pumuki 6.3.114 → 6.3.116

package/CHANGELOG.md

@@ -6,13 +6,23 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-## [6.3.114] - 2026-04-24
+## [6.3.116] - 2026-04-25
+
+### Fixed
+
+- **Inventario real de dependencia local en `status` y `doctor`:** la línea publicada diferencia por fin la señal de seguridad Git (`trackedNodeModulesCount` / `trackedNodeModulesPaths`) del estado real de instalación local (`dependencyInventory`).
+- **Diagnóstico consumer-facing de `pumuki`:** `status --json` y `doctor --json` exponen si existe `package.json`, lockfile, `node_modules`, declaración de `pumuki`, versión instalada y binario local.
+- **Salida humana alineada:** `status` y `doctor` imprimen una línea compacta `dependency pumuki` para que el operador no confunda ausencia de `node_modules` trackeados con ausencia de instalación local.
+- **Cobertura de regresión de `PUMUKI-INC-088`:** nuevas pruebas fijan el inventario de dependencia en ambas superficies lifecycle sin arrastrar el delta amplio de `develop`.
+
+## [6.3.115] - 2026-04-24
 
 ### Fixed
 
 - **`status` y `doctor` exponen `issues` canónicos también en evidencia `WARN`:** la línea publicada deja de reservar la lista de findings a estados bloqueados y pasa a emitir una advertencia consumible por automatización cuando governance está en atención operativa real.
 - **Hotfix mínimo sobre la superficie estable de `main`:** el contrato bloqueado existente se conserva, pero ahora la evidencia `WARN` produce `Governance requires attention (...)` como issue canónico sin arrastrar snapshots adicionales de `develop`.
 - **Cobertura de regresión de `INC-084` en la línea publicada:** nuevas pruebas fijan el caso `WARN` tanto en `status` como en `doctor`, manteniendo la semántica previa para estados `BLOCK`.
+- **Regresión de `postinstall` resuelta en la línea publicada:** `captureRepoState` deja de importar `status.ts` y rompe el ciclo que hacía fallar `scripts/consumer-postinstall.cjs` con `ReferenceError: Cannot access 'captureRepoState' before initialization`.
 
 ## [6.3.108] - 2026-04-22
 

package/VERSION

@@ -1 +1 @@
-v6.3.114
+v6.3.116

package/docs/operations/RELEASE_NOTES.md

@@ -6,11 +6,18 @@ This file keeps only the operational highlights and rollout notes that matter wh
 
 ## 2026-04 (CLI stability and macOS notifications)
 
-### 2026-04-24 (v6.3.114)
+### 2026-04-25 (v6.3.116)
+
+- **Inventario local real de dependencias:** `status` y `doctor` conservan `trackedNodeModules*` como señal estricta de seguridad Git y añaden `dependencyInventory` como fuente de verdad de instalación local.
+- **Cierre útil de `PUMUKI-INC-088`:** los consumers pueden ver si `pumuki` está declarado, instalado, con qué versión y si el binario local existe, sin inferirlo desde `git ls-files node_modules`.
+- **Rollout recomendado:** publicar `pumuki@6.3.116`, repin inmediato en `RuralGo` y revalidar `status --json` / `doctor --json` comprobando `dependencyInventory.pumuki.installedVersion`.
+
+### 2026-04-24 (v6.3.115)
 
 - **`issues` canónicos también para `WARN`:** `status` y `doctor` ya no dejan `issues=[]` cuando la evidencia operativa real está en atención (`WARN`) pero aún no bloquea el gate.
 - **Cierre útil de `PUMUKI-INC-084` en la línea publicada:** el consumer puede automatizar tanto estados `BLOCK` como `WARN` sin recombinar `attention_codes` y `human_summary_preview` por su cuenta.
-- **Rollout recomendado:** publicar `pumuki@6.3.114`, repin inmediato en `RuralGo` y revalidar `status --json` / `doctor --json` comprobando que la evidencia `WARN` ya aparece dentro de `issues`.
+- **`postinstall` vuelve a ser instalable en consumers reales:** la release evita el ciclo en `repoState` que rompía `npm install pumuki@6.3.114`.
+- **Rollout recomendado:** publicar `pumuki@6.3.115`, repin inmediato en `RuralGo` y revalidar `status --json` / `doctor --json` comprobando que la evidencia `WARN` ya aparece dentro de `issues`.
 
 ### 2026-04-22 (v6.3.108)
 

package/integrations/evidence/repoState.ts

@@ -1,8 +1,10 @@
 import { execFileSync as runBinarySync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { readLifecycleStatus } from '../lifecycle/status';
+import { LifecycleGitService } from '../lifecycle/gitService';
+import { getPumukiHooksStatus } from '../lifecycle/hookManager';
 import { resolvePumukiVersionMetadata } from '../lifecycle/packageInfo';
+import { readLifecycleState } from '../lifecycle/state';
 import { readPersistedHardModeConfig } from '../policy/policyProfiles';
 import type { RepoHardModeState, RepoHookState, RepoState } from './schema';
 
@@ -73,10 +75,13 @@ const toAheadBehind = (
 };
 
 const readLifecycleStatusSafe = (repoRoot: string): LifecycleStatusShape => {
+  const git = new LifecycleGitService();
   try {
-    return readLifecycleStatus({
-      cwd: repoRoot,
-    });
+    return {
+      lifecycleState: readLifecycleState(git, repoRoot),
+      packageVersion: resolvePumukiVersionMetadata({ repoRoot }).resolvedVersion,
+      hookStatus: getPumukiHooksStatus(repoRoot),
+    };
   } catch {
     return {
       lifecycleState: {},

package/integrations/lifecycle/cli.ts

@@ -1555,6 +1555,9 @@ const printDoctorReport = (
   writeInfo(
     `[pumuki] tracked node_modules paths: ${report.trackedNodeModulesPaths.length}`
   );
+  writeInfo(
+    `[pumuki] dependency pumuki: declared=${report.dependencyInventory.pumuki.declared ? 'yes' : 'no'}, installed=${report.dependencyInventory.pumuki.installed ? 'yes' : 'no'}, version=${report.dependencyInventory.pumuki.installedVersion ?? 'unknown'}, bin=${report.dependencyInventory.pumuki.binPresent ? 'present' : 'missing'}`
+  );
   writeInfo(
     `[pumuki] hook pre-commit: ${report.hookStatus['pre-commit'].managedBlockPresent ? 'managed' : 'missing'}`
   );
@@ -2428,6 +2431,9 @@ export const runLifecycleCli = async (
           writeInfo(
             `[pumuki] tracked node_modules paths: ${status.trackedNodeModulesCount}`
           );
+          writeInfo(
+            `[pumuki] dependency pumuki: declared=${status.dependencyInventory.pumuki.declared ? 'yes' : 'no'}, installed=${status.dependencyInventory.pumuki.installed ? 'yes' : 'no'}, version=${status.dependencyInventory.pumuki.installedVersion ?? 'unknown'}, bin=${status.dependencyInventory.pumuki.binPresent ? 'present' : 'missing'}`
+          );
           writeInfo(
             `[pumuki] policy-as-code: PRE_COMMIT=${status.policyValidation.stages.PRE_COMMIT.validationCode ?? 'n/a'} strict=${status.policyValidation.stages.PRE_COMMIT.strict ? 'yes' : 'no'} ` +
             `PRE_PUSH=${status.policyValidation.stages.PRE_PUSH.validationCode ?? 'n/a'} strict=${status.policyValidation.stages.PRE_PUSH.strict ? 'yes' : 'no'} ` +

package/integrations/lifecycle/dependencyInventory.ts

@@ -0,0 +1,92 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import packageJson from '../../package.json';
+
+export type LifecycleDependencyInventory = {
+  nodeModulesPresent: boolean;
+  packageJsonPresent: boolean;
+  lockfilePresent: boolean;
+  pumuki: {
+    declared: boolean;
+    declaredRange: string | null;
+    installed: boolean;
+    installedVersion: string | null;
+    packageJsonPath: string | null;
+    binPath: string | null;
+    binPresent: boolean;
+  };
+};
+
+const readJsonRecord = (path: string): Record<string, unknown> | null => {
+  if (!existsSync(path)) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8')) as unknown;
+    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  } catch {
+    return null;
+  }
+};
+
+const readDependencyRange = (
+  manifest: Record<string, unknown> | null,
+  dependencyName: string
+): string | null => {
+  if (!manifest) {
+    return null;
+  }
+
+  for (const section of ['dependencies', 'devDependencies', 'optionalDependencies'] as const) {
+    const dependencies = manifest[section];
+    if (typeof dependencies !== 'object' || dependencies === null || Array.isArray(dependencies)) {
+      continue;
+    }
+
+    const value = (dependencies as Record<string, unknown>)[dependencyName];
+    if (typeof value === 'string' && value.trim().length > 0) {
+      return value.trim();
+    }
+  }
+
+  return null;
+};
+
+const readInstalledVersion = (installedManifest: Record<string, unknown> | null): string | null => {
+  const version = installedManifest?.version;
+  return typeof version === 'string' && version.trim().length > 0 ? version.trim() : null;
+};
+
+export const readLifecycleDependencyInventory = (
+  repoRoot: string
+): LifecycleDependencyInventory => {
+  const manifestPath = join(repoRoot, 'package.json');
+  const nodeModulesPath = join(repoRoot, 'node_modules');
+  const lockfilePath = join(repoRoot, 'package-lock.json');
+  const installedPackageJsonPath = join(nodeModulesPath, packageJson.name, 'package.json');
+  const binName = process.platform === 'win32' ? `${packageJson.name}.cmd` : packageJson.name;
+  const binPath = join(nodeModulesPath, '.bin', binName);
+  const manifest = readJsonRecord(manifestPath);
+  const installedManifest = readJsonRecord(installedPackageJsonPath);
+  const declaredRange = readDependencyRange(manifest, packageJson.name);
+  const installedVersion = readInstalledVersion(installedManifest);
+  const binPresent = existsSync(binPath);
+
+  return {
+    nodeModulesPresent: existsSync(nodeModulesPath),
+    packageJsonPresent: existsSync(manifestPath),
+    lockfilePresent: existsSync(lockfilePath),
+    pumuki: {
+      declared: declaredRange !== null,
+      declaredRange,
+      installed: installedVersion !== null,
+      installedVersion,
+      packageJsonPath: installedVersion !== null ? `node_modules/${packageJson.name}/package.json` : null,
+      binPath: binPresent ? `node_modules/.bin/${binName}` : null,
+      binPresent,
+    },
+  };
+};

package/integrations/lifecycle/doctor.ts

@@ -16,6 +16,10 @@ import {
   evaluateOpenSpecCompatibility,
   isOpenSpecProjectInitialized,
 } from '../sdd/openSpecCli';
+import {
+  readLifecycleDependencyInventory,
+  type LifecycleDependencyInventory,
+} from './dependencyInventory';
 
 export type DoctorIssueSeverity = 'warning' | 'error';
 
@@ -91,6 +95,7 @@ export type LifecycleDoctorReport = {
   packageVersion: string;
   version: ReturnType<typeof buildLifecycleVersionReport>;
   lifecycleState: LifecycleState;
+  dependencyInventory: LifecycleDependencyInventory;
   trackedNodeModulesPaths: ReadonlyArray<string>;
   hookStatus: ReturnType<typeof getPumukiHooksStatus>;
   hooksDirectory: string;
@@ -842,6 +847,7 @@ export const runLifecycleDoctor = (params?: {
   const cwd = params?.cwd ?? process.cwd();
   const repoRoot = git.resolveRepoRoot(cwd);
   const trackedNodeModulesPaths = git.trackedNodeModulesPaths(repoRoot);
+  const dependencyInventory = readLifecycleDependencyInventory(repoRoot);
   const hooksDirectory = resolvePumukiHooksDirectory(repoRoot);
   const hookStatus = getPumukiHooksStatus(repoRoot);
   const lifecycleState = readLifecycleState(git, repoRoot);
@@ -886,6 +892,7 @@ export const runLifecycleDoctor = (params?: {
     packageVersion: version.effective,
     version,
     lifecycleState,
+    dependencyInventory,
     trackedNodeModulesPaths,
     hookStatus,
     hooksDirectory: hooksDirectory.path,

package/integrations/lifecycle/status.ts

@@ -13,6 +13,10 @@ import {
 } from './policyValidationSnapshot';
 import { readLifecycleState, type LifecycleState } from './state';
 import type { DoctorIssue } from './doctor';
+import {
+  readLifecycleDependencyInventory,
+  type LifecycleDependencyInventory,
+} from './dependencyInventory';
 
 export type LifecycleStatus = {
   repoRoot: string;
@@ -23,6 +27,7 @@ export type LifecycleStatus = {
   hooksDirectory: string;
   hooksDirectoryResolution: 'git-rev-parse' | 'git-config' | 'default';
   trackedNodeModulesCount: number;
+  dependencyInventory: LifecycleDependencyInventory;
   policyValidation: LifecyclePolicyValidationSnapshot;
   experimentalFeatures: LifecycleExperimentalFeaturesSnapshot;
   issues: ReadonlyArray<DoctorIssue>;
@@ -79,6 +84,7 @@ export const readLifecycleStatus = (params?: {
   const repoRoot = git.resolveRepoRoot(cwd);
   const hooksDirectory = resolvePumukiHooksDirectory(repoRoot);
   const trackedNodeModulesCount = git.trackedNodeModulesPaths(repoRoot).length;
+  const dependencyInventory = readLifecycleDependencyInventory(repoRoot);
   const lifecycleState = readLifecycleState(git, repoRoot);
   const version = buildLifecycleVersionReport({
     repoRoot,
@@ -97,6 +103,7 @@ export const readLifecycleStatus = (params?: {
     hooksDirectory: hooksDirectory.path,
     hooksDirectoryResolution: hooksDirectory.source,
     trackedNodeModulesCount,
+    dependencyInventory,
     policyValidation,
     experimentalFeatures,
     issues,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.114",
+  "version": "6.3.116",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {