pumuki 6.3.185 → 6.3.187

package/VERSION

@@ -1 +1 @@
-v6.3.185
+v6.3.187

package/core/facts/detectors/text/android.test.ts

@@ -11,6 +11,7 @@ import {
   hasKotlinGlobalScopeUsage,
   hasKotlinHardcodedBackgroundDispatcherUsage,
   hasKotlinLiveDataStateExposureUsage,
+  hasKotlinLifecycleScopeUsage,
   hasKotlinWithContextUsage,
   hasKotlinManualCoroutineScopeInViewModelUsage,
   hasKotlinRunBlockingUsage,
@@ -221,6 +222,31 @@ class SyncOrdersUseCase {
   assert.equal(hasKotlinWithContextUsage(source), false);
 });
 
+test('hasKotlinLifecycleScopeUsage detecta lifecycleScope con llamadas encadenadas', () => {
+  const source = `
+class SyncOrdersUseCase {
+  fun execute() {
+    lifecycleScope.launch { syncRemote() }
+  }
+}
+`;
+  assert.equal(hasKotlinLifecycleScopeUsage(source), true);
+});
+
+test('hasKotlinLifecycleScopeUsage ignora imports, comentarios, strings y nombres parciales', () => {
+  const source = `
+import androidx.lifecycle.lifecycleScope
+// lifecycleScope.launch { syncRemote() }
+val sample = "lifecycleScope.launch { syncRemote() }"
+class SyncOrdersUseCase {
+  fun execute() {
+    customLifecycleScope.launch { syncRemote() }
+  }
+}
+`;
+  assert.equal(hasKotlinLifecycleScopeUsage(source), false);
+});
+
 test('hasKotlinSupervisorScopeUsage detecta supervisorScope con parentesis y llaves', () => {
   const parenthesesSource = `
 class SyncOrdersUseCase {

package/core/facts/detectors/text/android.ts

@@ -263,6 +263,10 @@ export const hasKotlinWithContextUsage = (source: string): boolean => {
   return collectKotlinRegexLines(source, /\bwithContext\s*(?:<[^>\n]+>\s*)?\(/).length > 0;
 };
 
+export const hasKotlinLifecycleScopeUsage = (source: string): boolean => {
+  return collectKotlinRegexLines(source, /\blifecycleScope\s*\./).length > 0;
+};
+
 export const hasKotlinSupervisorScopeUsage = (source: string): boolean => {
   return collectKotlinRegexLines(source, /\bsupervisorScope\s*(?:<[^>\n]+>\s*)?(?:\(|\{)/).length > 0;
 };

package/core/facts/extractHeuristicFacts.ts

@@ -91,6 +91,13 @@ const isAndroidKotlinPath = (path: string): boolean => {
   return (path.endsWith('.kt') || path.endsWith('.kts')) && path.startsWith('apps/android/');
 };
 
+const isAndroidLocalPropertiesPath = (path: string): boolean => {
+  const normalized = path.replace(/\\/g, '/').toLowerCase();
+  return normalized.startsWith('apps/android/') && normalized.endsWith('/local.properties');
+};
+
+const detectsTrackedFilePresence = (_source: string): boolean => true;
+
 const isAndroidPresentationPath = (path: string): boolean => {
   return isAndroidKotlinPath(path) && path.includes('/presentation/');
 };
@@ -645,11 +652,13 @@ const textDetectorRegistry: ReadonlyArray<TextDetectorRegistryEntry> = [
   { platform: 'android', pathCheck: isAndroidKotlinPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinThreadSleepCall, ruleId: 'heuristics.android.thread-sleep.ast', code: 'HEURISTICS_ANDROID_THREAD_SLEEP_AST', message: 'AST heuristic detected Thread.sleep usage in production Kotlin code.' },
   { platform: 'android', pathCheck: isAndroidKotlinPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinGlobalScopeUsage, ruleId: 'heuristics.android.globalscope.ast', code: 'HEURISTICS_ANDROID_GLOBAL_SCOPE_AST', message: 'AST heuristic detected GlobalScope coroutine usage in production Kotlin code.' },
   { platform: 'android', pathCheck: isAndroidKotlinPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinRunBlockingUsage, ruleId: 'heuristics.android.run-blocking.ast', code: 'HEURISTICS_ANDROID_RUN_BLOCKING_AST', message: 'AST heuristic detected runBlocking usage in production Kotlin code.' },
+  { platform: 'android', pathCheck: isAndroidLocalPropertiesPath, excludePaths: [], detect: detectsTrackedFilePresence, ruleId: 'heuristics.android.security.local-properties-tracked.ast', code: 'HEURISTICS_ANDROID_SECURITY_LOCAL_PROPERTIES_TRACKED_AST', message: 'AST heuristic detected tracked Android local.properties file.' },
   { platform: 'android', pathCheck: isAndroidPresentationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinLiveDataStateExposureUsage, ruleId: 'heuristics.android.flow.livedata-state-exposure.ast', code: 'HEURISTICS_ANDROID_FLOW_LIVEDATA_STATE_EXPOSURE_AST', message: 'AST heuristic detected LiveData state exposure in Android presentation code where StateFlow or SharedFlow should be preferred.' },
   { platform: 'android', pathCheck: isAndroidPresentationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinManualCoroutineScopeInViewModelUsage, ruleId: 'heuristics.android.coroutines.manual-scope-in-viewmodel.ast', code: 'HEURISTICS_ANDROID_COROUTINES_MANUAL_SCOPE_IN_VIEWMODEL_AST', message: 'AST heuristic detected manual CoroutineScope inside an Android ViewModel where viewModelScope should be preferred.' },
   { platform: 'android', pathCheck: isAndroidNonPresentationKotlinPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinDispatcherMainBoundaryLeakUsage, ruleId: 'heuristics.android.coroutines.dispatchers-main-boundary-leak.ast', code: 'HEURISTICS_ANDROID_COROUTINES_DISPATCHERS_MAIN_BOUNDARY_LEAK_AST', message: 'AST heuristic detected Dispatchers.Main outside Android presentation code.' },
   { platform: 'android', pathCheck: isAndroidDomainOrApplicationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinHardcodedBackgroundDispatcherUsage, ruleId: 'heuristics.android.coroutines.hardcoded-background-dispatcher.ast', code: 'HEURISTICS_ANDROID_COROUTINES_HARDCODED_BACKGROUND_DISPATCHER_AST', message: 'AST heuristic detected hard-coded Dispatchers.IO or Dispatchers.Default in Android domain/application code.' },
   { platform: 'android', pathCheck: isAndroidDomainOrApplicationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinWithContextUsage, ruleId: 'heuristics.android.coroutines.with-context.ast', code: 'HEURISTICS_ANDROID_COROUTINES_WITH_CONTEXT_AST', message: 'AST heuristic detected withContext usage in Android domain/application code.' },
+  { platform: 'android', pathCheck: isAndroidDomainOrApplicationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinLifecycleScopeUsage, ruleId: 'heuristics.android.coroutines.lifecycle-scope-boundary-leak.ast', code: 'HEURISTICS_ANDROID_COROUTINES_LIFECYCLE_SCOPE_BOUNDARY_LEAK_AST', message: 'AST heuristic detected lifecycleScope usage in Android domain/application code.' },
   { platform: 'android', pathCheck: isAndroidDomainOrApplicationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinSupervisorScopeUsage, ruleId: 'heuristics.android.coroutines.supervisor-scope.ast', code: 'HEURISTICS_ANDROID_COROUTINES_SUPERVISOR_SCOPE_AST', message: 'AST heuristic detected supervisorScope usage in Android domain/application code.' },
   { platform: 'android', pathCheck: isAndroidDomainOrApplicationPath, excludePaths: [isKotlinTestPath], detect: TextAndroid.hasKotlinCoroutineTryCatchUsage, ruleId: 'heuristics.android.coroutines.try-catch.ast', code: 'HEURISTICS_ANDROID_COROUTINES_TRY_CATCH_AST', message: 'AST heuristic detected try-catch handling in Android coroutine code.' },
 ];

package/core/rules/presets/heuristics/android.test.ts

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { androidRules } from './android';
 
 test('androidRules define reglas heurísticas locked para plataforma android', () => {
-  assert.equal(androidRules.length, 15);
+  assert.equal(androidRules.length, 17);
 
   const ids = androidRules.map((rule) => rule.id);
   assert.deepEqual(ids, [
@@ -11,10 +11,12 @@ test('androidRules define reglas heurísticas locked para plataforma android', (
     'heuristics.android.globalscope.ast',
     'heuristics.android.run-blocking.ast',
     'heuristics.android.flow.livedata-state-exposure.ast',
+    'heuristics.android.security.local-properties-tracked.ast',
     'heuristics.android.coroutines.manual-scope-in-viewmodel.ast',
     'heuristics.android.coroutines.dispatchers-main-boundary-leak.ast',
     'heuristics.android.coroutines.hardcoded-background-dispatcher.ast',
     'heuristics.android.coroutines.with-context.ast',
+    'heuristics.android.coroutines.lifecycle-scope-boundary-leak.ast',
     'heuristics.android.coroutines.supervisor-scope.ast',
     'heuristics.android.coroutines.try-catch.ast',
     'heuristics.android.solid.srp.presentation-mixed-responsibilities.ast',
@@ -51,6 +53,10 @@ test('androidRules define reglas heurísticas locked para plataforma android', (
     byId.get('heuristics.android.flow.livedata-state-exposure.ast')?.then.code,
     'HEURISTICS_ANDROID_FLOW_LIVEDATA_STATE_EXPOSURE_AST'
   );
+  assert.equal(
+    byId.get('heuristics.android.security.local-properties-tracked.ast')?.then.code,
+    'HEURISTICS_ANDROID_SECURITY_LOCAL_PROPERTIES_TRACKED_AST'
+  );
   assert.equal(
     byId.get('heuristics.android.coroutines.manual-scope-in-viewmodel.ast')?.then.code,
     'HEURISTICS_ANDROID_COROUTINES_MANUAL_SCOPE_IN_VIEWMODEL_AST'
@@ -67,6 +73,10 @@ test('androidRules define reglas heurísticas locked para plataforma android', (
     byId.get('heuristics.android.coroutines.with-context.ast')?.then.code,
     'HEURISTICS_ANDROID_COROUTINES_WITH_CONTEXT_AST'
   );
+  assert.equal(
+    byId.get('heuristics.android.coroutines.lifecycle-scope-boundary-leak.ast')?.then.code,
+    'HEURISTICS_ANDROID_COROUTINES_LIFECYCLE_SCOPE_BOUNDARY_LEAK_AST'
+  );
   assert.equal(
     byId.get('heuristics.android.coroutines.supervisor-scope.ast')?.then.code,
     'HEURISTICS_ANDROID_COROUTINES_SUPERVISOR_SCOPE_AST'

package/core/rules/presets/heuristics/android.ts

@@ -75,6 +75,26 @@ export const androidRules: RuleSet = [
       code: 'HEURISTICS_ANDROID_FLOW_LIVEDATA_STATE_EXPOSURE_AST',
     },
   },
+  {
+    id: 'heuristics.android.security.local-properties-tracked.ast',
+    description:
+      'Detects tracked Android local.properties files that may expose machine-local SDK paths or secrets.',
+    severity: 'WARN',
+    platform: 'android',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.android.security.local-properties-tracked.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message:
+        'AST heuristic detected tracked Android local.properties file.',
+      code: 'HEURISTICS_ANDROID_SECURITY_LOCAL_PROPERTIES_TRACKED_AST',
+    },
+  },
   {
     id: 'heuristics.android.coroutines.manual-scope-in-viewmodel.ast',
     description:
@@ -155,6 +175,26 @@ export const androidRules: RuleSet = [
       code: 'HEURISTICS_ANDROID_COROUTINES_WITH_CONTEXT_AST',
     },
   },
+  {
+    id: 'heuristics.android.coroutines.lifecycle-scope-boundary-leak.ast',
+    description:
+      'Detects lifecycleScope usage in Android domain/application code where lifecycle ownership belongs to UI lifecycle owners.',
+    severity: 'WARN',
+    platform: 'android',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.android.coroutines.lifecycle-scope-boundary-leak.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message:
+        'AST heuristic detected lifecycleScope usage in Android domain/application code.',
+      code: 'HEURISTICS_ANDROID_COROUTINES_LIFECYCLE_SCOPE_BOUNDARY_LEAK_AST',
+    },
+  },
   {
     id: 'heuristics.android.coroutines.supervisor-scope.ast',
     description:

package/docs/codex-skills/android-enterprise-rules.md

@@ -127,11 +127,16 @@ app/
 ✅ `skills.android.guideline.android.viewmodelscope-scope-de-viewmodel-cancelado-automa-ticamente` debe mapear a señales ejecutables de scopes manuales dentro de `ViewModel`, empezando por `CoroutineScope(...)` construido en presentation.
 ✅ `skills.android.guideline.android.dispatchers-main-ui-io-network-disk-default-cpu` debe mapear a señales ejecutables de dispatchers mal ubicados: `Dispatchers.Main` fuera de `presentation` y `Dispatchers.IO` / `Dispatchers.Default` hardcodeados en `domain` o `application` en lugar de entrar por frontera inyectable.
 ✅ `skills.android.guideline.android.withcontext-cambiar-dispatcher` debe mapear a señal ejecutable de `withContext` en `domain` o `application`.
+✅ `skills.android.guideline.android.lifecyclescope-scope-de-activity-fragment` debe mapear a señal ejecutable de `lifecycleScope` fuera de la capa UI, empezando por `domain` o `application`.
 ✅ `skills.android.guideline.android.supervisorscope-errores-no-cancelan-otros-jobs` debe mapear a señal ejecutable de `supervisorScope` en `domain` o `application`.
 ✅ `skills.android.guideline.android.try-catch-manejo-de-errores-en-coroutines` debe mapear a señal ejecutable de `try/catch` dentro de código coroutine en `domain` o `application`.
-✅ El baseline inicial de coroutines es parcial: cubre APIs bloqueantes, scopes no estructurados, scopes manuales en `ViewModel`, filtraciones de `Dispatchers.Main`, hardcode de dispatchers de background en dominio/aplicación, `withContext`, `supervisorScope` y `try/catch` en coroutines, pero no declara todavía cobertura completa de `Flow`, dispatchers ni cancelación cooperativa.
+✅ El baseline inicial de coroutines es parcial: cubre APIs bloqueantes, scopes no estructurados, scopes manuales en `ViewModel`, filtraciones de `Dispatchers.Main`, hardcode de dispatchers de background en dominio/aplicación, `withContext`, fuga de `lifecycleScope`, `supervisorScope` y `try/catch` en coroutines, pero no declara todavía cobertura completa de `Flow`, dispatchers ni cancelación cooperativa.
 ✅ Si se amplía esta cobertura, cada nueva regla debe aterrizar como detector AST/textual semántico con test dirigido antes de declararse cubierta en el registry.
 
+### Enforcement AST inicial de seguridad Android
+✅ `skills.android.guideline.android.local-properties-api-keys-no-subir-a-git` debe mapear a señal ejecutable de `local.properties` versionado bajo `apps/android/`.
+✅ Este baseline no imprime ni analiza valores secretos; solo reporta la presencia del archivo versionado y exige retirarlo del control de versiones.
+
 ### Enforcement AST inicial de Flow/StateFlow Android
 ✅ Las reglas de `StateFlow` / `StateFlow-SharedFlow` deben mapear a señales ejecutables de estado observable legacy, empezando por exposición de `LiveData` / `MutableLiveData` en presentation.
 ✅ Este baseline no obliga a que todo ViewModel use Flow; solo detecta una alternativa legacy concreta cuando aparece en código de presentación Android.

package/integrations/config/skillsDetectorRegistry.ts

@@ -235,6 +235,10 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     'android.coroutines.with-context',
     ['heuristics.android.coroutines.with-context.ast']
   ),
+  'skills.android.guideline.android.lifecyclescope-scope-de-activity-fragment': heuristicDetector(
+    'android.coroutines.lifecycle-scope',
+    ['heuristics.android.coroutines.lifecycle-scope-boundary-leak.ast']
+  ),
   'skills.android.guideline.android.supervisorscope-errores-no-cancelan-otros-jobs': heuristicDetector(
     'android.coroutines.supervisor-scope',
     ['heuristics.android.coroutines.supervisor-scope.ast']
@@ -243,6 +247,10 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     'android.coroutines.try-catch',
     ['heuristics.android.coroutines.try-catch.ast']
   ),
+  'skills.android.guideline.android.local-properties-api-keys-no-subir-a-git': heuristicDetector(
+    'android.security.local-properties',
+    ['heuristics.android.security.local-properties-tracked.ast']
+  ),
   'skills.android.guideline.android.stateflow-estado-mutable-observable': heuristicDetector(
     'android.flow.state-exposure',
     ['heuristics.android.flow.livedata-state-exposure.ast']

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.185",
+  "version": "6.3.187",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {

package/skills.lock.json

@@ -1,7 +1,7 @@
 {
   "version": "1.0",
   "compilerVersion": "1.0.0",
-  "generatedAt": "2026-05-12T20:54:35.698Z",
+  "generatedAt": "2026-05-12T21:06:58.727Z",
   "bundles": [
     {
       "name": "android-guidelines",