}/**/*.js" 2>/dev/null || node --check $(find src -name '*.js' 2>/dev/null | head -5)` };
+        }
+      }
+    } catch {
+    }
+  }
+  return { runner: "unknown", baseCommand: "npm test || echo 'No test runner configured'" };
+}
+function checkRateLimit() {
+  if (_isRunning) {
+    return "\u23F3 Verification already in progress \u2014 only 1 verification at a time. Wait for it to complete, or try again later.";
+  }
+  const cutoff = Date.now() - RUNAWAY_WINDOW_MS;
+  const recent = _callHistory.filter((t) => t > cutoff);
+  if (recent.length >= RUNAWAY_THRESHOLD) {
+    return `\u{1F534} **Runaway Detection Triggered**
+
+Verification has been called ${recent.length} times in the last 5 minutes. This looks like an uncontrolled loop. Verification has been **blocked** to prevent resource exhaustion.
+
+\u{1F4A1} If you need to verify, wait ${Math.ceil((RUNAWAY_WINDOW_MS - (Date.now() - recent[0])) / 6e4)} minutes, or run \`kuma_safety({ action: "doctor" })\` to check system status.
+
+\u{1F6A8} If this is unexpected, run \`pkill -f "pnpm test"\` to kill orphaned processes.`;
+  }
+  if (_lastCompletedAt > 0) {
+    const elapsed = Date.now() - _lastCompletedAt;
+    if (elapsed < MIN_INTERVAL_MS) {
+      const remaining = Math.ceil((MIN_INTERVAL_MS - elapsed) / 1e3);
+      return `\u23F3 Rate limit: verification was run ${Math.floor(elapsed / 1e3)}s ago. Please wait ${remaining}s before running verification again. (Minimum interval: ${MIN_INTERVAL_MS / 1e3}s)`;
+    }
+  }
+  return null;
+}
+async function checkStaleness(scope) {
+  if (scope === "session-impact" || scope === void 0) {
+    try {
+      const recent = await getLatestVerifications(1);
+      if (recent.length > 0) {
+        const age = Date.now() - recent[0].created_at * 1e3;
+        if (age < STALE_RESULT_MS) {
+          const ageSeconds = Math.floor(age / 1e3);
+          return [
+            `\u23E9 **Using cached verification** (${ageSeconds}s old, < 5 min threshold)`,
+            `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+            "",
+            `\u{1F6E0}\uFE0F Runner: \`${recent[0].runner}\``,
+            `\u{1F4BB} Command: \`${recent[0].test_command}\``,
+            `\u{1F3AF} Scope: \`${recent[0].scope}\``,
+            `\u23F1\uFE0F Original duration: ${recent[0].duration_ms}ms`,
+            "",
+            recent[0].passed ? "\u2705 **Result: PASSED** (served from cache)" : "\u{1F534} **Result: FAILED** (served from cache)",
+            "",
+            "\u{1F4A1} Use `force: true` to bypass cache and run tests again."
+          ].join("\n");
+        }
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+async function runAutoVerification(options = {}) {
+  const startTime = Date.now();
+  const root = process.cwd();
+  const scope = options.scope || "session-impact";
+  const timeoutMs = options.timeoutMs || DEFAULT_TIMEOUT_MS;
+  const denial = checkRateLimit();
+  if (denial) {
+    return denial;
+  }
+  if (!options.force) {
+    const cached = await checkStaleness(scope);
+    if (cached) return cached;
+  }
+  _isRunning = true;
+  const { runner, baseCommand } = detectTestRunner(root);
+  let testFiles = [];
+  const modified = sessionMemory.getModifiedFiles().map((f) => f.filePath);
+  if (options.scope) {
+    const term = options.scope.toLowerCase();
+    testFiles = modified.filter((f) => f.toLowerCase().includes(term));
+    if (testFiles.length === 0) {
+      try {
+        const { default: glob } = await import("fast-glob");
+        const found = await glob([`**/*${term}*test*.*`, `**/*test*/*${term}*.*`], { cwd: root, ignore: ["node_modules/**", "dist/**"] });
+        testFiles = found;
+      } catch {
+      }
+    }
+  } else {
+    testFiles = modified.filter((f) => f.includes(".test.") || f.includes(".spec.") || f.includes("_test."));
+  }
+  let fullCommand = baseCommand;
+  if (testFiles.length > 0 && runner === "npm") {
+    fullCommand = `${baseCommand} -- ${testFiles.map((f) => `"${f}"`).join(" ")}`;
+  }
+  return new Promise((resolve) => {
+    const child = exec(fullCommand, { cwd: root, timeout: timeoutMs }, async (error, stdout, stderr) => {
+      const durationMs = Date.now() - startTime;
+      const rawOutput = (stdout + "\n" + stderr).trim();
+      const passed = !error;
+      const truncatedOutput = rawOutput.length > 2e3 ? rawOutput.substring(rawOutput.length - 2e3) : rawOutput;
+      await saveVerification(scope, runner, fullCommand, passed, truncatedOutput, durationMs);
+      _isRunning = false;
+      _lastCompletedAt = Date.now();
+      _callHistory.push(Date.now());
+      while (_callHistory.length > 100) _callHistory.shift();
+      _currentProcess = null;
+      const statusSymbol = passed ? "\u2705" : "\u{1F534}";
+      const summaryHeader = `${statusSymbol} **Verification ${passed ? "PASSED" : "FAILED"}**
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`;
+      const details = [
+        summaryHeader,
+        `\u{1F6E0}\uFE0F **Runner**: \`${runner}\``,
+        `\u{1F4BB} **Command**: \`${fullCommand}\``,
+        `\u{1F3AF} **Scope**: \`${scope}\`${testFiles.length > 0 ? ` (${testFiles.length} file(s) matched)` : ""}`,
+        `\u23F1\uFE0F **Duration**: ${durationMs}ms`,
+        ""
+      ];
+      if (!passed) {
+        details.push("\u26A0\uFE0F **Verification failed!** Please fix test failures before shipping.");
+        if (error && error.killed) {
+          details.push(`\u23F0 **Process was killed after ${timeoutMs}ms timeout**`);
+        }
+        details.push("```text");
+        details.push(rawOutput.substring(0, 1500));
+        details.push("```");
+      } else {
+        details.push("\u{1F389} All scoped tests passed!");
+        if (rawOutput) {
+          details.push("```text");
+          details.push(rawOutput.substring(0, 800));
+          details.push("```");
+        }
+      }
+      resolve(details.join("\n"));
+    });
+    _currentProcess = child;
+    _isRunning = true;
+    const killTimer = setTimeout(() => {
+      if (_currentProcess && !_currentProcess.killed) {
+        try {
+          const childPid = _currentProcess.pid;
+          if (childPid) {
+            try {
+              process.kill(-childPid, "SIGKILL");
+            } catch {
+            }
+            try {
+              _currentProcess.kill("SIGKILL");
+            } catch {
+            }
+          }
+        } catch {
+        }
+      }
+    }, timeoutMs + 5e3);
+    child.on("close", () => {
+      clearTimeout(killTimer);
+    });
+  });
+}
+export {
+  detectTestRunner,
+  getRecentCallCount,
+  getRunningVerificationPid,
+  isVerificationRunning,
+  msSinceLastVerification,
+  runAutoVerification
+};

package/dist/{safetyScore-GX2YMCQT.js → safetyScore-ZAOUPG6A.js}

@@ -2,10 +2,10 @@ import {
   getGitDiffStat,
   getSessionStats,
   getUnresolvedCount
-} from "./chunk-MSKQRKME.js";
+} from "./chunk-BKEDQFEH.js";
 import {
   sessionMemory
-} from "./chunk-N6QMWZGQ.js";
+} from "./chunk-77G3APNG.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/safetyScore.ts
@@ -52,7 +52,7 @@ async function computeSafetyScore(inputGoal) {
     totalScore += 20;
   }
   try {
-    const { getDb } = await import("./kumaDb-7VSQ4QLW.js");
+    const { getDb } = await import("./kumaDb-I4AJ5A7H.js");
     const db = await getDb();
     const nodeCount = db.exec("SELECT COUNT(*) as c FROM nodes")[0]?.values[0][0] ?? 0;
     const edgeCount = db.exec("SELECT COUNT(*) as c FROM edges")[0]?.values[0][0] ?? 0;
@@ -83,7 +83,7 @@ async function computeSafetyScore(inputGoal) {
     totalScore += 5;
   }
   try {
-    const { getDb } = await import("./kumaDb-7VSQ4QLW.js");
+    const { getDb } = await import("./kumaDb-I4AJ5A7H.js");
     const db = await getDb();
     const researchCount = db.exec("SELECT COUNT(*) as c FROM research_cache")[0]?.values[0][0] ?? 0;
     checks.push({
@@ -108,7 +108,7 @@ async function computeSafetyScore(inputGoal) {
   const hasRunTests = stats.hasRunTests;
   let latestVerif = null;
   try {
-    const { getLatestVerifications } = await import("./kumaDb-7VSQ4QLW.js");
+    const { getLatestVerifications } = await import("./kumaDb-I4AJ5A7H.js");
     const verifs = await getLatestVerifications(1);
     if (verifs.length > 0) latestVerif = verifs[0];
   } catch {

package/dist/{sessionMemory-45V6XJRH.js → sessionMemory-SKKYUGB6.js}

@@ -1,6 +1,6 @@
 import {
   sessionMemory
-} from "./chunk-N6QMWZGQ.js";
+} from "./chunk-77G3APNG.js";
 export {
   sessionMemory
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumpslabs/kuma",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "description": "Safety-first context & orchestration engine for AI coding agents. MCP server with mandatory research pipeline, knowledge graph, impact analysis, decision memory, and safety guard — works with any MCP client.",
   "type": "module",
   "main": "dist/index.js",

package/dist/kumaVerifier-Y4FQ2LOD.js

@@ -1,123 +0,0 @@
-import {
-  saveVerification
-} from "./chunk-MTH4DRP7.js";
-import {
-  sessionMemory
-} from "./chunk-N6QMWZGQ.js";
-import "./chunk-E2KFPEBT.js";
-
-// src/engine/kumaVerifier.ts
-import fs from "fs";
-import path from "path";
-import { exec } from "child_process";
-function detectTestRunner(root = process.cwd()) {
-  const pkgPath = path.join(root, "package.json");
-  if (fs.existsSync(pkgPath)) {
-    try {
-      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-      if (pkg.scripts && pkg.scripts.test) {
-        if (fs.existsSync(path.join(root, "pnpm-lock.yaml"))) {
-          return { runner: "pnpm", baseCommand: "pnpm test" };
-        }
-        if (fs.existsSync(path.join(root, "yarn.lock"))) {
-          return { runner: "yarn", baseCommand: "yarn test" };
-        }
-        return { runner: "npm", baseCommand: "npm test" };
-      }
-    } catch {
-    }
-  }
-  if (fs.existsSync(path.join(root, "pytest.ini")) || fs.existsSync(path.join(root, "pyproject.toml"))) {
-    return { runner: "pytest", baseCommand: "pytest" };
-  }
-  if (fs.existsSync(path.join(root, "Cargo.toml"))) {
-    return { runner: "cargo", baseCommand: "cargo test" };
-  }
-  if (fs.existsSync(path.join(root, "go.mod"))) {
-    return { runner: "go", baseCommand: "go test ./..." };
-  }
-  if (fs.existsSync(path.join(root, "Makefile"))) {
-    return { runner: "make", baseCommand: "make test" };
-  }
-  if (fs.existsSync(path.join(root, "package.json"))) {
-    try {
-      const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf-8"));
-      if (pkg.dependencies || pkg.devDependencies) {
-        if (fs.existsSync(path.join(root, "tsconfig.json"))) {
-          return { runner: "tsc", baseCommand: "npx tsc --noEmit" };
-        }
-        const srcDir = path.join(root, "src");
-        if (fs.existsSync(srcDir)) {
-          return { runner: "node", baseCommand: `node -c "${srcDir}/**/*.js" 2>/dev/null || node --check $(find src -name '*.js' 2>/dev/null | head -5)` };
-        }
-      }
-    } catch {
-    }
-  }
-  return { runner: "unknown", baseCommand: "npm test || echo 'No test runner configured'" };
-}
-async function runAutoVerification(options = {}) {
-  const startTime = Date.now();
-  const root = process.cwd();
-  const scope = options.scope || "session-impact";
-  const timeoutMs = options.timeoutMs || 3e4;
-  const { runner, baseCommand } = detectTestRunner(root);
-  let testFiles = [];
-  const modified = sessionMemory.getModifiedFiles().map((f) => f.filePath);
-  if (options.scope) {
-    const term = options.scope.toLowerCase();
-    testFiles = modified.filter((f) => f.toLowerCase().includes(term));
-    if (testFiles.length === 0) {
-      try {
-        const { default: glob } = await import("fast-glob");
-        const found = await glob([`**/*${term}*test*.*`, `**/*test*/*${term}*.*`], { cwd: root, ignore: ["node_modules/**", "dist/**"] });
-        testFiles = found;
-      } catch {
-      }
-    }
-  } else {
-    testFiles = modified.filter((f) => f.includes(".test.") || f.includes(".spec.") || f.includes("_test."));
-  }
-  let fullCommand = baseCommand;
-  if (testFiles.length > 0 && runner === "npm") {
-    fullCommand = `${baseCommand} -- ${testFiles.map((f) => `"${f}"`).join(" ")}`;
-  }
-  return new Promise((resolve) => {
-    exec(fullCommand, { cwd: root, timeout: timeoutMs }, async (error, stdout, stderr) => {
-      const durationMs = Date.now() - startTime;
-      const rawOutput = (stdout + "\n" + stderr).trim();
-      const passed = !error;
-      const truncatedOutput = rawOutput.length > 2e3 ? rawOutput.substring(rawOutput.length - 2e3) : rawOutput;
-      await saveVerification(scope, runner, fullCommand, passed, truncatedOutput, durationMs);
-      const statusSymbol = passed ? "\u2705" : "\u{1F534}";
-      const summaryHeader = `${statusSymbol} **Auto-Verification ${passed ? "PASSED" : "FAILED"}**
-\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`;
-      const details = [
-        summaryHeader,
-        `\u{1F6E0}\uFE0F **Runner**: \`${runner}\``,
-        `\u{1F4BB} **Command**: \`${fullCommand}\``,
-        `\u{1F3AF} **Scope**: \`${scope}\`${testFiles.length > 0 ? ` (${testFiles.length} file(s) matched)` : ""}`,
-        `\u23F1\uFE0F **Duration**: ${durationMs}ms`,
-        ""
-      ];
-      if (!passed) {
-        details.push("\u26A0\uFE0F **BLOCKER**: Verification failed! Please fix test failures before shipping or continuing edits.");
-        details.push("```text");
-        details.push(rawOutput.substring(0, 1500));
-        details.push("```");
-      } else {
-        details.push("\u{1F389} All scoped tests passed cleanly!");
-        if (rawOutput) {
-          details.push("```text");
-          details.push(rawOutput.substring(0, 800));
-          details.push("```");
-        }
-      }
-      resolve(details.join("\n"));
-    });
-  });
-}
-export {
-  detectTestRunner,
-  runAutoVerification
-};