pumuki 6.3.26 → 6.3.28

package/README.md

@@ -211,7 +211,9 @@ npx --yes pumuki-ci
 
 ```bash
 npx --yes pumuki-mcp-evidence
-npx --yes pumuki-mcp-enterprise
+npx --yes --package pumuki@latest pumuki-mcp-evidence-stdio
+npx --yes --package pumuki@latest pumuki-mcp-enterprise
+npx --yes --package pumuki@latest pumuki-mcp-enterprise-stdio
 ```
 
 ## Validation and Diagnostics (Framework-Only)

package/bin/pumuki-mcp-enterprise-stdio.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/mcp/enterpriseStdioServer.cli.ts', process.argv.slice(2)));

package/bin/pumuki-mcp-evidence-stdio.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/mcp/evidenceStdioServer.cli.ts', process.argv.slice(2)));

package/core/gate/conditionMatches.ts

@@ -4,6 +4,7 @@ import type { Fact } from '../facts/Fact';
 import type { DependencyFact } from '../facts/DependencyFact';
 import type { FileChangeFact } from '../facts/FileChangeFact';
 import type { FileContentFact } from '../facts/FileContentFact';
+import { matchesScope } from './scopeMatcher';
 
 type RuleScope = RuleDefinition['scope'];
 
@@ -26,27 +27,6 @@ const isDependencyFact = (fact: FactInput): fact is DependencyFact =>
 const isHeuristicFact = (fact: FactInput): fact is Extract<Fact, { kind: 'Heuristic' }> =>
   fact.kind === 'Heuristic';
 
-const extractPrefix = (pattern: string): string => {
-  const wildcardIndex = pattern.indexOf('*');
-  return wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
-};
-
-const matchesAnyPrefix = (path: string, patterns: ReadonlyArray<string>): boolean => {
-  return patterns.some((pattern) => path.startsWith(extractPrefix(pattern)));
-};
-
-const matchesScope = (path: string, scope?: RuleScope): boolean => {
-  const include = scope?.include;
-  const exclude = scope?.exclude;
-  if (exclude && exclude.length > 0 && matchesAnyPrefix(path, exclude)) {
-    return false;
-  }
-  if (!include || include.length === 0) {
-    return true;
-  }
-  return matchesAnyPrefix(path, include);
-};
-
 const matchesFileChange = (
   condition: Extract<Condition, { kind: 'FileChange' }>,
   facts: ReadonlyArray<FactInput>

package/core/gate/evaluateGate.js

@@ -0,0 +1,5 @@
+'use strict';
+
+require('tsx/cjs');
+
+module.exports = require('./evaluateGate.ts');

package/core/gate/evaluateRules.js

@@ -0,0 +1,5 @@
+'use strict';
+
+require('tsx/cjs');
+
+module.exports = require('./evaluateRules.ts');

package/core/gate/evaluateRules.ts

@@ -7,6 +7,7 @@ import type { FileChangeFact } from '../facts/FileChangeFact';
 import type { FileContentFact } from '../facts/FileContentFact';
 import type { Finding } from './Finding';
 import { conditionMatches } from './conditionMatches';
+import { matchesScope } from './scopeMatcher';
 
 type FactInput = Fact | FileChangeFact | FileContentFact;
 
@@ -37,30 +38,6 @@ const toFinding = (
   };
 };
 
-const extractPrefix = (pattern: string): string => {
-  const wildcardIndex = pattern.indexOf('*');
-  return wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
-};
-
-const matchesAnyPrefix = (path: string, patterns: ReadonlyArray<string>): boolean => {
-  return patterns.some((pattern) => path.startsWith(extractPrefix(pattern)));
-};
-
-const matchesScope = (
-  path: string,
-  scope?: RuleDefinition['scope']
-): boolean => {
-  const include = scope?.include;
-  const exclude = scope?.exclude;
-  if (exclude && exclude.length > 0 && matchesAnyPrefix(path, exclude)) {
-    return false;
-  }
-  if (!include || include.length === 0) {
-    return true;
-  }
-  return matchesAnyPrefix(path, include);
-};
-
 const collectSimpleFindingTargets = (
   condition: Condition,
   facts: ReadonlyArray<FactInput>,

package/core/gate/scopeMatcher.ts

@@ -0,0 +1,84 @@
+import type { RuleDefinition } from '../rules/RuleDefinition';
+
+type RuleScope = RuleDefinition['scope'];
+
+const SPECIAL_REGEX_CHARS = /[|\\{}()[\]^$+?.]/;
+const regexCache = new Map<string, RegExp>();
+
+const normalize = (value: string): string => {
+  return value.replace(/\\/g, '/');
+};
+
+const escapeRegexChar = (value: string): string => {
+  return SPECIAL_REGEX_CHARS.test(value) ? `\\${value}` : value;
+};
+
+const toGlobRegex = (pattern: string): RegExp => {
+  const cached = regexCache.get(pattern);
+  if (cached) {
+    return cached;
+  }
+
+  let regex = '^';
+  for (let index = 0; index < pattern.length;) {
+    if (pattern.startsWith('**/', index)) {
+      regex += '(?:.*/)?';
+      index += 3;
+      continue;
+    }
+    if (pattern.startsWith('**', index)) {
+      regex += '.*';
+      index += 2;
+      continue;
+    }
+
+    const char = pattern[index];
+    if (char === '*') {
+      regex += '[^/]*';
+      index += 1;
+      continue;
+    }
+
+    regex += escapeRegexChar(char);
+    index += 1;
+  }
+  regex += '$';
+
+  const compiled = new RegExp(regex);
+  regexCache.set(pattern, compiled);
+  return compiled;
+};
+
+const matchesPattern = (path: string, pattern: string): boolean => {
+  const normalizedPath = normalize(path);
+  const normalizedPattern = normalize(pattern);
+
+  const wildcardIndex = normalizedPattern.indexOf('*');
+  if (wildcardIndex === -1) {
+    return normalizedPath.startsWith(normalizedPattern);
+  }
+
+  const prefix = normalizedPattern.slice(0, wildcardIndex);
+  if (prefix.length > 0 && normalizedPath.startsWith(prefix)) {
+    return true;
+  }
+
+  return toGlobRegex(normalizedPattern).test(normalizedPath);
+};
+
+const matchesAnyPattern = (path: string, patterns: ReadonlyArray<string>): boolean => {
+  return patterns.some((pattern) => matchesPattern(path, pattern));
+};
+
+export const matchesScope = (path: string, scope?: RuleScope): boolean => {
+  const include = scope?.include;
+  const exclude = scope?.exclude;
+
+  if (exclude && exclude.length > 0 && matchesAnyPattern(path, exclude)) {
+    return false;
+  }
+  if (!include || include.length === 0) {
+    return true;
+  }
+  return matchesAnyPattern(path, include);
+};