@plumpslabs/kuma 2.3.31 → 2.3.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumpslabs/kuma",
-  "version": "2.3.31",
+  "version": "2.3.33",
   "description": "Safety-first context & orchestration engine for AI coding agents. MCP server with mandatory research pipeline, knowledge graph, impact analysis, decision memory, and safety guard — works with any MCP client.",
   "type": "module",
   "main": "dist/index.js",

package/packages/ide/studio/dist/index.js

@@ -3,135 +3,328 @@
 // src/index.ts
 import { serve } from "@hono/node-server";
 import { readFileSync } from "fs";
-import { join as join2, dirname } from "path";
+import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { spawn } from "child_process";
 
 // src/api.ts
 import { Hono } from "hono";
-import { cors } from "hono/cors";
 
 // src/db.ts
-import { execSync } from "child_process";
-import { existsSync } from "fs";
-import { join, resolve } from "path";
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var sqlJs = null;
+async function getSqlJs() {
+  if (!sqlJs) {
+    const initSqlJs = await require2("sql.js");
+    sqlJs = await initSqlJs();
+  }
+  return sqlJs;
+}
 function findKumaDb(startDir) {
-  let current = startDir ? resolve(startDir) : process.cwd();
+  let current = startDir ? path.resolve(startDir) : process.cwd();
   for (let i = 0; i < 20; i++) {
-    const candidate = join(current, ".kuma", "kuma.db");
-    if (existsSync(candidate)) return candidate;
-    const parent = resolve(current, "..");
+    const candidate = path.join(current, ".kuma", "kuma.db");
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.resolve(current, "..");
     if (parent === current) break;
     current = parent;
   }
   return null;
 }
-function query(sql) {
+function projectRootFromDb(dbPath) {
+  return path.dirname(path.dirname(dbPath));
+}
+async function openDb() {
+  const SQL = await getSqlJs();
   const dbPath = findKumaDb();
   if (!dbPath) throw new Error("No .kuma/kuma.db found");
-  return execSync(`sqlite3 "${dbPath}" "${sql}"`, {
-    encoding: "utf-8",
-    maxBuffer: 2 * 1024 * 1024,
-    timeout: 1e4
-  }).trim();
+  const buffer = fs.readFileSync(dbPath);
+  return new SQL.Database(buffer);
 }
-function queryJson(sql) {
-  const raw = query(sql);
-  if (!raw) return [];
+function readSessionMetrics(dbPath) {
+  const empty = {
+    metrics: { filesRead: 0, filesEdited: 0, researchTimeSaved: 0 },
+    recordings: { archFlows: 0, gotchas: 0, decisions: 0, researchSaves: 0, total: 0 }
+  };
   try {
-    return JSON.parse(raw);
+    const root = projectRootFromDb(dbPath);
+    const memPath = path.join(root, ".kuma", "memory.json");
+    if (!fs.existsSync(memPath)) return empty;
+    const parsed = JSON.parse(fs.readFileSync(memPath, "utf-8"));
+    return {
+      metrics: {
+        filesRead: parsed?.metrics?.filesRead ?? 0,
+        filesEdited: parsed?.metrics?.filesEdited ?? 0,
+        researchTimeSaved: parsed?.metrics?.researchTimeSaved ?? 0
+      },
+      recordings: {
+        archFlows: parsed?.recordings?.archFlows ?? 0,
+        gotchas: parsed?.recordings?.gotchas ?? 0,
+        decisions: parsed?.recordings?.decisions ?? 0,
+        researchSaves: parsed?.recordings?.researchSaves ?? 0,
+        total: parsed?.recordings?.total ?? 0
+      }
+    };
   } catch {
-    try {
-      const sanitized = raw.replace(/[\r\n]+/g, " ");
-      return JSON.parse(sanitized);
-    } catch (e) {
-      console.warn("[Studio DB] queryJson parse failed:", e);
-      return [];
+    return empty;
+  }
+}
+function detectStaleNodes(db, dbPath) {
+  try {
+    const root = projectRootFromDb(dbPath);
+    const stmt = db.prepare(
+      `SELECT id, file_path, metadata, COUNT(*) as cnt FROM nodes
+       WHERE file_path IS NOT NULL AND file_path != '' AND file_path NOT LIKE '%::%'
+       GROUP BY file_path ORDER BY cnt DESC LIMIT 500`
+    );
+    const missing = [];
+    let checked = 0;
+    let staleNodes = 0;
+    while (stmt.step()) {
+      const row = stmt.getAsObject();
+      const fp = row.file_path;
+      const metadata = row.metadata || "{}";
+      checked++;
+      const fullPath = path.join(root, fp);
+      if (!fs.existsSync(fullPath)) {
+        const count = Number(row.cnt ?? 1);
+        missing.push({ filePath: fp, nodeCount: count, reason: "file_missing" });
+        staleNodes += count;
+      } else {
+        try {
+          const parsed = JSON.parse(metadata);
+          const storedHash = parsed.contentHash;
+          if (storedHash) {
+            const content = fs.readFileSync(fullPath, "utf-8");
+            const currentHash = crypto.createHash("md5").update(content).digest("hex");
+            if (currentHash !== storedHash) {
+              const count = Number(row.cnt ?? 1);
+              missing.push({ filePath: fp, nodeCount: count, reason: "content_changed" });
+              staleNodes += count;
+            }
+          }
+        } catch {
+        }
+      }
     }
+    stmt.free();
+    return { checked, staleNodes, missing };
+  } catch {
+    return { checked: 0, staleNodes: 0, missing: [] };
   }
 }
-function getDashboardData() {
-  return {
-    stats: queryJson(`
-      SELECT json_object(
-        'node_count', (SELECT COUNT(*) FROM nodes),
-        'edge_count', (SELECT COUNT(*) FROM edges),
-        'gotcha_count', (SELECT COUNT(*) FROM known_gotchas),
-        'feature_count', (SELECT COUNT(*) FROM nodes WHERE type = 'feature'),
-        'health_score', COALESCE((SELECT score FROM health_snapshots ORDER BY created_at DESC LIMIT 1), 0)
+async function getDashboardData() {
+  const db = await openDb();
+  const dbPath = findKumaDb();
+  try {
+    const run = (sql) => {
+      try {
+        const stmt = db.prepare(sql);
+        const rows = [];
+        while (stmt.step()) rows.push(stmt.getAsObject());
+        stmt.free();
+        return rows;
+      } catch {
+        return [];
+      }
+    };
+    const first = (sql, key) => {
+      const rows = run(sql);
+      if (!rows.length) return 0;
+      const v = rows[0][key];
+      return Number(v ?? 0) || 0;
+    };
+    const jsonRows = (sql) => {
+      const rows = run(sql);
+      if (!rows.length) return [];
+      const key = Object.keys(rows[0])[0];
+      const raw = rows[0][key];
+      if (raw === null || raw === void 0) return [];
+      try {
+        const parsed = JSON.parse(String(raw));
+        return Array.isArray(parsed) ? parsed : [parsed];
+      } catch {
+        return [];
+      }
+    };
+    const stats = {
+      node_count: first(`SELECT COUNT(*) as c FROM nodes`, "c"),
+      edge_count: first(`SELECT COUNT(*) as c FROM edges`, "c"),
+      gotcha_count: first(`SELECT COUNT(*) as c FROM known_gotchas`, "c"),
+      feature_count: first(`SELECT COUNT(*) as c FROM nodes WHERE type = 'feature'`, "c"),
+      health_score: first(
+        `SELECT COALESCE((SELECT score FROM health_snapshots ORDER BY created_at DESC LIMIT 1), 0) as c`,
+        "c"
       )
-    `),
-    nodes: queryJson(
-      `SELECT json_group_array(json_object('id',id,'name',name,'type',type,'file_path',file_path,'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'metadata',COALESCE(metadata,'{}'))) FROM nodes ORDER BY updated_at DESC`
-    ),
-    edges: queryJson(
+    };
+    const nodes = jsonRows(
+      `SELECT json_group_array(json_object('id',id,'name',name,'type',type,'file_path',file_path,'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'metadata',COALESCE(metadata,'{}'))) FROM (SELECT * FROM nodes ORDER BY updated_at DESC)`
+    );
+    const edges = jsonRows(
       `SELECT json_group_array(json_object('source',source_id,'target',target_id,'relation',type,'weight',weight)) FROM edges`
-    ),
-    gotchas: queryJson(
-      `SELECT json_group_array(json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at)) FROM known_gotchas ORDER BY severity DESC`
-    ),
-    features: queryJson(
-      `SELECT json_group_array(json_object('id',id,'name',name,'metadata',COALESCE(metadata,'{}'))) FROM nodes WHERE type = 'feature' ORDER BY name`
-    ),
-    health: queryJson(
-      `SELECT json_group_array(json_object('score',score,'summary',REPLACE(REPLACE(COALESCE(summary,''),char(10),' '),char(13),''),'risk_level',risk_level,'created_at',created_at)) FROM health_snapshots ORDER BY created_at DESC LIMIT 10`
-    )
-  };
+    );
+    const gotchas = jsonRows(
+      `SELECT json_group_array(json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at)) FROM (SELECT * FROM known_gotchas ORDER BY created_at DESC)`
+    );
+    const features = jsonRows(
+      `SELECT json_group_array(json_object('id',id,'name',name,'metadata',COALESCE(metadata,'{}'))) FROM (SELECT * FROM nodes WHERE type = 'feature' ORDER BY updated_at DESC)`
+    );
+    const health = jsonRows(
+      `SELECT json_group_array(json_object('score',score,'summary',REPLACE(REPLACE(COALESCE(summary,''),char(10),' '),char(13),''),'risk_level',risk_level,'created_at',created_at)) FROM (SELECT * FROM health_snapshots ORDER BY created_at DESC LIMIT 10)`
+    );
+    const sessionMetrics = readSessionMetrics(dbPath);
+    const verifTotal = first(`SELECT COUNT(*) as c FROM verifications`, "c");
+    const verifPassed = first(`SELECT COUNT(*) as c FROM verifications WHERE passed = 1`, "c");
+    const recentSessions = run(
+      `SELECT started_at, COALESCE(goal,'') as goal, tool_calls, edits, rollbacks, failures, safety_score
+       FROM (SELECT * FROM sessions ORDER BY started_at DESC LIMIT 8)`
+    ).map((r) => ({
+      startedAt: Number(r.started_at ?? 0),
+      goal: r.goal || "",
+      toolCalls: Number(r.tool_calls ?? 0),
+      edits: Number(r.edits ?? 0),
+      rollbacks: Number(r.rollbacks ?? 0),
+      failures: Number(r.failures ?? 0),
+      safetyScore: r.safety_score == null ? null : Number(r.safety_score)
+    }));
+    const efficiency = {
+      sessions: first(`SELECT COUNT(*) as c FROM sessions`, "c"),
+      toolCalls: first(`SELECT COUNT(*) as c FROM tool_calls`, "c"),
+      gotchas: first(`SELECT COUNT(*) as c FROM known_gotchas`, "c"),
+      archFlows: sessionMetrics.recordings.archFlows,
+      decisions: first(`SELECT COUNT(*) as c FROM (SELECT id FROM decision_log UNION SELECT id FROM nodes WHERE type = 'decision')`, "c"),
+      researchCacheScopes: first(`SELECT COUNT(*) as c FROM research_cache`, "c"),
+      verifications: verifTotal,
+      verificationPassRate: verifTotal > 0 ? Math.round(verifPassed / verifTotal * 100) : null,
+      metrics: sessionMetrics.metrics,
+      recordings: sessionMetrics.recordings,
+      recentSessions
+    };
+    const staleness = detectStaleNodes(db, dbPath);
+    return { stats, nodes, edges, gotchas, features, health, efficiency, staleness };
+  } finally {
+    db.close();
+  }
 }
-function getNodeDetail(nodeId) {
-  const escaped = nodeId.replace(/'/g, "''");
-  const parts = nodeId.split("::");
-  const shortName = parts.pop()?.replace(/'/g, "''") || "";
-  const filePath = parts[0] === "gotcha" && parts.length >= 2 ? parts[1]?.replace(/'/g, "''") : "";
-  const scope = parts[0] === "research" && parts.length >= 2 ? parts.slice(1).join("::").replace(/'/g, "''") : "";
-  const node = queryJson(
-    `SELECT json_object('id',id,'name',name,'type',type,'file_path',COALESCE(file_path,''),'metadata',COALESCE(metadata,'{}'),'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'last_verified_at',last_verified_at,'created_at',created_at,'updated_at',updated_at) FROM nodes WHERE id = '${escaped}'`
-  );
-  const nodeObj = Array.isArray(node) ? node[0] : node;
-  if (!nodeObj) return null;
-  const rawOut = query(
-    `SELECT json_object('target',e.target_id,'relation',e.type,'weight',e.weight,'target_name',n.name,'target_type',n.type) FROM edges e LEFT JOIN nodes n ON n.id = e.target_id WHERE e.source_id = '${escaped}'`
-  );
-  const outgoing = rawOut ? rawOut.split("\n").filter(Boolean).map((r) => {
-    try {
-      return JSON.parse(r);
-    } catch {
-      return null;
-    }
-  }).filter(Boolean) : [];
-  const rawIn = query(
-    `SELECT json_object('source',e.source_id,'relation',e.type,'weight',e.weight,'source_name',n.name,'source_type',n.type) FROM edges e LEFT JOIN nodes n ON n.id = e.source_id WHERE e.target_id = '${escaped}'`
-  );
-  const incoming = rawIn ? rawIn.split("\n").filter(Boolean).map((r) => {
-    try {
-      return JSON.parse(r);
-    } catch {
-      return null;
-    }
-  }).filter(Boolean) : [];
-  const gotchaFilter = filePath ? `file_path = '${filePath}'` : `file_path = '${escaped}' OR file_path LIKE '%${shortName}%'`;
-  const rawGotcha = query(
-    `SELECT json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at) FROM known_gotchas WHERE ${gotchaFilter}`
-  );
-  const gotchas = rawGotcha ? rawGotcha.split("\n").filter(Boolean).map((r) => {
+async function getNodeDetail(nodeId) {
+  const db = await openDb();
+  try {
+    const run = (sql) => {
+      try {
+        const stmt = db.prepare(sql);
+        const rows = [];
+        while (stmt.step()) rows.push(stmt.getAsObject());
+        stmt.free();
+        return rows;
+      } catch {
+        return [];
+      }
+    };
+    const escaped = nodeId.replace(/'/g, "''");
+    const parts = nodeId.split("::");
+    const shortName = parts.pop()?.replace(/'/g, "''") || "";
+    const filePath = parts[0] === "gotcha" && parts.length >= 2 ? parts[1]?.replace(/'/g, "''") : "";
+    const scope = parts[0] === "research" && parts.length >= 2 ? parts.slice(1).join("::").replace(/'/g, "''") : "";
+    const nodeRows = run(
+      `SELECT json_object('id',id,'name',name,'type',type,'file_path',COALESCE(file_path,''),'metadata',COALESCE(metadata,'{}'),'severity',COALESCE(severity,'medium'),'confidence',COALESCE(confidence,0.8),'last_verified_at',last_verified_at,'created_at',created_at,'updated_at',updated_at) FROM nodes WHERE id = '${escaped}'`
+    );
+    if (!nodeRows.length) return null;
+    const rawNode = nodeRows[0][Object.keys(nodeRows[0])[0]];
+    let node = null;
     try {
-      return JSON.parse(r);
+      node = typeof rawNode === "string" ? JSON.parse(rawNode) : rawNode;
     } catch {
       return null;
     }
-  }).filter(Boolean) : [];
-  return { node: nodeObj, outgoing, incoming, gotchas };
+    if (!node) return null;
+    const parseRelation = (rows, label) => rows.map((r) => {
+      const out = {
+        relation: r.relation,
+        weight: r.weight
+      };
+      if (label === "out") {
+        out.target = r.target;
+        out.target_name = r.target_name;
+        out.target_type = r.target_type;
+      } else {
+        out.source = r.source;
+        out.source_name = r.source_name;
+        out.source_type = r.source_type;
+      }
+      return out;
+    }).filter(Boolean);
+    const outgoing = parseRelation(
+      run(
+        `SELECT e.target_id as target, e.type as relation, e.weight, n.name as target_name, n.type as target_type
+         FROM edges e LEFT JOIN nodes n ON n.id = e.target_id
+         WHERE e.source_id = '${escaped}'`
+      ),
+      "out"
+    );
+    const incoming = parseRelation(
+      run(
+        `SELECT e.source_id as source, e.type as relation, e.weight, n.name as source_name, n.type as source_type
+         FROM edges e LEFT JOIN nodes n ON n.id = e.source_id
+         WHERE e.target_id = '${escaped}'`
+      ),
+      "in"
+    );
+    const gotchaFilter = filePath ? `file_path = '${filePath}'` : `file_path = '${escaped}' OR file_path LIKE '%${shortName}%'`;
+    const gotchaRows = run(
+      `SELECT json_object('id',id,'file_path',file_path,'description',REPLACE(REPLACE(description,char(10),' '),char(13),''),'severity',severity,'workaround',REPLACE(REPLACE(COALESCE(workaround,''),char(10),' '),char(13),''),'added_by',COALESCE(added_by,'agent'),'created_at',created_at) FROM known_gotchas WHERE ${gotchaFilter}`
+    );
+    const gotchas = gotchaRows.map((r) => {
+      const raw = r[Object.keys(r)[0]];
+      if (raw === null || raw === void 0) return null;
+      try {
+        return JSON.parse(String(raw));
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+    return { node, outgoing, incoming, gotchas };
+  } finally {
+    db.close();
+  }
 }
 
 // src/api.ts
-import fs from "fs";
+import fs2 from "fs";
 var api = new Hono();
-api.use("/*", cors());
+var LOCALHOST_ORIGINS = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i;
+function isLocalhostOrigin(origin) {
+  if (!origin) return false;
+  return LOCALHOST_ORIGINS.test(origin);
+}
+api.use("/*", async (c, next) => {
+  const origin = c.req.header("origin");
+  if (origin && !isLocalhostOrigin(origin)) {
+    return c.json({ error: "Forbidden: cross-origin requests are not allowed." }, 403);
+  }
+  if (origin) {
+    c.header("Access-Control-Allow-Origin", origin);
+    c.header("Vary", "Origin");
+    c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    c.header("Access-Control-Allow-Headers", "Content-Type");
+  }
+  await next();
+});
+function confirmGuard(c) {
+  const confirm = c.req.query("confirm");
+  if (confirm !== "1") {
+    return c.json({ ok: false, error: "Confirmation required: pass ?confirm=1" }, 400);
+  }
+  return null;
+}
 api.get("/status", (c) => {
   const dbPath = findKumaDb();
   let dbSize = "0 KB";
-  if (dbPath && fs.existsSync(dbPath)) {
-    const bytes = fs.statSync(dbPath).size;
+  if (dbPath && fs2.existsSync(dbPath)) {
+    const bytes = fs2.statSync(dbPath).size;
     dbSize = bytes > 1024 * 1024 ? (bytes / (1024 * 1024)).toFixed(2) + " MB" : (bytes / 1024).toFixed(1) + " KB";
   }
   return c.json({
@@ -141,18 +334,18 @@ api.get("/status", (c) => {
     project: dbPath ? dbPath.replace("/.kuma/kuma.db", "").split("/").pop() : null
   });
 });
-api.get("/dashboard", (c) => {
+api.get("/dashboard", async (c) => {
   try {
-    const data = getDashboardData();
+    const data = await getDashboardData();
     return c.json(data);
   } catch (e) {
     return c.json({ error: e.message }, 500);
   }
 });
-api.get("/node/:id", (c) => {
+api.get("/node/:id", async (c) => {
   try {
     const nodeId = c.req.param("id");
-    const detail = getNodeDetail(nodeId);
+    const detail = await getNodeDetail(nodeId);
     if (!detail) return c.json({ error: "Node not found" }, 404);
     return c.json(detail);
   } catch (e) {
@@ -160,17 +353,21 @@ api.get("/node/:id", (c) => {
   }
 });
 api.post("/reset-db", (c) => {
+  const blocked = confirmGuard(c);
+  if (blocked) return blocked;
   try {
     const dbPath = findKumaDb();
-    if (dbPath && fs.existsSync(dbPath)) {
-      fs.unlinkSync(dbPath);
+    if (dbPath && fs2.existsSync(dbPath)) {
+      fs2.unlinkSync(dbPath);
     }
     return c.json({ ok: true, message: "Kuma DB reset successfully" });
   } catch (e) {
-    return c.json({ error: e.message }, 500);
+    return c.json({ ok: false, error: e.message }, 500);
   }
 });
 api.post("/stop-server", (c) => {
+  const blocked = confirmGuard(c);
+  if (blocked) return blocked;
   setTimeout(() => process.exit(0), 500);
   return c.json({ ok: true, message: "Kuma Studio server shutting down" });
 });
@@ -199,7 +396,7 @@ if (customDir) {
 }
 var app = new Hono2();
 app.route("/api", api_default);
-var htmlPath = join2(__dirname, "..", "public", "index.html");
+var htmlPath = join(__dirname, "..", "public", "index.html");
 var htmlCache = null;
 try {
   htmlCache = readFileSync(htmlPath, "utf-8");