@plumpslabs/kuma 2.3.31 → 2.3.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumpslabs/kuma",
-  "version": "2.3.31",
+  "version": "2.3.32",
   "description": "Safety-first context & orchestration engine for AI coding agents. MCP server with mandatory research pipeline, knowledge graph, impact analysis, decision memory, and safety guard — works with any MCP client.",
   "type": "module",
   "main": "dist/index.js",

package/packages/ide/studio/dist/index.js

@@ -3,135 +3,310 @@
 // src/index.ts
 import { serve } from "@hono/node-server";
 import { readFileSync } from "fs";
-import { join as join2, dirname } from "path";
+import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { spawn } from "child_process";
 
 // src/api.ts
 import { Hono } from "hono";
-import { cors } from "hono/cors";
 
 // src/db.ts
-import { execSync } from "child_process";
-import { existsSync } from "fs";
-import { join, resolve } from "path";
+import fs from "fs";
+import path from "path";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var sqlJs = null;
+async function getSqlJs() {
+  if (!sqlJs) {
+    sqlJs = await require2("sql.js");
+  }
+  return sqlJs;
+}
 function findKumaDb(startDir) {
-  let current = startDir ? resolve(startDir) : process.cwd();
+  let current = startDir ? path.resolve(startDir) : process.cwd();
   for (let i = 0; i < 20; i++) {
-    const candidate = join(current, ".kuma", "kuma.db");
-    if (existsSync(candidate)) return candidate;
-    const parent = resolve(current, "..");
+    const candidate = path.join(current, ".kuma", "kuma.db");
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.resolve(current, "..");
     if (parent === current) break;
     current = parent;
   }
   return null;
 }
-function query(sql) {
+function projectRootFromDb(dbPath) {
+  return path.dirname(path.dirname(dbPath));
+}
+async function openDb() {
+  const SQL = await getSqlJs();
   const dbPath = findKumaDb();
   if (!dbPath) throw new Error("No .kuma/kuma.db found");
-  return execSync(`sqlite3 "${dbPath}" "${sql}"`, {
-    encoding: "utf-8",
-    maxBuffer: 2 * 1024 * 1024,
-    timeout: 1e4
-  }).trim();
+  const buffer = fs.readFileSync(dbPath);
+  return new SQL.Database(buffer);
 }
-function queryJson(sql) {
-  const raw = query(sql);
-  if (!raw) return [];
+function readSessionMetrics(dbPath) {
+  const empty = {
+    metrics: { filesRead: 0, filesEdited: 0, researchTimeSaved: 0 },
+    recordings: { archFlows: 0, gotchas: 0, decisions: 0, researchSaves: 0, total: 0 }
+  };
   try {
-    return JSON.parse(raw);
+    const root = projectRootFromDb(dbPath);
+    const memPath = path.join(root, ".kuma", "memory.json");
+    if (!fs.existsSync(memPath)) return empty;
+    const parsed = JSON.parse(fs.readFileSync(memPath, "utf-8"));
+    return {
+      metrics: {
+        filesRead: parsed?.metrics?.filesRead ?? 0,
+        filesEdited: parsed?.metrics?.filesEdited ?? 0,
+        researchTimeSaved: parsed?.metrics?.researchTimeSaved ?? 0
+      },
+      recordings: {
+        archFlows: parsed?.recordings?.archFlows ?? 0,
+        gotchas: parsed?.recordings?.gotchas ?? 0,
+        decisions: parsed?.recordings?.decisions ?? 0,
+        researchSaves: parsed?.recordings?.researchSaves ?? 0,
+        total: parsed?.recordings?.total ?? 0
+      }
+    };
   } catch {
-    try {
-      const sanitized = raw.replace(/[\r\n]+/g, " ");
-      return JSON.parse(sanitized);
-    } catch (e) {
-      console.warn("[Studio DB] queryJson parse failed:", e);
-      return [];
+    return empty;
+  }
+}
+function detectStaleNodes(db, dbPath) {
+  try {
+    const root = projectRootFromDb(dbPath);
+    const stmt = db.prepare(
+      `SELECT file_path, COUNT(*) as cnt FROM nodes
+       WHERE file_path IS NOT NULL AND file_path != '' AND file_path NOT LIKE '%::%'
+       GROUP BY file_path ORDER BY cnt DESC LIMIT 500`
+    );
+    const missing = [];
+    let checked = 0;
+    let staleNodes = 0;
+    while (stmt.step()) {
+      const row = stmt.getAsObject();
+      const fp = row.file_path;
+      checked++;
+      if (!fs.existsSync(path.join(root, fp))) {
+        const count = Number(row.cnt ?? 1);
+        missing.push({ filePath: fp, nodeCount: count });
+        staleNodes += count;
+      }
     }
+    stmt.free();
+    return { checked, staleNodes, missing };
+  } catch {
+    return { checked: 0, staleNodes: 0, missing: [] };
   }
 }
-function getDashboardData() {
-  return {
-    stats: queryJson(`
-      SELECT json_object(
-        'node_count', (SELECT COUNT(*) FROM nodes),
-        'edge_count', (SELECT COUNT(*) FROM edges),
-        'gotcha_count', (SELECT COUNT(*) FROM known_gotchas),
-        'feature_count', (SELECT COUNT(*) FROM nodes WHERE type = 'feature'),
-        'health_score', COALESCE((SELECT score FROM health_snapshots ORDER BY created_at DESC LIMIT 1), 0)
+async function getDashboardData() {
+  const db = await openDb();
+  const dbPath = findKumaDb();
+  try {
+    const run = (sql) => {
+      try {
+        const stmt = db.prepare(sql);
+        const rows = [];
+        while (stmt.step()) rows.push(stmt.getAsObject());
+        stmt.free();
+        return rows;
+      } catch {
+        return [];
+      }
+    };
+    const first = (sql, key) => {
+      const rows = run(sql);
+      if (!rows.length) return 0;
+      const v = rows[0][key];
+      return Number(v ?? 0) || 0;
+    };
+    const jsonRows = (sql) => {
+      const rows = run(sql);
+      if (!rows.length) return [];
+      const key = Object.keys(rows[0])[0];
+      const raw = rows[0][key];
+      if (raw === null || raw === void 0) return [];
+      try {
+        const parsed = JSON.parse(String(raw));
+        return Array.isArray(parsed) ? parsed : [parsed];
+      } catch {
+        return [];
+      }
+    };
+    const stats = {
+      node_count: first(`SELECT COUNT(*) as c FROM nodes`, "c"),
+      edge_count: first(`SELECT COUNT(*) as c FROM edges`, "c"),
+      gotcha_count: first(`SELECT COUNT(*) as c FROM known_gotchas`, "c"),
+      feature_count: first(`SELECT COUNT(*) as c FROM nodes WHERE type = 'feature'`, "c"),
+      health_score: first(
+        `SELECT COALESCE((SELECT score FROM health_snapshots ORDER BY created_at DESC LIMIT 1), 0) as c`,
+        "c"
       )
-    `),
-    nodes: queryJson(
+    };
+    const nodes = jsonRows(
       `SELECT json_group_array(json_object('id',id,'name',name,'type',type,'file_path',file_path,'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'metadata',COALESCE(metadata,'{}'))) FROM nodes ORDER BY updated_at DESC`
-    ),
-    edges: queryJson(
+    );
+    const edges = jsonRows(
       `SELECT json_group_array(json_object('source',source_id,'target',target_id,'relation',type,'weight',weight)) FROM edges`
-    ),
-    gotchas: queryJson(
+    );
+    const gotchas = jsonRows(
       `SELECT json_group_array(json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at)) FROM known_gotchas ORDER BY severity DESC`
-    ),
-    features: queryJson(
+    );
+    const features = jsonRows(
       `SELECT json_group_array(json_object('id',id,'name',name,'metadata',COALESCE(metadata,'{}'))) FROM nodes WHERE type = 'feature' ORDER BY name`
-    ),
-    health: queryJson(
+    );
+    const health = jsonRows(
       `SELECT json_group_array(json_object('score',score,'summary',REPLACE(REPLACE(COALESCE(summary,''),char(10),' '),char(13),''),'risk_level',risk_level,'created_at',created_at)) FROM health_snapshots ORDER BY created_at DESC LIMIT 10`
-    )
-  };
+    );
+    const sessionMetrics = readSessionMetrics(dbPath);
+    const verifTotal = first(`SELECT COUNT(*) as c FROM verifications`, "c");
+    const verifPassed = first(`SELECT COUNT(*) as c FROM verifications WHERE passed = 1`, "c");
+    const recentSessions = run(
+      `SELECT started_at, COALESCE(goal,'') as goal, tool_calls, edits, rollbacks, failures, safety_score
+       FROM sessions ORDER BY started_at DESC LIMIT 8`
+    ).map((r) => ({
+      startedAt: Number(r.started_at ?? 0),
+      goal: r.goal || "",
+      toolCalls: Number(r.tool_calls ?? 0),
+      edits: Number(r.edits ?? 0),
+      rollbacks: Number(r.rollbacks ?? 0),
+      failures: Number(r.failures ?? 0),
+      safetyScore: r.safety_score == null ? null : Number(r.safety_score)
+    }));
+    const efficiency = {
+      sessions: first(`SELECT COUNT(*) as c FROM sessions`, "c"),
+      toolCalls: first(`SELECT COUNT(*) as c FROM tool_calls`, "c"),
+      totalEdits: first(`SELECT COALESCE(SUM(edits),0) as c FROM sessions`, "c"),
+      totalRollbacks: first(`SELECT COALESCE(SUM(rollbacks),0) as c FROM sessions`, "c"),
+      totalFailures: first(`SELECT COALESCE(SUM(failures),0) as c FROM sessions`, "c"),
+      researchCacheScopes: first(`SELECT COUNT(*) as c FROM research_cache`, "c"),
+      decisions: first(`SELECT COUNT(*) as c FROM decision_log`, "c"),
+      verifications: verifTotal,
+      verificationPassRate: verifTotal > 0 ? Math.round(verifPassed / verifTotal * 100) : null,
+      metrics: sessionMetrics.metrics,
+      recordings: sessionMetrics.recordings,
+      recentSessions
+    };
+    const staleness = detectStaleNodes(db, dbPath);
+    return { stats, nodes, edges, gotchas, features, health, efficiency, staleness };
+  } finally {
+    db.close();
+  }
 }
-function getNodeDetail(nodeId) {
-  const escaped = nodeId.replace(/'/g, "''");
-  const parts = nodeId.split("::");
-  const shortName = parts.pop()?.replace(/'/g, "''") || "";
-  const filePath = parts[0] === "gotcha" && parts.length >= 2 ? parts[1]?.replace(/'/g, "''") : "";
-  const scope = parts[0] === "research" && parts.length >= 2 ? parts.slice(1).join("::").replace(/'/g, "''") : "";
-  const node = queryJson(
-    `SELECT json_object('id',id,'name',name,'type',type,'file_path',COALESCE(file_path,''),'metadata',COALESCE(metadata,'{}'),'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'last_verified_at',last_verified_at,'created_at',created_at,'updated_at',updated_at) FROM nodes WHERE id = '${escaped}'`
-  );
-  const nodeObj = Array.isArray(node) ? node[0] : node;
-  if (!nodeObj) return null;
-  const rawOut = query(
-    `SELECT json_object('target',e.target_id,'relation',e.type,'weight',e.weight,'target_name',n.name,'target_type',n.type) FROM edges e LEFT JOIN nodes n ON n.id = e.target_id WHERE e.source_id = '${escaped}'`
-  );
-  const outgoing = rawOut ? rawOut.split("\n").filter(Boolean).map((r) => {
-    try {
-      return JSON.parse(r);
-    } catch {
-      return null;
-    }
-  }).filter(Boolean) : [];
-  const rawIn = query(
-    `SELECT json_object('source',e.source_id,'relation',e.type,'weight',e.weight,'source_name',n.name,'source_type',n.type) FROM edges e LEFT JOIN nodes n ON n.id = e.source_id WHERE e.target_id = '${escaped}'`
-  );
-  const incoming = rawIn ? rawIn.split("\n").filter(Boolean).map((r) => {
-    try {
-      return JSON.parse(r);
-    } catch {
-      return null;
-    }
-  }).filter(Boolean) : [];
-  const gotchaFilter = filePath ? `file_path = '${filePath}'` : `file_path = '${escaped}' OR file_path LIKE '%${shortName}%'`;
-  const rawGotcha = query(
-    `SELECT json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at) FROM known_gotchas WHERE ${gotchaFilter}`
-  );
-  const gotchas = rawGotcha ? rawGotcha.split("\n").filter(Boolean).map((r) => {
+async function getNodeDetail(nodeId) {
+  const db = await openDb();
+  try {
+    const run = (sql) => {
+      try {
+        const stmt = db.prepare(sql);
+        const rows = [];
+        while (stmt.step()) rows.push(stmt.getAsObject());
+        stmt.free();
+        return rows;
+      } catch {
+        return [];
+      }
+    };
+    const escaped = nodeId.replace(/'/g, "''");
+    const parts = nodeId.split("::");
+    const shortName = parts.pop()?.replace(/'/g, "''") || "";
+    const filePath = parts[0] === "gotcha" && parts.length >= 2 ? parts[1]?.replace(/'/g, "''") : "";
+    const scope = parts[0] === "research" && parts.length >= 2 ? parts.slice(1).join("::").replace(/'/g, "''") : "";
+    const nodeRows = run(
+      `SELECT json_object('id',id,'name',name,'type',type,'file_path',COALESCE(file_path,''),'metadata',COALESCE(metadata,'{}'),'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'last_verified_at',last_verified_at,'created_at',created_at,'updated_at',updated_at) FROM nodes WHERE id = '${escaped}'`
+    );
+    if (!nodeRows.length) return null;
+    const rawNode = nodeRows[0][Object.keys(nodeRows[0])[0]];
+    let node = null;
     try {
-      return JSON.parse(r);
+      node = typeof rawNode === "string" ? JSON.parse(rawNode) : rawNode;
     } catch {
       return null;
     }
-  }).filter(Boolean) : [];
-  return { node: nodeObj, outgoing, incoming, gotchas };
+    if (!node) return null;
+    const parseRelation = (rows, label) => rows.map((r) => {
+      const out = {
+        relation: r.relation,
+        weight: r.weight
+      };
+      if (label === "out") {
+        out.target = r.target;
+        out.target_name = r.target_name;
+        out.target_type = r.target_type;
+      } else {
+        out.source = r.source;
+        out.source_name = r.source_name;
+        out.source_type = r.source_type;
+      }
+      return out;
+    }).filter(Boolean);
+    const outgoing = parseRelation(
+      run(
+        `SELECT e.target_id as target, e.type as relation, e.weight, n.name as target_name, n.type as target_type
+         FROM edges e LEFT JOIN nodes n ON n.id = e.target_id
+         WHERE e.source_id = '${escaped}'`
+      ),
+      "out"
+    );
+    const incoming = parseRelation(
+      run(
+        `SELECT e.source_id as source, e.type as relation, e.weight, n.name as source_name, n.type as source_type
+         FROM edges e LEFT JOIN nodes n ON n.id = e.source_id
+         WHERE e.target_id = '${escaped}'`
+      ),
+      "in"
+    );
+    const gotchaFilter = filePath ? `file_path = '${filePath}'` : `file_path = '${escaped}' OR file_path LIKE '%${shortName}%'`;
+    const gotchaRows = run(
+      `SELECT json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at) FROM known_gotchas WHERE ${gotchaFilter}`
+    );
+    const gotchas = gotchaRows.map((r) => {
+      const raw = r[Object.keys(r)[0]];
+      if (raw === null || raw === void 0) return null;
+      try {
+        return JSON.parse(String(raw));
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+    return { node, outgoing, incoming, gotchas };
+  } finally {
+    db.close();
+  }
 }
 
 // src/api.ts
-import fs from "fs";
+import fs2 from "fs";
 var api = new Hono();
-api.use("/*", cors());
+var LOCALHOST_ORIGINS = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i;
+function isLocalhostOrigin(origin) {
+  if (!origin) return false;
+  return LOCALHOST_ORIGINS.test(origin);
+}
+api.use("/*", async (c, next) => {
+  const origin = c.req.header("origin");
+  if (origin && !isLocalhostOrigin(origin)) {
+    return c.json({ error: "Forbidden: cross-origin requests are not allowed." }, 403);
+  }
+  if (origin) {
+    c.header("Access-Control-Allow-Origin", origin);
+    c.header("Vary", "Origin");
+    c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    c.header("Access-Control-Allow-Headers", "Content-Type");
+  }
+  await next();
+});
+function confirmGuard(c) {
+  const confirm = c.req.query("confirm");
+  if (confirm !== "1") {
+    return c.json({ ok: false, error: "Confirmation required: pass ?confirm=1" }, 400);
+  }
+  return null;
+}
 api.get("/status", (c) => {
   const dbPath = findKumaDb();
   let dbSize = "0 KB";
-  if (dbPath && fs.existsSync(dbPath)) {
-    const bytes = fs.statSync(dbPath).size;
+  if (dbPath && fs2.existsSync(dbPath)) {
+    const bytes = fs2.statSync(dbPath).size;
     dbSize = bytes > 1024 * 1024 ? (bytes / (1024 * 1024)).toFixed(2) + " MB" : (bytes / 1024).toFixed(1) + " KB";
   }
   return c.json({
@@ -141,18 +316,18 @@ api.get("/status", (c) => {
     project: dbPath ? dbPath.replace("/.kuma/kuma.db", "").split("/").pop() : null
   });
 });
-api.get("/dashboard", (c) => {
+api.get("/dashboard", async (c) => {
   try {
-    const data = getDashboardData();
+    const data = await getDashboardData();
     return c.json(data);
   } catch (e) {
     return c.json({ error: e.message }, 500);
   }
 });
-api.get("/node/:id", (c) => {
+api.get("/node/:id", async (c) => {
   try {
     const nodeId = c.req.param("id");
-    const detail = getNodeDetail(nodeId);
+    const detail = await getNodeDetail(nodeId);
     if (!detail) return c.json({ error: "Node not found" }, 404);
     return c.json(detail);
   } catch (e) {
@@ -160,17 +335,21 @@ api.get("/node/:id", (c) => {
   }
 });
 api.post("/reset-db", (c) => {
+  const blocked = confirmGuard(c);
+  if (blocked) return blocked;
   try {
     const dbPath = findKumaDb();
-    if (dbPath && fs.existsSync(dbPath)) {
-      fs.unlinkSync(dbPath);
+    if (dbPath && fs2.existsSync(dbPath)) {
+      fs2.unlinkSync(dbPath);
     }
     return c.json({ ok: true, message: "Kuma DB reset successfully" });
   } catch (e) {
-    return c.json({ error: e.message }, 500);
+    return c.json({ ok: false, error: e.message }, 500);
   }
 });
 api.post("/stop-server", (c) => {
+  const blocked = confirmGuard(c);
+  if (blocked) return blocked;
   setTimeout(() => process.exit(0), 500);
   return c.json({ ok: true, message: "Kuma Studio server shutting down" });
 });
@@ -199,7 +378,7 @@ if (customDir) {
 }
 var app = new Hono2();
 app.route("/api", api_default);
-var htmlPath = join2(__dirname, "..", "public", "index.html");
+var htmlPath = join(__dirname, "..", "public", "index.html");
 var htmlCache = null;
 try {
   htmlCache = readFileSync(htmlPath, "utf-8");

package/packages/ide/studio/public/index.html

@@ -252,6 +252,8 @@ header .status .dot.off { background: var(--red); }
       <div class="tab active" data-tab="features"><i data-lucide="star" style="width:13px;height:13px;vertical-align:middle;margin-right:3px"></i> Features</div>
       <div class="tab" data-tab="gotchas"><i data-lucide="alert-triangle" style="width:13px;height:13px;vertical-align:middle;margin-right:3px"></i> Gotchas</div>
       <div class="tab" data-tab="health"><i data-lucide="heart-pulse" style="width:13px;height:13px;vertical-align:middle;margin-right:3px"></i> Health</div>
+      <div class="tab" data-tab="efficiency"><i data-lucide="zap" style="width:13px;height:13px;vertical-align:middle;margin-right:3px"></i> Efficiency</div>
+      <div class="tab" data-tab="staleness"><i data-lucide="activity" style="width:13px;height:13px;vertical-align:middle;margin-right:3px"></i> Staleness</div>
     </div>
     <div class="tab-content" id="tab-content"></div>
   </div>
@@ -273,7 +275,7 @@ async function resetKumaDb() {
   var confirmation = prompt("⚠️ TYPE 'DELETE' TO CONFIRM RESETTING KUMA DB\nThis will permanently wipe all knowledge:");
   if (confirmation !== "DELETE") { if (confirmation !== null) alert("Reset cancelled."); return; }
   try {
-    var res = await fetch(API + "/reset-db", { method: "POST" }).then(function(r){return r.json()});
+    var res = await fetch(API + "/reset-db?confirm=1", { method: "POST" }).then(function(r){return r.json()});
     if (res.ok) { alert("Kuma DB reset."); refetch(); }
   } catch (e) { alert("Reset failed: " + e.message); }
 }
@@ -281,7 +283,7 @@ async function resetKumaDb() {
 async function stopKumaStudio() {
   if (!confirm("Stop Kuma Studio?")) return;
   try {
-    await fetch(API + "/stop-server", { method: "POST" });
+    await fetch(API + "/stop-server?confirm=1", { method: "POST" });
     document.body.innerHTML = '<div style="display:flex;height:100vh;align-items:center;justify-content:center;color:#94a3b8;font-size:16px;">Server stopped. Close this tab.</div>';
   } catch (e) { alert("Stop failed: " + e.message); }
 }
@@ -336,6 +338,8 @@ async function init() {
   renderFeatures(data);
   renderGotchas(data);
   renderHealth(data);
+  renderEfficiency(data);
+  renderStaleness(data);
   setupSearch();
   lucide.createIcons();
 }
@@ -784,7 +788,7 @@ async function refetch() {
     if (status.ok) { dot.className = 'dot on'; txt.textContent = status.project || 'connected'; } else { dot.className = 'dot off'; txt.textContent = 'no kuma.db found'; }
     var data = await fetch(API+'/dashboard').then(function(r){return r.json()});
     if (data.error) { showError(data.error); return; }
-    renderStats(data); renderGraph(data); renderFeatures(data); renderGotchas(data); renderHealth(data);
+    renderStats(data); renderGraph(data); renderFeatures(data); renderGotchas(data); renderHealth(data); renderEfficiency(data); renderStaleness(data);
     lucide.createIcons();
   } catch(e) { showError('Refetch failed: ' + e.message); }
   btn.innerHTML = '<i data-lucide="refresh-cw" style="width:13px;height:13px;vertical-align:middle;margin-right:3px"></i> Refetch';
@@ -802,7 +806,9 @@ function setupTabs(){
   content.innerHTML =
     '<div class="panel active" id="panel-features"><div class="empty">Loading...</div></div>' +
     '<div class="panel" id="panel-gotchas"><div class="empty">Loading...</div></div>' +
-    '<div class="panel" id="panel-health"><div class="empty">Loading...</div></div>';
+    '<div class="panel" id="panel-health"><div class="empty">Loading...</div></div>' +
+    '<div class="panel" id="panel-efficiency"><div class="empty">Loading...</div></div>' +
+    '<div class="panel" id="panel-staleness"><div class="empty">Loading...</div></div>';
   document.querySelectorAll('.tab').forEach(function(tab){
     tab.onclick = function(){
       document.querySelectorAll('.tab').forEach(function(t){t.classList.remove('active')});
@@ -867,6 +873,137 @@ function renderHealth(data){
   }).join('');
 }
 
+// ============ EFFICIENCY PANEL (GAP 1) ============
+// Proves the philosophy: "the more you use Kuma, the more efficient it gets."
+// Every saved decision / record is an asset — here is the evidence.
+
+function fmtDuration(sec) {
+  if (!sec || sec <= 0) return "0s";
+  if (sec >= 3600) return (sec/3600).toFixed(1)+"h";
+  if (sec >= 60) return Math.round(sec/60)+"m "+(sec%60)+"s";
+  return sec+"s";
+}
+
+function renderEfficiency(data){
+  var el = document.getElementById("panel-efficiency");
+  if(!el) return;
+  var eff = data.efficiency || {};
+  var m = eff.metrics || {};
+  var r = eff.recordings || {};
+  var savedSec = m.researchTimeSaved ? Math.round(m.researchTimeSaved/1000) : 0;
+  var passRate = eff.verificationPassRate;
+  var passColor = passRate == null ? 'var(--muted)' : passRate >= 80 ? 'var(--green)' : passRate >= 50 ? 'var(--yellow)' : 'var(--red)';
+
+  var stat = function(num, lbl, color){
+    return '<div style="flex:1;min-width:110px;padding:10px 12px;background:var(--bg);border-radius:8px;border:1px solid var(--border)"><div style="font-size:20px;font-weight:700;color:'+(color||'var(--accent2)')+'">'+num+'</div><div style="font-size:11px;color:var(--muted);margin-top:2px">'+lbl+'</div></div>';
+  };
+
+  var html = '';
+  html += '<div style="display:flex;flex-wrap:wrap;gap:8px;margin-bottom:12px">' +
+    stat(eff.sessions||0, 'sessions') +
+    stat(eff.toolCalls||0, 'tool calls') +
+    stat(eff.totalEdits||0, 'file edits') +
+    stat(eff.researchCacheScopes||0, 'research cached', 'var(--green)') +
+    stat(eff.decisions||0, 'decisions', 'var(--accent)') +
+    stat(eff.verifications||0, 'verifications', passRate==null?'var(--muted)':'var(--green)') +
+    '</div>';
+
+  // The headline: time saved from cache — the compounding asset
+  html += '<div class="health-item" style="border-left:3px solid var(--green);margin-bottom:12px">' +
+    '<div style="font-size:13px;color:var(--muted)">⏱ Estimated time saved from research cache</div>' +
+    '<div class="score good" style="font-size:28px">'+fmtDuration(savedSec)+'</div>' +
+    '<div class="meta">'+ (m.filesRead||0) +' files read &middot; '+ (m.filesEdited||0) +' files edited (current session)</div>' +
+    '</div>';
+
+  // Recording assets — what we've banked
+  var recTotal = r.total||0;
+  html += '<div style="font-size:11px;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:0.5px;margin:10px 0 6px">📦 Recorded Assets</div>';
+  html += '<div class="health-item" style="margin-bottom:12px">';
+  html += '<div style="display:flex;flex-wrap:wrap;gap:6px">';
+  html += '<span class="sev-tag" style="background:rgba(124,58,237,0.15);color:var(--accent)">arch_flow: '+(r.archFlows||0)+'</span>';
+  html += '<span class="sev-tag" style="background:#f9731620;color:var(--orange)">gotcha: '+(r.gotchas||0)+'</span>';
+  html += '<span class="sev-tag" style="background:#eab30820;color:var(--yellow)">decision: '+(r.decisions||0)+'</span>';
+  html += '<span class="sev-tag" style="background:#06b6d420;color:var(--accent2)">research_save: '+(r.researchSaves||0)+'</span>';
+  html += '</div>';
+  html += '<div class="meta" style="margin-top:6px">Total assets banked: <b style="color:var(--accent2)">'+recTotal+'</b> — each one saves re-research next session</div>';
+  html += '</div>';
+
+  // Verification pass rate
+  html += '<div style="font-size:11px;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:0.5px;margin:10px 0 6px">🧪 Verification</div>';
+  html += '<div class="health-item" style="margin-bottom:12px">' +
+    '<div class="score" style="color:'+passColor+'">'+(passRate==null?'—':passRate+'%')+'</div>' +
+    '<div class="meta">'+(eff.verifications||0)+' runs &middot; pass rate</div>' +
+    '</div>';
+
+  // Recent sessions breakdown
+  var sess = eff.recentSessions || [];
+  if (sess.length) {
+    html += '<div style="font-size:11px;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:0.5px;margin:10px 0 6px">🕐 Recent Sessions</div>';
+    html += sess.map(function(s){
+      var d = s.startedAt ? new Date(s.startedAt*1000) : null;
+      var dateStr = d ? d.toLocaleDateString()+' '+d.toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'}) : '-';
+      return '<div class="health-item">' +
+        '<div style="font-size:12px;color:var(--text)">'+escapeHtml(s.goal || 'untitled goal')+'</div>' +
+        '<div class="meta">'+dateStr+' &middot; '+s.toolCalls+' calls &middot; '+s.edits+' edits'+(s.failures?' &middot; <span style="color:var(--red)">'+s.failures+' failures</span>':'')+'</div>' +
+        '</div>';
+    }).join('');
+  }
+
+  el.innerHTML = html;
+  lucide.createIcons();
+}
+
+// ============ STALENESS PANEL (GAP 4) ============
+// Assets can become liabilities when stale. Surface them before they bite.
+
+function renderStaleness(data){
+  var el = document.getElementById("panel-staleness");
+  if(!el) return;
+  var st = data.staleness || { checked: 0, staleNodes: 0, missing: [] };
+  var html = '';
+
+  if (!st.staleNodes) {
+    html += '<div class="health-item" style="border-left:3px solid var(--green)">' +
+      '<div class="score good" style="font-size:22px">✅ All fresh</div>' +
+      '<div class="meta">'+st.checked+' file references checked — no stale assets found.</div>' +
+      '</div>';
+  } else {
+    html += '<div class="health-item" style="border-left:3px solid var(--red)">' +
+      '<div class="score bad" style="font-size:22px">'+st.staleNodes+' stale node(s)</div>' +
+      '<div class="meta">'+st.missing.length+' file(s) referenced but missing on disk ('+st.checked+' checked).</div>' +
+      '</div>';
+    html += '<div style="display:flex;gap:6px;margin:10px 0">' +
+      '<button onclick="copyHealCommand(this)" style="background:rgba(124,58,237,0.15);border:1px solid rgba(124,58,237,0.3);border-radius:6px;color:var(--accent);padding:6px 12px;font-size:11px;cursor:pointer">🛠 Copy heal command</button>' +
+      '</div>';
+    html += st.missing.map(function(m){
+      return '<div class="gotcha-item" style="border-color:var(--red)">' +
+        '<div class="file">'+escapeHtml(m.filePath)+'</div>' +
+        '<div class="desc">Referenced by <b style="color:var(--red)">'+m.nodeCount+'</b> node(s) but the file no longer exists.</div>' +
+        '</div>';
+    }).join('');
+  }
+
+  el.innerHTML = html;
+  lucide.createIcons();
+}
+
+function copyHealCommand(btn) {
+  var cmd = "kuma_memory({ action: 'heal' })";
+  if (navigator.clipboard && navigator.clipboard.writeText) {
+    navigator.clipboard.writeText(cmd).then(function() {
+      if (btn) { btn.textContent = "✅ Copied!"; setTimeout(function(){ btn.textContent = "🛠 Copy heal command"; }, 1500); }
+    }).catch(function() {
+      if (btn) { btn.textContent = "⚠️ Copy failed"; setTimeout(function(){ btn.textContent = "🛠 Copy heal command"; }, 1500); }
+    });
+  } else {
+    // Fallback for non-secure contexts
+    var ta = document.createElement("textarea");
+    ta.value = cmd; document.body.appendChild(ta); ta.select();
+    try { document.execCommand("copy"); if (btn) { btn.textContent = "✅ Copied!"; setTimeout(function(){ btn.textContent = "🛠 Copy heal command"; }, 1500); } } catch(e) {}
+    document.body.removeChild(ta);
+  }
+}
+
 function setupSearch() {
   var searchTimeout = null;
   document.getElementById("node-search").oninput = function() {