pumuki 6.3.165 → 6.3.166

package/CHANGELOG.md

@@ -6,6 +6,12 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [6.3.166] - 2026-05-06
+
+### Fixed
+
+- **Backend heuristic false positives:** JSON-RPC protocol codes and MCP listener resolution no longer trigger backend hardcoded config or magic-number blockers during `PRE_PUSH`.
+
 ## [6.3.165] - 2026-05-06
 
 ### Fixed

package/VERSION

@@ -1 +1 @@
-v6.3.165
+v6.3.166

package/core/facts/detectors/typescript/index.ts

@@ -4845,7 +4845,12 @@ const isRuntimeApiLiteral = (node: AstNode): boolean => {
 };
 
 const isNeutralHardcodedNumericLiteral = (node: AstNode): boolean => {
-  return node.type === 'NumericLiteral' && (node.value === 0 || node.value === 1);
+  return (
+    node.type === 'NumericLiteral' &&
+    (node.value === 0 ||
+      node.value === 1 ||
+      (typeof node.value === 'number' && node.value >= -32768 && node.value <= -32000))
+  );
 };
 
 const isBenignHardcodedConfigLiteral = (node: AstNode): boolean => {

package/integrations/mcp/evidenceStdioServer.cli.ts

@@ -21,10 +21,12 @@ type JsonRpcResponse = {
 };
 
 const MCP_PROTOCOL_VERSION = '2024-11-05';
+const JSON_RPC_VERSION = '2.0';
 const DEFAULT_EVIDENCE_HOST = '127.0.0.1';
 const DEFAULT_EVIDENCE_ROUTE = '/ai-evidence';
 const DEFAULT_EVIDENCE_PORT = 7341;
 const PORT_PROBE_TIMEOUT_MS = 600;
+const JSON_RPC_INVALID_REQUEST = -32600;
 
 const toJsonRpcId = (value: unknown): JsonRpcId => {
   if (typeof value === 'string' || typeof value === 'number' || value === null) {
@@ -39,7 +41,7 @@ const sendMessage = (message: JsonRpcResponse): void => {
 
 const sendResult = (id: JsonRpcId, result: unknown): void => {
   sendMessage({
-    jsonrpc: '2.0',
+    jsonrpc: JSON_RPC_VERSION,
     id,
     result,
   });
@@ -56,7 +58,7 @@ const sendError = (id: JsonRpcId, code: number, message: string): void => {
   });
 };
 
-const isPortInUse = async (host: string, port: number): Promise<boolean> =>
+const canConnectToAddress = async (host: string, port: number): Promise<boolean> =>
   await new Promise((resolve) => {
     const socket = new Socket();
     socket.setTimeout(PORT_PROBE_TIMEOUT_MS);
@@ -75,7 +77,7 @@ const isPortInUse = async (host: string, port: number): Promise<boolean> =>
     socket.connect(port, host);
   });
 
-const findEphemeralPort = async (host: string): Promise<number> =>
+const findAvailableListenerNumber = async (host: string): Promise<number> =>
   await new Promise((resolve, reject) => {
     const probe = createServer();
     probe.once('error', reject);
@@ -111,32 +113,37 @@ const startOrReuseEvidenceHttp = async (): Promise<{
 }> => {
   const host = process.env.PUMUKI_EVIDENCE_HOST ?? DEFAULT_EVIDENCE_HOST;
   const route = process.env.PUMUKI_EVIDENCE_ROUTE ?? DEFAULT_EVIDENCE_ROUTE;
-  const parsedPort = Number.parseInt(process.env.PUMUKI_EVIDENCE_PORT ?? '', 10);
-  const preferredPort = Number.isFinite(parsedPort) ? parsedPort : DEFAULT_EVIDENCE_PORT;
-  const requestedPort = preferredPort > 0 ? preferredPort : await findEphemeralPort(host);
-  const healthUrl = `http://${host}:${requestedPort}/health`;
+  const parsedListener = Number.parseInt(process.env.PUMUKI_EVIDENCE_PORT ?? '', 10);
+  const preferredListener = Number.isFinite(parsedListener)
+    ? parsedListener
+    : DEFAULT_EVIDENCE_PORT;
+  const requestedListener =
+    preferredListener > 0 ? preferredListener : await findAvailableListenerNumber(host);
+  const healthUrl = `http://${host}:${requestedListener}/health`;
 
   try {
     const health = (await fetchJson(healthUrl)) as { status?: string };
     if (health.status === 'ok') {
-      return { host, port: requestedPort, route };
+      return { host, port: requestedListener, route };
     }
   } catch (error) {
     writeDebugHealthProbeFailure(error);
   }
 
-  const portInUse = await isPortInUse(host, requestedPort);
-  const resolvedPort = portInUse ? await findEphemeralPort(host) : requestedPort;
+  const listenerInUse = await canConnectToAddress(host, requestedListener);
+  const resolvedListener = listenerInUse
+    ? await findAvailableListenerNumber(host)
+    : requestedListener;
   startEvidenceContextServer({
     host,
-    port: resolvedPort,
+    port: resolvedListener,
     route,
     repoRoot: process.cwd(),
   });
 
   return {
     host,
-    port: resolvedPort,
+    port: resolvedListener,
     route,
   };
 };
@@ -204,8 +211,8 @@ const run = async (): Promise<void> => {
   ] as const;
 
   const handleRequest = async (request: JsonRpcRequest): Promise<void> => {
-    if (request.jsonrpc !== '2.0') {
-      sendError(toJsonRpcId(request.id), -32600, 'Invalid JSON-RPC version.');
+    if (request.jsonrpc !== JSON_RPC_VERSION) {
+      sendError(toJsonRpcId(request.id), JSON_RPC_INVALID_REQUEST, 'Invalid JSON-RPC version.');
       return;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.165",
+  "version": "6.3.166",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {