pumuki 6.3.7

package/bin/_run-ts-entry.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require('node:child_process');
+const { resolve } = require('node:path');
+
+function runTsEntry(relativeEntry, forwardedArgs = []) {
+  const packageRoot = resolve(__dirname, '..');
+  const entryFile = resolve(packageRoot, relativeEntry);
+  let tsxCli;
+
+  try {
+    tsxCli = require.resolve('tsx/cli', { paths: [packageRoot] });
+  } catch (error) {
+    console.error(
+      `[pumuki] failed to resolve tsx runtime for ${relativeEntry}: ${error.message}`
+    );
+    return 1;
+  }
+
+  const result = spawnSync(
+    process.execPath,
+    [tsxCli, entryFile, ...forwardedArgs],
+    {
+      stdio: 'inherit',
+      env: process.env,
+    }
+  );
+
+  if (result.error) {
+    console.error(`[pumuki] failed to execute ${relativeEntry}: ${result.error.message}`);
+    return 1;
+  }
+
+  return typeof result.status === 'number' ? result.status : 1;
+}
+
+module.exports = { runTsEntry };
+
+if (require.main === module) {
+  const [entry, ...args] = process.argv.slice(2);
+  if (!entry) {
+    console.error('Usage: _run-ts-entry <relative-entry.ts> [args...]');
+    process.exit(1);
+  }
+  process.exit(runTsEntry(entry, args));
+}

package/bin/pumuki-ci.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/git/ciBackend.cli.ts', process.argv.slice(2)));

package/bin/pumuki-framework.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('scripts/framework-menu.cli.ts', process.argv.slice(2)));

package/bin/pumuki-mcp-evidence.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/mcp/evidenceContextServer.cli.ts', process.argv.slice(2)));

package/bin/pumuki-pre-commit.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/git/preCommitBackend.cli.ts', process.argv.slice(2)));

package/bin/pumuki-pre-push.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/git/prePushBackend.cli.ts', process.argv.slice(2)));

package/bin/pumuki.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { runTsEntry } = require('./_run-ts-entry');
+
+process.exit(runTsEntry('integrations/lifecycle/cli.ts', process.argv.slice(2)));

package/core/facts/DependencyFact.test.ts

@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { DependencyFact } from './DependencyFact';
+
+test('DependencyFact conserva kind, from, to y source', () => {
+  const fact: DependencyFact = {
+    kind: 'Dependency',
+    from: 'core/gate/evaluateGate',
+    to: 'core/rules/RuleSet',
+    source: 'import-graph',
+  };
+
+  assert.equal(fact.kind, 'Dependency');
+  assert.equal(fact.from, 'core/gate/evaluateGate');
+  assert.equal(fact.to, 'core/rules/RuleSet');
+  assert.equal(fact.source, 'import-graph');
+});
+
+test('DependencyFact permite modelar relaciones distintas dentro del grafo', () => {
+  const dependencies: DependencyFact[] = [
+    {
+      kind: 'Dependency',
+      from: 'integrations/git/runPlatformGate',
+      to: 'core/gate/evaluateGate',
+      source: 'depcruise',
+    },
+    {
+      kind: 'Dependency',
+      from: 'core/facts/extractHeuristicFacts',
+      to: 'core/facts/detectors/security',
+      source: 'depcruise',
+    },
+  ];
+
+  assert.equal(dependencies.length, 2);
+  assert.equal(dependencies[0]?.kind, 'Dependency');
+  assert.equal(dependencies[1]?.source, 'depcruise');
+});

package/core/facts/DependencyFact.ts

@@ -0,0 +1,6 @@
+export interface DependencyFact {
+  kind: 'Dependency';
+  from: string;
+  to: string;
+  source: string;
+}

package/core/facts/Fact.test.ts

@@ -0,0 +1,74 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { Fact } from './Fact';
+
+test('Fact incluye source en variantes FileChange, FileContent, Dependency y Heuristic', () => {
+  const fileChangeFact: Fact = {
+    kind: 'FileChange',
+    path: 'apps/backend/src/main.ts',
+    changeType: 'modified',
+    source: 'git',
+  };
+  const fileContentFact: Fact = {
+    kind: 'FileContent',
+    path: 'apps/backend/src/main.ts',
+    content: 'export const ready = true;',
+    source: 'repo',
+  };
+  const dependencyFact: Fact = {
+    kind: 'Dependency',
+    from: 'module/a',
+    to: 'module/b',
+    source: 'deps',
+  };
+  const heuristicFact: Fact = {
+    kind: 'Heuristic',
+    ruleId: 'heuristics.example.rule',
+    severity: 'WARN',
+    code: 'HEURISTICS_EXAMPLE_RULE',
+    message: 'Example heuristic.',
+    filePath: 'apps/backend/src/main.ts',
+    source: 'heuristics:ast',
+  };
+
+  assert.equal(fileChangeFact.source, 'git');
+  assert.equal(fileContentFact.source, 'repo');
+  assert.equal(dependencyFact.source, 'deps');
+  assert.equal(heuristicFact.source, 'heuristics:ast');
+});
+
+test('Fact mantiene acceso consistente al discriminante kind', () => {
+  const facts: Fact[] = [
+    {
+      kind: 'FileChange',
+      path: 'apps/backend/src/main.ts',
+      changeType: 'added',
+      source: 'git',
+    },
+    {
+      kind: 'FileContent',
+      path: 'apps/backend/src/main.ts',
+      content: 'const a = 1;',
+      source: 'repo',
+    },
+    {
+      kind: 'Dependency',
+      from: 'a',
+      to: 'b',
+      source: 'deps',
+    },
+    {
+      kind: 'Heuristic',
+      ruleId: 'heuristics.example',
+      severity: 'WARN',
+      code: 'HEURISTICS_EXAMPLE',
+      message: 'Example',
+      source: 'heuristics:ast',
+    },
+  ];
+
+  assert.deepEqual(
+    facts.map((fact) => fact.kind),
+    ['FileChange', 'FileContent', 'Dependency', 'Heuristic']
+  );
+});

package/core/facts/Fact.ts

@@ -0,0 +1,10 @@
+import type { DependencyFact } from './DependencyFact';
+import type { FileChangeFact } from './FileChangeFact';
+import type { FileContentFact } from './FileContentFact';
+import type { HeuristicFact } from './HeuristicFact';
+
+type FactBase = {
+  source: string;
+};
+
+export type Fact = (FileChangeFact | DependencyFact | FileContentFact | HeuristicFact) & FactBase;

package/core/facts/FactSet.test.ts

@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { FactSet } from './FactSet';
+
+test('FactSet acepta colecciones de hechos tipados como solo lectura', () => {
+  const factSet: FactSet = [
+    {
+      kind: 'FileChange',
+      path: 'apps/backend/src/main.ts',
+      changeType: 'modified',
+      source: 'git',
+    },
+    {
+      kind: 'FileContent',
+      path: 'apps/backend/src/main.ts',
+      content: 'export const ready = true;',
+      source: 'repo',
+    },
+    {
+      kind: 'Dependency',
+      from: 'module/a',
+      to: 'module/b',
+      source: 'deps',
+    },
+  ];
+
+  assert.equal(factSet.length, 3);
+  assert.equal(factSet[0]?.kind, 'FileChange');
+  assert.equal(factSet[1]?.kind, 'FileContent');
+  assert.equal(factSet[2]?.kind, 'Dependency');
+});
+
+test('FactSet puede representar colecciones vacias', () => {
+  const emptyFactSet: FactSet = [];
+
+  assert.deepEqual(emptyFactSet, []);
+  assert.equal(emptyFactSet.length, 0);
+});

package/core/facts/FactSet.ts

@@ -0,0 +1,3 @@
+import type { Fact } from './Fact';
+
+export type FactSet = ReadonlyArray<Fact>;

package/core/facts/FileChangeFact.test.ts

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { FileChangeFact } from './FileChangeFact';
+
+test('FileChangeFact soporta los tres changeType permitidos', () => {
+  const addedFact: FileChangeFact = {
+    kind: 'FileChange',
+    path: 'apps/backend/src/new-file.ts',
+    changeType: 'added',
+  };
+  const modifiedFact: FileChangeFact = {
+    kind: 'FileChange',
+    path: 'apps/backend/src/existing-file.ts',
+    changeType: 'modified',
+  };
+  const deletedFact: FileChangeFact = {
+    kind: 'FileChange',
+    path: 'apps/backend/src/old-file.ts',
+    changeType: 'deleted',
+  };
+
+  assert.equal(addedFact.changeType, 'added');
+  assert.equal(modifiedFact.changeType, 'modified');
+  assert.equal(deletedFact.changeType, 'deleted');
+});
+
+test('FileChangeFact conserva kind y path en registros tipados', () => {
+  const fact: FileChangeFact = {
+    kind: 'FileChange',
+    path: 'apps/frontend/src/App.tsx',
+    changeType: 'modified',
+  };
+
+  assert.equal(fact.kind, 'FileChange');
+  assert.equal(fact.path, 'apps/frontend/src/App.tsx');
+});

package/core/facts/FileChangeFact.ts

@@ -0,0 +1,5 @@
+export interface FileChangeFact {
+  kind: 'FileChange';
+  path: string;
+  changeType: 'added' | 'modified' | 'deleted';
+}

package/core/facts/FileContentFact.test.ts

@@ -0,0 +1,26 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { FileContentFact } from './FileContentFact';
+
+test('FileContentFact conserva kind, path y content', () => {
+  const fact: FileContentFact = {
+    kind: 'FileContent',
+    path: 'apps/backend/src/service.ts',
+    content: 'export const value = 1;',
+  };
+
+  assert.equal(fact.kind, 'FileContent');
+  assert.equal(fact.path, 'apps/backend/src/service.ts');
+  assert.equal(fact.content, 'export const value = 1;');
+});
+
+test('FileContentFact permite contenido multilinea', () => {
+  const fact: FileContentFact = {
+    kind: 'FileContent',
+    path: 'apps/frontend/src/App.tsx',
+    content: 'const a = 1;\nconst b = 2;\n',
+  };
+
+  assert.equal(fact.content.includes('\n'), true);
+  assert.equal(fact.content.split('\n').length > 1, true);
+});

package/core/facts/FileContentFact.ts

@@ -0,0 +1,5 @@
+export interface FileContentFact {
+  kind: 'FileContent';
+  path: string;
+  content: string;
+}

package/core/facts/HeuristicFact.test.ts

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { HeuristicFact } from './HeuristicFact';
+
+test('HeuristicFact conserva campos requeridos y severidad valida', () => {
+  const fact: HeuristicFact = {
+    kind: 'Heuristic',
+    ruleId: 'heuristics.ts.console-log.ast',
+    severity: 'WARN',
+    code: 'HEURISTICS_CONSOLE_LOG_AST',
+    message: 'AST heuristic detected console.log usage.',
+    filePath: 'apps/backend/src/main.ts',
+  };
+
+  assert.equal(fact.kind, 'Heuristic');
+  assert.equal(fact.ruleId, 'heuristics.ts.console-log.ast');
+  assert.equal(fact.severity, 'WARN');
+  assert.equal(fact.code, 'HEURISTICS_CONSOLE_LOG_AST');
+  assert.equal(fact.message, 'AST heuristic detected console.log usage.');
+  assert.equal(fact.filePath, 'apps/backend/src/main.ts');
+});
+
+test('HeuristicFact permite omitir filePath', () => {
+  const factWithoutPath: HeuristicFact = {
+    kind: 'Heuristic',
+    ruleId: 'heuristics.summary',
+    severity: 'INFO',
+    code: 'HEURISTICS_SUMMARY',
+    message: 'Summary heuristic.',
+  };
+
+  assert.equal(factWithoutPath.filePath, undefined);
+  assert.equal(factWithoutPath.severity, 'INFO');
+});

package/core/facts/HeuristicFact.ts

@@ -0,0 +1,10 @@
+import type { Severity } from '../rules/Severity';
+
+export interface HeuristicFact {
+  kind: 'Heuristic';
+  ruleId: string;
+  severity: Severity;
+  code: string;
+  message: string;
+  filePath?: string;
+}

package/core/facts/detectors/browser/index.test.ts

@@ -0,0 +1,131 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasDocumentWriteCall,
+  hasInnerHtmlAssignment,
+  hasInsertAdjacentHtmlCall,
+} from './index';
+
+test('hasInnerHtmlAssignment detecta asignacion directa a innerHTML', () => {
+  const ast = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'AssignmentExpression',
+          left: {
+            type: 'MemberExpression',
+            computed: false,
+            object: { type: 'Identifier', name: 'element' },
+            property: { type: 'Identifier', name: 'innerHTML' },
+          },
+          right: { type: 'StringLiteral', value: '<div>x</div>' },
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasInnerHtmlAssignment(ast), true);
+});
+
+test('hasInnerHtmlAssignment detecta acceso computed con StringLiteral', () => {
+  const ast = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: true,
+      object: { type: 'Identifier', name: 'target' },
+      property: { type: 'StringLiteral', value: 'innerHTML' },
+    },
+    right: { type: 'Identifier', name: 'payload' },
+  };
+
+  assert.equal(hasInnerHtmlAssignment(ast), true);
+});
+
+test('hasInnerHtmlAssignment no detecta propiedades distintas', () => {
+  const ast = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'element' },
+      property: { type: 'Identifier', name: 'textContent' },
+    },
+    right: { type: 'StringLiteral', value: 'safe' },
+  };
+
+  assert.equal(hasInnerHtmlAssignment(ast), false);
+});
+
+test('hasDocumentWriteCall detecta document.write no computed', () => {
+  const ast = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'document' },
+      property: { type: 'Identifier', name: 'write' },
+    },
+    arguments: [{ type: 'StringLiteral', value: '<script>alert(1)</script>' }],
+  };
+
+  assert.equal(hasDocumentWriteCall(ast), true);
+});
+
+test('hasDocumentWriteCall ignora member expressions computed', () => {
+  const ast = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: true,
+      object: { type: 'Identifier', name: 'document' },
+      property: { type: 'StringLiteral', value: 'write' },
+    },
+    arguments: [],
+  };
+
+  assert.equal(hasDocumentWriteCall(ast), false);
+});
+
+test('hasInsertAdjacentHtmlCall detecta propiedad insertAdjacentHTML', () => {
+  const directAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'node' },
+      property: { type: 'Identifier', name: 'insertAdjacentHTML' },
+    },
+    arguments: [],
+  };
+  const computedAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: true,
+      object: { type: 'Identifier', name: 'node' },
+      property: { type: 'StringLiteral', value: 'insertAdjacentHTML' },
+    },
+    arguments: [],
+  };
+
+  assert.equal(hasInsertAdjacentHtmlCall(directAst), true);
+  assert.equal(hasInsertAdjacentHtmlCall(computedAst), true);
+});
+
+test('hasInsertAdjacentHtmlCall no detecta metodos distintos', () => {
+  const ast = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'node' },
+      property: { type: 'Identifier', name: 'insertAdjacentText' },
+    },
+    arguments: [],
+  };
+
+  assert.equal(hasInsertAdjacentHtmlCall(ast), false);
+});

package/core/facts/detectors/browser/index.ts

@@ -0,0 +1,67 @@
+import { hasNode, isObject } from '../utils/astHelpers';
+
+export const hasInnerHtmlAssignment = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'AssignmentExpression') {
+      return false;
+    }
+    const left = value.left;
+    if (!isObject(left) || left.type !== 'MemberExpression') {
+      return false;
+    }
+    const propertyNode = left.property;
+    if (!isObject(propertyNode)) {
+      return false;
+    }
+    if (left.computed === true) {
+      return propertyNode.type === 'StringLiteral' && propertyNode.value === 'innerHTML';
+    }
+    return propertyNode.type === 'Identifier' && propertyNode.name === 'innerHTML';
+  });
+};
+
+export const hasDocumentWriteCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'document' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'write'
+    );
+  });
+};
+
+export const hasInsertAdjacentHtmlCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression') {
+      return false;
+    }
+
+    const propertyNode = callee.property;
+    if (!isObject(propertyNode)) {
+      return false;
+    }
+    if (callee.computed === true) {
+      return propertyNode.type === 'StringLiteral' && propertyNode.value === 'insertAdjacentHTML';
+    }
+    return propertyNode.type === 'Identifier' && propertyNode.name === 'insertAdjacentHTML';
+  });
+};

package/core/facts/detectors/fs/callbacks.test.ts

@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasFsFstatCallbackCall,
+  hasFsReadFileCallbackCall,
+  hasFsRmCallbackCall,
+  hasFsWatchCallbackCall,
+  hasFsWriteFileCallbackCall,
+  hasFsWritevCallbackCall,
+} from './callbacks';
+
+const createFsCallbackCallAst = (
+  methodName: string,
+  options?: {
+    computed?: boolean;
+    callbackType?: 'ArrowFunctionExpression' | 'FunctionExpression' | 'Identifier';
+    objectName?: string;
+  }
+) => {
+  const computed = options?.computed === true;
+  const callbackType = options?.callbackType ?? 'ArrowFunctionExpression';
+  const objectName = options?.objectName ?? 'fs';
+
+  const callbackArg =
+    callbackType === 'Identifier'
+      ? { type: 'Identifier', name: 'cb' }
+      : { type: callbackType, async: false, params: [], body: { type: 'BlockStatement', body: [] } };
+
+  return {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed,
+      object: { type: 'Identifier', name: objectName },
+      property: computed
+        ? { type: 'StringLiteral', value: methodName }
+        : { type: 'Identifier', name: methodName },
+    },
+    arguments: [{ type: 'StringLiteral', value: '/tmp/file.txt' }, callbackArg],
+  };
+};
+
+test('detectores callback de fs detectan llamadas esperadas', () => {
+  assert.equal(hasFsReadFileCallbackCall(createFsCallbackCallAst('readFile')), true);
+  assert.equal(hasFsWriteFileCallbackCall(createFsCallbackCallAst('writeFile')), true);
+  assert.equal(hasFsWatchCallbackCall(createFsCallbackCallAst('watch')), true);
+  assert.equal(hasFsRmCallbackCall(createFsCallbackCallAst('rm')), true);
+  assert.equal(hasFsFstatCallbackCall(createFsCallbackCallAst('fstat')), true);
+  assert.equal(hasFsWritevCallbackCall(createFsCallbackCallAst('writev')), true);
+});
+
+test('detectores callback de fs soportan propiedades computed con StringLiteral', () => {
+  assert.equal(hasFsReadFileCallbackCall(createFsCallbackCallAst('readFile', { computed: true })), true);
+  assert.equal(hasFsRmCallbackCall(createFsCallbackCallAst('rm', { computed: true })), true);
+  assert.equal(hasFsWritevCallbackCall(createFsCallbackCallAst('writev', { computed: true })), true);
+});
+
+test('detectores callback de fs descartan llamadas sin callback function', () => {
+  assert.equal(
+    hasFsReadFileCallbackCall(createFsCallbackCallAst('readFile', { callbackType: 'Identifier' })),
+    false
+  );
+  assert.equal(
+    hasFsWriteFileCallbackCall(createFsCallbackCallAst('writeFile', { callbackType: 'Identifier' })),
+    false
+  );
+});
+
+test('detectores callback de fs descartan objetos distintos de fs o metodos distintos', () => {
+  assert.equal(hasFsReadFileCallbackCall(createFsCallbackCallAst('readFile', { objectName: 'fsExtra' })), false);
+  assert.equal(hasFsWriteFileCallbackCall(createFsCallbackCallAst('appendFile')), false);
+  assert.equal(hasFsWatchCallbackCall(createFsCallbackCallAst('watchFile')), false);
+});