@plumpslabs/kuma 2.3.7 → 2.3.9

package/dist/kumaGotchas-5HODT5RI.js

@@ -0,0 +1,151 @@
+import {
+  appendToLayer,
+  checkFileGotchas,
+  getActiveGotchas
+} from "./chunk-Q2444HWO.js";
+import {
+  sessionMemory
+} from "./chunk-R6B3VUSB.js";
+import {
+  getDb,
+  saveDb
+} from "./chunk-3TX6Q37T.js";
+import "./chunk-E2KFPEBT.js";
+
+// src/engine/kumaGotchas.ts
+async function ensureGotchasSchema() {
+  const db = await getDb();
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS known_gotchas (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      file_path TEXT NOT NULL,
+      description TEXT NOT NULL,
+      severity TEXT NOT NULL DEFAULT 'medium'
+        CHECK(severity IN ('low','medium','high','critical')),
+      workaround TEXT,
+      added_by TEXT DEFAULT 'agent',
+      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
+      updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_gotchas_file ON known_gotchas(file_path);
+    CREATE INDEX IF NOT EXISTS idx_gotchas_severity ON known_gotchas(severity);
+  `);
+  saveDb();
+}
+async function addGotcha(entry) {
+  try {
+    await ensureGotchasSchema();
+    const db = await getDb();
+    const severity = entry.severity || "medium";
+    const formatted = [
+      `### ${entry.filePath} \u2014 ${entry.description}`,
+      `- **Issue**: ${entry.description}`,
+      `- **Severity**: ${severity}`,
+      entry.workaround ? `- **Workaround**: ${entry.workaround}` : "",
+      `- **Added**: ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`
+    ].filter(Boolean).join("\n");
+    db.run(
+      `INSERT INTO known_gotchas (file_path, description, severity, workaround) VALUES (?, ?, ?, ?)`,
+      [entry.filePath, entry.description, severity, entry.workaround || null]
+    );
+    const mdResult = appendToLayer("gotcha", formatted);
+    saveDb();
+    sessionMemory.recordToolCall("kuma_gotcha_add", {
+      filePath: entry.filePath,
+      severity
+    });
+    return `\u2705 **Gotcha recorded**: ${entry.filePath} \u2014 ${entry.description}
+${mdResult}`;
+  } catch (err) {
+    return `\u274C Failed to add gotcha: ${err}`;
+  }
+}
+async function listGotchas(params) {
+  try {
+    await ensureGotchasSchema();
+    const db = await getDb();
+    let sql = "SELECT * FROM known_gotchas WHERE 1=1";
+    const bind = [];
+    if (params.filePath) {
+      sql += " AND file_path LIKE ?";
+      bind.push(`%${params.filePath}%`);
+    }
+    if (params.severity) {
+      sql += " AND severity = ?";
+      bind.push(params.severity);
+    }
+    sql += " ORDER BY severity DESC, created_at DESC LIMIT 50";
+    const stmt = db.prepare(sql);
+    stmt.bind(bind);
+    const results = [];
+    while (stmt.step()) results.push(stmt.getAsObject());
+    stmt.free();
+    if (results.length === 0) {
+      return "\u2705 **No gotchas recorded** \u2014 legacy codebase looks clean.";
+    }
+    const lines = [
+      `\u26A0\uFE0F **Known Gotchas** \u2014 ${results.length} recorded`,
+      "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501",
+      ""
+    ];
+    for (const g of results) {
+      const icon = g.severity === "critical" ? "\u{1F534}" : g.severity === "high" ? "\u{1F7E0}" : g.severity === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
+      lines.push(`${icon} [${g.severity}] ${g.file_path}`);
+      lines.push(`   \u{1F4DD} ${g.description?.toString().substring(0, 100)}`);
+      if (g.workaround) lines.push(`   \u{1F4A1} ${g.workaround.substring(0, 100)}`);
+      lines.push("");
+    }
+    return lines.join("\n");
+  } catch (err) {
+    return `Error: ${err}`;
+  }
+}
+function checkGotchasForFile(filePath) {
+  const warnings = [];
+  const markdownWarnings = checkFileGotchas(filePath);
+  try {
+    const gotchas = getActiveGotchas();
+    for (const g of gotchas) {
+      if (filePath.includes(g.filePath) || g.filePath.includes(filePath)) {
+        if (!markdownWarnings.some((w) => w.includes(g.description))) {
+          const icon = g.severity === "critical" ? "\u{1F534}" : g.severity === "high" ? "\u{1F7E0}" : g.severity === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
+          warnings.push(`${icon} **Known Gotcha**: ${g.description} (${g.severity})`);
+        }
+      }
+    }
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([...markdownWarnings, ...warnings])];
+}
+async function syncGotchasToDb() {
+  try {
+    await ensureGotchasSchema();
+    const db = await getDb();
+    const gotchas = getActiveGotchas();
+    let synced = 0;
+    for (const g of gotchas) {
+      const checkStmt = db.prepare(
+        `SELECT id FROM known_gotchas WHERE file_path = ? AND description = ?`
+      );
+      checkStmt.bind([g.filePath, g.description]);
+      const exists = checkStmt.step();
+      checkStmt.free();
+      if (exists) continue;
+      db.run(
+        `INSERT INTO known_gotchas (file_path, description, severity) VALUES (?, ?, ?)`,
+        [g.filePath, g.description, g.severity]
+      );
+      synced++;
+    }
+    saveDb();
+    return { synced };
+  } catch {
+    return { synced: 0 };
+  }
+}
+export {
+  addGotcha,
+  checkGotchasForFile,
+  listGotchas,
+  syncGotchasToDb
+};

package/dist/{kumaGraph-35TAIBWD.js → kumaGraph-GUQM75WL.js}

@@ -5,17 +5,20 @@ import {
   formatFlow,
   formatImpact,
   getGraphStats,
+  listFederatedReferences,
+  nodeId,
   queryGraph,
   recordApiRoute,
   recordFileDefinition,
   recordFunctionCall,
   recordImport,
   recordTestRelation,
+  resolveFederatedNode,
   searchGraph,
   traceFlow,
   upsertNode
-} from "./chunk-K64NSHBR.js";
-import "./chunk-GDNAWLHF.js";
+} from "./chunk-ZKDYTYMS.js";
+import "./chunk-3TX6Q37T.js";
 import "./chunk-E2KFPEBT.js";
 export {
   addEdge,
@@ -24,12 +27,15 @@ export {
   formatFlow,
   formatImpact,
   getGraphStats,
+  listFederatedReferences,
+  nodeId,
   queryGraph,
   recordApiRoute,
   recordFileDefinition,
   recordFunctionCall,
   recordImport,
   recordTestRelation,
+  resolveFederatedNode,
   searchGraph,
   traceFlow,
   upsertNode

package/dist/{kumaMemory-5SR3TGRL.js → kumaMemory-FMOWIODH.js}

@@ -4,8 +4,8 @@ import {
   recordDecision,
   scoreMemoryRelevance,
   shouldRecordDecision
-} from "./chunk-X5TPBDKO.js";
-import "./chunk-BI7KD3SG.js";
+} from "./chunk-OJALFQ4H.js";
+import "./chunk-R6B3VUSB.js";
 import "./chunk-E2KFPEBT.js";
 export {
   formatDecisionTemplate,

package/dist/{kumaMiner-P5KCUSF7.js → kumaMiner-3RXEOCBP.js}

@@ -1,10 +1,10 @@
 import {
   recordDecision
-} from "./chunk-X5TPBDKO.js";
-import "./chunk-BI7KD3SG.js";
+} from "./chunk-OJALFQ4H.js";
+import "./chunk-R6B3VUSB.js";
 import {
   recordDecisionLog
-} from "./chunk-GDNAWLHF.js";
+} from "./chunk-3TX6Q37T.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/kumaMiner.ts

package/dist/kumaPolicyEngine-ORBWL5PT.js

@@ -0,0 +1,311 @@
+import {
+  sessionMemory
+} from "./chunk-R6B3VUSB.js";
+import {
+  getProjectRoot
+} from "./chunk-E2KFPEBT.js";
+
+// src/engine/kumaPolicyEngine.ts
+import fs from "fs";
+import path from "path";
+var DEFAULT_POLICY_CONFIG = {
+  version: 1,
+  name: "Kuma Default Security Policy",
+  description: "Default safety policy for AI coding agents",
+  rules: [
+    {
+      id: "block-rm-rf",
+      description: "Block recursive force deletion",
+      severity: "error",
+      patterns: ["rm -rf", "rm -fr", "rm --recursive --force"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "block-git-force-push",
+      description: "Block force push to git",
+      severity: "error",
+      patterns: ["git push --force", "git push -f"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "block-npm-publish",
+      description: "Block package publishing",
+      severity: "error",
+      patterns: ["npm publish", "yarn publish", "pnpm publish"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "block-pipe-to-shell",
+      description: "Block curl/wget pipe to shell",
+      severity: "error",
+      patterns: ["curl | bash", "curl | sh", "wget -O - | bash", "curl | sudo"],
+      action: "block",
+      requireOverride: true
+    },
+    {
+      id: "warn-destructive-db",
+      description: "Warn about destructive database operations",
+      severity: "warning",
+      patterns: ["DROP DATABASE", "DROP TABLE", "TRUNCATE", "DELETE FROM"],
+      action: "warn"
+    },
+    {
+      id: "block-prod-deploy",
+      description: "Block production deployments without override",
+      severity: "error",
+      patterns: ["deploy --production", "deploy --prod", "deploy:production"],
+      action: "block",
+      requireOverride: true
+    }
+  ],
+  block_commands: [
+    "rm -rf",
+    "rm -fr",
+    "git push --force",
+    "git push -f",
+    "npm publish",
+    "yarn publish",
+    "pnpm publish",
+    "curl | bash",
+    "curl | sh"
+  ],
+  never_touch: [
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.development",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+    "node_modules/**"
+  ]
+};
+function loadPolicyConfig() {
+  try {
+    const root = getProjectRoot();
+    const policyPath = path.join(root, ".kuma", "POLICY.json");
+    if (fs.existsSync(policyPath)) {
+      const content = fs.readFileSync(policyPath, "utf-8");
+      const config = JSON.parse(content);
+      return { ...DEFAULT_POLICY_CONFIG, ...config };
+    }
+    const ymlPath = path.join(root, ".kuma", "policy.yml");
+    if (fs.existsSync(ymlPath)) {
+      console.error("[PolicyEngine] Found legacy policy.yml \u2014 consider migrating to POLICY.json");
+    }
+  } catch (err) {
+    console.error(`[PolicyEngine] Failed to load policy config: ${err}`);
+  }
+  return DEFAULT_POLICY_CONFIG;
+}
+function savePolicyConfig(config) {
+  try {
+    const root = getProjectRoot();
+    const policyPath = path.join(root, ".kuma", "POLICY.json");
+    const dir = path.dirname(policyPath);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(policyPath, JSON.stringify(config, null, 2), "utf-8");
+    return `\u2705 Policy config saved to .kuma/POLICY.json (${config.rules.length} rules)`;
+  } catch (err) {
+    return `\u274C Failed to save policy: ${err}`;
+  }
+}
+function evaluateCommand(command) {
+  const config = loadPolicyConfig();
+  const warnings = [];
+  const cmdLower = command.toLowerCase();
+  for (const rule of config.rules) {
+    const matches = rule.patterns.some((p) => cmdLower.includes(p.toLowerCase()));
+    if (!matches) continue;
+    if (rule.action === "block" || rule.severity === "error") {
+      return {
+        allowed: false,
+        blockedBy: rule,
+        warnings,
+        requiresOverride: rule.requireOverride ?? false,
+        message: `\u26D4 Policy violation: "${rule.description}" (rule: ${rule.id})`
+      };
+    }
+    if (rule.action === "warn") {
+      warnings.push(rule);
+    }
+  }
+  for (const cmd of config.block_commands || []) {
+    if (cmdLower.includes(cmd.toLowerCase())) {
+      return {
+        allowed: false,
+        blockedBy: {
+          id: "block-command",
+          description: `Blocked command: ${cmd}`,
+          severity: "error",
+          patterns: [cmd],
+          action: "block",
+          requireOverride: true
+        },
+        warnings,
+        requiresOverride: true,
+        message: `\u26D4 Command matches blocked pattern: "${cmd}"`
+      };
+    }
+  }
+  return {
+    allowed: true,
+    blockedBy: null,
+    warnings,
+    requiresOverride: false,
+    message: warnings.length > 0 ? `\u26A0\uFE0F Command allowed with ${warnings.length} warning(s)` : "\u2705 Command allowed by policy"
+  };
+}
+function evaluateFilePath(filePath) {
+  const config = loadPolicyConfig();
+  const filesToCheck = config.never_touch || DEFAULT_POLICY_CONFIG.never_touch || [];
+  for (const pattern of filesToCheck) {
+    if (matchesGlob(pattern, filePath)) {
+      return {
+        allowed: false,
+        blockedBy: {
+          id: "never-touch",
+          description: `File matches never_touch pattern: ${pattern}`,
+          severity: "error",
+          patterns: [pattern],
+          action: "block",
+          requireOverride: true
+        },
+        warnings: [],
+        requiresOverride: true,
+        message: `\u26D4 File "${filePath}" is protected by never_touch policy (pattern: ${pattern}). Use kuma_safety({ action: 'override' }) to bypass.`
+      };
+    }
+  }
+  return {
+    allowed: true,
+    blockedBy: null,
+    warnings: [],
+    requiresOverride: false,
+    message: "\u2705 File allowed by policy"
+  };
+}
+function evaluateDatabaseAction(action) {
+  const cmdLower = action.toLowerCase();
+  if ((cmdLower.includes("drop") || cmdLower.includes("truncate")) && (cmdLower.includes("database") || cmdLower.includes("table") || cmdLower.includes("schema"))) {
+    return {
+      allowed: false,
+      blockedBy: {
+        id: "block-destructive-db",
+        description: "Destructive database operation blocked",
+        severity: "error",
+        patterns: ["DROP DATABASE", "DROP TABLE", "TRUNCATE", "DELETE FROM"],
+        action: "block",
+        requireOverride: true
+      },
+      warnings: [],
+      requiresOverride: true,
+      message: `\u26D4 Destructive database action blocked: "${action}". Use kuma_safety({ action: 'override' }) with a clear reason.`
+    };
+  }
+  return {
+    allowed: true,
+    blockedBy: null,
+    warnings: [],
+    requiresOverride: false,
+    message: "\u2705 Database action allowed by policy"
+  };
+}
+async function processOverride(request) {
+  const { recordAudit } = await import("./safetyAudit-32WSA4Z5.js");
+  await recordAudit({
+    timestamp: Math.floor(Date.now() / 1e3),
+    toolName: request.toolName,
+    action: "policy_override",
+    filePath: request.filePath,
+    riskLevel: "high",
+    policyViolations: 1,
+    allowed: true,
+    durationMs: 0,
+    metadata: {
+      override: true,
+      reason: request.reason,
+      command: request.command
+    }
+  });
+  sessionMemory.recordToolCall("kuma_policy_override", {
+    toolName: request.toolName,
+    reason: request.reason,
+    filePath: request.filePath,
+    command: request.command
+  });
+  return [
+    `\u26A0\uFE0F **Policy Override** \u2014 ${request.toolName}`,
+    `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+    "",
+    `\u{1F4DD} Reason: ${request.reason}`,
+    request.filePath ? `\u{1F4C4} File: ${request.filePath}` : "",
+    request.command ? `\u{1F4BB} Command: ${request.command}` : "",
+    "",
+    "\u{1F534} This override is recorded in the safety audit trail.",
+    "\u{1F534} Overrides reduce project safety \u2014 use sparingly."
+  ].filter(Boolean).join("\n");
+}
+function formatPolicyStatus() {
+  const config = loadPolicyConfig();
+  const lines = [
+    "\u{1F4DC} **Policy-as-Code Engine**",
+    "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501",
+    "",
+    `\u{1F4CB} Policy: ${config.name}`,
+    `\u{1F522} Version: ${config.version}`,
+    `\u{1F4DD} Rules: ${config.rules.length}`,
+    "",
+    "**Rules:**"
+  ];
+  for (const rule of config.rules) {
+    const icon = rule.action === "block" ? "\u{1F534}" : rule.action === "warn" ? "\u{1F7E1}" : "\u{1F7E2}";
+    const override = rule.requireOverride ? " \u{1F511} override" : "";
+    lines.push(`  ${icon} [${rule.action}] ${rule.description}${override}`);
+    lines.push(`     Patterns: ${rule.patterns.slice(0, 3).join(", ")}`);
+  }
+  const neverTouch = config.never_touch || [];
+  if (neverTouch.length > 0) {
+    lines.push("", "**Protected Files (never_touch):**");
+    for (const p of neverTouch) {
+      lines.push(`  \u{1F6E1}\uFE0F ${p}`);
+    }
+  }
+  return lines.join("\n");
+}
+function matchesGlob(pattern, filePath) {
+  const normalizedPattern = pattern.replace(/\\/g, "/");
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  let regexStr = "^";
+  for (let i = 0; i < normalizedPattern.length; i++) {
+    const ch = normalizedPattern[i];
+    if (ch === "*" && normalizedPattern[i + 1] === "*" && normalizedPattern[i + 2] === "/") {
+      regexStr += "(.+/)?";
+      i += 2;
+    } else if (ch === "*") {
+      regexStr += "[^/]*";
+    } else if (ch === "?") {
+      regexStr += "[^/]";
+    } else {
+      regexStr += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  regexStr += "$";
+  try {
+    return new RegExp(regexStr).test(normalizedPath);
+  } catch {
+    return false;
+  }
+}
+export {
+  evaluateCommand,
+  evaluateDatabaseAction,
+  evaluateFilePath,
+  formatPolicyStatus,
+  loadPolicyConfig,
+  processOverride,
+  savePolicyConfig
+};