pumuki 6.3.13 → 6.3.14

package/integrations/mcp/index.ts

@@ -1 +1,2 @@
 export { startEvidenceContextServer } from './evidenceContextServer';
+export { startEnterpriseMcpServer } from './enterpriseServer';

package/integrations/sdd/index.ts

@@ -0,0 +1,11 @@
+export type {
+  OpenSpecValidationSummary,
+  SddDecision,
+  SddDecisionCode,
+  SddEvaluateResult,
+  SddSessionState,
+  SddStage,
+  SddStatusPayload,
+} from './types';
+export { evaluateSddPolicy, readSddStatus } from './policy';
+export { closeSddSession, openSddSession, readSddSession, refreshSddSession } from './sessionStore';

package/integrations/sdd/openSpecCli.ts

@@ -0,0 +1,180 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import type { OpenSpecValidationSummary } from './types';
+
+export const OPENSPEC_NPM_PACKAGE_NAME = '@fission-ai/openspec';
+export const OPENSPEC_COMPATIBILITY_MATRIX = {
+  packageName: OPENSPEC_NPM_PACKAGE_NAME,
+  minimumVersion: '1.1.1',
+  recommendedVersion: '1.1.1',
+} as const;
+
+type OpenSpecCommandResult = {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+};
+
+const resolveOpenSpecBinary = (repoRoot: string): string => {
+  const binaryName = process.platform === 'win32' ? 'openspec.cmd' : 'openspec';
+  const localBinaryPath = join(repoRoot, 'node_modules', '.bin', binaryName);
+  if (existsSync(localBinaryPath)) {
+    return localBinaryPath;
+  }
+  return 'openspec';
+};
+
+const runOpenSpecCommand = (
+  args: ReadonlyArray<string>,
+  cwd: string
+): OpenSpecCommandResult => {
+  const result = spawnSync(resolveOpenSpecBinary(cwd), [...args], {
+    cwd,
+    encoding: 'utf8',
+  });
+  return {
+    exitCode: typeof result.status === 'number' ? result.status : 1,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+  };
+};
+
+const extractSemver = (raw: string | undefined): string | undefined => {
+  if (typeof raw !== 'string') {
+    return undefined;
+  }
+  const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) {
+    return undefined;
+  }
+  return `${match[1]}.${match[2]}.${match[3]}`;
+};
+
+const compareSemver = (left: string, right: string): number => {
+  const leftParts = left.split('.').map((value) => Number.parseInt(value, 10));
+  const rightParts = right.split('.').map((value) => Number.parseInt(value, 10));
+  for (let index = 0; index < 3; index += 1) {
+    const leftPart = leftParts[index] ?? 0;
+    const rightPart = rightParts[index] ?? 0;
+    if (leftPart > rightPart) {
+      return 1;
+    }
+    if (leftPart < rightPart) {
+      return -1;
+    }
+  }
+  return 0;
+};
+
+export type OpenSpecCompatibilityStatus = {
+  minimumVersion: string;
+  recommendedVersion: string;
+  detectedVersion?: string;
+  parsedVersion?: string;
+  compatible: boolean;
+};
+
+export const evaluateOpenSpecCompatibility = (params: {
+  installed: boolean;
+  version?: string;
+}): OpenSpecCompatibilityStatus => {
+  const parsedVersion = extractSemver(params.version);
+  if (!params.installed || !parsedVersion) {
+    return {
+      minimumVersion: OPENSPEC_COMPATIBILITY_MATRIX.minimumVersion,
+      recommendedVersion: OPENSPEC_COMPATIBILITY_MATRIX.recommendedVersion,
+      detectedVersion: params.version,
+      parsedVersion,
+      compatible: false,
+    };
+  }
+
+  return {
+    minimumVersion: OPENSPEC_COMPATIBILITY_MATRIX.minimumVersion,
+    recommendedVersion: OPENSPEC_COMPATIBILITY_MATRIX.recommendedVersion,
+    detectedVersion: params.version,
+    parsedVersion,
+    compatible:
+      compareSemver(parsedVersion, OPENSPEC_COMPATIBILITY_MATRIX.minimumVersion) >= 0,
+  };
+};
+
+const parseValidationJson = (stdout: string): {
+  totals: { items: number; failed: number; passed: number };
+  issues: { errors: number; warnings: number; infos: number };
+} => {
+  try {
+    const parsed: unknown = JSON.parse(stdout);
+    const summary = (parsed as { summary?: unknown }).summary;
+    const totals = (summary as { totals?: unknown })?.totals as
+      | { items?: unknown; failed?: unknown; passed?: unknown }
+      | undefined;
+    const byLevel = (summary as { byLevel?: unknown })?.byLevel as
+      | { ERROR?: unknown; WARNING?: unknown; INFO?: unknown }
+      | undefined;
+
+    return {
+      totals: {
+        items: Number(totals?.items ?? 0) || 0,
+        failed: Number(totals?.failed ?? 0) || 0,
+        passed: Number(totals?.passed ?? 0) || 0,
+      },
+      issues: {
+        errors: Number(byLevel?.ERROR ?? 0) || 0,
+        warnings: Number(byLevel?.WARNING ?? 0) || 0,
+        infos: Number(byLevel?.INFO ?? 0) || 0,
+      },
+    };
+  } catch {
+    return {
+      totals: {
+        items: 0,
+        failed: 0,
+        passed: 0,
+      },
+      issues: {
+        errors: 0,
+        warnings: 0,
+        infos: 0,
+      },
+    };
+  }
+};
+
+export const detectOpenSpecInstallation = (
+  repoRoot: string
+): { installed: boolean; version?: string } => {
+  const result = runOpenSpecCommand(['--version'], repoRoot);
+  if (result.exitCode !== 0) {
+    return {
+      installed: false,
+    };
+  }
+  return {
+    installed: true,
+    version: result.stdout.trim() || undefined,
+  };
+};
+
+export const isOpenSpecProjectInitialized = (repoRoot: string): boolean =>
+  existsSync(resolve(repoRoot, 'openspec'));
+
+export const validateOpenSpecChanges = (
+  repoRoot: string
+): OpenSpecValidationSummary => {
+  const result = runOpenSpecCommand(
+    ['validate', '--changes', '--json', '--no-interactive'],
+    repoRoot
+  );
+  const parsed = parseValidationJson(result.stdout);
+  const hasErrors = parsed.totals.failed > 0 || parsed.issues.errors > 0;
+  return {
+    ok: result.exitCode === 0 && !hasErrors,
+    exitCode: result.exitCode,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    totals: parsed.totals,
+    issues: parsed.issues,
+  };
+};

package/integrations/sdd/policy.ts

@@ -0,0 +1,190 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import {
+  detectOpenSpecInstallation,
+  evaluateOpenSpecCompatibility,
+  isOpenSpecProjectInitialized,
+  validateOpenSpecChanges,
+} from './openSpecCli';
+import { readSddSession } from './sessionStore';
+import type {
+  SddDecision,
+  SddEvaluateResult,
+  SddStage,
+  SddStatusPayload,
+} from './types';
+
+const buildStatus = (repoRoot: string): SddStatusPayload => {
+  const openspec = detectOpenSpecInstallation(repoRoot);
+  const compatibility = evaluateOpenSpecCompatibility(openspec);
+  const session = readSddSession(repoRoot);
+  return {
+    repoRoot,
+    openspec: {
+      installed: openspec.installed,
+      version: openspec.version,
+      projectInitialized: isOpenSpecProjectInitialized(repoRoot),
+      minimumVersion: compatibility.minimumVersion,
+      recommendedVersion: compatibility.recommendedVersion,
+      compatible: compatibility.compatible,
+      parsedVersion: compatibility.parsedVersion,
+    },
+    session,
+  };
+};
+
+const allowed = (message: string, details?: Record<string, unknown>): SddDecision => ({
+  allowed: true,
+  code: 'ALLOWED',
+  message,
+  details,
+});
+
+const blocked = (
+  code: Exclude<SddDecision['code'], 'ALLOWED'>,
+  message: string,
+  details?: Record<string, unknown>
+): SddDecision => ({
+  allowed: false,
+  code,
+  message,
+  details,
+});
+
+const activeChangeExists = (repoRoot: string, changeId: string): boolean =>
+  existsSync(resolve(repoRoot, 'openspec', 'changes', changeId));
+
+const activeChangeArchived = (repoRoot: string, changeId: string): boolean =>
+  existsSync(resolve(repoRoot, 'openspec', 'changes', 'archive', changeId));
+
+const evaluateSessionRequirements = (status: SddStatusPayload): SddDecision | undefined => {
+  if (!status.session.active) {
+    return blocked(
+      'SDD_SESSION_MISSING',
+      'SDD session is not active. Run `pumuki sdd session --open --change=<id>`.'
+    );
+  }
+  if (!status.session.valid || !status.session.changeId) {
+    return blocked(
+      'SDD_SESSION_INVALID',
+      'SDD session is invalid or expired. Run `pumuki sdd session --refresh` or reopen it.'
+    );
+  }
+  if (activeChangeArchived(status.repoRoot, status.session.changeId)) {
+    return blocked(
+      'SDD_CHANGE_ARCHIVED',
+      `Active SDD change "${status.session.changeId}" is archived. Open a new active change session.`
+    );
+  }
+  if (!activeChangeExists(status.repoRoot, status.session.changeId)) {
+    return blocked(
+      'SDD_CHANGE_MISSING',
+      `Active SDD change "${status.session.changeId}" was not found in openspec/changes.`
+    );
+  }
+  return undefined;
+};
+
+export const evaluateSddPolicy = (params: {
+  stage: SddStage;
+  repoRoot?: string;
+}): SddEvaluateResult => {
+  const repoRoot = params.repoRoot ?? process.cwd();
+  const bypassEnabled = process.env.PUMUKI_SDD_BYPASS === '1';
+  const status = buildStatus(repoRoot);
+
+  if (bypassEnabled) {
+    return {
+      stage: params.stage,
+      status,
+      decision: allowed(
+        'SDD bypass is active via PUMUKI_SDD_BYPASS=1. Enforcement skipped by emergency override.',
+        {
+          bypass: true,
+          env: 'PUMUKI_SDD_BYPASS',
+        }
+      ),
+    };
+  }
+
+  if (!status.openspec.installed) {
+    return {
+      stage: params.stage,
+      status,
+      decision: blocked(
+        'OPENSPEC_MISSING',
+        'OpenSpec is required but was not detected. Install OpenSpec before continuing.'
+      ),
+    };
+  }
+
+  if (!status.openspec.compatible) {
+    return {
+      stage: params.stage,
+      status,
+      decision: blocked(
+        'OPENSPEC_VERSION_UNSUPPORTED',
+        `OpenSpec version is unsupported. Minimum required is ${status.openspec.minimumVersion} (detected: ${status.openspec.version ?? 'unknown'}).`
+      ),
+    };
+  }
+
+  if (!status.openspec.projectInitialized) {
+    return {
+      stage: params.stage,
+      status,
+      decision: blocked(
+        'OPENSPEC_PROJECT_MISSING',
+        'OpenSpec project is not initialized in this repository. Run OpenSpec init/bootstrap.'
+      ),
+    };
+  }
+
+  const sessionDecision = evaluateSessionRequirements(status);
+  if (sessionDecision) {
+    return {
+      stage: params.stage,
+      status,
+      decision: sessionDecision,
+    };
+  }
+
+  if (params.stage === 'PRE_WRITE') {
+    return {
+      stage: params.stage,
+      status,
+      decision: allowed('SDD pre-write checks passed with active valid session.'),
+    };
+  }
+
+  const validation = validateOpenSpecChanges(repoRoot);
+  if (!validation.ok) {
+    return {
+      stage: params.stage,
+      status,
+      validation,
+      decision: blocked(
+        validation.exitCode !== 0 ? 'SDD_VALIDATION_FAILED' : 'SDD_VALIDATION_ERROR',
+        'OpenSpec validation failed for active changes. Resolve SDD issues before continuing.',
+        {
+          exitCode: validation.exitCode,
+          failedItems: validation.totals.failed,
+          errors: validation.issues.errors,
+        }
+      ),
+    };
+  }
+
+  return {
+    stage: params.stage,
+    status,
+    validation,
+    decision: allowed('SDD validation passed for active changes.', {
+      passedItems: validation.totals.passed,
+      warnings: validation.issues.warnings,
+    }),
+  };
+};
+
+export const readSddStatus = (repoRoot?: string): SddStatusPayload =>
+  buildStatus(repoRoot ?? process.cwd());

package/integrations/sdd/sessionStore.ts

@@ -0,0 +1,152 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import {
+  LifecycleGitService,
+  type ILifecycleGitService,
+} from '../lifecycle/gitService';
+import type { SddSessionState } from './types';
+
+const SDD_KEYS = {
+  active: 'pumuki.sdd.session.active',
+  change: 'pumuki.sdd.session.change',
+  updatedAt: 'pumuki.sdd.session.updatedAt',
+  expiresAt: 'pumuki.sdd.session.expiresAt',
+  ttlMinutes: 'pumuki.sdd.session.ttlMinutes',
+} as const;
+
+const DEFAULT_TTL_MINUTES = 45;
+
+const resolveRepoRoot = (cwd: string, git: ILifecycleGitService): string =>
+  git.resolveRepoRoot(cwd);
+
+const nowIso = (): string => new Date().toISOString();
+
+const addMinutesIso = (minutes: number): string =>
+  new Date(Date.now() + minutes * 60_000).toISOString();
+
+const parsePositiveMinutes = (value: number | undefined): number =>
+  Number.isFinite(value) && (value as number) > 0
+    ? Math.floor(value as number)
+    : DEFAULT_TTL_MINUTES;
+
+const computeValidity = (expiresAt?: string): {
+  valid: boolean;
+  remainingSeconds?: number;
+} => {
+  if (!expiresAt) {
+    return { valid: false };
+  }
+  const target = new Date(expiresAt).getTime();
+  if (!Number.isFinite(target)) {
+    return { valid: false };
+  }
+  const remaining = Math.floor((target - Date.now()) / 1000);
+  if (remaining <= 0) {
+    return { valid: false, remainingSeconds: 0 };
+  }
+  return { valid: true, remainingSeconds: remaining };
+};
+
+const readConfig = (
+  repoRoot: string,
+  git: ILifecycleGitService
+): SddSessionState => {
+  const active = git.getLocalConfig(repoRoot, SDD_KEYS.active) === 'true';
+  const changeId = git.getLocalConfig(repoRoot, SDD_KEYS.change) ?? undefined;
+  const updatedAt = git.getLocalConfig(repoRoot, SDD_KEYS.updatedAt) ?? undefined;
+  const expiresAt = git.getLocalConfig(repoRoot, SDD_KEYS.expiresAt) ?? undefined;
+  const ttlRaw = git.getLocalConfig(repoRoot, SDD_KEYS.ttlMinutes);
+  const ttlMinutes =
+    typeof ttlRaw === 'string' && ttlRaw.trim().length > 0
+      ? Number.parseInt(ttlRaw, 10)
+      : undefined;
+
+  const validity = computeValidity(expiresAt);
+  return {
+    repoRoot,
+    active,
+    changeId,
+    updatedAt,
+    expiresAt,
+    ttlMinutes,
+    valid: active && !!changeId && validity.valid,
+    remainingSeconds: validity.remainingSeconds,
+  };
+};
+
+const ensureChangePath = (repoRoot: string, changeId: string): {
+  exists: boolean;
+  archived: boolean;
+} => {
+  const activePath = resolve(repoRoot, 'openspec', 'changes', changeId);
+  const archivedPath = resolve(repoRoot, 'openspec', 'changes', 'archive', changeId);
+  return {
+    exists: existsSync(activePath),
+    archived: existsSync(archivedPath),
+  };
+};
+
+export const readSddSession = (
+  cwd = process.cwd(),
+  git: ILifecycleGitService = new LifecycleGitService()
+): SddSessionState => {
+  const repoRoot = resolveRepoRoot(cwd, git);
+  return readConfig(repoRoot, git);
+};
+
+export const openSddSession = (params: {
+  changeId: string;
+  ttlMinutes?: number;
+  cwd?: string;
+  git?: ILifecycleGitService;
+}): SddSessionState => {
+  const git = params.git ?? new LifecycleGitService();
+  const repoRoot = resolveRepoRoot(params.cwd ?? process.cwd(), git);
+  const changeId = params.changeId.trim();
+  const changeState = ensureChangePath(repoRoot, changeId);
+  if (!changeState.exists) {
+    throw new Error(`OpenSpec change "${changeId}" not found in openspec/changes.`);
+  }
+  if (changeState.archived) {
+    throw new Error(`OpenSpec change "${changeId}" is archived and cannot be used as active SDD session.`);
+  }
+
+  const ttlMinutes = parsePositiveMinutes(params.ttlMinutes);
+  git.setLocalConfig(repoRoot, SDD_KEYS.active, 'true');
+  git.setLocalConfig(repoRoot, SDD_KEYS.change, changeId);
+  git.setLocalConfig(repoRoot, SDD_KEYS.updatedAt, nowIso());
+  git.setLocalConfig(repoRoot, SDD_KEYS.expiresAt, addMinutesIso(ttlMinutes));
+  git.setLocalConfig(repoRoot, SDD_KEYS.ttlMinutes, String(ttlMinutes));
+  return readConfig(repoRoot, git);
+};
+
+export const refreshSddSession = (params?: {
+  ttlMinutes?: number;
+  cwd?: string;
+  git?: ILifecycleGitService;
+}): SddSessionState => {
+  const git = params?.git ?? new LifecycleGitService();
+  const repoRoot = resolveRepoRoot(params?.cwd ?? process.cwd(), git);
+  const current = readConfig(repoRoot, git);
+  if (!current.active || !current.changeId) {
+    throw new Error('No active SDD session to refresh. Run `pumuki sdd session --open --change=<id>` first.');
+  }
+  const ttlMinutes = parsePositiveMinutes(params?.ttlMinutes ?? current.ttlMinutes);
+  git.setLocalConfig(repoRoot, SDD_KEYS.updatedAt, nowIso());
+  git.setLocalConfig(repoRoot, SDD_KEYS.expiresAt, addMinutesIso(ttlMinutes));
+  git.setLocalConfig(repoRoot, SDD_KEYS.ttlMinutes, String(ttlMinutes));
+  return readConfig(repoRoot, git);
+};
+
+export const closeSddSession = (
+  cwd = process.cwd(),
+  git: ILifecycleGitService = new LifecycleGitService()
+): SddSessionState => {
+  const repoRoot = resolveRepoRoot(cwd, git);
+  git.unsetLocalConfig(repoRoot, SDD_KEYS.active);
+  git.unsetLocalConfig(repoRoot, SDD_KEYS.change);
+  git.unsetLocalConfig(repoRoot, SDD_KEYS.updatedAt);
+  git.unsetLocalConfig(repoRoot, SDD_KEYS.expiresAt);
+  git.unsetLocalConfig(repoRoot, SDD_KEYS.ttlMinutes);
+  return readConfig(repoRoot, git);
+};

package/integrations/sdd/types.ts

@@ -0,0 +1,69 @@
+export type SddStage = 'PRE_WRITE' | 'PRE_COMMIT' | 'PRE_PUSH' | 'CI';
+
+export type SddDecisionCode =
+  | 'ALLOWED'
+  | 'OPENSPEC_MISSING'
+  | 'OPENSPEC_VERSION_UNSUPPORTED'
+  | 'OPENSPEC_PROJECT_MISSING'
+  | 'SDD_SESSION_MISSING'
+  | 'SDD_SESSION_INVALID'
+  | 'SDD_CHANGE_MISSING'
+  | 'SDD_CHANGE_ARCHIVED'
+  | 'SDD_VALIDATION_FAILED'
+  | 'SDD_VALIDATION_ERROR';
+
+export type SddDecision = {
+  allowed: boolean;
+  code: SddDecisionCode;
+  message: string;
+  details?: Record<string, unknown>;
+};
+
+export type OpenSpecValidationSummary = {
+  ok: boolean;
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+  totals: {
+    items: number;
+    failed: number;
+    passed: number;
+  };
+  issues: {
+    errors: number;
+    warnings: number;
+    infos: number;
+  };
+};
+
+export type SddSessionState = {
+  repoRoot: string;
+  active: boolean;
+  changeId?: string;
+  updatedAt?: string;
+  expiresAt?: string;
+  ttlMinutes?: number;
+  valid: boolean;
+  remainingSeconds?: number;
+};
+
+export type SddStatusPayload = {
+  repoRoot: string;
+  openspec: {
+    installed: boolean;
+    version?: string;
+    projectInitialized: boolean;
+    minimumVersion: string;
+    recommendedVersion: string;
+    compatible: boolean;
+    parsedVersion?: string;
+  };
+  session: SddSessionState;
+};
+
+export type SddEvaluateResult = {
+  stage: SddStage;
+  decision: SddDecision;
+  status: SddStatusPayload;
+  validation?: OpenSpecValidationSummary;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.13",
+  "version": "6.3.14",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {
@@ -9,9 +9,11 @@
     "ast-hooks": "bin/pumuki-framework.js",
     "pumuki-framework": "bin/pumuki-framework.js",
     "pumuki-pre-commit": "bin/pumuki-pre-commit.js",
+    "pumuki-pre-write": "bin/pumuki-pre-write.js",
     "pumuki-pre-push": "bin/pumuki-pre-push.js",
     "pumuki-ci": "bin/pumuki-ci.js",
-    "pumuki-mcp-evidence": "bin/pumuki-mcp-evidence.js"
+    "pumuki-mcp-evidence": "bin/pumuki-mcp-evidence.js",
+    "pumuki-mcp-enterprise": "bin/pumuki-mcp-enterprise.js"
   },
   "scripts": {
     "install-hooks": "node bin/pumuki.js install",
@@ -22,6 +24,7 @@
     "pumuki:update": "node bin/pumuki.js update --latest",
     "pumuki:doctor": "node bin/pumuki.js doctor",
     "pumuki:status": "node bin/pumuki.js status",
+    "pumuki:sdd:pre-write": "node bin/pumuki-pre-write.js",
     "audit": "node bin/ast",
     "ast": "node bin/ast",
     "audit-library": "node bin/audit-library.js",
@@ -37,14 +40,14 @@
     "violations:summary": "node bin/violations summary",
     "violations:top": "node bin/violations top",
     "violations:demo": "bash bin/demo-violations",
-    "test": "npx --yes tsx@4.21.0 --test integrations/config/__tests__/*.test.ts integrations/gate/__tests__/*.test.ts integrations/git/__tests__/*.test.ts integrations/lifecycle/__tests__/*.test.ts scripts/__tests__/*.test.ts && jest --runInBand --testMatch \"**/__tests__/**/*.spec.ts\"",
+    "test": "npx --yes tsx@4.21.0 --test integrations/config/__tests__/*.test.ts integrations/gate/__tests__/*.test.ts integrations/git/__tests__/*.test.ts integrations/lifecycle/__tests__/*.test.ts integrations/sdd/__tests__/*.test.ts scripts/__tests__/*.test.ts && jest --runInBand --testMatch \"**/__tests__/**/*.spec.ts\"",
     "lint": "npm run typecheck",
     "build:ts": "tsc --noEmit",
     "typecheck": "tsc --noEmit",
     "test:heuristics": "npx --yes tsx@4.21.0 --test core/facts/__tests__/extractHeuristicFacts.test.ts",
     "test:evidence": "npx --yes tsx@4.21.0 --test integrations/evidence/__tests__/buildEvidence.test.ts integrations/evidence/__tests__/humanIntent.test.ts",
     "test:mcp": "npx --yes tsx@4.21.0 --test integrations/mcp/__tests__/*.test.ts",
-    "test:stage-gates": "npx --yes tsx@4.21.0 --test integrations/config/__tests__/*.test.ts integrations/gate/__tests__/*.test.ts integrations/git/__tests__/*.test.ts integrations/lifecycle/__tests__/*.test.ts scripts/__tests__/*.test.ts",
+    "test:stage-gates": "npx --yes tsx@4.21.0 --test integrations/config/__tests__/*.test.ts integrations/gate/__tests__/*.test.ts integrations/git/__tests__/*.test.ts integrations/lifecycle/__tests__/*.test.ts integrations/sdd/__tests__/*.test.ts scripts/__tests__/*.test.ts",
     "test:deterministic": "npm run test:evidence && npm run test:mcp && npm run test:heuristics",
     "ast:refresh": "bash scripts/hooks-system/bin/update-evidence.sh",
     "ast:audit": "node scripts/hooks-system/infrastructure/ast/ast-intelligence.js",
@@ -103,6 +106,7 @@
     "skills:compile": "npx --yes tsx@4.21.0 scripts/compile-skills-lock.ts",
     "skills:lock:check": "npx --yes tsx@4.21.0 scripts/compile-skills-lock.ts --check",
     "mcp:evidence": "node bin/pumuki-mcp-evidence.js",
+    "mcp:enterprise": "node bin/pumuki-mcp-enterprise.js",
     "validate:adapter-hooks-local": "echo 'Migrated to modern TS scripts — use validation:adapter-readiness instead'",
     "verify:adapter-hooks-runtime": "echo 'Migrated to modern TS scripts — use validation:adapter-readiness instead'"
   },
@@ -185,6 +189,7 @@
     "integrations/gate/*.ts",
     "integrations/git/*.ts",
     "integrations/lifecycle/*.ts",
+    "integrations/sdd/*.ts",
     "integrations/mcp/*.ts",
     "integrations/platform/*.ts",
     "scripts/*.ts",
@@ -211,6 +216,7 @@
     "./package.json": "./package.json",
     "./integrations/git": "./integrations/git/index.ts",
     "./integrations/lifecycle": "./integrations/lifecycle/index.ts",
+    "./integrations/sdd": "./integrations/sdd/index.ts",
     "./integrations/mcp": "./integrations/mcp/index.ts",
     "./core/gate/evaluateGate": "./core/gate/evaluateGate.ts",
     "./core/gate/evaluateRules": "./core/gate/evaluateRules.ts"

package/scripts/framework-menu-runner-path-lib.ts

@@ -2,9 +2,16 @@ import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 
 export const resolveScriptOrReportMissing = (relativePath: string): string | undefined => {
-  const scriptPath = resolve(process.cwd(), relativePath);
-  if (existsSync(scriptPath)) {
-    return scriptPath;
+  const repoLocalPath = resolve(process.cwd(), relativePath);
+  if (existsSync(repoLocalPath)) {
+    return repoLocalPath;
+  }
+
+  // Consumer repos run menu binaries from node_modules, so scripts must also
+  // be resolved relative to the installed package root.
+  const packageFallbackPath = resolve(__dirname, '..', relativePath);
+  if (existsSync(packageFallbackPath)) {
+    return packageFallbackPath;
   }
 
   process.stdout.write(`\nCould not find ${relativePath} in current repository.\n`);