@plumpslabs/kuma 2.3.6 → 2.3.8

package/dist/kumaPolicyEngine-S2PXN3C7.js

@@ -0,0 +1,311 @@
+import {
+  sessionMemory
+} from "./chunk-SLRRDKQ2.js";
+import {
+  getProjectRoot
+} from "./chunk-E2KFPEBT.js";
+
+// src/engine/kumaPolicyEngine.ts
+import fs from "fs";
+import path from "path";
+var DEFAULT_POLICY_CONFIG = {
+  version: 1,
+  name: "Kuma Default Security Policy",
+  description: "Default safety policy for AI coding agents",
+  rules: [
+    {
+      id: "block-rm-rf",
+      description: "Block recursive force deletion",
+      severity: "error",
+      patterns: ["rm -rf", "rm -fr", "rm --recursive --force"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "block-git-force-push",
+      description: "Block force push to git",
+      severity: "error",
+      patterns: ["git push --force", "git push -f"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "block-npm-publish",
+      description: "Block package publishing",
+      severity: "error",
+      patterns: ["npm publish", "yarn publish", "pnpm publish"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "block-pipe-to-shell",
+      description: "Block curl/wget pipe to shell",
+      severity: "error",
+      patterns: ["curl | bash", "curl | sh", "wget -O - | bash", "curl | sudo"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "warn-destructive-db",
+      description: "Warn about destructive database operations",
+      severity: "warning",
+      patterns: ["DROP DATABASE", "DROP TABLE", "TRUNCATE", "DELETE FROM"],
+      action: "warn"
+    },
+    {
+      id: "block-prod-deploy",
+      description: "Block production deployments without override",
+      severity: "error",
+      patterns: ["deploy --production", "deploy --prod", "deploy:production"],
+      action: "block",
+      requireOverride: true
+    }
+  ],
+  block_commands: [
+    "rm -rf",
+    "rm -fr",
+    "git push --force",
+    "git push -f",
+    "npm publish",
+    "yarn publish",
+    "pnpm publish",
+    "curl | bash",
+    "curl | sh"
+  ],
+  never_touch: [
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.development",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+    "node_modules/**"
+  ]
+};
+function loadPolicyConfig() {
+  try {
+    const root = getProjectRoot();
+    const policyPath = path.join(root, ".kuma", "POLICY.json");
+    if (fs.existsSync(policyPath)) {
+      const content = fs.readFileSync(policyPath, "utf-8");
+      const config = JSON.parse(content);
+      return { ...DEFAULT_POLICY_CONFIG, ...config };
+    }
+    const ymlPath = path.join(root, ".kuma", "policy.yml");
+    if (fs.existsSync(ymlPath)) {
+      console.error("[PolicyEngine] Found legacy policy.yml \u2014 consider migrating to POLICY.json");
+    }
+  } catch (err) {
+    console.error(`[PolicyEngine] Failed to load policy config: ${err}`);
+  }
+  return DEFAULT_POLICY_CONFIG;
+}
+function savePolicyConfig(config) {
+  try {
+    const root = getProjectRoot();
+    const policyPath = path.join(root, ".kuma", "POLICY.json");
+    const dir = path.dirname(policyPath);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(policyPath, JSON.stringify(config, null, 2), "utf-8");
+    return `\u2705 Policy config saved to .kuma/POLICY.json (${config.rules.length} rules)`;
+  } catch (err) {
+    return `\u274C Failed to save policy: ${err}`;
+  }
+}
+function evaluateCommand(command) {
+  const config = loadPolicyConfig();
+  const warnings = [];
+  const cmdLower = command.toLowerCase();
+  for (const rule of config.rules) {
+    const matches = rule.patterns.some((p) => cmdLower.includes(p.toLowerCase()));
+    if (!matches) continue;
+    if (rule.action === "block" || rule.severity === "error") {
+      return {
+        allowed: false,
+        blockedBy: rule,
+        warnings,
+        requiresOverride: rule.requireOverride ?? false,
+        message: `\u26D4 Policy violation: "${rule.description}" (rule: ${rule.id})`
+      };
+    }
+    if (rule.action === "warn") {
+      warnings.push(rule);
+    }
+  }
+  for (const cmd of config.block_commands || []) {
+    if (cmdLower.includes(cmd.toLowerCase())) {
+      return {
+        allowed: false,
+        blockedBy: {
+          id: "block-command",
+          description: `Blocked command: ${cmd}`,
+          severity: "error",
+          patterns: [cmd],
+          action: "block",
+          requireOverride: true
+        },
+        warnings,
+        requiresOverride: true,
+        message: `\u26D4 Command matches blocked pattern: "${cmd}"`
+      };
+    }
+  }
+  return {
+    allowed: true,
+    blockedBy: null,
+    warnings,
+    requiresOverride: false,
+    message: warnings.length > 0 ? `\u26A0\uFE0F Command allowed with ${warnings.length} warning(s)` : "\u2705 Command allowed by policy"
+  };
+}
+function evaluateFilePath(filePath) {
+  const config = loadPolicyConfig();
+  const filesToCheck = config.never_touch || DEFAULT_POLICY_CONFIG.never_touch || [];
+  for (const pattern of filesToCheck) {
+    if (matchesGlob(pattern, filePath)) {
+      return {
+        allowed: false,
+        blockedBy: {
+          id: "never-touch",
+          description: `File matches never_touch pattern: ${pattern}`,
+          severity: "error",
+          patterns: [pattern],
+          action: "block",
+          requireOverride: true
+        },
+        warnings: [],
+        requiresOverride: true,
+        message: `\u26D4 File "${filePath}" is protected by never_touch policy (pattern: ${pattern}). Use kuma_safety({ action: 'override' }) to bypass.`
+      };
+    }
+  }
+  return {
+    allowed: true,
+    blockedBy: null,
+    warnings: [],
+    requiresOverride: false,
+    message: "\u2705 File allowed by policy"
+  };
+}
+function evaluateDatabaseAction(action) {
+  const cmdLower = action.toLowerCase();
+  if ((cmdLower.includes("drop") || cmdLower.includes("truncate")) && (cmdLower.includes("database") || cmdLower.includes("table") || cmdLower.includes("schema"))) {
+    return {
+      allowed: false,
+      blockedBy: {
+        id: "block-destructive-db",
+        description: "Destructive database operation blocked",
+        severity: "error",
+        patterns: ["DROP DATABASE", "DROP TABLE", "TRUNCATE", "DELETE FROM"],
+        action: "block",
+        requireOverride: true
+      },
+      warnings: [],
+      requiresOverride: true,
+      message: `\u26D4 Destructive database action blocked: "${action}". Use kuma_safety({ action: 'override' }) with a clear reason.`
+    };
+  }
+  return {
+    allowed: true,
+    blockedBy: null,
+    warnings: [],
+    requiresOverride: false,
+    message: "\u2705 Database action allowed by policy"
+  };
+}
+async function processOverride(request) {
+  const { recordAudit } = await import("./safetyAudit-55IVCG5B.js");
+  await recordAudit({
+    timestamp: Math.floor(Date.now() / 1e3),
+    toolName: request.toolName,
+    action: "policy_override",
+    filePath: request.filePath,
+    riskLevel: "high",
+    policyViolations: 1,
+    allowed: true,
+    durationMs: 0,
+    metadata: {
+      override: true,
+      reason: request.reason,
+      command: request.command
+    }
+  });
+  sessionMemory.recordToolCall("kuma_policy_override", {
+    toolName: request.toolName,
+    reason: request.reason,
+    filePath: request.filePath,
+    command: request.command
+  });
+  return [
+    `\u26A0\uFE0F **Policy Override** \u2014 ${request.toolName}`,
+    `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+    "",
+    `\u{1F4DD} Reason: ${request.reason}`,
+    request.filePath ? `\u{1F4C4} File: ${request.filePath}` : "",
+    request.command ? `\u{1F4BB} Command: ${request.command}` : "",
+    "",
+    "\u{1F534} This override is recorded in the safety audit trail.",
+    "\u{1F534} Overrides reduce project safety \u2014 use sparingly."
+  ].filter(Boolean).join("\n");
+}
+function formatPolicyStatus() {
+  const config = loadPolicyConfig();
+  const lines = [
+    "\u{1F4DC} **Policy-as-Code Engine**",
+    "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501",
+    "",
+    `\u{1F4CB} Policy: ${config.name}`,
+    `\u{1F522} Version: ${config.version}`,
+    `\u{1F4DD} Rules: ${config.rules.length}`,
+    "",
+    "**Rules:**"
+  ];
+  for (const rule of config.rules) {
+    const icon = rule.action === "block" ? "\u{1F534}" : rule.action === "warn" ? "\u{1F7E1}" : "\u{1F7E2}";
+    const override = rule.requireOverride ? " \u{1F511} override" : "";
+    lines.push(`  ${icon} [${rule.action}] ${rule.description}${override}`);
+    lines.push(`     Patterns: ${rule.patterns.slice(0, 3).join(", ")}`);
+  }
+  const neverTouch = config.never_touch || [];
+  if (neverTouch.length > 0) {
+    lines.push("", "**Protected Files (never_touch):**");
+    for (const p of neverTouch) {
+      lines.push(`  \u{1F6E1}\uFE0F ${p}`);
+    }
+  }
+  return lines.join("\n");
+}
+function matchesGlob(pattern, filePath) {
+  const normalizedPattern = pattern.replace(/\\/g, "/");
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  let regexStr = "^";
+  for (let i = 0; i < normalizedPattern.length; i++) {
+    const ch = normalizedPattern[i];
+    if (ch === "*" && normalizedPattern[i + 1] === "*" && normalizedPattern[i + 2] === "/") {
+      regexStr += "(.+/)?";
+      i += 2;
+    } else if (ch === "*") {
+      regexStr += "[^/]*";
+    } else if (ch === "?") {
+      regexStr += "[^/]";
+    } else {
+      regexStr += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  regexStr += "$";
+  try {
+    return new RegExp(regexStr).test(normalizedPath);
+  } catch {
+    return false;
+  }
+}
+export {
+  evaluateCommand,
+  evaluateDatabaseAction,
+  evaluateFilePath,
+  formatPolicyStatus,
+  loadPolicyConfig,
+  processOverride,
+  savePolicyConfig
+};

package/dist/kumaSearch-QGB4QVXS.js

@@ -0,0 +1,321 @@
+import {
+  getDb
+} from "./chunk-NAM7SCBT.js";
+import {
+  getProjectRoot
+} from "./chunk-E2KFPEBT.js";
+
+// src/engine/kumaSearch.ts
+import fs from "fs";
+import path from "path";
+var SYNONYM_MAP = {
+  timeout: ["timeout", "duration", "expiry", "ttl", "deadline", "latency"],
+  duration: ["duration", "timeout", "length", "period", "interval"],
+  delay: ["delay", "wait", "latency", "defer", "throttle"],
+  latency: ["latency", "delay", "response time", "speed", "performance"],
+  error: ["error", "failure", "exception", "bug", "fault", "crash"],
+  crash: ["crash", "panic", "oom", "out of memory", "segfault"],
+  fail: ["fail", "error", "break", "regression", "broken"],
+  auth: ["auth", "authentication", "login", "oauth", "session", "token", "credential"],
+  login: ["login", "signin", "auth", "authenticate"],
+  token: ["token", "jwt", "session", "api key", "secret"],
+  permission: ["permission", "access", "role", "rbac", "authorization", "acl"],
+  database: ["database", "db", "storage", "persistence", "sql", "nosql"],
+  query: ["query", "search", "fetch", "select", "lookup"],
+  index: ["index", "key", "lookup", "search"],
+  cache: ["cache", "memcached", "redis", "buffer", "temporary storage"],
+  api: ["api", "endpoint", "route", "rest", "graphql", "service"],
+  route: ["route", "endpoint", "path", "handler"],
+  request: ["request", "http", "call", "fetch", "invocation"],
+  response: ["response", "reply", "result", "output"],
+  performance: ["performance", "speed", "latency", "throughput", "efficiency"],
+  memory: ["memory", "ram", "heap", "allocation", "leak"],
+  cpu: ["cpu", "processor", "compute", "thread", "worker"],
+  architecture: ["architecture", "design", "pattern", "structure", "system"],
+  service: ["service", "microservice", "module", "component", "layer"],
+  config: ["config", "configuration", "setting", "env", "environment"],
+  deploy: ["deploy", "release", "rollout", "publish", "ship"],
+  build: ["build", "compile", "bundle", "transpile", "package"],
+  test: ["test", "spec", "unit test", "integration", "e2e"],
+  lint: ["lint", "format", "style", "prettier", "eslint"],
+  redis: ["redis", "cache", "session store", "message queue"],
+  postgres: ["postgres", "postgresql", "psql", "relational db", "sql"],
+  docker: ["docker", "container", "image", "dockerfile", "compose"],
+  typescript: ["typescript", "ts", "type system", "compiler"],
+  prisma: ["prisma", "orm", "database client", "schema"],
+  create: ["create", "add", "new", "make", "generate"],
+  update: ["update", "modify", "change", "edit", "patch"],
+  delete: ["delete", "remove", "drop", "clear", "purge"]
+};
+function expandQueryTerms(query) {
+  const terms = query.toLowerCase().split(/[\s_-]+/).filter((t) => t.length > 2);
+  const expanded = /* @__PURE__ */ new Map();
+  for (const term of terms) {
+    const sources = /* @__PURE__ */ new Set();
+    sources.add(term);
+    if (SYNONYM_MAP[term]) {
+      for (const syn of SYNONYM_MAP[term]) {
+        sources.add(syn);
+      }
+    }
+    for (const [key, synonyms] of Object.entries(SYNONYM_MAP)) {
+      if (synonyms.includes(term)) {
+        sources.add(key);
+      }
+    }
+    expanded.set(term, sources);
+  }
+  return expanded;
+}
+var _vectorCache = null;
+var VECTOR_CACHE_TTL = 3e5;
+async function buildSearchVectors() {
+  if (_vectorCache && Date.now() - _vectorCache.builtAt < VECTOR_CACHE_TTL) {
+    return _vectorCache.vectors;
+  }
+  const vectors = [];
+  try {
+    const db = await getDb();
+    const stmt = db.prepare("SELECT id, name, metadata, file_path FROM nodes ORDER BY updated_at DESC LIMIT 500");
+    while (stmt.step()) {
+      const row = stmt.getAsObject();
+      const name = row.name || "";
+      const metaStr = row.metadata || "{}";
+      let metaText = "";
+      try {
+        const meta = JSON.parse(metaStr);
+        metaText = Object.values(meta).join(" ");
+      } catch {
+      }
+      const filePath = row.file_path || "";
+      const nodeText = `${name} ${metaText} ${filePath}`.toLowerCase();
+      const rawTerms = extractTerms(nodeText);
+      const termCounts = /* @__PURE__ */ new Map();
+      for (const t of rawTerms) {
+        termCounts.set(t, (termCounts.get(t) || 0) + 1);
+      }
+      vectors.push({
+        terms: termCounts,
+        source: name || row.id,
+        sourceType: "graph"
+      });
+    }
+    stmt.free();
+  } catch {
+  }
+  try {
+    const root = getProjectRoot();
+    const memDir = path.join(root, ".kuma", "memories");
+    if (fs.existsSync(memDir)) {
+      const files = fs.readdirSync(memDir).filter((f) => f.endsWith(".md")).slice(0, 10);
+      for (const file of files) {
+        try {
+          const content = fs.readFileSync(path.join(memDir, file), "utf-8");
+          const text = content.toLowerCase();
+          const rawTerms = extractTerms(text);
+          const termCounts = /* @__PURE__ */ new Map();
+          for (const t of rawTerms) {
+            termCounts.set(t, (termCounts.get(t) || 0) + 1);
+          }
+          vectors.push({
+            terms: termCounts,
+            source: file.replace(/\.md$/, ""),
+            sourceType: "memory"
+          });
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  try {
+    const db = await getDb();
+    const stmt = db.prepare("SELECT scope, record FROM research_cache ORDER BY updated_at DESC LIMIT 50");
+    while (stmt.step()) {
+      const row = stmt.getAsObject();
+      const scope = row.scope || "";
+      const record = row.record || "";
+      const text = `${scope} ${record}`.toLowerCase();
+      const rawTerms = extractTerms(text);
+      const termCounts = /* @__PURE__ */ new Map();
+      for (const t of rawTerms) {
+        termCounts.set(t, (termCounts.get(t) || 0) + 1);
+      }
+      vectors.push({
+        terms: termCounts,
+        source: scope,
+        sourceType: "research"
+      });
+    }
+    stmt.free();
+  } catch {
+  }
+  const docCount = vectors.length || 1;
+  const docFreq = /* @__PURE__ */ new Map();
+  for (const vec of vectors) {
+    const seen = /* @__PURE__ */ new Set();
+    for (const [term] of vec.terms) {
+      if (!seen.has(term)) {
+        docFreq.set(term, (docFreq.get(term) || 0) + 1);
+        seen.add(term);
+      }
+    }
+  }
+  for (const vec of vectors) {
+    const maxFreq = Math.max(1, ...Array.from(vec.terms.values()));
+    for (const [term, rawFreq] of vec.terms) {
+      const tf = 0.5 + 0.5 * rawFreq / maxFreq;
+      const docsWithTerm = docFreq.get(term) || 1;
+      const idf = Math.log(1 + (docCount - docsWithTerm + 0.5) / (docsWithTerm + 0.5));
+      vec.terms.set(term, tf * idf);
+    }
+  }
+  _vectorCache = { vectors, builtAt: Date.now() };
+  return vectors;
+}
+function extractTerms(text) {
+  return text.toLowerCase().split(/[\s,.;:!?()\[\]{}"'\/\\|@#$%^&*+=<>~`]+/).filter((t) => t.length > 2 && t.length < 50 && !/^\d+$/.test(t));
+}
+function cosineSimilarity(queryVec, docVec) {
+  let dotProduct = 0;
+  let queryMagnitude = 0;
+  let docMagnitude = 0;
+  for (const [term, qWeight] of queryVec) {
+    queryMagnitude += qWeight * qWeight;
+    const dWeight = docVec.get(term) || 0;
+    dotProduct += qWeight * dWeight;
+  }
+  for (const [, dWeight] of docVec) {
+    docMagnitude += dWeight * dWeight;
+  }
+  const mag = Math.sqrt(queryMagnitude) * Math.sqrt(docMagnitude);
+  if (mag === 0) return 0;
+  return dotProduct / mag;
+}
+async function hybridSearch(query, limit = 10) {
+  const results = [];
+  const expandedTerms = expandQueryTerms(query);
+  const allSearchTerms = /* @__PURE__ */ new Set();
+  for (const [, sources] of expandedTerms) {
+    for (const term of sources) {
+      allSearchTerms.add(term);
+    }
+  }
+  const searchTerms = Array.from(allSearchTerms);
+  const queryVector = /* @__PURE__ */ new Map();
+  for (const [originalTerm, sources] of expandedTerms) {
+    for (const term of sources) {
+      const weight = term === originalTerm ? 2 : 1;
+      queryVector.set(term, (queryVector.get(term) || 0) + weight);
+    }
+  }
+  try {
+    const db = await getDb();
+    const likeClauses = searchTerms.map(() => `name LIKE ?`).join(" OR ");
+    const sql = `SELECT id, name, type, file_path, metadata FROM nodes WHERE (${likeClauses}) LIMIT ${limit * 3}`;
+    const stmt = db.prepare(sql);
+    stmt.bind(searchTerms.map((t) => `%${t}%`));
+    const seen = /* @__PURE__ */ new Set();
+    while (stmt.step()) {
+      const row = stmt.getAsObject();
+      const name = row.name || "";
+      const filePath = row.file_path || "";
+      const sourceKey = name + filePath;
+      if (seen.has(sourceKey)) continue;
+      seen.add(sourceKey);
+      const lowerText = `${name} ${filePath}`.toLowerCase();
+      const matchedTerms = searchTerms.filter((t) => lowerText.includes(t));
+      const keywordScore = matchedTerms.length > 0 ? Math.round(matchedTerms.length / Math.max(1, searchTerms.length) * 100) : 0;
+      results.push({
+        source: name,
+        sourceType: "graph",
+        score: keywordScore,
+        keywordScore,
+        vectorScore: 0,
+        matchedTerms
+      });
+    }
+    stmt.free();
+  } catch (err) {
+    console.error(`[KumaSearch] DB search failed: ${err}`);
+  }
+  try {
+    const vectors = await buildSearchVectors();
+    for (const vec of vectors) {
+      const vectorScore = Math.round(cosineSimilarity(queryVector, vec.terms) * 100);
+      const existing = results.find((r) => r.source === vec.source);
+      if (existing) {
+        existing.vectorScore = vectorScore;
+        existing.score = Math.min(100, Math.round(existing.keywordScore * 0.6 + vectorScore * 0.4));
+        for (const [term] of vec.terms) {
+          if (queryVector.has(term) && !existing.matchedTerms.includes(term)) {
+            existing.matchedTerms.push(term);
+          }
+        }
+      } else if (vectorScore > 0) {
+        const matchedTerms = [];
+        for (const [term] of vec.terms) {
+          if (queryVector.has(term)) matchedTerms.push(term);
+        }
+        results.push({
+          source: vec.source,
+          sourceType: vec.sourceType,
+          score: Math.round(vectorScore * 0.4),
+          keywordScore: 0,
+          vectorScore,
+          matchedTerms
+        });
+      }
+    }
+  } catch (err) {
+    console.error(`[KumaSearch] Vector search failed: ${err}`);
+  }
+  const uniqueResults = Array.from(
+    new Map(results.map((r) => [r.source, r])).values()
+  );
+  return uniqueResults.sort((a, b) => b.score - a.score).slice(0, limit);
+}
+function formatHybridResults(query, results) {
+  const expandedTerms = expandQueryTerms(query);
+  const originalTerms = Array.from(expandedTerms.keys()).join(", ");
+  const totalSynonyms = Array.from(expandedTerms.values()).reduce(
+    (sum, s) => sum + s.size,
+    0
+  );
+  const lines = [
+    "**Hybrid Search** \u2014 " + query,
+    "----------------------------------------",
+    "",
+    "Expanded query: " + originalTerms + " (" + totalSynonyms + " total terms with synonyms)",
+    ""
+  ];
+  if (results.length === 0) {
+    lines.push("No results found. Try different keywords or research first.");
+    return lines.join("\n");
+  }
+  lines.push(results.length + " result(s) \u2014 ranked by hybrid relevance");
+  lines.push("");
+  for (let i = 0; i < results.length; i++) {
+    const r = results[i];
+    const typeIcon = r.sourceType === "graph" ? "file" : r.sourceType === "memory" ? "memory" : "research";
+    const matchType = r.vectorScore > r.keywordScore ? "semantic match" : r.keywordScore > 0 ? "keyword match" : "expanded match";
+    lines.push(i + 1 + ". [" + typeIcon + "] " + r.source + " \u2014 " + r.score + "%");
+    lines.push("   keyword: " + r.keywordScore + "% | vector: " + r.vectorScore + "% (" + matchType + ")");
+    if (r.matchedTerms.length > 0) {
+      lines.push("   Terms: " + r.matchedTerms.slice(0, 6).join(", "));
+    }
+    lines.push("");
+  }
+  lines.push("Hybrid search combines keyword matching with semantic synonym expansion.");
+  return lines.join("\n");
+}
+function clearSearchCache() {
+  _vectorCache = null;
+}
+export {
+  buildSearchVectors,
+  clearSearchCache,
+  expandQueryTerms,
+  formatHybridResults,
+  hybridSearch
+};

package/dist/{kumaVerifier-B4D7NOFT.js → kumaVerifier-ARSGPZAM.js}

@@ -1,10 +1,10 @@
+import {
+  sessionMemory
+} from "./chunk-SLRRDKQ2.js";
 import {
   getLatestVerifications,
   saveVerification
-} from "./chunk-GDNAWLHF.js";
-import {
-  sessionMemory
-} from "./chunk-BI7KD3SG.js";
+} from "./chunk-NAM7SCBT.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/kumaVerifier.ts
@@ -56,6 +56,24 @@ var _localRunning = false;
 var _currentProcess = null;
 var STALE_RESULT_MS = 3e5;
 var DEFAULT_TIMEOUT_MS = 3e4;
+var RUNAWAY_WINDOW_MS = 3e5;
+var RUNAWAY_MAX_CALLS = 3;
+var _verifyCallTimestamps = [];
+function checkRunaway() {
+  const now = Date.now();
+  while (_verifyCallTimestamps.length > 0 && _verifyCallTimestamps[0] < now - RUNAWAY_WINDOW_MS) {
+    _verifyCallTimestamps.shift();
+  }
+  if (_verifyCallTimestamps.length >= RUNAWAY_MAX_CALLS) {
+    const oldestInWindow = _verifyCallTimestamps[0];
+    const waitMs = RUNAWAY_WINDOW_MS - (now - oldestInWindow);
+    const waitSec = Math.ceil(waitMs / 1e3);
+    return `\u26D4 **Runaway protection active** \u2014 ${RUNAWAY_MAX_CALLS}+ verify calls in the last 5 minutes. Please wait ${waitSec}s before trying again.
+\u{1F4A1} This prevents resource exhaustion (CPU/RAM) from uncontrolled test spawning.`;
+  }
+  _verifyCallTimestamps.push(now);
+  return null;
+}
 function getRunningVerificationPid() {
   return _currentProcess?.pid ?? null;
 }
@@ -126,6 +144,11 @@ async function runAutoVerification(options = {}) {
   const timeoutMs = options.timeoutMs || DEFAULT_TIMEOUT_MS;
   const denial = checkAllowed(root);
   if (denial) return denial;
+  const runawayBlock = checkRunaway();
+  if (runawayBlock) {
+    releaseFileLock(root);
+    return runawayBlock;
+  }
   try {
     if (!options.force) {
       const cached = await checkStaleness(scope);