pumuki 6.3.267 → 6.3.269

package/integrations/lifecycle/cli.ts

@@ -76,6 +76,11 @@ import {
 import { runPolicyReconcile } from './policyReconcile';
 import { runLifecycleAudit, type LifecycleAuditStage } from './audit';
 import { resolvePreWriteEnforcement, type PreWriteEnforcementResolution } from '../policy/preWriteEnforcement';
+import {
+  readLocalContextStatus,
+  repairLocalContext,
+  writeLocalContext,
+} from '../context/contextGate';
 
 type LifecycleCommand =
   | 'bootstrap'
@@ -92,6 +97,7 @@ type LifecycleCommand =
   | 'adapter'
   | 'analytics'
   | 'policy'
+  | 'context'
   | 'audit';
 
 type SddCommand =
@@ -107,6 +113,7 @@ type LoopCommand = 'run' | 'status' | 'stop' | 'resume' | 'list' | 'export';
 type AnalyticsCommand = 'hotspots';
 type AnalyticsHotspotsCommand = 'report' | 'diagnose';
 type PolicyCommand = 'reconcile';
+type ContextCommand = 'init' | 'status' | 'repair';
 
 type SddSessionAction = 'open' | 'refresh' | 'close';
 
@@ -178,6 +185,7 @@ export type ParsedArgs = {
   policyCommand?: PolicyCommand;
   policyStrict?: boolean;
   policyApply?: boolean;
+  contextCommand?: ContextCommand;
   auditStage?: LifecycleAuditStage;
   auditEngine?: boolean;
 };
@@ -204,6 +212,9 @@ Pumuki lifecycle commands:
   pumuki analytics hotspots report [--top=<n>] [--since-days=<n>] [--json] [--output-json=<path>] [--output-markdown=<path>]
   pumuki analytics hotspots diagnose [--json]
   pumuki policy reconcile [--strict] [--apply] [--json]
+  pumuki context init [--json]
+  pumuki context status [--json]
+  pumuki context repair [--json]
   pumuki sdd status [--json]
   pumuki sdd validate [--stage=PRE_WRITE|PRE_COMMIT|PRE_PUSH|CI] [--json]
   pumuki sdd session --open --change=<change-id|auto> [--ttl-minutes=<n>] [--json]
@@ -239,6 +250,7 @@ const isLifecycleCommand = (value: string): value is LifecycleCommand =>
   value === 'adapter' ||
   value === 'analytics' ||
   value === 'policy' ||
+  value === 'context' ||
   value === 'audit';
 
 const parseAdapterAgent = (value?: string): AdapterAgent => {
@@ -651,6 +663,7 @@ export const parseLifecycleCliArgs = (argv: ReadonlyArray<string>): ParsedArgs =
   let analyticsSinceDays: ParsedArgs['analyticsSinceDays'];
   let analyticsJsonOutputPath: ParsedArgs['analyticsJsonOutputPath'];
   let analyticsMarkdownOutputPath: ParsedArgs['analyticsMarkdownOutputPath'];
+  let contextCommand: ParsedArgs['contextCommand'];
   let auditStage: LifecycleAuditStage | undefined;
   let auditEngine = false;
 
@@ -863,6 +876,31 @@ export const parseLifecycleCliArgs = (argv: ReadonlyArray<string>): ParsedArgs =
     };
   }
 
+  if (commandRaw === 'context') {
+    const subcommandRaw = argv[1] ?? 'status';
+    if (
+      subcommandRaw !== 'init' &&
+      subcommandRaw !== 'status' &&
+      subcommandRaw !== 'repair'
+    ) {
+      throw new Error(`Unsupported context subcommand "${subcommandRaw}".\n\n${HELP_TEXT}`);
+    }
+    contextCommand = subcommandRaw;
+    for (const arg of argv.slice(2)) {
+      if (arg === '--json') {
+        json = true;
+        continue;
+      }
+      throw new Error(`Unsupported argument "${arg}".\n\n${HELP_TEXT}`);
+    }
+    return {
+      command: commandRaw,
+      purgeArtifacts: false,
+      json,
+      contextCommand,
+    };
+  }
+
   if (commandRaw === 'loop') {
     const subcommandRaw = argv[1] ?? '';
     if (
@@ -1582,6 +1620,16 @@ const printDoctorReport = (
     `PRE_PUSH=${report.policyValidation.stages.PRE_PUSH.validationCode ?? 'n/a'} strict=${report.policyValidation.stages.PRE_PUSH.strict ? 'yes' : 'no'} ` +
     `CI=${report.policyValidation.stages.CI.validationCode ?? 'n/a'} strict=${report.policyValidation.stages.CI.strict ? 'yes' : 'no'}`
   );
+  writeInfo(
+    `[pumuki] notifications: enabled=${report.notifications.enabled ? 'yes' : 'no'} ` +
+    `deliverable=${report.notifications.deliverable ? 'yes' : 'no'} ` +
+    `channel=${report.notifications.channel} ` +
+    `blocked_dialog=${report.notifications.blockedDialogEnabled ? 'yes' : 'no'} ` +
+    `reason=${report.notifications.disabledReason ?? 'none'}`
+  );
+  if (report.notifications.remediation) {
+    writeInfo(`[pumuki] notifications remediation: ${report.notifications.remediation}`);
+  }
 
   for (const issue of report.issues) {
     writeInfo(`[pumuki] ${issue.severity.toUpperCase()}: ${issue.message}`);
@@ -2377,6 +2425,28 @@ export const runLifecycleCli = async (
         }
         return result.gate_exit_code;
       }
+      case 'context': {
+        const repoRoot = process.cwd();
+        const result =
+          parsed.contextCommand === 'init'
+            ? writeLocalContext(repoRoot)
+            : parsed.contextCommand === 'repair'
+              ? repairLocalContext(repoRoot)
+              : readLocalContextStatus(repoRoot);
+        if (parsed.json) {
+          writeInfo(JSON.stringify(result, null, 2));
+        } else {
+          writeInfo(`[pumuki][context] status=${result.status}`);
+          writeInfo(`[pumuki][context] path=${result.path}`);
+          writeInfo(`[pumuki][context] ${result.message}`);
+          if (result.document) {
+            writeInfo(`[pumuki][context] repo=${result.document.repo_root}`);
+            writeInfo(`[pumuki][context] agent=${result.document.contract.agent_instruction}`);
+            writeInfo(`[pumuki][context] user=${result.document.contract.user_remediation}`);
+          }
+        }
+        return result.status === 'ok' ? 0 : 1;
+      }
       case 'doctor': {
         const report = runLifecycleDoctor({
           deep: parsed.doctorDeep === true,
@@ -2467,6 +2537,16 @@ export const runLifecycleCli = async (
             `PRE_PUSH=${status.policyValidation.stages.PRE_PUSH.validationCode ?? 'n/a'} strict=${status.policyValidation.stages.PRE_PUSH.strict ? 'yes' : 'no'} ` +
             `CI=${status.policyValidation.stages.CI.validationCode ?? 'n/a'} strict=${status.policyValidation.stages.CI.strict ? 'yes' : 'no'}`
           );
+          writeInfo(
+            `[pumuki] notifications: enabled=${status.notifications.enabled ? 'yes' : 'no'} ` +
+            `deliverable=${status.notifications.deliverable ? 'yes' : 'no'} ` +
+            `channel=${status.notifications.channel} ` +
+            `blocked_dialog=${status.notifications.blockedDialogEnabled ? 'yes' : 'no'} ` +
+            `reason=${status.notifications.disabledReason ?? 'none'}`
+          );
+          if (status.notifications.remediation) {
+            writeInfo(`[pumuki] notifications remediation: ${status.notifications.remediation}`);
+          }
           writeInfo(
             `[pumuki] experimental: ANALYTICS=${status.experimentalFeatures.features.analytics.mode} source=${status.experimentalFeatures.features.analytics.source} layer=${status.experimentalFeatures.features.analytics.layer} blocking=${status.experimentalFeatures.features.analytics.blocking ? 'yes' : 'no'} env=${status.experimentalFeatures.features.analytics.activationVariable}`
           );
@@ -2849,8 +2929,18 @@ export const runLifecycleCli = async (
   }
 };
 
-if (require.main === module) {
-  void runLifecycleCli(process.argv.slice(2)).then((code) => {
-    process.exitCode = code;
-  });
+if (
+  require.main === module &&
+  process.env.PUMUKI_RUNTIME_EXECUTION_SOURCE === 'source-bin'
+) {
+  void runLifecycleCli(process.argv.slice(2)).then(
+    (code) => {
+      process.exit(code);
+    },
+    (error) => {
+      const message = error instanceof Error ? error.message : 'Unexpected lifecycle CLI error.';
+      writeError(message);
+      process.exit(1);
+    }
+  );
 }

package/integrations/lifecycle/doctor.ts

@@ -20,6 +20,11 @@ import {
   readLifecycleDependencyInventory,
   type LifecycleDependencyInventory,
 } from './dependencyInventory';
+import { readPreWriteLeaseStatus } from './preWriteLease';
+import {
+  readLifecycleNotificationStatus,
+  type LifecycleNotificationStatus,
+} from './notificationStatus';
 
 export type DoctorIssueSeverity = 'warning' | 'error';
 
@@ -101,6 +106,7 @@ export type LifecycleDoctorReport = {
   hooksDirectory: string;
   hooksDirectoryResolution: 'git-rev-parse' | 'git-config' | 'default';
   policyValidation: LifecyclePolicyValidationSnapshot;
+  notifications: LifecycleNotificationStatus;
   policy_signature_remediation?: string;
   issues: ReadonlyArray<DoctorIssue>;
   deep?: DoctorDeepReport;
@@ -116,7 +122,32 @@ const buildDoctorIssues = (params: {
   lifecycleState: LifecycleState;
 }): ReadonlyArray<DoctorIssue> => {
   const issues: DoctorIssue[] = [];
+  const notificationStatus = readLifecycleNotificationStatus({
+    repoRoot: params.repoRoot,
+  });
   const evidenceResult = readEvidenceResult(params.repoRoot);
+  const preWriteLeaseStatus = readPreWriteLeaseStatus({
+    repoRoot: params.repoRoot,
+    git: new LifecycleGitService(),
+  });
+
+  if (!preWriteLeaseStatus.valid && preWriteLeaseStatus.changedCodePaths.length > 0) {
+    issues.push({
+      severity: 'error',
+      message:
+        `ENFORCEMENT_GAP: PRE_WRITE hard-stop lease is not valid (${preWriteLeaseStatus.code}) ` +
+        `for ${preWriteLeaseStatus.changedCodePaths.length} changed code file(s).`,
+    });
+  }
+
+  if (!notificationStatus.deliverable) {
+    issues.push({
+      severity: 'warning',
+      message:
+        `System notifications are not deliverable (${notificationStatus.disabledReason ?? 'unknown'}). ` +
+        `${notificationStatus.remediation ?? 'Review notification configuration.'}`,
+    });
+  }
 
   if (params.trackedNodeModulesPaths.length > 0) {
     issues.push({
@@ -886,6 +917,7 @@ export const runLifecycleDoctor = (params?: {
 
   const policyValidation = readLifecyclePolicyValidationSnapshot(repoRoot);
   const policySignatureRemediation = buildPolicySignatureRemediation(policyValidation);
+  const notifications = readLifecycleNotificationStatus({ repoRoot });
 
   return {
     repoRoot,
@@ -898,6 +930,7 @@ export const runLifecycleDoctor = (params?: {
     hooksDirectory: hooksDirectory.path,
     hooksDirectoryResolution: hooksDirectory.source,
     policyValidation,
+    notifications,
     ...(policySignatureRemediation
       ? { policy_signature_remediation: policySignatureRemediation }
       : {}),

package/integrations/lifecycle/install.ts

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { installPumukiHooks } from './hookManager';
 import { LifecycleGitService, type ILifecycleGitService } from './gitService';
-import { doctorHasBlockingIssues, runLifecycleDoctor } from './doctor';
+import { runLifecycleDoctor } from './doctor';
 import { runOpenSpecBootstrap, type OpenSpecBootstrapResult } from './openSpecBootstrap';
 import { LifecycleNpmService, type ILifecycleNpmService } from './npmService';
 import { getCurrentPumukiVersion } from './packageInfo';
@@ -15,6 +15,11 @@ import { ensureRuntimeArtifactsIgnored } from './artifacts';
 import { runLifecycleAdapterInstall } from './adapter';
 import { runPolicyReconcile } from './policyReconcile';
 import { emitGateBlockedNotification } from '../notifications/emitAuditSummaryNotification';
+import { persistSystemNotificationsConfig } from '../../scripts/framework-menu-system-notifications-config';
+import {
+  readLifecycleNotificationStatus,
+  type LifecycleNotificationStatus,
+} from './notificationStatus';
 
 export type LifecycleInstallResult = {
   repoRoot: string;
@@ -22,6 +27,7 @@ export type LifecycleInstallResult = {
   changedHooks: ReadonlyArray<string>;
   openSpecBootstrap?: OpenSpecBootstrapResult;
   degradedDoctorBypass?: boolean;
+  notifications: LifecycleNotificationStatus;
 };
 
 const shouldBootstrapEvidence = (repoRoot: string): boolean =>
@@ -99,6 +105,14 @@ const materializeStrictPolicyAsCode = (repoRoot: string): void => {
   }
 };
 
+const isPreWriteEnforcementGapIssue = (message: string): boolean =>
+  message.startsWith('ENFORCEMENT_GAP: PRE_WRITE hard-stop lease is not valid');
+
+const ensureInstallNotificationsEnabled = (repoRoot: string): LifecycleNotificationStatus => {
+  persistSystemNotificationsConfig(repoRoot, true);
+  return readLifecycleNotificationStatus({ repoRoot });
+};
+
 export const runLifecycleInstall = (params?: {
   cwd?: string;
   git?: ILifecycleGitService;
@@ -114,8 +128,14 @@ export const runLifecycleInstall = (params?: {
     cwd: params?.cwd,
     git,
   });
+  const notifications = ensureInstallNotificationsEnabled(report.repoRoot);
+  const installBlockingIssues = report.issues.filter(
+    (issue) => issue.severity === 'error' && !isPreWriteEnforcementGapIssue(issue.message)
+  );
+  const hasInstallBlockingIssues =
+    installBlockingIssues.length > 0 || report.deep?.blocking === true;
 
-  if (doctorHasBlockingIssues(report)) {
+  if (hasInstallBlockingIssues) {
     if (bestEffortAfterDoctorBlock) {
       const version = getCurrentPumukiVersion();
       const priorArtifacts = readOpenSpecManagedArtifacts(git, report.repoRoot);
@@ -133,10 +153,11 @@ export const runLifecycleInstall = (params?: {
         changedHooks,
         openSpecBootstrap: undefined,
         degradedDoctorBypass: true,
+        notifications,
       };
     }
-    const renderedIssues = report.issues.map((issue) => `- [${issue.severity}] ${issue.message}`).join('\n');
-    const firstIssue = report.issues[0];
+    const renderedIssues = installBlockingIssues.map((issue) => `- [${issue.severity}] ${issue.message}`).join('\n');
+    const firstIssue = installBlockingIssues[0];
     const notificationResult = (params?.notifyGateBlocked ?? emitGateBlockedNotification)({
       repoRoot: report.repoRoot,
       stage: 'PRE_COMMIT',
@@ -185,5 +206,6 @@ export const runLifecycleInstall = (params?: {
     version,
     changedHooks,
     openSpecBootstrap,
+    notifications,
   };
 };

package/integrations/lifecycle/notificationStatus.ts

@@ -0,0 +1,54 @@
+import { resolveEffectiveSystemNotificationsConfig } from '../../scripts/framework-menu-system-notifications-effective-config';
+import { resolveSystemNotificationGate } from '../../scripts/framework-menu-system-notifications-gate';
+
+export type LifecycleNotificationStatus = {
+  enabled: boolean;
+  blockedDialogEnabled: boolean;
+  channel: string;
+  muteUntil: string | null;
+  deliverable: boolean;
+  disabledReason: string | null;
+  remediation: string | null;
+};
+
+const remediationForReason = (reason: string | null): string | null => {
+  if (reason === null) {
+    return null;
+  }
+  if (reason === 'disabled') {
+    return 'Activa notificaciones con la configuracion repo-local de Pumuki y elimina env vars PUMUKI_*NOTIFICATIONS que las deshabiliten.';
+  }
+  if (reason === 'muted') {
+    return 'Quita el silencio temporal desde la notificacion o elimina muteUntil en .pumuki/system-notifications.json.';
+  }
+  if (reason === 'unsupported-platform') {
+    return 'Usa el fallback stderr o configura un canal compatible para este sistema.';
+  }
+  return 'Revisa la configuracion de notificaciones y reejecuta pumuki status/doctor.';
+};
+
+export const readLifecycleNotificationStatus = (params: {
+  repoRoot: string;
+  env?: NodeJS.ProcessEnv;
+  now?: () => number;
+}): LifecycleNotificationStatus => {
+  const env = params.env ?? process.env;
+  const config = resolveEffectiveSystemNotificationsConfig({
+    repoRoot: params.repoRoot,
+  });
+  const gate = resolveSystemNotificationGate({
+    config,
+    nowMs: (params.now ?? Date.now)(),
+    env,
+  });
+  const disabledReason = gate?.reason ?? null;
+  return {
+    enabled: config.enabled,
+    blockedDialogEnabled: config.blockedDialogEnabled === true,
+    channel: config.channel,
+    muteUntil: config.muteUntil ?? null,
+    deliverable: gate === null,
+    disabledReason,
+    remediation: remediationForReason(disabledReason),
+  };
+};

package/integrations/lifecycle/preWriteAutomation.ts

@@ -1,8 +1,11 @@
+import { existsSync } from 'node:fs';
 import { evaluateAiGate } from '../gate/evaluateAiGate';
+import { GitService } from '../git/GitService';
 import { runPlatformGate } from '../git/runPlatformGate';
 import { runEnterpriseAiGateCheck } from '../mcp/aiGateCheck';
 import { writeMcpAiGateReceipt } from '../mcp/aiGateReceipt';
 import { evaluateSddPolicy } from '../sdd';
+import { writePreWriteLease } from './preWriteLease';
 
 const PRE_WRITE_AUTOMATION_RETRY_BACKOFF_MS = 200;
 
@@ -33,7 +36,7 @@ const PRE_WRITE_AUTOFIXABLE_MCP_RECEIPT_CODES = new Set<string>([
 ]);
 
 export type PreWriteAutomationAction = {
-  action: 'refresh_evidence' | 'refresh_mcp_receipt' | 'retry_backoff';
+  action: 'refresh_evidence' | 'refresh_mcp_receipt' | 'retry_backoff' | 'write_prewrite_lease';
   status: 'OK' | 'FAILED';
   details: string;
 };
@@ -47,6 +50,7 @@ type PreWriteAutomationDependencies = {
   evaluateAiGate: typeof evaluateAiGate;
   runEnterpriseAiGateCheck: typeof runEnterpriseAiGateCheck;
   writeMcpAiGateReceipt: typeof writeMcpAiGateReceipt;
+  writePreWriteLease: typeof writePreWriteLease;
   sleep: (ms: number) => Promise<void>;
   retryBackoffMs: number;
 };
@@ -55,6 +59,7 @@ const defaultDependencies: PreWriteAutomationDependencies = {
   evaluateAiGate,
   runEnterpriseAiGateCheck,
   writeMcpAiGateReceipt,
+  writePreWriteLease,
   sleep: (ms: number) =>
     new Promise((resolve) => {
       setTimeout(resolve, ms);
@@ -98,7 +103,7 @@ export const buildPreWriteAutomationTrace = async (params: {
     attempted: false,
     actions: [],
   };
-  if (params.sdd.stage !== 'PRE_WRITE' || params.aiGate.allowed) {
+  if (params.sdd.stage !== 'PRE_WRITE') {
     return {
       aiGate: params.aiGate,
       trace,
@@ -106,14 +111,17 @@ export const buildPreWriteAutomationTrace = async (params: {
   }
 
   let aiGate = params.aiGate;
-  if (hasAutoFixableEvidenceViolation(aiGate)) {
+  if (
+    process.env.PUMUKI_PRE_WRITE_REFRESH_GATE !== '0' ||
+    hasAutoFixableEvidenceViolation(aiGate)
+  ) {
     trace.attempted = true;
     try {
       const gateExitCode = await params.runPlatformGate({
         policy: {
           stage: 'PRE_COMMIT',
-          blockOnOrAbove: 'ERROR',
-          warnOnOrAbove: 'WARN',
+          blockOnOrAbove: 'INFO',
+          warnOnOrAbove: 'INFO',
         },
         scope: {
           kind: 'workingTree',
@@ -235,6 +243,28 @@ export const buildPreWriteAutomationTrace = async (params: {
     }
   }
 
+  if (params.sdd.decision.allowed && aiGate.allowed && existsSync(params.repoRoot)) {
+    trace.attempted = true;
+    try {
+      const git = new GitService();
+      const leaseResult = activeDependencies.writePreWriteLease({
+        repoRoot: params.repoRoot,
+        git,
+      });
+      trace.actions.push({
+        action: 'write_prewrite_lease',
+        status: leaseResult.valid ? 'OK' : 'FAILED',
+        details: `${leaseResult.code} path=${leaseResult.path}`,
+      });
+    } catch (error) {
+      trace.actions.push({
+        action: 'write_prewrite_lease',
+        status: 'FAILED',
+        details: error instanceof Error ? error.message : 'Unknown PRE_WRITE lease write error',
+      });
+    }
+  }
+
   return {
     aiGate,
     trace,