@plumpslabs/kuma 2.3.6 → 2.3.8

package/README.md

@@ -108,7 +108,7 @@ Kuma consolidates everything into **3 coarse-grained tools**. Each action trigge
 
 ### 🧠 `kuma_context` — Context & Research
 
-| Action | Pipelina | Use case |
+| Action | Pipeline | Use case |
 |--------|----------|----------|
 | `init` | Project brief | **Call first every session.** Load graph, detect stack, show structure. |
 | `research` | 5-step pipeline | **WAJIB before editing.** Cache → staleness → graph → impact → decisions. |
@@ -116,6 +116,12 @@ Kuma consolidates everything into **3 coarse-grained tools**. Each action trigge
 | `navigate` | BFS traversal | "How does login work?" — full call chain from route to database. |
 | `changes` | Change log query | "What changed this session?" — selective undo support. |
 | `health` | Aggregate scoring | Project health dashboard 0-100 across 9 dimensions. |
+| `rollback` | File restore | Rollback a specific change by ID from the change log. |
+| `researches` | Cache list | List all cached research scopes with confidence & age. |
+| `sync` | Unified batch | Combines init + health + memory state in single roundtrip (~60-70% token savings). |
+| `visualize` | Mermaid diagram | Generate interactive knowledge graph diagrams (flowchart, dependency, mindmap). |
+| `digest` | Ultra-compact brief | <500 token project briefing — fastest way to bootstrap context (Issue #18). |
+| `drift` | Staleness detection | Detect memory staleness & code drift between graph and actual filesystem (Issue #20). |
 
 ### 📝 `kuma_memory` — Decision & Knowledge
 
@@ -126,20 +132,36 @@ Kuma consolidates everything into **3 coarse-grained tools**. Each action trigge
 | `research_save` | Persist research to graph + `.kuma/research/<scope>.json`. |
 | `session` | "What happened this session?" — files, failures, progress. |
 | `heal` | Self-heal knowledge graph — stale detection, git repair. |
-| `search` | Search across memories + knowledge graph. |
+| `search` | Search across memories + knowledge graph (with TF-IDF hybrid semantic search). |
 | `changes` | Change log for selective undo. |
+| `todo` | Persistent todo CRUD — add, list, update status with scope & success criteria. |
+| `context` | Inject context notes from external sources (Slack, Jira, meetings). |
+| `benchmark` | Before/after metric capture & diff (e.g., type errors, test count). |
+| `decision_log` | Living decision document with status tracking (active/superseded/deprecated). |
+| `domain_rules` | Layer 1 — Business/domain rules knowledge (Issue #17). |
+| `arch_flow` | Layer 2 — Architecture flow mapping (Issue #17). |
+| `gotcha` | Layer 3 — Known gotchas & anti-regression shield (Issue #17/#21). |
+| `layers` | Show all 3 memory layers summary. |
 
 ### 🛡️ `kuma_safety` — Safety & Policy
 
 | Action | Use case |
 |--------|----------|
 | `guard` | Anti-pattern, drift, tool-loop, and failure checks. |
-| `verify` | **SAFETY-GUARDED** on-demand test verification — only runs via explicit tool call. Auto-detects runner (pnpm/npm/yarn/pytest/cargo/go), scopes to session changes, rate-limited (60s min interval), concurrency-locked (1 at a time), cached (< 5 min returns stale result), runaway-protected (> 3 calls in 5 min auto-blocks). ⚠️ NEVER auto-triggered — only via explicit `kuma_safety({ action: "verify" })`. |
+| `verify` | **SAFETY-GUARDED** on-demand test verification — only runs via explicit tool call. Auto-detects runner (pnpm/npm/yarn/pytest/cargo/go), scopes to session changes, rate-limited (30s handler + 60s verifier cooldown), concurrency-locked (intra-process + cross-process file lock), cached (< 5 min returns stale result), runaway-protected (> 3 calls in 5 min auto-blocks), hard timeout (30s + SIGKILL). ⚠️ NEVER auto-triggered — only via explicit `kuma_safety({ action: "verify" })`. |
 | `check` | Pre-execution safety: policy, path, lock, risk level. |
 | `audit` | Query audit trail + stats + override log. |
 | `lock` | Multi-agent file locking. |
 | `health` | Safety score 0-100 with dimension breakdown. |
 | `override` | Logged safety bypass with reason. |
+| `security` | Security leak scanner — regex-based credential/token detection. |
+| `gc` | Kuma garbage collection — orphan cleanup, VACUUM, index maintenance. |
+| `doctor` | Kuma health diagnostics — DB integrity, schema health, process status, verification history. |
+| `portability` | Check path portability — no absolute paths in stored data. |
+| `gitignore` | Auto-configure `.gitignore` to include `.kuma/`. |
+| `clean` | Purge scratch directory + reset drift warnings. |
+| `policy` | Policy-as-Code engine — evaluate commands against `.kuma/policy.yml` (Issue #24). |
+| `ast` / `validate` | AST-based code validation — validate JS/TS code structure & patterns (Issue #22). |
 
 ---
 

package/dist/{chunk-K64NSHBR.js → chunk-4OB3XMHT.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   saveDb
-} from "./chunk-GDNAWLHF.js";
+} from "./chunk-NAM7SCBT.js";
 import {
   getProjectRoot
 } from "./chunk-E2KFPEBT.js";
@@ -458,7 +458,7 @@ The two nodes may not be connected in the knowledge graph yet. Use more tools to
 }
 async function buildFromSessionMemory() {
   try {
-    const { sessionMemory } = await import("./sessionMemory-HBBXUSIP.js");
+    const { sessionMemory } = await import("./sessionMemory-CA34TCPF.js");
     const toolCalls = sessionMemory.getToolCallHistory(50);
     let edgeCount = 0;
     for (const call of toolCalls) {

package/dist/chunk-53J56QCQ.js

@@ -0,0 +1,282 @@
+import {
+  sessionMemory
+} from "./chunk-SLRRDKQ2.js";
+import {
+  getProjectRoot
+} from "./chunk-E2KFPEBT.js";
+
+// src/engine/domainRules.ts
+import fs from "fs";
+import path from "path";
+var LAYER_FILES = {
+  domain_rules: { filename: "DOMAIN_RULES.md", label: "Domain & Business Rules" },
+  arch_flow: { filename: "ARCHITECTURE_FLOW.md", label: "Architecture & Sequence Flow" },
+  gotcha: { filename: "KNOWN_GOTCHAS.md", label: "Known Code Gotchas" }
+};
+var DOMAIN_RULES_TEMPLATE = `# Domain & Business Rules (Layer 1)
+
+Auto-generated by Kuma 3-Layer Memory Engine.
+Update this file with core business logic, workflows, and boundary rules.
+
+## Who
+<!-- Who are the users/actors? -->
+
+## What
+<!-- What are the core features and business capabilities? -->
+
+## When
+<!-- What are the time-based rules, schedules, deadlines? -->
+
+## Where
+<!-- Where does the business operate (environments, regions)? -->
+
+## Why
+<!-- Why were key architectural decisions made? -->
+
+## How
+<!-- How do core workflows execute? -->
+
+## Business Rules
+<!-- Critical business logic constraints -->
+- Rule 1:
+- Rule 2:
+
+## Workflows
+<!-- Ordered sequence of operations -->
+1.
+2.
+
+## Boundary Conditions
+<!-- Edge cases, error states, validation rules -->
+-
+`;
+var ARCH_FLOW_TEMPLATE = `# Architecture & Sequence Flow Map (Layer 2)
+
+Auto-generated by Kuma 3-Layer Memory Engine.
+Document execution call chains and architectural dependencies.
+
+## System Overview
+<!-- High-level description of the system architecture -->
+
+## Entry Points
+<!-- Main entry points for the application -->
+- 
+
+## Execution Chains
+<!-- Route -> Middleware -> Controller -> Service -> DB -->
+\`\`\`
+Request Flow:
+  1. [Entry] -> [Middleware] -> [Handler] -> [Service] -> [DB]
+\`\`\`
+
+## Module Dependency Map
+<!-- How modules depend on each other -->
+- Module A depends on: Module B, Module C
+- Module B depends on: Module D
+
+## Data Flow
+<!-- How data flows through the system -->
+1. Input: 
+2. Process: 
+3. Storage: 
+4. Output: 
+
+## External Integrations
+<!-- External services, APIs, databases -->
+- 
+`;
+var GOTCHAS_TEMPLATE = `# Known Code Gotchas (Layer 3)
+
+Auto-generated by Kuma 3-Layer Memory Engine.
+Catalog of fragile legacy contracts, edge cases, and unexpected framework quirks.
+
+## How to Add a Gotcha
+
+\`\`\`
+kuma_memory({
+  action: 'gotcha',
+  scope: 'auth_middleware',
+  content: 'The auth middleware expects req.user after JWT decode. Missing middleware causes silent 500.',
+  filePath: 'src/middleware/auth.ts'
+})
+\`\`\`
+
+## Active Gotchas
+
+<!-- Format:
+### [File Path] \u2014 [Short Description]
+- **Issue**: [What happens]
+- **Fix**: [How to handle it correctly]
+- **Severity**: [low | medium | high | critical]
+- **Added**: [Date]
+-->
+
+`;
+function layerFilePath(layer) {
+  return path.join(getProjectRoot(), ".kuma", LAYER_FILES[layer].filename);
+}
+function ensureLayerFile(layer) {
+  const fp = layerFilePath(layer);
+  if (!fs.existsSync(fp)) {
+    const template = layer === "domain_rules" ? DOMAIN_RULES_TEMPLATE : layer === "arch_flow" ? ARCH_FLOW_TEMPLATE : GOTCHAS_TEMPLATE;
+    const dir = path.dirname(fp);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(fp, template, "utf-8");
+    console.error(`[DomainRules] Auto-created ${LAYER_FILES[layer].filename}`);
+  }
+  return fp;
+}
+function readLayer(layer) {
+  try {
+    const fp = ensureLayerFile(layer);
+    return fs.readFileSync(fp, "utf-8");
+  } catch (err) {
+    return `Error reading ${layer}: ${err}`;
+  }
+}
+function writeLayer(layer, content) {
+  try {
+    const fp = ensureLayerFile(layer);
+    fs.writeFileSync(fp, content, "utf-8");
+    const label = LAYER_FILES[layer].label;
+    sessionMemory.recordToolCall("kuma_memory", { action: `write_${layer}` });
+    return `\u2705 **${label}** updated successfully.`;
+  } catch (err) {
+    return `\u274C Failed to update ${layer}: ${err}`;
+  }
+}
+function appendToLayer(layer, entry) {
+  try {
+    const fp = ensureLayerFile(layer);
+    const existing = fs.readFileSync(fp, "utf-8");
+    const newContent = existing.trimEnd() + "\n\n" + entry.trim() + "\n";
+    fs.writeFileSync(fp, newContent, "utf-8");
+    return `\u2705 Entry added to **${LAYER_FILES[layer].label}**.`;
+  } catch (err) {
+    return `\u274C Failed to append: ${err}`;
+  }
+}
+function getLayersSummary() {
+  const lines = ["\u{1F4DA} **3-Layer Memory Engine**", "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501"];
+  for (const layer of ["domain_rules", "arch_flow", "gotcha"]) {
+    const fp = layerFilePath(layer);
+    const exists = fs.existsSync(fp);
+    const label = LAYER_FILES[layer].label;
+    if (exists) {
+      try {
+        const content = fs.readFileSync(fp, "utf-8");
+        const lineCount = content.split("\n").length;
+        const sizeKB = Math.round(Buffer.byteLength(content) / 1024);
+        lines.push(`  ${layer === "domain_rules" ? "\u{1F4CB}" : layer === "arch_flow" ? "\u{1F3D7}\uFE0F" : "\u26A0\uFE0F"} **${label}** \u2014 ${lineCount} lines, ${sizeKB}KB`);
+      } catch {
+        lines.push(`  \u2753 **${label}** \u2014 could not read`);
+      }
+    } else {
+      lines.push(`  \u{1F4C4} **${label}** \u2014 not yet created`);
+    }
+  }
+  return lines.join("\n");
+}
+function getActiveGotchas() {
+  const results = [];
+  try {
+    const fp = ensureLayerFile("gotcha");
+    const content = fs.readFileSync(fp, "utf-8");
+    const lines = content.split("\n");
+    let currentSection = "";
+    let currentFilePath = "";
+    let currentDesc = "";
+    let currentSeverity = "";
+    for (const line of lines) {
+      const fileMatch = line.match(/^###\s+(.+?)\s*[—–-]+\s*(.+)/);
+      if (fileMatch) {
+        if (currentFilePath) {
+          results.push({ filePath: currentFilePath, description: currentDesc, severity: currentSeverity, content: currentSection });
+        }
+        currentFilePath = fileMatch[1].trim();
+        currentDesc = fileMatch[2].trim();
+        currentSeverity = "medium";
+        currentSection = line + "\n";
+        continue;
+      }
+      const sevMatch = line.match(/- \*\*Severity\*\*:\s*(\w+)/);
+      if (sevMatch) currentSeverity = sevMatch[1].toLowerCase();
+      currentSection += line + "\n";
+    }
+    if (currentFilePath) {
+      results.push({ filePath: currentFilePath, description: currentDesc, severity: currentSeverity, content: currentSection });
+    }
+  } catch {
+  }
+  return results;
+}
+function checkFileGotchas(filePath) {
+  const gotchas = getActiveGotchas();
+  const warnings = [];
+  for (const g of gotchas) {
+    if (filePath.includes(g.filePath) || g.filePath.includes(filePath)) {
+      const icon = g.severity === "critical" ? "\u{1F534}" : g.severity === "high" ? "\u{1F7E0}" : g.severity === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
+      warnings.push(`${icon} **Gotcha**: ${g.description} (${g.severity})`);
+    }
+  }
+  return warnings;
+}
+function generateDigest() {
+  const lines = [
+    "\u{1F4CB} **Kuma Project Digest**",
+    "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501",
+    ""
+  ];
+  try {
+    const fp1 = ensureLayerFile("domain_rules");
+    const content = fs.readFileSync(fp1, "utf-8");
+    const rules = [];
+    const workflows = [];
+    for (const line of content.split("\n")) {
+      const r = line.match(/^- Rule \d+:?\s*(.+)/);
+      if (r) rules.push(r[1].substring(0, 60));
+      const w = line.match(/^\d+\.\s*(.+)/);
+      if (w) workflows.push(w[1].substring(0, 60));
+    }
+    if (rules.length > 0) lines.push(`\u{1F4CB} **Domain Rules** (${rules.length}): ${rules.slice(0, 3).join("; ")}`);
+    if (workflows.length > 0) lines.push(`\u{1F504} **Workflows**: ${workflows.slice(0, 3).join(" \u2192 ")}`);
+  } catch {
+    lines.push("\u{1F4CB} **Domain Rules**: not set");
+  }
+  try {
+    const fp2 = ensureLayerFile("arch_flow");
+    const content = fs.readFileSync(fp2, "utf-8");
+    const chains = [];
+    for (const line of content.split("\n")) {
+      if (line.includes("->") && line.includes("[")) chains.push(line.trim());
+    }
+    if (chains.length > 0) lines.push(`\u{1F3D7}\uFE0F **Architecture**: ${chains[0].substring(0, 80)}`);
+    else lines.push("\u{1F3D7}\uFE0F **Architecture**: see .kuma/ARCHITECTURE_FLOW.md");
+  } catch {
+    lines.push("\u{1F3D7}\uFE0F **Architecture**: not documented");
+  }
+  const gotchas = getActiveGotchas();
+  if (gotchas.length > 0) {
+    const highCount = gotchas.filter((g) => g.severity === "high" || g.severity === "critical").length;
+    lines.push(`\u26A0\uFE0F **Gotchas**: ${gotchas.length} active (${highCount} high/critical)`);
+    for (const g of gotchas.slice(0, 3)) {
+      lines.push(`  \u2022 ${g.filePath}: ${g.description.substring(0, 60)}`);
+    }
+  } else {
+    lines.push("\u26A0\uFE0F **Gotchas**: none recorded");
+  }
+  const summary = sessionMemory.getSummary();
+  lines.push(`\u{1F3AF} **Goal**: ${summary.currentGoal?.substring(0, 60) || "not set"}`);
+  lines.push(`\u{1F4DD} **Modified**: ${summary.modifiedFiles?.length || 0} files | \u{1F6E0}\uFE0F ${summary.toolCallCount} calls`);
+  return lines.join("\n");
+}
+
+export {
+  readLayer,
+  writeLayer,
+  appendToLayer,
+  getLayersSummary,
+  getActiveGotchas,
+  checkFileGotchas,
+  generateDigest
+};

package/dist/{chunk-FOQQ2CSL.js → chunk-FL2TLLMX.js}

@@ -1,6 +1,6 @@
 import {
   sessionMemory
-} from "./chunk-BI7KD3SG.js";
+} from "./chunk-SLRRDKQ2.js";
 import {
   getProjectRoot
 } from "./chunk-E2KFPEBT.js";

package/dist/{chunk-GDNAWLHF.js → chunk-NAM7SCBT.js}

@@ -283,6 +283,68 @@ function createSchema(db) {
     duration_ms INTEGER,
     created_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
   )`);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS blackboard_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      type TEXT NOT NULL,
+      source TEXT NOT NULL,
+      topic TEXT NOT NULL,
+      payload TEXT NOT NULL DEFAULT '{}',
+      severity TEXT NOT NULL DEFAULT 'info'
+        CHECK(severity IN ('info','warning','critical')),
+      tags TEXT DEFAULT '[]',
+      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+    );
+  `);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_bb_type ON blackboard_events(type)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_bb_topic ON blackboard_events(topic)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_bb_severity ON blackboard_events(severity)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_bb_created ON blackboard_events(created_at)`);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS known_gotchas (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      file_path TEXT NOT NULL,
+      description TEXT NOT NULL,
+      severity TEXT NOT NULL DEFAULT 'medium'
+        CHECK(severity IN ('low','medium','high','critical')),
+      workaround TEXT,
+      added_by TEXT DEFAULT 'agent',
+      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
+      updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+    );
+  `);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_gotchas_file ON known_gotchas(file_path)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_gotchas_severity ON known_gotchas(severity)`);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS trajectories (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      goal TEXT NOT NULL,
+      steps TEXT NOT NULL DEFAULT '[]',
+      total_duration_ms INTEGER DEFAULT 0,
+      success_rate REAL DEFAULT 0.0,
+      complexity INTEGER DEFAULT 0,
+      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+    );
+  `);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_traj_goal ON trajectories(goal)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_traj_complexity ON trajectories(complexity)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_traj_created ON trajectories(created_at)`);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS distilled_skills (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      name TEXT NOT NULL UNIQUE,
+      description TEXT NOT NULL,
+      pattern TEXT NOT NULL,
+      parameters TEXT DEFAULT '[]',
+      success_count INTEGER DEFAULT 1,
+      avg_duration_ms INTEGER DEFAULT 0,
+      source_trajectory_id INTEGER,
+      last_used_at INTEGER,
+      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+    );
+  `);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_skills_name ON distilled_skills(name)`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_skills_used ON distilled_skills(last_used_at)`);
   db.run(`CREATE TABLE IF NOT EXISTS portability_entries (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     entry_type TEXT NOT NULL,
@@ -787,7 +849,7 @@ async function runDoctor() {
     } catch {
       checks.push("**Database Integrity**: \u274C check failed");
     }
-    const allTables = ["nodes", "edges", "sessions", "research_cache", "change_log", "safety_audit", "todos", "security_findings", "context_notes", "benchmarks", "decision_log", "file_summaries", "verifications", "health_snapshots", "tool_calls", "experiences", "experience_patterns", "patterns", "api_endpoints", "otel_config", "cost_tracking", "scratch_entries", "portability_entries"];
+    const allTables = ["nodes", "edges", "sessions", "research_cache", "change_log", "safety_audit", "todos", "security_findings", "context_notes", "benchmarks", "decision_log", "file_summaries", "verifications", "health_snapshots", "tool_calls", "experiences", "experience_patterns", "patterns", "api_endpoints", "otel_config", "cost_tracking", "scratch_entries", "portability_entries", "blackboard_events", "known_gotchas", "trajectories", "distilled_skills"];
     let existing = 0;
     for (const t of allTables) {
       try {

package/dist/chunk-PTEPJK6M.js

@@ -0,0 +1,155 @@
+import {
+  getDb,
+  saveDb
+} from "./chunk-NAM7SCBT.js";
+
+// src/engine/safetyAudit.ts
+var SCHEMA_SQL = `
+  CREATE TABLE IF NOT EXISTS safety_audit (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    timestamp INTEGER NOT NULL,
+    tool_name TEXT NOT NULL,
+    action TEXT NOT NULL,
+    file_path TEXT,
+    risk_level TEXT NOT NULL DEFAULT 'low',
+    policy_violations INTEGER DEFAULT 0,
+    allowed INTEGER NOT NULL DEFAULT 1,
+    duration_ms INTEGER DEFAULT 0,
+    metadata TEXT DEFAULT '{}'
+  );
+  CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON safety_audit(timestamp);
+  CREATE INDEX IF NOT EXISTS idx_audit_tool ON safety_audit(tool_name);
+  CREATE INDEX IF NOT EXISTS idx_audit_risk ON safety_audit(risk_level);
+  CREATE INDEX IF NOT EXISTS idx_audit_allowed ON safety_audit(allowed);
+`;
+var schemaEnsured = false;
+async function ensureSchema() {
+  if (schemaEnsured) return;
+  try {
+    const db = await getDb();
+    db.exec(SCHEMA_SQL);
+    saveDb();
+    schemaEnsured = true;
+  } catch (err) {
+    console.error(`[SafetyAudit] Failed to ensure schema: ${err}`);
+  }
+}
+async function recordAudit(entry) {
+  try {
+    await ensureSchema();
+    const db = await getDb();
+    db.run(`
+      INSERT INTO safety_audit (timestamp, tool_name, action, file_path, risk_level, policy_violations, allowed, duration_ms, metadata)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      entry.timestamp,
+      entry.toolName,
+      entry.action,
+      entry.filePath || null,
+      entry.riskLevel,
+      entry.policyViolations,
+      entry.allowed ? 1 : 0,
+      entry.durationMs,
+      JSON.stringify(entry.metadata || {})
+    ]);
+    saveDb();
+  } catch (err) {
+    console.error(`[SafetyAudit] Failed to record audit: ${err}`);
+  }
+}
+async function queryAudit(params) {
+  try {
+    await ensureSchema();
+    const db = await getDb();
+    const { toolName, riskLevel, allowed, limit = 20, since } = params;
+    let sql = "SELECT * FROM safety_audit WHERE 1=1";
+    const bindParams = [];
+    if (toolName) {
+      sql += " AND tool_name = ?";
+      bindParams.push(toolName);
+    }
+    if (riskLevel) {
+      sql += " AND risk_level = ?";
+      bindParams.push(riskLevel);
+    }
+    if (allowed !== void 0) {
+      sql += " AND allowed = ?";
+      bindParams.push(allowed ? 1 : 0);
+    }
+    if (since) {
+      sql += " AND timestamp >= ?";
+      bindParams.push(since);
+    }
+    sql += " ORDER BY timestamp DESC LIMIT ?";
+    bindParams.push(limit);
+    const stmt = db.prepare(sql);
+    stmt.bind(bindParams);
+    const results = [];
+    while (stmt.step()) {
+      results.push(stmt.getAsObject());
+    }
+    stmt.free();
+    if (results.length === 0) {
+      return "\u{1F4CB} **Safety Audit** \u2014 No records found for the given filters.";
+    }
+    const lines = [
+      `\u{1F4CB} **Safety Audit** \u2014 ${results.length} record(s)`,
+      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+      ""
+    ];
+    for (const r of results) {
+      const riskIcon = r.risk_level === "critical" ? "\u{1F534}" : r.risk_level === "high" ? "\u{1F7E0}" : r.risk_level === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
+      const allowIcon = r.allowed ? "\u2705" : "\u26D4";
+      const time = new Date(r.timestamp * 1e3).toLocaleTimeString();
+      lines.push(`${allowIcon} ${riskIcon} **${r.tool_name}** \u2014 ${r.action}`);
+      if (r.file_path) lines.push(`   \u{1F4CD} ${r.file_path}`);
+      lines.push(`   \u{1F550} ${time} | ${r.duration_ms}ms | ${r.policy_violations} policy violation(s)`);
+      lines.push("");
+    }
+    return lines.join("\n");
+  } catch (err) {
+    return `Error querying audit: ${err}`;
+  }
+}
+async function auditStats() {
+  try {
+    await ensureSchema();
+    const db = await getDb();
+    const total = db.exec("SELECT COUNT(*) as c FROM safety_audit")[0]?.values[0][0] ?? 0;
+    const blocked = db.exec("SELECT COUNT(*) as c FROM safety_audit WHERE allowed = 0")[0]?.values[0][0] ?? 0;
+    const critical = db.exec("SELECT COUNT(*) as c FROM safety_audit WHERE risk_level IN ('high','critical')")[0]?.values[0][0] ?? 0;
+    let topBlocked = [];
+    try {
+      const stmt = db.prepare("SELECT tool_name, COUNT(*) as cnt FROM safety_audit WHERE allowed = 0 GROUP BY tool_name ORDER BY cnt DESC LIMIT 5");
+      while (stmt.step()) {
+        topBlocked.push(stmt.getAsObject());
+      }
+      stmt.free();
+    } catch {
+    }
+    const lines = [
+      `\u{1F4CA} **Safety Audit Stats**`,
+      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+      "",
+      `\u{1F4DD} Total operations: ${total}`,
+      `\u26D4 Blocked: ${blocked} (${total > 0 ? (blocked / total * 100).toFixed(1) : 0}%)`,
+      `\u{1F534} High/Critical risk: ${critical}`,
+      ""
+    ];
+    if (topBlocked.length > 0) {
+      lines.push("**Most blocked tools:**");
+      for (const t of topBlocked) {
+        lines.push(`  \u2022 ${t.tool_name}: ${t.cnt}x blocked`);
+      }
+    }
+    return lines.join("\n");
+  } catch (err) {
+    return `Error getting audit stats: ${err}`;
+  }
+}
+
+export {
+  recordAudit,
+  queryAudit,
+  auditStats
+};

package/dist/{chunk-X5TPBDKO.js → chunk-RTGLQDMI.js}

@@ -1,6 +1,6 @@
 import {
   sessionMemory
-} from "./chunk-BI7KD3SG.js";
+} from "./chunk-SLRRDKQ2.js";
 import {
   getProjectRoot
 } from "./chunk-E2KFPEBT.js";
@@ -82,7 +82,7 @@ function recordDecision(decision) {
 }
 async function recordDecisionToGraph(decision) {
   try {
-    const { upsertNode, addEdge } = await import("./kumaGraph-35TAIBWD.js");
+    const { upsertNode, addEdge } = await import("./kumaGraph-AWP743TJ.js");
     const decisionId = `decision::${decision.title.replace(/[^a-zA-Z0-9_\-\s]/g, "").trim().replace(/\s+/g, "-")}`;
     await upsertNode({
       id: decisionId,

package/dist/{chunk-BI7KD3SG.js → chunk-SLRRDKQ2.js}

@@ -320,7 +320,7 @@ No unresolved issues.`;
    */
   async autoTrackToDb(toolName, params, timestamp) {
     try {
-      const { getDb, saveDb } = await import("./kumaDb-DJUDLYBJ.js");
+      const { getDb, saveDb } = await import("./kumaDb-6D53ERFP.js");
       const db = await getDb();
       db.run(
         `INSERT INTO tool_calls (tool_name, params, success, duration_ms, created_at) VALUES (?, ?, 1, 0, ?)`,
@@ -605,7 +605,7 @@ No unresolved issues.`;
       this.addModifiedFile(filePath);
     }
     try {
-      const { recordChange } = await import("./kumaDb-DJUDLYBJ.js");
+      const { recordChange } = await import("./kumaDb-6D53ERFP.js");
       const gitHash = this.getGitHead();
       await recordChange({ filePath, changeType, symbol, gitCommitHash: gitHash || void 0 });
     } catch {