@plumpslabs/kuma 2.3.7 → 2.3.9

package/dist/{kumaVerifier-LFRNIGSL.js → kumaVerifier-KAYJHR5K.js}

@@ -1,10 +1,10 @@
 import {
   sessionMemory
-} from "./chunk-BI7KD3SG.js";
+} from "./chunk-R6B3VUSB.js";
 import {
   getLatestVerifications,
   saveVerification
-} from "./chunk-GDNAWLHF.js";
+} from "./chunk-3TX6Q37T.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/kumaVerifier.ts
@@ -56,6 +56,24 @@ var _localRunning = false;
 var _currentProcess = null;
 var STALE_RESULT_MS = 3e5;
 var DEFAULT_TIMEOUT_MS = 3e4;
+var RUNAWAY_WINDOW_MS = 3e5;
+var RUNAWAY_MAX_CALLS = 3;
+var _verifyCallTimestamps = [];
+function checkRunaway() {
+  const now = Date.now();
+  while (_verifyCallTimestamps.length > 0 && _verifyCallTimestamps[0] < now - RUNAWAY_WINDOW_MS) {
+    _verifyCallTimestamps.shift();
+  }
+  if (_verifyCallTimestamps.length >= RUNAWAY_MAX_CALLS) {
+    const oldestInWindow = _verifyCallTimestamps[0];
+    const waitMs = RUNAWAY_WINDOW_MS - (now - oldestInWindow);
+    const waitSec = Math.ceil(waitMs / 1e3);
+    return `\u26D4 **Runaway protection active** \u2014 ${RUNAWAY_MAX_CALLS}+ verify calls in the last 5 minutes. Please wait ${waitSec}s before trying again.
+\u{1F4A1} This prevents resource exhaustion (CPU/RAM) from uncontrolled test spawning.`;
+  }
+  _verifyCallTimestamps.push(now);
+  return null;
+}
 function getRunningVerificationPid() {
   return _currentProcess?.pid ?? null;
 }
@@ -126,6 +144,11 @@ async function runAutoVerification(options = {}) {
   const timeoutMs = options.timeoutMs || DEFAULT_TIMEOUT_MS;
   const denial = checkAllowed(root);
   if (denial) return denial;
+  const runawayBlock = checkRunaway();
+  if (runawayBlock) {
+    releaseFileLock(root);
+    return runawayBlock;
+  }
   try {
     if (!options.force) {
       const cached = await checkStaleness(scope);

package/dist/{kumaVisualize-ODCWFSUY.js → kumaVisualize-AFL7STLL.js}

@@ -1,6 +1,6 @@
 import {
   getDb
-} from "./chunk-GDNAWLHF.js";
+} from "./chunk-3TX6Q37T.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/kumaVisualize.ts

package/dist/safetyAudit-32WSA4Z5.js

@@ -0,0 +1,12 @@
+import {
+  auditStats,
+  queryAudit,
+  recordAudit
+} from "./chunk-RI3DKY62.js";
+import "./chunk-3TX6Q37T.js";
+import "./chunk-E2KFPEBT.js";
+export {
+  auditStats,
+  queryAudit,
+  recordAudit
+};

package/dist/{safetyScore-PJGRRBWP.js → safetyScore-WU27EOG4.js}

@@ -2,10 +2,10 @@ import {
   getGitDiffStat,
   getSessionStats,
   getUnresolvedCount
-} from "./chunk-FOQQ2CSL.js";
+} from "./chunk-SPHI2BOO.js";
 import {
   sessionMemory
-} from "./chunk-BI7KD3SG.js";
+} from "./chunk-R6B3VUSB.js";
 import "./chunk-E2KFPEBT.js";
 
 // src/engine/safetyScore.ts
@@ -60,7 +60,7 @@ async function computeSafetyScore(inputGoal) {
     totalScore += 20;
   }
   try {
-    const { getDb } = await import("./kumaDb-DJUDLYBJ.js");
+    const { getDb } = await import("./kumaDb-IC7UX7PU.js");
     const db = await getDb();
     const nodeCount = db.exec("SELECT COUNT(*) as c FROM nodes")[0]?.values[0][0] ?? 0;
     const edgeCount = db.exec("SELECT COUNT(*) as c FROM edges")[0]?.values[0][0] ?? 0;
@@ -91,7 +91,7 @@ async function computeSafetyScore(inputGoal) {
     totalScore += 5;
   }
   try {
-    const { getDb } = await import("./kumaDb-DJUDLYBJ.js");
+    const { getDb } = await import("./kumaDb-IC7UX7PU.js");
     const db = await getDb();
     const researchCount = db.exec("SELECT COUNT(*) as c FROM research_cache")[0]?.values[0][0] ?? 0;
     checks.push({
@@ -116,7 +116,7 @@ async function computeSafetyScore(inputGoal) {
   const hasRunTests = stats.hasRunTests;
   let latestVerif = null;
   try {
-    const { getLatestVerifications } = await import("./kumaDb-DJUDLYBJ.js");
+    const { getLatestVerifications } = await import("./kumaDb-IC7UX7PU.js");
     const verifs = await getLatestVerifications(1);
     if (verifs.length > 0) latestVerif = verifs[0];
   } catch {

package/dist/{sessionMemory-HBBXUSIP.js → sessionMemory-4UWA3E5J.js}

@@ -1,6 +1,6 @@
 import {
   sessionMemory
-} from "./chunk-BI7KD3SG.js";
+} from "./chunk-R6B3VUSB.js";
 export {
   sessionMemory
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumpslabs/kuma",
-  "version": "2.3.7",
+  "version": "2.3.9",
   "description": "Safety-first context & orchestration engine for AI coding agents. MCP server with mandatory research pipeline, knowledge graph, impact analysis, decision memory, and safety guard — works with any MCP client.",
   "type": "module",
   "main": "dist/index.js",
@@ -9,17 +9,10 @@
     "kuma": "dist/index.js"
   },
   "files": [
-    "dist/"
+    "dist/",
+    "packages/ide/studio/dist/",
+    "packages/ide/studio/public/"
   ],
-  "scripts": {
-    "build": "tsup src/index.ts --format esm --clean --out-dir dist",
-    "dev": "tsup src/index.ts --format esm --watch --out-dir dist",
-    "start": "node dist/index.js",
-    "typecheck": "tsc --noEmit",
-    "lint": "echo 'No linting configured'",
-    "prepublishOnly": "npm run build",
-    "test": "NODE_OPTIONS=--experimental-vm-modules pnpm exec jest"
-  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.7.0",
     "fast-glob": "^3.3.2",
@@ -68,5 +61,17 @@
     "url": "https://github.com/plumpslabs/kuma/issues"
   },
   "homepage": "https://github.com/plumpslabs/kuma#readme",
-  "license": "MIT"
-}
+  "license": "MIT",
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --clean --out-dir dist",
+    "build:studio": "cd packages/ide/studio && tsup src/index.ts --format esm --clean --out-dir dist",
+    "build:all": "pnpm run build && pnpm run build:studio",
+    "dev": "tsup src/index.ts --format esm --watch --out-dir dist",
+    "start": "node dist/index.js",
+    "studio": "node dist/index.js studio",
+    "studio:dev": "bun run packages/ide/studio/src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "lint": "echo 'No linting configured'",
+    "test": "NODE_OPTIONS=--experimental-vm-modules pnpm exec jest"
+  }
+}

package/packages/ide/studio/dist/index.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { serve } from "@hono/node-server";
+import { readFileSync } from "fs";
+import { join as join2, dirname } from "path";
+import { fileURLToPath } from "url";
+import { spawn } from "child_process";
+
+// src/api.ts
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+
+// src/db.ts
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { join, resolve } from "path";
+function findKumaDb(startDir) {
+  let current = startDir ? resolve(startDir) : process.cwd();
+  for (let i = 0; i < 20; i++) {
+    const candidate = join(current, ".kuma", "kuma.db");
+    if (existsSync(candidate)) return candidate;
+    const parent = resolve(current, "..");
+    if (parent === current) break;
+    current = parent;
+  }
+  return null;
+}
+function query(sql) {
+  const dbPath = findKumaDb();
+  if (!dbPath) throw new Error("No .kuma/kuma.db found");
+  return execSync(`sqlite3 "${dbPath}" "${sql}"`, {
+    encoding: "utf-8",
+    maxBuffer: 2 * 1024 * 1024,
+    timeout: 1e4
+  }).trim();
+}
+function queryJson(sql) {
+  const raw = query(sql);
+  if (!raw) return [];
+  return JSON.parse(raw);
+}
+function getDashboardData() {
+  return {
+    stats: queryJson(`
+      SELECT json_object(
+        'node_count', (SELECT COUNT(*) FROM nodes),
+        'edge_count', (SELECT COUNT(*) FROM edges),
+        'gotcha_count', (SELECT COUNT(*) FROM known_gotchas),
+        'trajectory_count', (SELECT COUNT(*) FROM trajectories),
+        'skill_count', (SELECT COUNT(*) FROM distilled_skills),
+        'health_score', COALESCE((SELECT score FROM health_snapshots ORDER BY created_at DESC LIMIT 1), 0)
+      )
+    `),
+    nodes: queryJson(
+      `SELECT json_group_array(json_object('id',id,'name',name,'type',type,'file_path',file_path)) FROM nodes ORDER BY created_at DESC`
+    ),
+    edges: queryJson(
+      `SELECT json_group_array(json_object('source',source_id,'target',target_id,'relation',type)) FROM edges`
+    ),
+    gotchas: queryJson(
+      `SELECT json_group_array(json_object('id',id,'file_path',file_path,'description',description,'severity',severity,'workaround',workaround)) FROM known_gotchas ORDER BY severity DESC`
+    ),
+    trajectories: queryJson(
+      `SELECT json_group_array(json_object('id',id,'goal',goal,'total_duration_ms',total_duration_ms,'success_rate',success_rate,'created_at',created_at)) FROM trajectories ORDER BY created_at DESC LIMIT 20`
+    ),
+    health: queryJson(
+      `SELECT json_group_array(json_object('score',score,'summary',summary,'risk_level',risk_level,'created_at',created_at)) FROM health_snapshots ORDER BY created_at DESC LIMIT 10`
+    )
+  };
+}
+
+// src/api.ts
+var api = new Hono();
+api.use("/*", cors());
+api.get("/status", (c) => {
+  const dbPath = findKumaDb();
+  return c.json({
+    ok: !!dbPath,
+    dbPath,
+    project: dbPath ? dbPath.replace("/.kuma/kuma.db", "").split("/").pop() : null
+  });
+});
+api.get("/dashboard", (c) => {
+  try {
+    const data = getDashboardData();
+    return c.json(data);
+  } catch (e) {
+    return c.json({ error: e.message }, 500);
+  }
+});
+var api_default = api;
+
+// src/index.ts
+import { Hono as Hono2 } from "hono";
+var args = process.argv.slice(2);
+var PORT = parseInt(args.find((a) => a.startsWith("--port="))?.split("=")[1] || "3322", 10);
+var customDir = args.find((a) => a.startsWith("--dir="))?.split("=")[1];
+var showHelp = args.includes("--help") || args.includes("-h");
+if (showHelp) {
+  console.error(`\u2662 Kuma Studio \u2014 Usage:
+  bun run src/index.ts [options]
+
+Options:
+  --port=PORT   Server port (default: 3322)
+  --dir=PATH    Project directory (default: auto-detect from cwd)
+  --help, -h    Show this help
+  `);
+  process.exit(0);
+}
+var __dirname = dirname(fileURLToPath(import.meta.url));
+if (customDir) {
+  process.chdir(customDir);
+}
+var app = new Hono2();
+app.route("/api", api_default);
+var htmlPath = join2(__dirname, "..", "public", "index.html");
+var htmlCache = null;
+try {
+  htmlCache = readFileSync(htmlPath, "utf-8");
+} catch {
+}
+app.get("/", (c) => {
+  if (!htmlCache) {
+    return c.text("index.html not found. Run from packages/ide/studio/", 500);
+  }
+  return c.html(htmlCache);
+});
+serve({ fetch: app.fetch, port: PORT }, (info) => {
+  const dbPath = findKumaDb();
+  const projectName = dbPath ? dbPath.replace("/.kuma/kuma.db", "").split("/").pop() : "unknown";
+  console.error(`\u2662 Kuma Studio`);
+  console.error(`  Project: ${projectName}`);
+  console.error(`  DB:      ${dbPath || "not found"}`);
+  console.error(`  Server:  http://localhost:${PORT}`);
+  console.error(``);
+  const url = `http://localhost:${PORT}`;
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  spawn(cmd, [url], { stdio: "ignore", detached: true });
+});