pumuki 6.3.64 → 6.3.68

package/README.md

@@ -37,7 +37,7 @@ npx --yes pumuki status
 npx --yes pumuki doctor --json
 ```
 
-Desde **6.3.63**, `npm install` en la raíz de un repo **Git** dispara un `postinstall` que ejecuta `pumuki install` automáticamente (hooks `pre-commit` / `pre-push`). No configura MCP del IDE por sí solo: usa `pumuki install --with-mcp` o el adaptador. Desactivar el postinstall: `PUMUKI_SKIP_POSTINSTALL=1`. En CI suele saltarse solo (`CI=true`). En **6.3.64+**, las notificaciones del sistema en plataformas sin banner nativo se reflejan en **stderr** por defecto (`PUMUKI_DISABLE_STDERR_NOTIFICATIONS=1` para silenciarlas).
+Desde **6.3.63**, `npm install` en la raíz de un repo **Git** dispara un `postinstall` que ejecuta **`pumuki install` solo** (hooks `pre-commit` / `pre-push`, lifecycle, evidencia cuando aplica). **Pumuki no depende de ningún IDE** para el baseline: no toca `.cursor/` ni otros ficheros de editor por defecto. Desde **6.3.68**, cada hook gestionado ejecuta **`pumuki-pre-write` antes** de `pumuki-pre-commit` / `pumuki-pre-push` (stage **PRE_WRITE** vía Git). Saltar solo PRE_WRITE en hooks: `PUMUKI_SKIP_CHAINED_PRE_WRITE=1`. Tras install, si no existía, aparece **`.pumuki/adapter.json`** con los comandos de hooks y **MCP stdio** para referencia o para clientes que los registren manualmente. Para generar también config de IDE: **`pumuki install --with-mcp --agent=cursor`** (u otro) o **`pumuki bootstrap --enterprise --agent=…`**. Desactivar el postinstall: `PUMUKI_SKIP_POSTINSTALL=1`. En CI suele saltarse solo (`CI=true`). En **6.3.64+**, las notificaciones del sistema en plataformas sin banner nativo se reflejan en **stderr** por defecto (`PUMUKI_DISABLE_STDERR_NOTIFICATIONS=1` para silenciarlas).
 
 Fallback (equivalent in pasos separados):
 

package/docs/operations/RELEASE_NOTES.md

@@ -6,6 +6,23 @@ This file keeps only the operational highlights and rollout notes that matter wh
 
 ## 2026-04 (CLI stability and macOS notifications)
 
+### 2026-04-06 (v6.3.68)
+
+- **PRE_WRITE sin depender del IDE**: `pre-commit` y `pre-push` gestionados ejecutan **`pumuki-pre-write`** antes del gate del stage principal. Opt-out: `PUMUKI_SKIP_CHAINED_PRE_WRITE=1`.
+- **`.pumuki/adapter.json`**: se crea en `pumuki install` si faltaba, con comandos de **MCP stdio** y hooks (plantilla `repo`); sigue sin imponer Cursor ni otros IDEs.
+- Rollout: `pumuki@6.3.68` y **`pumuki install`** en consumidores para reescribir hooks.
+
+### 2026-04-06 (v6.3.67)
+
+- **Corrección de producto**: el `postinstall` **no** acopla Pumuki a Cursor ni a ningún IDE. Vuelve a ejecutar solo **`pumuki install`** (baseline Git + lifecycle). IDE/MCP: opt-in con `pumuki install --with-mcp --agent=…` o `bootstrap --enterprise`.
+- La plantilla adaptador **Cursor** sigue pudiendo fusionar `.cursor/mcp.json` y escribir `.pumuki/adapter.json` cuando el equipo elige ese agente explícitamente.
+- Rollout: `pumuki@6.3.67` si **6.3.66** llegó a publicarse; si no, repin directo a **6.3.67**.
+
+### 2026-04-06 (v6.3.65)
+
+- **pre-commit.com + `exec`**: Pumuki ya no inserta su bloque gestionado *después* del `exec` del hook generado por pre-commit (código inalcanzable). Tras actualizar a **6.3.65**, ejecutar `pumuki install` en el consumer para reordenar `.git/hooks/pre-commit`.
+- Rollout: repin a `pumuki@6.3.65`; validar que un `git commit` dispara el gate (salida `[pumuki]` / policy) antes de que corra pre-commit.
+
 ### 2026-04-05 (v6.3.64)
 
 - **Notificaciones multiplataforma**: fuera de macOS, avisos críticos van a **stderr** por defecto (terminal visible). `PUMUKI_DISABLE_STDERR_NOTIFICATIONS=1` lo silencia para CI/scripts. En macOS, `PUMUKI_NOTIFICATION_STDERR_MIRROR=1` añade copia en terminal; si `osascript`/banner falla, stderr actúa como respaldo.

package/docs/product/INSTALLATION.md

@@ -51,6 +51,8 @@ If both commands pass, the workspace is ready.
 npm install --save-exact pumuki
 ```
 
+The package `postinstall` runs **`pumuki install` only** (Git hooks + lifecycle wiring). Hooks chain **`pumuki-pre-write`** then **`pumuki-pre-commit`** / **`pumuki-pre-push`** (IDE-agnostic). When missing, **`.pumuki/adapter.json`** is created with hook + **MCP stdio** command lines (any MCP client can use them). It does **not** write IDE-specific files; use step 2 or `pumuki install --with-mcp --agent=<name>` for that.
+
 ### 2) Bootstrap managed lifecycle (recommended single command)
 
 ```bash

package/integrations/lifecycle/adapter.templates.json

@@ -28,6 +28,35 @@
       }
     }
   ],
+  "repo": [
+    {
+      "path": ".pumuki/adapter.json",
+      "payload": {
+        "hooks": {
+          "pre_write": {
+            "command": "npx --yes --package pumuki@latest pumuki-pre-write"
+          },
+          "pre_commit": {
+            "command": "npx --yes --package pumuki@latest pumuki-pre-commit"
+          },
+          "pre_push": {
+            "command": "npx --yes --package pumuki@latest pumuki-pre-push"
+          },
+          "ci": {
+            "command": "npx --yes --package pumuki@latest pumuki-ci"
+          }
+        },
+        "mcp": {
+          "enterprise": {
+            "command": "npx --yes --package pumuki@latest pumuki-mcp-enterprise-stdio"
+          },
+          "evidence": {
+            "command": "npx --yes --package pumuki@latest pumuki-mcp-evidence-stdio"
+          }
+        }
+      }
+    }
+  ],
   "claude": [
     {
       "path": ".claude/settings.json",
@@ -74,6 +103,7 @@
   "cursor": [
     {
       "path": ".cursor/mcp.json",
+      "mode": "json-merge",
       "payload": {
         "mcpServers": {
           "pumuki-enterprise": {
@@ -110,6 +140,33 @@
           }
         }
       }
+    },
+    {
+      "path": ".pumuki/adapter.json",
+      "payload": {
+        "hooks": {
+          "pre_write": {
+            "command": "npx --yes --package pumuki@latest pumuki-pre-write"
+          },
+          "pre_commit": {
+            "command": "npx --yes --package pumuki@latest pumuki-pre-commit"
+          },
+          "pre_push": {
+            "command": "npx --yes --package pumuki@latest pumuki-pre-push"
+          },
+          "ci": {
+            "command": "npx --yes --package pumuki@latest pumuki-ci"
+          }
+        },
+        "mcp": {
+          "enterprise": {
+            "command": "npx --yes --package pumuki@latest pumuki-mcp-enterprise-stdio"
+          },
+          "evidence": {
+            "command": "npx --yes --package pumuki@latest pumuki-mcp-evidence-stdio"
+          }
+        }
+      }
     }
   ],
   "windsurf": [

package/integrations/lifecycle/hookBlock.ts

@@ -9,6 +9,10 @@ const HOOK_COMMANDS: Record<PumukiManagedHook, string> = {
   'pre-push': 'pumuki-pre-push',
 };
 
+const PRE_WRITE_CLI = 'pumuki-pre-write';
+
+type ResolverPhase = 'pre-write' | 'main';
+
 const trimTrailingWhitespace = (value: string): string =>
   value.replace(/[ \t]+\n/g, '\n').trimEnd();
 
@@ -24,54 +28,72 @@ const managedBlockPattern = new RegExp(
   'g'
 );
 
-const toHookRunner = (params: {
-  hook: PumukiManagedHook;
-  runner: string;
-}): string => {
-  if (params.hook === 'pre-push') {
-    return `  PUMUKI_PRE_PUSH_STDIN="$PUMUKI_PRE_PUSH_STDIN" ${params.runner} "$@"`;
+const runnerLine = (
+  parentHook: PumukiManagedHook,
+  phase: ResolverPhase,
+  runner: string
+): string => {
+  if (parentHook === 'pre-push' && phase === 'main') {
+    return `  PUMUKI_PRE_PUSH_STDIN="$PUMUKI_PRE_PUSH_STDIN" ${runner} "$@"`;
   }
-  return `  ${params.runner}`;
+  return `  ${runner}`;
 };
 
-export const buildPumukiManagedHookBlock = (hook: PumukiManagedHook): string => {
-  const cli = HOOK_COMMANDS[hook];
+const buildCliResolver = (params: {
+  cli: string;
+  parentHook: PumukiManagedHook;
+  phase: ResolverPhase;
+}): string[] => {
+  const { cli, parentHook, phase } = params;
   const localBinPath = `./node_modules/.bin/${cli}`;
   const localNodeEntry = `./node_modules/pumuki/bin/${cli}.js`;
-
   return [
-    PUMUKI_MANAGED_BLOCK_START,
-    ...(hook === 'pre-push' ? ['PUMUKI_PRE_PUSH_STDIN="$(cat)"'] : []),
     `if [ -x "${localBinPath}" ]; then`,
-    toHookRunner({
-      hook,
-      runner: localBinPath,
-    }),
+    runnerLine(parentHook, phase, localBinPath),
     `elif [ -f "${localNodeEntry}" ] && command -v node >/dev/null 2>&1; then`,
-    toHookRunner({
-      hook,
-      runner: `node ${localNodeEntry}`,
-    }),
+    runnerLine(parentHook, phase, `node ${localNodeEntry}`),
     `elif command -v ${cli} >/dev/null 2>&1; then`,
-    toHookRunner({
-      hook,
-      runner: cli,
-    }),
+    runnerLine(parentHook, phase, cli),
     'elif command -v npx >/dev/null 2>&1; then',
-    toHookRunner({
-      hook,
-      runner: `npx --yes --package pumuki@latest ${cli}`,
-    }),
+    runnerLine(parentHook, phase, `npx --yes --package pumuki@latest ${cli}`),
     'else',
     `  echo "[pumuki] unable to resolve ${cli} runner. Install dependencies or ensure npx is available." >&2`,
     '  exit 1',
     'fi',
-    '  status=$?',
-    '  if [ "$status" -ne 0 ]; then',
-    '    exit "$status"',
-    '  fi',
-    PUMUKI_MANAGED_BLOCK_END,
-  ].join('\n');
+  ];
+};
+
+export const buildPumukiManagedHookBlock = (hook: PumukiManagedHook): string => {
+  const mainCli = HOOK_COMMANDS[hook];
+  const lines: string[] = [PUMUKI_MANAGED_BLOCK_START];
+
+  lines.push('if [ "${PUMUKI_SKIP_CHAINED_PRE_WRITE:-}" != "1" ]; then');
+  lines.push(...buildCliResolver({
+    cli: PRE_WRITE_CLI,
+    parentHook: hook,
+    phase: 'pre-write',
+  }));
+  lines.push('  status=$?');
+  lines.push('  if [ "$status" -ne 0 ]; then');
+  lines.push('    exit "$status"');
+  lines.push('  fi');
+  lines.push('fi');
+
+  if (hook === 'pre-push') {
+    lines.push('PUMUKI_PRE_PUSH_STDIN="$(cat)"');
+  }
+
+  lines.push(...buildCliResolver({
+    cli: mainCli,
+    parentHook: hook,
+    phase: 'main',
+  }));
+  lines.push('  status=$?');
+  lines.push('  if [ "$status" -ne 0 ]; then');
+  lines.push('    exit "$status"');
+  lines.push('  fi');
+  lines.push(PUMUKI_MANAGED_BLOCK_END);
+  return lines.join('\n');
 };
 
 const ensureExecutableHeader = (contents: string): string => {
@@ -82,23 +104,58 @@ const ensureExecutableHeader = (contents: string): string => {
   return contents;
 };
 
+const isPreCommitFrameworkWithExecTerminator = (contents: string): boolean => {
+  if (!contents.includes('pre-commit.com') && !contents.includes('pre_commit')) {
+    return false;
+  }
+  return /\bexec\b/.test(contents);
+};
+
+const prependManagedBlockAfterShebang = (params: {
+  contents: string;
+  block: string;
+}): string => {
+  const trimmed = trimTrailingWhitespace(params.contents);
+  const firstNewline = trimmed.indexOf('\n');
+  const shebangLine = firstNewline === -1 ? trimmed : trimmed.slice(0, firstNewline);
+  const rest =
+    firstNewline === -1 ? '' : trimmed.slice(firstNewline + 1).replace(/^\n+/, '');
+  const header = shebangLine.startsWith('#!') ? shebangLine : '#!/usr/bin/env sh';
+  const bodyAfterShebang = shebangLine.startsWith('#!') ? rest : trimmed;
+  const tail = trimTrailingWhitespace(bodyAfterShebang);
+  return tail.length > 0
+    ? `${header}\n${params.block}\n\n${tail}\n`
+    : `${header}\n${params.block}\n`;
+};
+
 export const upsertPumukiManagedBlock = (params: {
   contents: string;
   hook: PumukiManagedHook;
 }): string => {
   const block = buildPumukiManagedHookBlock(params.hook);
   const baseline = ensureExecutableHeader(params.contents);
+  const hadManagedBlock = hasPumukiManagedBlock(baseline);
+  const core = collapseBlankLines(
+    trimTrailingWhitespace(
+      hadManagedBlock ? baseline.replace(managedBlockPattern, '\n') : baseline
+    )
+  );
+
+  if (
+    params.hook === 'pre-commit' &&
+    core.length > 0 &&
+    isPreCommitFrameworkWithExecTerminator(core)
+  ) {
+    const merged = prependManagedBlockAfterShebang({ contents: core, block });
+    return `${trimTrailingWhitespace(merged)}\n`;
+  }
 
-  if (hasPumukiManagedBlock(baseline)) {
-    const replaced = baseline.replace(managedBlockPattern, `${block}\n`);
-    return `${trimTrailingWhitespace(replaced)}\n`;
+  if (hadManagedBlock || core.length > 0) {
+    const withSeparator = core.length > 0 ? `${core}\n\n${block}` : block;
+    return `${trimTrailingWhitespace(withSeparator)}\n`;
   }
 
-  const withSeparator =
-    trimTrailingWhitespace(baseline).length > 0
-      ? `${trimTrailingWhitespace(baseline)}\n\n${block}`
-      : block;
-  return `${withSeparator}\n`;
+  return `${block}\n`;
 };
 
 export const removePumukiManagedBlock = (contents: string): {

package/integrations/lifecycle/install.ts

@@ -12,6 +12,7 @@ import { captureRepoState } from '../evidence/repoState';
 import { createEmptyEvaluationMetrics } from '../evidence/evaluationMetrics';
 import { readOpenSpecManagedArtifacts, writeLifecycleState } from './state';
 import { ensureRuntimeArtifactsIgnored } from './artifacts';
+import { runLifecycleAdapterInstall } from './adapter';
 
 export type LifecycleInstallResult = {
   repoRoot: string;
@@ -59,6 +60,23 @@ const wireHooksLifecycleAndBootstrapEvidence = (params: {
   return hookResult.changedHooks;
 };
 
+const ensureRepoBaselineAdapter = (repoRoot: string): void => {
+  const adapterPath = join(repoRoot, '.pumuki', 'adapter.json');
+  if (existsSync(adapterPath)) {
+    return;
+  }
+  try {
+    runLifecycleAdapterInstall({
+      cwd: repoRoot,
+      agent: 'repo',
+    });
+  } catch (cause: unknown) {
+    if (process.env.PUMUKI_VERBOSE_INSTALL === '1') {
+      console.debug('[pumuki] adapter scaffold skipped', cause);
+    }
+  }
+};
+
 export const runLifecycleInstall = (params?: {
   cwd?: string;
   git?: ILifecycleGitService;
@@ -84,6 +102,7 @@ export const runLifecycleInstall = (params?: {
         version,
         openSpecManagedArtifacts: priorArtifacts.length > 0 ? priorArtifacts : undefined,
       });
+      ensureRepoBaselineAdapter(report.repoRoot);
       return {
         repoRoot: report.repoRoot,
         version,
@@ -122,6 +141,7 @@ export const runLifecycleInstall = (params?: {
     version,
     openSpecManagedArtifacts: Array.from(mergedOpenSpecArtifacts),
   });
+  ensureRepoBaselineAdapter(report.repoRoot);
 
   return {
     repoRoot: report.repoRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.64",
+  "version": "6.3.68",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {
@@ -212,6 +212,7 @@
     "@babel/preset-env": "^7.29.0",
     "@babel/preset-typescript": "^7.28.5",
     "@babel/traverse": "^7.28.5",
+    "@fission-ai/openspec": "1.2.0",
     "@types/node": "^20.10.0",
     "@typescript-eslint/eslint-plugin": "^8.55.0",
     "@typescript-eslint/parser": "^8.55.0",