pumuki-ast-hooks 5.6.7 → 5.6.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +249 -460
- package/docs/HOW_IT_WORKS.md +68 -2
- package/package.json +1 -1
- package/scripts/hooks-system/.audit-reports/auto-recovery.log +1 -0
- package/scripts/hooks-system/.audit-reports/install-wizard.log +4 -0
- package/scripts/hooks-system/.audit_tmp/hook-metrics.jsonl +24 -0
- package/scripts/hooks-system/bin/__tests__/cli.spec.js +133 -0
- package/scripts/hooks-system/bin/cli.js +59 -5
- package/scripts/hooks-system/infrastructure/mcp/ast-intelligence-automation.js +39 -10
- package/scripts/hooks-system/infrastructure/watchdog/__tests__/.audit-reports/token-monitor.log +3 -0
package/README.md
CHANGED
|
@@ -1,685 +1,474 @@
|
|
|
1
|
-
<p align="center">
|
|
2
|
-
<img src="./assets/logo.png" alt="PUMUKI - AST Intelligence" width="350" />
|
|
3
|
-
</p>
|
|
4
|
-
|
|
5
|
-
<h1 align="center">@pumuki/ast-intelligence-hooks</h1>
|
|
6
|
-
|
|
7
|
-
<p align="center">
|
|
8
|
-
<a href="https://www.npmjs.com/package/pumuki-ast-hooks"><img src="https://img.shields.io/npm/v/pumuki-ast-hooks.svg?style=flat-square&label=npm&color=CB3837" alt="npm version" /></a>
|
|
9
|
-
<a href="https://www.npmjs.com/package/pumuki-ast-hooks"><img src="https://img.shields.io/npm/dm/pumuki-ast-hooks.svg?style=flat-square&color=CB3837" alt="npm downloads" /></a>
|
|
10
|
-
<a href="https://github.com/SwiftEnProfundidad/ast-intelligence-hooks/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square" alt="License: MIT" /></a>
|
|
11
|
-
<a href="https://nodejs.org/"><img src="https://img.shields.io/badge/node-20.x-brightgreen.svg?style=flat-square&logo=node.js" alt="Node.js Version" /></a>
|
|
12
|
-
<a href="https://www.npmjs.com/"><img src="https://img.shields.io/badge/npm-10%2B-red.svg?style=flat-square&logo=npm" alt="npm" /></a>
|
|
13
|
-
<img src="https://img.shields.io/badge/platforms-iOS%20%7C%20Android%20%7C%20Backend%20%7C%20Frontend-blue.svg?style=flat-square" alt="Platforms" />
|
|
14
|
-
<a href="https://github.com/SwiftEnProfundidad/ast-intelligence-hooks/releases"><img src="https://img.shields.io/github/release-date/SwiftEnProfundidad/ast-intelligence-hooks.svg?style=flat-square&label=last%20release" alt="Last Release" /></a>
|
|
15
|
-
<a href="https://github.com/SwiftEnProfundidad/ast-intelligence-hooks/issues"><img src="https://img.shields.io/github/issues/SwiftEnProfundidad/ast-intelligence-hooks.svg?style=flat-square" alt="GitHub Issues" /></a>
|
|
16
|
-
</p>
|
|
17
|
-
|
|
18
|
-
<p align="center">
|
|
19
|
-
<strong>Enterprise-grade AST Intelligence System for multi-platform code quality enforcement</strong>
|
|
20
|
-
</p>
|
|
21
|
-
|
|
22
|
-
### Navigation
|
|
23
|
-
|
|
24
|
-
| Section | Description |
|
|
25
|
-
|---------|-------------|
|
|
26
|
-
| [Quick Start](#quick-start) | Get started in 30 seconds |
|
|
27
|
-
| [Features](#features) | Main capabilities |
|
|
28
|
-
| [Installation](./docs/INSTALLATION.md) | Full installation guide |
|
|
29
|
-
| [Architecture](./docs/ARCHITECTURE.md) | System design & contracts |
|
|
30
|
-
| [API Reference](./docs/API_REFERENCE.md) | Programmatic interface |
|
|
31
|
-
| [Roadmap](./docs/TODO.md) | Planned improvements |
|
|
32
|
-
| [Changelog](./CHANGELOG.md) | Version history |
|
|
33
|
-
| [Contributing](./docs/CONTRIBUTING.md) | How to contribute |
|
|
34
|
-
|
|
35
1
|
# Pumuki AST Intelligence Framework
|
|
36
2
|
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
It provides a **deterministic control layer** over AI behavior by combining:
|
|
42
|
-
|
|
43
|
-
* AST-based static analysis
|
|
44
|
-
* Persistent AI context evidence
|
|
45
|
-
* Rule-based validation
|
|
46
|
-
* Hard AI gating (block / allow)
|
|
47
|
-
* Native Git workflow integration
|
|
48
|
-
|
|
49
|
-
The framework is **project-agnostic** by design and can be adopted by any organization seeking to use AI **safely, predictably, and at scale**.
|
|
50
|
-
|
|
51
|
-
---
|
|
52
|
-
|
|
53
|
-
## Problem Statement
|
|
54
|
-
|
|
55
|
-
AI assistants are powerful but fundamentally unreliable when used in real-world, enterprise codebases:
|
|
3
|
+
<p align="center">
|
|
4
|
+
<img src="./assets/logo.png" alt="Pumuki AST Intelligence Framework" width="800" />
|
|
5
|
+
</p>
|
|
56
6
|
|
|
57
|
-
|
|
58
|
-
* Architectural rules are suggested but not enforced
|
|
59
|
-
* AI hallucinations introduce subtle, high-impact defects
|
|
60
|
-
* There is no persistent or auditable source of truth
|
|
61
|
-
* Long-running features suffer from context drift
|
|
7
|
+
Portable, project‑agnostic, multi‑platform enterprise framework to govern AI‑assisted development through AST analysis, deterministic evidence, AI Gate controls, and operational automation.
|
|
62
8
|
|
|
63
|
-
|
|
9
|
+

|
|
10
|
+

|
|
11
|
+

|
|
12
|
+

|
|
64
13
|
|
|
65
14
|
---
|
|
66
15
|
|
|
67
|
-
## Quick Start
|
|
16
|
+
## Quick Start (30–60s)
|
|
68
17
|
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
18
|
+
```bash
|
|
19
|
+
npm install --save-dev @pumuki/ast-intelligence-hooks
|
|
20
|
+
npm run install-hooks
|
|
21
|
+
npx ast-hooks
|
|
22
|
+
```
|
|
73
23
|
|
|
74
24
|
---
|
|
75
25
|
|
|
76
|
-
##
|
|
77
|
-
|
|
78
|
-
* Install (dev): `npm install --save-dev @pumuki/ast-intelligence-hooks`
|
|
79
|
-
* Update to latest: `npm install --save-dev @pumuki/ast-intelligence-hooks@latest && npm run install-hooks`
|
|
80
|
-
* Uninstall: `npm uninstall @pumuki/ast-intelligence-hooks`
|
|
81
|
-
* Install/reinstall hooks: `npm run install-hooks` (alias `npx ast-install`)
|
|
82
|
-
* Interactive menu (hook-system): `npx ast-hooks`
|
|
83
|
-
* Evidence guard daemon: `npm run ast:guard:start|stop|restart|status|logs`
|
|
84
|
-
* Refresh evidence: `npm run ast:refresh`
|
|
85
|
-
* Check installed vs latest version: `npm run ast:check-version`
|
|
86
|
-
|
|
87
|
-
---
|
|
26
|
+
## Operational visuals (examples)
|
|
88
27
|
|
|
89
|
-
|
|
28
|
+
### Pre‑write enforcement (block before writing)
|
|
90
29
|
|
|
91
|
-
|
|
30
|
+

|
|
92
31
|
|
|
93
|
-
|
|
94
|
-
* **Evidence file** `.AI_EVIDENCE.json` as single source of truth
|
|
95
|
-
* **AI Gate** (block/allow) with metrics and enforcement
|
|
32
|
+
### AI Gate (blocked example)
|
|
96
33
|
|
|
97
|
-
|
|
34
|
+

|
|
98
35
|
|
|
99
|
-
|
|
100
|
-
* **In-Memory AST Analysis**: `analyzeCodeInMemory()` for proposed code validation
|
|
101
|
-
* **IDE Hooks**: Real-time blocking in Windsurf, Claude Code, OpenCode
|
|
36
|
+
### ai-start (bootstrap + evidence refresh)
|
|
102
37
|
|
|
103
|
-
|
|
38
|
+

|
|
104
39
|
|
|
105
|
-
|
|
106
|
-
### NEW: MCP Integration
|
|
40
|
+
### Pre-flight check (in-memory validation)
|
|
107
41
|
|
|
108
|
-
|
|
109
|
-
* **ai_gate_check**: Mandatory gate before AI operations
|
|
110
|
-
* **pre_flight_check**: Validate proposed code before writing
|
|
111
|
-
* **set_human_intent**: Track user goals across sessions
|
|
42
|
+

|
|
112
43
|
|
|
113
|
-
|
|
44
|
+
### Interactive menu (orchestrator overview)
|
|
114
45
|
|
|
115
|
-
|
|
46
|
+
The framework includes an interactive audit menu that drives the orchestrator (full audit, strict modes, pattern checks, ESLint suites, AST intelligence, export, etc.).
|
|
116
47
|
|
|
117
|
-
|
|
118
|
-
|
|
48
|
+
```bash
|
|
49
|
+
npx ast-hooks
|
|
50
|
+
```
|
|
119
51
|
|
|
120
|
-
|
|
52
|
+
Documentation:
|
|
121
53
|
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
* **macOS Notifications**: Real-time alerts and guardrails
|
|
54
|
+
- `docs/USAGE.md` (Interactive Menu, non‑interactive `AUDIT_OPTION`, and typical flows)
|
|
55
|
+
- `CHANGELOG.md` (Release notes and changes)
|
|
125
56
|
|
|
126
57
|
---
|
|
127
58
|
|
|
128
59
|
## Visual Overview
|
|
129
60
|
|
|
130
|
-

|
|
131
62
|
|
|
132
|
-

|
|
133
64
|
|
|
134
|
-

|
|
135
66
|
|
|
136
|
-

|
|
137
68
|
|
|
138
|
-

|
|
139
70
|
|
|
140
71
|
---
|
|
141
72
|
|
|
142
|
-
##
|
|
143
|
-
|
|
144
|
-
Pumuki is built on a few non-negotiable principles:
|
|
145
|
-
|
|
146
|
-
* **Evidence over conversation**
|
|
147
|
-
AI does not rely on chat memory. All decisions depend on a persistent evidence file.
|
|
73
|
+
## 1. Identity
|
|
148
74
|
|
|
149
|
-
|
|
150
|
-
AI actions are explicitly allowed or blocked based on project state.
|
|
75
|
+
### Name
|
|
151
76
|
|
|
152
|
-
|
|
153
|
-
Code is analyzed structurally, not via regex or conventions.
|
|
77
|
+
Pumuki AST Intelligence Framework
|
|
154
78
|
|
|
155
|
-
|
|
156
|
-
Unsafe or invalid AI actions are prevented before code changes occur.
|
|
79
|
+
### Enterprise positioning (one line)
|
|
157
80
|
|
|
158
|
-
|
|
159
|
-
The same rules apply consistently across iOS, Android, backend, and frontend.
|
|
81
|
+
Enterprise governance for AI‑assisted development: persistent evidence, deterministic gate, and multi‑platform AST enforcement.
|
|
160
82
|
|
|
161
83
|
---
|
|
162
84
|
|
|
163
|
-
##
|
|
85
|
+
## 2. Clear definition
|
|
164
86
|
|
|
165
|
-
### 1
|
|
87
|
+
### 2.1 What the framework is
|
|
166
88
|
|
|
167
|
-
Pumuki
|
|
89
|
+
Pumuki AST Intelligence Framework is a portable, project‑agnostic framework for long‑lived systems that governs AI‑assisted work by combining:
|
|
168
90
|
|
|
169
|
-
|
|
91
|
+
- multi‑platform AST analysis;
|
|
92
|
+
- persistent evidence as the source of truth;
|
|
93
|
+
- a deterministic gate (ALLOW/BLOCK);
|
|
94
|
+
- enforcement before writing, before commit, and in CI/CD;
|
|
95
|
+
- MCP integration for agents;
|
|
96
|
+
- Git Flow automation;
|
|
97
|
+
- a guard/daemon and operational signals.
|
|
170
98
|
|
|
171
|
-
|
|
172
|
-
* Architectural and quality rules
|
|
173
|
-
* Detected violations and severities
|
|
174
|
-
* Session and workflow metadata
|
|
175
|
-
* AI gate state
|
|
99
|
+
### 2.2 What problem it solves
|
|
176
100
|
|
|
177
|
-
|
|
101
|
+
AI assistants are probabilistic systems: they can produce a coherent change once and a degrading change on the next run, even with the same prompt. In enterprise repositories this causes:
|
|
178
102
|
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
103
|
+
- architecture drift;
|
|
104
|
+
- silent introduction of anti‑patterns;
|
|
105
|
+
- security degradation;
|
|
106
|
+
- accumulation of technical debt;
|
|
107
|
+
- loss of traceability.
|
|
182
108
|
|
|
183
|
-
|
|
109
|
+
Pumuki introduces control and operational reproducibility: it does not rely on “conversation”, it relies on evidence and enforcement.
|
|
184
110
|
|
|
185
|
-
|
|
111
|
+
### 2.3 Why it exists
|
|
186
112
|
|
|
187
|
-
|
|
113
|
+
Without governance, AI:
|
|
188
114
|
|
|
189
|
-
|
|
115
|
+
- does not preserve verifiable context;
|
|
116
|
+
- does not apply rules deterministically;
|
|
117
|
+
- can break architectural invariants;
|
|
118
|
+
- can introduce high‑impact defects that are not obvious in a superficial review.
|
|
190
119
|
|
|
191
|
-
|
|
120
|
+
Pumuki exists to make AI usage compatible with enterprise engineering standards.
|
|
192
121
|
|
|
193
|
-
|
|
122
|
+
### 2.4 Why AI cannot be trusted without governance
|
|
194
123
|
|
|
195
|
-
|
|
124
|
+
Operational reliability is not achieved with prompts. It is achieved with:
|
|
196
125
|
|
|
197
|
-
|
|
126
|
+
- persistent, auditable evidence;
|
|
127
|
+
- formal rules per platform;
|
|
128
|
+
- deterministic enforcement;
|
|
129
|
+
- early blocking of critical violations.
|
|
198
130
|
|
|
199
131
|
---
|
|
200
132
|
|
|
201
|
-
|
|
133
|
+
## 3. Core principles
|
|
202
134
|
|
|
203
|
-
|
|
135
|
+
### 3.1 Evidence over conversation
|
|
204
136
|
|
|
205
|
-
|
|
137
|
+
Decisions are made based on a persistent evidence file (`.AI_EVIDENCE.json`), not chat memory.
|
|
206
138
|
|
|
207
|
-
|
|
208
|
-
* Security and data safety validation
|
|
209
|
-
* Performance anti-pattern detection
|
|
210
|
-
* Detection of forbidden constructs and flows
|
|
139
|
+
### 3.2 Gated intelligence
|
|
211
140
|
|
|
212
|
-
|
|
141
|
+
Before any AI‑assisted operation, repository state and evidence are validated. If it does not comply, the operation is blocked.
|
|
213
142
|
|
|
214
|
-
|
|
143
|
+
### 3.3 AST, not heuristics
|
|
215
144
|
|
|
216
|
-
|
|
145
|
+
Rules run on real ASTs and code structure, avoiding fragile approximations.
|
|
217
146
|
|
|
218
|
-
|
|
147
|
+
### 3.4 Fail fast, block early
|
|
219
148
|
|
|
220
|
-
|
|
221
|
-
* Pre-push hooks
|
|
222
|
-
* Branch and flow validation
|
|
149
|
+
Pumuki blocks as early as possible: pre‑write, pre‑commit, and CI.
|
|
223
150
|
|
|
224
|
-
|
|
151
|
+
### 3.5 Platform‑agnostic governance
|
|
225
152
|
|
|
226
|
-
|
|
227
|
-
* Block pushes
|
|
228
|
-
* Prevent unsafe changes from reaching CI/CD
|
|
153
|
+
A single enforcement model governs iOS, Android, backend, and frontend.
|
|
229
154
|
|
|
230
|
-
|
|
155
|
+
### 3.6 Token economy (cost-aware operation)
|
|
231
156
|
|
|
232
|
-
|
|
157
|
+
This framework treats token usage as an operational cost.
|
|
233
158
|
|
|
234
|
-
|
|
159
|
+
- **Batch checks and avoid redundant scans**.
|
|
160
|
+
- **Reuse cached context** when safe.
|
|
161
|
+
- **Ask the user for missing info** instead of exploring blindly.
|
|
162
|
+
- **Keep responses concise**.
|
|
235
163
|
|
|
236
|
-
|
|
164
|
+
This principle is part of the framework contract and is surfaced to agents via:
|
|
237
165
|
|
|
238
|
-
|
|
239
|
-
|
|
166
|
+
- `ai_gate_check` → `mandatory_rules.framework_rules`
|
|
167
|
+
- `pre_flight_check` → `framework_rules`
|
|
240
168
|
|
|
241
|
-
|
|
242
|
-
const result = analyzeCodeInMemory(proposedCode, virtualFilePath);
|
|
169
|
+
---
|
|
243
170
|
|
|
244
|
-
|
|
245
|
-
// BLOCK the write - violations detected
|
|
246
|
-
console.log('❌ BLOCKED:', result.violations);
|
|
247
|
-
} else {
|
|
248
|
-
// ALLOW the write
|
|
249
|
-
console.log('✅ ALLOWED');
|
|
250
|
-
}
|
|
251
|
-
```
|
|
171
|
+
## 4. Architecture and mental model
|
|
252
172
|
|
|
253
|
-
|
|
173
|
+
### 4.1 AI Evidence File (`.AI_EVIDENCE.json`)
|
|
254
174
|
|
|
255
|
-
|
|
256
|
-
* Detect critical violations before code is written
|
|
257
|
-
* Platform-aware analysis (iOS, Android, Backend, Frontend)
|
|
258
|
-
* Integration with IDE hooks for real-time blocking
|
|
259
|
-

|
|
175
|
+
`.AI_EVIDENCE.json` is the persistent source of truth. It represents the governance state and enables reproducible decisions.
|
|
260
176
|
|
|
261
|
-
|
|
177
|
+
It includes:
|
|
262
178
|
|
|
263
|
-
|
|
179
|
+
- session and branch context;
|
|
180
|
+
- violations by severity;
|
|
181
|
+
- gate state;
|
|
182
|
+
- detected platforms;
|
|
183
|
+
- operational watchers;
|
|
184
|
+
- cognitive layers.
|
|
264
185
|
|
|
265
|
-
|
|
186
|
+
### 4.2 AI Gate (ALLOW / BLOCK)
|
|
266
187
|
|
|
267
|
-
|
|
268
|
-
|------|---------|----------|
|
|
269
|
-
| `ai_gate_check` | Mandatory gate before any AI operation | ✅ Yes |
|
|
270
|
-
| `pre_flight_check` | Validate proposed code before writing | ✅ Yes |
|
|
271
|
-
| `read_platform_rules` | Load platform-specific rules | No |
|
|
272
|
-
| `set_human_intent` | Track user goals across sessions | No |
|
|
273
|
-
| `get_human_intent` | Retrieve current user intent | No |
|
|
274
|
-
| `auto_complete_gitflow` | Automate Git Flow cycle | No |
|
|
188
|
+
The AI Gate decides:
|
|
275
189
|
|
|
276
|
-
**
|
|
190
|
+
- **ALLOWED**: proceed (following rules).
|
|
191
|
+
- **BLOCKED**: the operation is blocked with actionable feedback.
|
|
277
192
|
|
|
278
|
-
|
|
279
|
-
# Start MCP server
|
|
280
|
-
node scripts/hooks-system/infrastructure/mcp/ast-intelligence-automation.js
|
|
281
|
-
```
|
|
193
|
+
### 4.3 Deterministic enforcement
|
|
282
194
|
|
|
283
|
-
|
|
195
|
+
Enforcement happens in layers:
|
|
284
196
|
|
|
285
|
-
|
|
197
|
+
1) pre‑write in IDEs that support it;
|
|
198
|
+
2) Git hooks as a universal fallback;
|
|
199
|
+
3) MCP gate/pre‑flight for agents;
|
|
200
|
+
4) CI/CD as final enforcement.
|
|
286
201
|
|
|
287
|
-
|
|
202
|
+
### 4.4 Cognitive layers
|
|
288
203
|
|
|
289
|
-
|
|
204
|
+
#### Human Intent (Intentional Memory)
|
|
290
205
|
|
|
291
|
-
|
|
292
|
-
{
|
|
293
|
-
"human_intent": {
|
|
294
|
-
"primary_goal": "Implement user authentication with OAuth2",
|
|
295
|
-
"secondary_goals": ["Add unit tests", "Update documentation"],
|
|
296
|
-
"constraints": ["Must use existing User model", "No breaking changes"],
|
|
297
|
-
"non_goals": ["UI redesign"],
|
|
298
|
-
"confidence_level": "high",
|
|
299
|
-
"expires_at": "2026-01-10T12:00:00Z"
|
|
300
|
-
}
|
|
301
|
-
}
|
|
302
|
-
```
|
|
206
|
+
Defines the human goal, constraints, and expiration.
|
|
303
207
|
|
|
304
|
-
|
|
208
|
+
#### Semantic Snapshot (Semantic Memory)
|
|
305
209
|
|
|
306
|
-
|
|
307
|
-
* Active platforms and detected patterns
|
|
308
|
-
* Architectural context for AI decisions
|
|
210
|
+
Summarizes project state (health, active platforms, gate state) to prevent drift.
|
|
309
211
|
|
|
310
212
|
---
|
|
311
213
|
|
|
312
|
-
##
|
|
214
|
+
## 5. Features (complete)
|
|
313
215
|
|
|
314
|
-
|
|
216
|
+
### 5.1 AST Intelligence (iOS, Android, Backend, Frontend)
|
|
315
217
|
|
|
316
|
-
|
|
317
|
-
* Android (Kotlin)
|
|
318
|
-
* Backend (Node.js / NestJS)
|
|
319
|
-
* Frontend (React / Next.js)
|
|
218
|
+
Multi‑platform AST‑based analysis:
|
|
320
219
|
|
|
321
|
-
|
|
220
|
+
- iOS (Swift)
|
|
221
|
+
- Android (Kotlin)
|
|
222
|
+
- Backend (Node.js / NestJS)
|
|
223
|
+
- Frontend (React / Next.js)
|
|
322
224
|
|
|
323
|
-
|
|
225
|
+
### 5.2 Pre‑write enforcement
|
|
324
226
|
|
|
325
|
-
|
|
227
|
+
Block before writing when the IDE can intercept operations.
|
|
326
228
|
|
|
327
|
-
|
|
229
|
+
### 5.3 In‑memory AST analysis
|
|
328
230
|
|
|
329
|
-
|
|
330
|
-
|-----|--------------|---------------------|----------|
|
|
331
|
-
| **Windsurf** | `pre_write_code` | ✅ YES | Git pre-commit |
|
|
332
|
-
| **Claude Code** | `PreToolUse` (Write/Edit) | ✅ YES | Git pre-commit |
|
|
333
|
-
| **OpenCode** | Plugin `tool.execute.before` | ✅ YES | Git pre-commit |
|
|
334
|
-
| **Codex CLI** | Approval policies only | ⚠️ Manual | Git pre-commit |
|
|
335
|
-
| **Cursor** | `afterFileEdit` only | ⚠️ Post-write | Git pre-commit |
|
|
336
|
-
| **Kilo Code** | Not documented | ⚠️ No | Git pre-commit |
|
|
337
|
-
|
|
338
|
-
### How It Works
|
|
339
|
-
|
|
340
|
-
```text
|
|
341
|
-
AI generates code → IDE Hook intercepts → AST Intelligence analyzes →
|
|
342
|
-
├─ Critical violations? → ❌ BLOCKED (code not written)
|
|
343
|
-
└─ No violations? → ✅ ALLOWED (code written)
|
|
344
|
-
```
|
|
345
|
-
|
|
346
|
-
### Enforcement Layers
|
|
231
|
+
Validation over proposed code as a string (without writing to disk).
|
|
347
232
|
|
|
348
|
-
|
|
349
|
-
2. **Git Pre-Commit**: Block commits with violations (100% fallback for all IDEs)
|
|
350
|
-
3. **MCP Gate**: AI cannot proceed without passing `ai_gate_check`
|
|
233
|
+
### 5.4 IDE hooks
|
|
351
234
|
|
|
352
|
-
|
|
235
|
+
IDE integrations to intercept changes before writing (or fallback via Git).
|
|
353
236
|
|
|
354
|
-
###
|
|
237
|
+
### 5.5 MCP server
|
|
355
238
|
|
|
356
|
-
|
|
239
|
+
MCP server for agents with blocking and non‑blocking tools.
|
|
357
240
|
|
|
358
|
-
|
|
241
|
+
### 5.6 Git hooks
|
|
359
242
|
|
|
360
|
-
|
|
361
|
-
* Before code is written to disk
|
|
243
|
+
Universal Git‑level enforcement (pre‑commit / pre‑push) to prevent violations from entering history.
|
|
362
244
|
|
|
363
|
-
|
|
245
|
+
### 5.7 Git Flow automation
|
|
364
246
|
|
|
365
|
-
|
|
366
|
-
* If the IDE only provides **partial diffs** (`tool_input.edits`), the hook reconstructs the final candidate file content by applying `old_string → new_string` edits over the current file content, then analyzes the result.
|
|
367
|
-
* **Blocks** the operation when **CRITICAL/HIGH** violations are detected (exit code `2`).
|
|
247
|
+
Automation of feature/fix cycles and releases.
|
|
368
248
|
|
|
369
|
-
|
|
249
|
+
### 5.8 macOS notifications
|
|
370
250
|
|
|
371
|
-
|
|
372
|
-
* To prevent silent injection of high-impact patterns (e.g. empty `catch {}`) during AI-assisted edits.
|
|
251
|
+
Operational notifications for gate, evidence, health, guard, and tokens.
|
|
373
252
|
|
|
374
|
-
|
|
253
|
+
### 5.9 Evidence guard daemon
|
|
375
254
|
|
|
376
|
-
|
|
255
|
+
Guard/daemon to keep evidence fresh and reduce drift during long sessions.
|
|
377
256
|
|
|
378
|
-
|
|
257
|
+
### 5.10 CI/CD enforcement
|
|
379
258
|
|
|
380
|
-
|
|
381
|
-
* Multi-day or multi-chat workflows
|
|
382
|
-
* Large monorepos and distributed teams
|
|
383
|
-
* Strict Clean Architecture enforcement
|
|
384
|
-
* Regulated or compliance-sensitive environments
|
|
259
|
+
Apply the same rules in pipelines.
|
|
385
260
|
|
|
386
261
|
---
|
|
387
262
|
|
|
388
|
-
##
|
|
263
|
+
## 6. Pre‑Write Enforcement
|
|
389
264
|
|
|
390
|
-
|
|
265
|
+
### 6.1 What it does
|
|
391
266
|
|
|
392
|
-
|
|
393
|
-
* npm 10+
|
|
267
|
+
Analyzes code before writing it to disk. This prevents dangerous or degrading patterns from even entering the working tree.
|
|
394
268
|
|
|
395
|
-
|
|
269
|
+
### 6.2 IDE interception
|
|
396
270
|
|
|
397
|
-
|
|
398
|
-
npm install --save-dev @pumuki/ast-intelligence-hooks
|
|
399
|
-
```
|
|
271
|
+
When the IDE supports pre‑write hooks, the framework intercepts edit/write operations and validates the final content.
|
|
400
272
|
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
```bash
|
|
404
|
-
npm install --save-dev pumuki-ast-hooks
|
|
405
|
-
```
|
|
273
|
+
### 6.3 Content reconstruction from partial diffs
|
|
406
274
|
|
|
407
|
-
|
|
275
|
+
If the IDE provides partial diffs, the system reconstructs the final content by applying `old_string → new_string` transformations over the current state before analyzing.
|
|
408
276
|
|
|
409
|
-
|
|
410
|
-
npx ai-start
|
|
411
|
-
```
|
|
277
|
+
### 6.4 Blocking behavior
|
|
412
278
|
|
|
413
|
-
|
|
279
|
+
If CRITICAL/HIGH violations exist, the operation is blocked.
|
|
414
280
|
|
|
415
|
-
|
|
281
|
+
### 6.5 Example (in‑memory pre‑flight)
|
|
416
282
|
|
|
417
|
-
|
|
283
|
+
```javascript
|
|
284
|
+
const { analyzeCodeInMemory } = require('./scripts/hooks-system/infrastructure/ast/ast-core');
|
|
418
285
|
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
|
|
286
|
+
const virtualFilePath = 'apps/backend/src/users/UserService.ts';
|
|
287
|
+
const proposedCode = `
|
|
288
|
+
export class UserService {
|
|
289
|
+
// ...
|
|
290
|
+
}
|
|
291
|
+
`;
|
|
422
292
|
|
|
423
|
-
|
|
293
|
+
const result = analyzeCodeInMemory(proposedCode, virtualFilePath);
|
|
424
294
|
|
|
425
|
-
|
|
426
|
-
|
|
427
|
-
|
|
295
|
+
if (result.hasCritical || result.hasHigh) {
|
|
296
|
+
throw new Error('BLOCKED: Critical/High violations detected');
|
|
297
|
+
}
|
|
298
|
+
```
|
|
428
299
|
|
|
429
|
-

|
|
430
300
|
---
|
|
431
301
|
|
|
432
|
-
##
|
|
302
|
+
## 7. MCP Integration
|
|
433
303
|
|
|
434
|
-
###
|
|
304
|
+
### 7.1 Purpose
|
|
435
305
|
|
|
436
|
-
|
|
437
|
-
npm install --save-dev @pumuki/ast-intelligence-hooks@latest
|
|
438
|
-
npm run install-hooks
|
|
439
|
-
````
|
|
306
|
+
MCP provides a standard contract so agents can consume governance tools (gate and pre‑flight) before modifying the repository.
|
|
440
307
|
|
|
441
|
-
###
|
|
308
|
+
### 7.2 Tools (blocking vs non‑blocking)
|
|
442
309
|
|
|
443
|
-
|
|
444
|
-
npm uninstall @pumuki/ast-intelligence-hooks
|
|
445
|
-
```
|
|
310
|
+
#### Blocking
|
|
446
311
|
|
|
447
|
-
|
|
312
|
+
- `ai_gate_check`
|
|
313
|
+
- `pre_flight_check`
|
|
448
314
|
|
|
449
|
-
|
|
450
|
-
npm uninstall pumuki-ast-hooks
|
|
451
|
-
```
|
|
315
|
+
#### Non‑blocking
|
|
452
316
|
|
|
453
|
-
|
|
317
|
+
- `read_platform_rules`
|
|
318
|
+
- `set_human_intent`
|
|
319
|
+
- `get_human_intent`
|
|
320
|
+
- `clear_human_intent`
|
|
321
|
+
- `suggest_human_intent`
|
|
322
|
+
- `auto_execute_ai_start`
|
|
323
|
+
- `check_evidence_status`
|
|
324
|
+
- `validate_and_fix`
|
|
325
|
+
- `sync_branches`
|
|
326
|
+
- `cleanup_stale_branches`
|
|
327
|
+
- `auto_complete_gitflow`
|
|
328
|
+
- `record_test_created`
|
|
329
|
+
- `reset_tdd_session`
|
|
454
330
|
|
|
455
|
-
|
|
331
|
+
### 7.3 Blocking vs non‑blocking
|
|
456
332
|
|
|
457
|
-
|
|
333
|
+
Blocking tools return ALLOWED/BLOCKED and stop the flow if violations are detected.
|
|
458
334
|
|
|
459
|
-
|
|
460
|
-
npm run install-hooks
|
|
461
|
-
```
|
|
335
|
+
---
|
|
462
336
|
|
|
463
|
-
|
|
337
|
+
## 8. Git Governance
|
|
464
338
|
|
|
465
|
-
|
|
339
|
+
### 8.1 `ast:gitflow`
|
|
466
340
|
|
|
467
|
-
|
|
341
|
+
Automates the feature/fix → develop cycle.
|
|
468
342
|
|
|
469
|
-
###
|
|
343
|
+
### 8.2 `ast:release`
|
|
470
344
|
|
|
471
|
-
|
|
472
|
-
npm run ast:check-version
|
|
473
|
-
```
|
|
345
|
+
Automates the develop → main release.
|
|
474
346
|
|
|
475
|
-
###
|
|
347
|
+
### 8.3 Full Git Flow cycle
|
|
476
348
|
|
|
477
|
-
|
|
478
|
-
npx ast-hooks
|
|
479
|
-
```
|
|
349
|
+
The Git Flow cycle includes branch validation, commits, push, PR, merge (by policy), cleanup, and sync.
|
|
480
350
|
|
|
481
351
|
---
|
|
482
352
|
|
|
483
|
-
##
|
|
353
|
+
## 9. Commands Section (MANDATORY – DO NOT CHANGE)
|
|
484
354
|
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
### Recommended
|
|
355
|
+
### Install (dev)
|
|
488
356
|
|
|
489
357
|
```bash
|
|
490
|
-
|
|
358
|
+
npm install --save-dev @pumuki/ast-intelligence-hooks
|
|
491
359
|
```
|
|
492
360
|
|
|
493
|
-
###
|
|
361
|
+
### Legacy install
|
|
494
362
|
|
|
495
363
|
```bash
|
|
496
|
-
ast-hooks
|
|
364
|
+
npm install --save-dev pumuki-ast-hooks
|
|
497
365
|
```
|
|
498
366
|
|
|
499
|
-
###
|
|
367
|
+
### Update
|
|
500
368
|
|
|
501
369
|
```bash
|
|
502
|
-
|
|
370
|
+
npm install --save-dev @pumuki/ast-intelligence-hooks@latest
|
|
371
|
+
npm run install-hooks
|
|
503
372
|
```
|
|
504
373
|
|
|
505
|
-
###
|
|
506
|
-
|
|
507
|
-
You can run specific audit modes without the menu:
|
|
374
|
+
### Uninstall
|
|
508
375
|
|
|
509
376
|
```bash
|
|
510
|
-
|
|
511
|
-
AUDIT_OPTION=7 bash scripts/hooks-system/infrastructure/shell/orchestrators/audit-orchestrator.sh
|
|
512
|
-
|
|
513
|
-
# Example: analyze staged files only (pre-commit equivalent)
|
|
514
|
-
AUDIT_OPTION=3 bash scripts/hooks-system/infrastructure/shell/orchestrators/audit-orchestrator.sh
|
|
377
|
+
npm uninstall @pumuki/ast-intelligence-hooks
|
|
515
378
|
```
|
|
516
379
|
|
|
517
|
-
|
|
380
|
+
### Install hooks
|
|
518
381
|
|
|
519
382
|
```bash
|
|
520
|
-
npm run
|
|
521
|
-
npm run ast:release # guided release flow (develop → main)
|
|
522
|
-
npm run ast:audit # direct audit
|
|
383
|
+
npm run install-hooks
|
|
523
384
|
```
|
|
524
385
|
|
|
525
|
-
|
|
526
|
-
|
|
527
|
-
## Git Governance & Flow Automation
|
|
528
|
-
|
|
529
|
-
Pumuki includes first-class Git governance commands to enforce a consistent workflow across teams and repositories.
|
|
530
|
-
|
|
531
|
-
### Daily Development Flow
|
|
386
|
+
### Run interactive menu
|
|
532
387
|
|
|
533
388
|
```bash
|
|
534
|
-
|
|
389
|
+
npx ast-hooks
|
|
535
390
|
```
|
|
536
391
|
|
|
537
|
-
|
|
392
|
+
### Version check
|
|
538
393
|
|
|
539
394
|
```bash
|
|
540
|
-
npm run ast:
|
|
395
|
+
npm run ast:check-version
|
|
541
396
|
```
|
|
542
397
|
|
|
543
|
-
###
|
|
398
|
+
### Audit
|
|
544
399
|
|
|
545
400
|
```bash
|
|
546
|
-
npm run
|
|
401
|
+
npm run audit
|
|
547
402
|
```
|
|
548
403
|
|
|
549
|
-
|
|
404
|
+
### Git flow
|
|
550
405
|
|
|
551
406
|
```bash
|
|
552
|
-
npm run ast:
|
|
407
|
+
npm run ast:gitflow
|
|
553
408
|
```
|
|
554
409
|
|
|
555
|
-
###
|
|
556
|
-
|
|
557
|
-
Pumuki runs a complete Git Flow cycle:
|
|
558
|
-
|
|
559
|
-
* Step 1: Validate Branch (must be feature/, fix/, etc.)
|
|
560
|
-
* Step 2: Commit Changes (if uncommitted)
|
|
561
|
-
* Step 3: Push to Origin
|
|
562
|
-
* Step 4: Create Pull Request
|
|
563
|
-
* Step 5: Merge Pull Request (optional)
|
|
564
|
-
* Step 6: Cleanup Merged Branches
|
|
565
|
-
* Step 7: Sync Branches
|
|
566
|
-
* Git Flow Cycle Complete
|
|
567
|
-
|
|
568
|
-
### Options
|
|
410
|
+
### Release
|
|
569
411
|
|
|
570
412
|
```bash
|
|
571
|
-
npm run ast:
|
|
572
|
-
npm run ast:gitflow -- -m "feat: new feature"
|
|
573
|
-
npm run ast:gitflow -- --auto-merge
|
|
574
|
-
npm run ast:gitflow -- --skip-cleanup
|
|
575
|
-
npm run ast:gitflow -- --skip-sync
|
|
413
|
+
npm run ast:release
|
|
576
414
|
```
|
|
577
415
|
|
|
578
|
-
|
|
579
|
-
|
|
580
|
-
## Evidence Guard (Daemon)
|
|
581
|
-
|
|
582
|
-
The evidence guard ensures AI evidence freshness during long work sessions.
|
|
416
|
+
### Guard start/stop/status/logs
|
|
583
417
|
|
|
584
418
|
```bash
|
|
585
419
|
npm run ast:guard:start
|
|
586
420
|
npm run ast:guard:stop
|
|
587
|
-
npm run ast:guard:restart
|
|
588
421
|
npm run ast:guard:status
|
|
589
422
|
npm run ast:guard:logs
|
|
590
423
|
```
|
|
591
424
|
|
|
592
|
-
|
|
593
|
-
|
|
594
|
-
## Developer Experience: Notifications & Guardrails
|
|
595
|
-
|
|
596
|
-
Pumuki includes a built-in notification and guardrail layer to keep long work sessions safe and predictable.
|
|
597
|
-
|
|
598
|
-
### macOS Notifications
|
|
599
|
-
|
|
600
|
-
On macOS, notifications are delivered using:
|
|
601
|
-
|
|
602
|
-
* `terminal-notifier` (preferred, if installed)
|
|
603
|
-
* `osascript` fallback (built-in)
|
|
604
|
-
|
|
605
|
-
The notification system includes deduplication, cooldowns, and retry logic to avoid spam during long sessions.
|
|
606
|
-
|
|
607
|
-
### Evidence Freshness Alerts (SLA)
|
|
608
|
-
|
|
609
|
-
When `.AI_EVIDENCE.json` becomes stale beyond the configured threshold, the guard will:
|
|
610
|
-
|
|
611
|
-
* Notify that evidence is stale (including how many seconds)
|
|
612
|
-
* Optionally attempt an auto-refresh depending on guard configuration
|
|
613
|
-
|
|
614
|
-
When evidence returns to a fresh state (back within SLA), the guard can notify that evidence is healthy again.
|
|
615
|
-
|
|
616
|
-
### AI Evidence Refresh Notifications
|
|
617
|
-
|
|
618
|
-
When evidence is refreshed, the orchestration layer updates `.AI_EVIDENCE.json` and sends a macOS notification:
|
|
619
|
-
|
|
620
|
-
* If gate is **ALLOWED**: `AI Evidence has been refreshed automatically`
|
|
621
|
-
* If gate is **BLOCKED**: `AI Gate BLOCKED - <N> violations need fixing`
|
|
425
|
+
### Evidence refresh
|
|
622
426
|
|
|
623
|
-
|
|
624
|
-
|
|
625
|
-
|
|
626
|
-
|
|
627
|
-
Typical behavior:
|
|
628
|
-
|
|
629
|
-
* Warn/error when the git tree exceeds configured limits (total/staged/unstaged)
|
|
630
|
-
* Suggest splitting work into smaller, atomic commits
|
|
631
|
-
* Provide grouped commit suggestions when it can infer feature-based groupings
|
|
632
|
-
|
|
633
|
-
Configuration (environment variables):
|
|
427
|
+
```bash
|
|
428
|
+
npm run ast:refresh
|
|
429
|
+
```
|
|
634
430
|
|
|
635
|
-
|
|
636
|
-
* `HOOK_GUARD_DIRTY_TREE_UNSTAGED_LIMIT` (default: 15)
|
|
637
|
-
* `HOOK_GUARD_DIRTY_TREE_TOTAL_LIMIT` (default: 20)
|
|
638
|
-
* `HOOK_GUARD_DIRTY_TREE_INTERVAL` (default: 60000 ms)
|
|
639
|
-
* `HOOK_GUARD_DIRTY_TREE_REMINDER` (default: 300000 ms)
|
|
431
|
+
---
|
|
640
432
|
|
|
641
|
-
|
|
433
|
+
## 10. IDE Compatibility Matrix
|
|
642
434
|
|
|
643
|
-
|
|
435
|
+
| IDE | Hook Support | Blocks Before Write? | Fallback |
|
|
436
|
+
| --- | --- | --- | --- |
|
|
437
|
+
| Windsurf | `pre_write_code` | Yes | Git pre-commit |
|
|
438
|
+
| Claude Code | `PreToolUse` (Write/Edit/MultiEdit) | Yes | Git pre-commit |
|
|
439
|
+
| OpenCode | `tool.execute.before` | Yes | Git pre-commit |
|
|
440
|
+
| Cursor | Post-write (`afterFileEdit`) | No | Git pre-commit |
|
|
441
|
+
| Codex CLI | Approval policies only | Manual | Git pre-commit |
|
|
442
|
+
| Kilo Code | Not documented | No | Git pre-commit |
|
|
644
443
|
|
|
645
444
|
---
|
|
646
445
|
|
|
647
|
-
##
|
|
648
|
-
|
|
649
|
-
Manually refresh AI evidence:
|
|
446
|
+
## 11. Typical Enterprise Use Cases
|
|
650
447
|
|
|
651
|
-
|
|
652
|
-
|
|
653
|
-
|
|
448
|
+
- Long‑running feature development with AI assistance.
|
|
449
|
+
- Regulated systems where traceability and control are mandatory.
|
|
450
|
+
- Platform teams governing multiple repositories.
|
|
451
|
+
- Monorepos and multi‑team repositories with architecture drift risk.
|
|
654
452
|
|
|
655
453
|
---
|
|
656
454
|
|
|
657
|
-
##
|
|
658
|
-
|
|
659
|
-
## Maturity & Stability
|
|
455
|
+
## 12. Intended Audience
|
|
660
456
|
|
|
661
|
-
|
|
662
|
-
* CI/CD integration
|
|
663
|
-
* Changelog-driven evolution
|
|
664
|
-
* Designed for long-lived codebases
|
|
457
|
+
Designed for:
|
|
665
458
|
|
|
666
|
-
|
|
459
|
+
- senior engineers;
|
|
460
|
+
- software architects;
|
|
461
|
+
- platform teams;
|
|
462
|
+
- teams responsible for SDLC quality, security, and governance.
|
|
667
463
|
|
|
668
464
|
---
|
|
669
465
|
|
|
670
|
-
##
|
|
671
|
-
|
|
672
|
-
Pumuki is intentionally opinionated and designed for:
|
|
673
|
-
|
|
674
|
-
* Senior engineers
|
|
675
|
-
* Tech leads
|
|
676
|
-
* Software architects
|
|
677
|
-
* Platform and infrastructure teams
|
|
466
|
+
## 13. Maturity & Stability
|
|
678
467
|
|
|
679
|
-
|
|
468
|
+
Production‑ready, version‑evolving, and designed for CI/CD integration.
|
|
680
469
|
|
|
681
470
|
---
|
|
682
471
|
|
|
683
|
-
## License
|
|
472
|
+
## 14. License
|
|
684
473
|
|
|
685
|
-
|
|
474
|
+
MIT
|