pumuki 6.3.7

package/integrations/config/loadProjectRules.ts

@@ -0,0 +1,43 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { ProjectRulesConfig } from './projectRules';
+import { projectRulesConfigSchema } from './projectRulesSchema';
+
+const isObject = (value: unknown): value is Record<string, unknown> => {
+  return typeof value === 'object' && value !== null;
+};
+
+const validateProjectRulesConfig = (value: unknown): ProjectRulesConfig | undefined => {
+  const result = projectRulesConfigSchema.safeParse(value);
+  if (result.success) {
+    return result.data as ProjectRulesConfig;
+  }
+  console.warn(
+    `[pumuki] Invalid project rules config: ${result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ')}`
+  );
+  return undefined;
+};
+
+const loadFromPath = (configPath: string): ProjectRulesConfig | undefined => {
+  if (!existsSync(configPath)) {
+    return undefined;
+  }
+
+  const loaded: unknown = require(configPath);
+  const validated = validateProjectRulesConfig(loaded);
+  if (validated) {
+    return validated;
+  }
+  if (isObject(loaded) && 'default' in loaded) {
+    return validateProjectRulesConfig(loaded.default);
+  }
+
+  return undefined;
+};
+
+export const loadProjectRules = (): ProjectRulesConfig | undefined => {
+  const localConfig = resolve(process.cwd(), '.pumuki', 'rules.ts');
+  const rootConfig = resolve(process.cwd(), 'pumuki.rules.ts');
+
+  return loadFromPath(localConfig) ?? loadFromPath(rootConfig);
+};

package/integrations/config/projectRules.ts

@@ -0,0 +1,6 @@
+import type { RuleSet } from '../../core/rules/RuleSet';
+
+export type ProjectRulesConfig = {
+  rules?: RuleSet;
+  allowOverrideLocked?: boolean;
+};

package/integrations/config/projectRulesSchema.ts

@@ -0,0 +1,85 @@
+import { z } from 'zod';
+
+const severitySchema = z.enum(['ERROR', 'WARN', 'INFO', 'OFF']);
+
+const conditionSchema: z.ZodType = z.lazy(() =>
+  z.discriminatedUnion('kind', [
+    z.object({
+      kind: z.literal('FileChange'),
+      where: z
+        .object({
+          pathPrefix: z.string().optional(),
+          changeType: z.enum(['added', 'modified', 'deleted']).optional(),
+        })
+        .optional(),
+    }),
+    z.object({
+      kind: z.literal('Heuristic'),
+      where: z
+        .object({
+          ruleId: z.string().optional(),
+          code: z.string().optional(),
+          filePathPrefix: z.string().optional(),
+        })
+        .optional(),
+    }),
+    z.object({
+      kind: z.literal('FileContent'),
+      contains: z.array(z.string()).readonly().optional(),
+      regex: z.array(z.string()).readonly().optional(),
+    }),
+    z.object({
+      kind: z.literal('Dependency'),
+      where: z
+        .object({
+          from: z.string().optional(),
+          to: z.string().optional(),
+        })
+        .optional(),
+    }),
+    z.object({
+      kind: z.literal('All'),
+      conditions: z.array(conditionSchema).readonly(),
+    }),
+    z.object({
+      kind: z.literal('Any'),
+      conditions: z.array(conditionSchema).readonly(),
+    }),
+    z.object({
+      kind: z.literal('Not'),
+      condition: conditionSchema,
+    }),
+  ])
+);
+
+const consequenceSchema = z.object({
+  kind: z.literal('Finding'),
+  message: z.string(),
+});
+
+const ruleDefinitionSchema = z.object({
+  id: z.string().min(1),
+  description: z.string(),
+  severity: severitySchema,
+  when: conditionSchema,
+  then: consequenceSchema,
+  locked: z.boolean().optional(),
+  platform: z
+    .enum(['ios', 'android', 'backend', 'frontend', 'text', 'generic'])
+    .optional(),
+  stage: z.enum(['PRE_COMMIT', 'PRE_PUSH', 'CI', 'STAGED']).optional(),
+  scope: z
+    .object({
+      include: z.array(z.string()).optional(),
+      exclude: z.array(z.string()).optional(),
+    })
+    .optional(),
+  confidence: z.enum(['HIGH', 'MEDIUM', 'LOW']).optional(),
+});
+
+export const projectRulesConfigSchema = z.object({
+  rules: z.array(ruleDefinitionSchema).readonly().optional(),
+  allowOverrideLocked: z.boolean().optional(),
+});
+
+export type ValidatedProjectRulesConfig = z.infer<typeof projectRulesConfigSchema>;

package/integrations/config/skillsCompilerTemplates.ts

@@ -0,0 +1,151 @@
+import type { SkillsCompiledRule } from './skillsLock';
+
+export const SKILLS_LOCK_COMPILER_VERSION = '1.0.0';
+
+export type SkillsRuleTemplate = Omit<SkillsCompiledRule, 'sourceSkill' | 'sourcePath'>;
+
+export type SkillsCompilerTemplate = {
+  name: string;
+  description: string;
+  rules: ReadonlyArray<SkillsRuleTemplate>;
+};
+
+export const skillsCompilerTemplates: Record<string, SkillsCompilerTemplate> = {
+  'ios-guidelines': {
+    name: 'ios-guidelines',
+    description: 'Curated enforcement mapping for iOS skill baseline.',
+    rules: [
+      {
+        id: 'skills.ios.no-force-unwrap',
+        description: 'Disallow force unwrap in production iOS code.',
+        severity: 'ERROR',
+        platform: 'ios',
+        confidence: 'HIGH',
+        locked: true,
+      },
+      {
+        id: 'skills.ios.no-force-try',
+        description: 'Disallow force try in production iOS code.',
+        severity: 'ERROR',
+        platform: 'ios',
+        confidence: 'HIGH',
+        locked: true,
+      },
+      {
+        id: 'skills.ios.no-anyview',
+        description: 'Disallow AnyView in production iOS code.',
+        severity: 'ERROR',
+        platform: 'ios',
+        confidence: 'HIGH',
+        locked: true,
+      },
+      {
+        id: 'skills.ios.no-callback-style-outside-bridges',
+        description: 'Disallow callback-style signatures outside approved iOS bridge layers.',
+        severity: 'WARN',
+        platform: 'ios',
+        confidence: 'MEDIUM',
+        stage: 'PRE_PUSH',
+        locked: true,
+      },
+    ],
+  },
+  'backend-guidelines': {
+    name: 'backend-guidelines',
+    description: 'Curated enforcement mapping for backend skill baseline.',
+    rules: [
+      {
+        id: 'skills.backend.no-empty-catch',
+        description: 'Disallow empty catch blocks in backend runtime code.',
+        severity: 'CRITICAL',
+        platform: 'backend',
+        confidence: 'HIGH',
+        locked: true,
+      },
+      {
+        id: 'skills.backend.no-console-log',
+        description: 'Disallow console.log in backend runtime code.',
+        severity: 'ERROR',
+        platform: 'backend',
+        confidence: 'HIGH',
+        stage: 'PRE_PUSH',
+        locked: true,
+      },
+      {
+        id: 'skills.backend.avoid-explicit-any',
+        description: 'Avoid explicit any in backend runtime code.',
+        severity: 'WARN',
+        platform: 'backend',
+        confidence: 'MEDIUM',
+        stage: 'PRE_COMMIT',
+        locked: true,
+      },
+    ],
+  },
+  'frontend-guidelines': {
+    name: 'frontend-guidelines',
+    description: 'Curated enforcement mapping for frontend skill baseline.',
+    rules: [
+      {
+        id: 'skills.frontend.no-console-log',
+        description: 'Disallow console.log in frontend production code.',
+        severity: 'ERROR',
+        platform: 'frontend',
+        confidence: 'HIGH',
+        stage: 'PRE_PUSH',
+        locked: true,
+      },
+      {
+        id: 'skills.frontend.no-empty-catch',
+        description: 'Disallow empty catch blocks in frontend runtime code.',
+        severity: 'ERROR',
+        platform: 'frontend',
+        confidence: 'HIGH',
+        stage: 'PRE_PUSH',
+        locked: true,
+      },
+      {
+        id: 'skills.frontend.avoid-explicit-any',
+        description: 'Avoid explicit any in frontend runtime code.',
+        severity: 'WARN',
+        platform: 'frontend',
+        confidence: 'MEDIUM',
+        stage: 'PRE_COMMIT',
+        locked: true,
+      },
+    ],
+  },
+  'android-guidelines': {
+    name: 'android-guidelines',
+    description: 'Curated enforcement mapping for Android skill baseline.',
+    rules: [
+      {
+        id: 'skills.android.no-thread-sleep',
+        description: 'Disallow Thread.sleep in Android production code.',
+        severity: 'ERROR',
+        platform: 'android',
+        confidence: 'HIGH',
+        stage: 'PRE_PUSH',
+        locked: true,
+      },
+      {
+        id: 'skills.android.no-globalscope',
+        description: 'Disallow GlobalScope in Android production code.',
+        severity: 'ERROR',
+        platform: 'android',
+        confidence: 'HIGH',
+        stage: 'PRE_PUSH',
+        locked: true,
+      },
+      {
+        id: 'skills.android.no-runblocking',
+        description: 'Disallow runBlocking in Android production code.',
+        severity: 'WARN',
+        platform: 'android',
+        confidence: 'MEDIUM',
+        stage: 'PRE_COMMIT',
+        locked: true,
+      },
+    ],
+  },
+};

package/integrations/config/skillsLock.ts

@@ -0,0 +1,248 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { GateStage } from '../../core/gate/GateStage';
+import type { RuleDefinition } from '../../core/rules/RuleDefinition';
+import type { Severity } from '../../core/rules/Severity';
+
+export type SkillsStage = Exclude<GateStage, 'STAGED'>;
+
+export type SkillsRuleConfidence = 'HIGH' | 'MEDIUM' | 'LOW';
+
+export type SkillsCompiledRule = {
+  id: string;
+  description: string;
+  severity: Severity;
+  platform: NonNullable<RuleDefinition['platform']>;
+  sourceSkill: string;
+  sourcePath: string;
+  stage?: SkillsStage;
+  confidence?: SkillsRuleConfidence;
+  locked?: boolean;
+};
+
+export type SkillsLockBundle = {
+  name: string;
+  version: string;
+  source: string;
+  hash: string;
+  rules: ReadonlyArray<SkillsCompiledRule>;
+};
+
+export type SkillsLockV1 = {
+  version: '1.0';
+  compilerVersion: string;
+  generatedAt: string;
+  bundles: ReadonlyArray<SkillsLockBundle>;
+};
+
+const SKILLS_LOCK_FILE = 'skills.lock.json';
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+const SHA256_PATTERN = /^[A-Fa-f0-9]{64}$/;
+
+const severityValues = new Set<Severity>(['INFO', 'WARN', 'ERROR', 'CRITICAL']);
+const stageValues = new Set<SkillsStage>(['PRE_COMMIT', 'PRE_PUSH', 'CI']);
+const confidenceValues = new Set<SkillsRuleConfidence>(['HIGH', 'MEDIUM', 'LOW']);
+const platformValues = new Set<NonNullable<RuleDefinition['platform']>>([
+  'ios',
+  'android',
+  'backend',
+  'frontend',
+  'text',
+  'generic',
+]);
+
+const isObject = (value: unknown): value is Record<string, unknown> => {
+  return typeof value === 'object' && value !== null;
+};
+
+const isNonEmptyString = (value: unknown): value is string => {
+  return typeof value === 'string' && value.trim().length > 0;
+};
+
+const isIsoTimestamp = (value: unknown): value is string => {
+  return (
+    typeof value === 'string' &&
+    value.trim().length > 0 &&
+    Number.isFinite(Date.parse(value))
+  );
+};
+
+const isSeverity = (value: unknown): value is Severity => {
+  return typeof value === 'string' && severityValues.has(value as Severity);
+};
+
+const isSkillsStage = (value: unknown): value is SkillsStage => {
+  return typeof value === 'string' && stageValues.has(value as SkillsStage);
+};
+
+const isRuleConfidence = (value: unknown): value is SkillsRuleConfidence => {
+  return typeof value === 'string' && confidenceValues.has(value as SkillsRuleConfidence);
+};
+
+const isRulePlatform = (
+  value: unknown
+): value is NonNullable<RuleDefinition['platform']> => {
+  return (
+    typeof value === 'string' && platformValues.has(value as NonNullable<RuleDefinition['platform']>)
+  );
+};
+
+const isSemver = (value: unknown): value is string => {
+  return typeof value === 'string' && SEMVER_PATTERN.test(value);
+};
+
+const isSha256Hex = (value: unknown): value is string => {
+  return typeof value === 'string' && SHA256_PATTERN.test(value);
+};
+
+const isSkillsCompiledRule = (value: unknown): value is SkillsCompiledRule => {
+  if (!isObject(value)) {
+    return false;
+  }
+
+  if (!isNonEmptyString(value.id) || !isNonEmptyString(value.description)) {
+    return false;
+  }
+
+  if (!isSeverity(value.severity) || !isRulePlatform(value.platform)) {
+    return false;
+  }
+
+  if (!isNonEmptyString(value.sourceSkill) || !isNonEmptyString(value.sourcePath)) {
+    return false;
+  }
+
+  if (typeof value.locked !== 'undefined' && typeof value.locked !== 'boolean') {
+    return false;
+  }
+
+  if (typeof value.stage !== 'undefined' && !isSkillsStage(value.stage)) {
+    return false;
+  }
+
+  if (typeof value.confidence !== 'undefined' && !isRuleConfidence(value.confidence)) {
+    return false;
+  }
+
+  return true;
+};
+
+const isSkillsLockBundle = (value: unknown): value is SkillsLockBundle => {
+  if (!isObject(value)) {
+    return false;
+  }
+
+  if (!isNonEmptyString(value.name) || !isSemver(value.version)) {
+    return false;
+  }
+
+  if (!isNonEmptyString(value.source) || !isSha256Hex(value.hash)) {
+    return false;
+  }
+
+  if (!Array.isArray(value.rules) || value.rules.some((rule) => !isSkillsCompiledRule(rule))) {
+    return false;
+  }
+
+  return true;
+};
+
+export const isSkillsLockV1 = (value: unknown): value is SkillsLockV1 => {
+  if (!isObject(value)) {
+    return false;
+  }
+
+  if (value.version !== '1.0' || !isSemver(value.compilerVersion)) {
+    return false;
+  }
+
+  if (!isIsoTimestamp(value.generatedAt)) {
+    return false;
+  }
+
+  if (!Array.isArray(value.bundles) || value.bundles.some((bundle) => !isSkillsLockBundle(bundle))) {
+    return false;
+  }
+
+  return true;
+};
+
+const stableStringify = (value: unknown): string => {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(',')}]`;
+  }
+
+  if (isObject(value)) {
+    const entries = Object.entries(value).sort(([left], [right]) => left.localeCompare(right));
+    return `{${entries
+      .map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`)
+      .join(',')}}`;
+  }
+
+  return JSON.stringify(value) ?? 'null';
+};
+
+const normalizedRuleForHash = (rule: SkillsCompiledRule): Record<string, unknown> => {
+  return {
+    id: rule.id,
+    description: rule.description,
+    severity: rule.severity,
+    platform: rule.platform,
+    sourceSkill: rule.sourceSkill,
+    sourcePath: rule.sourcePath,
+    stage: rule.stage ?? null,
+    confidence: rule.confidence ?? null,
+    locked: rule.locked ?? false,
+  };
+};
+
+const normalizedBundleForHash = (bundle: SkillsLockBundle): Record<string, unknown> => {
+  const sortedRules = [...bundle.rules].sort((left, right) => left.id.localeCompare(right.id));
+  return {
+    name: bundle.name,
+    version: bundle.version,
+    source: bundle.source,
+    hash: bundle.hash,
+    rules: sortedRules.map((rule) => normalizedRuleForHash(rule)),
+  };
+};
+
+const normalizedLockForHash = (lock: SkillsLockV1): Record<string, unknown> => {
+  const sortedBundles = [...lock.bundles].sort((left, right) => {
+    const byName = left.name.localeCompare(right.name);
+    if (byName !== 0) {
+      return byName;
+    }
+    return left.version.localeCompare(right.version);
+  });
+
+  return {
+    version: lock.version,
+    compilerVersion: lock.compilerVersion,
+    bundles: sortedBundles.map((bundle) => normalizedBundleForHash(bundle)),
+  };
+};
+
+export const createSkillsLockDeterministicHash = (lock: SkillsLockV1): string => {
+  const normalized = normalizedLockForHash(lock);
+  return createHash('sha256').update(stableStringify(normalized)).digest('hex');
+};
+
+export const parseSkillsLock = (value: unknown): SkillsLockV1 | undefined => {
+  return isSkillsLockV1(value) ? value : undefined;
+};
+
+export const loadSkillsLock = (repoRoot: string = process.cwd()): SkillsLockV1 | undefined => {
+  const filePath = resolve(repoRoot, SKILLS_LOCK_FILE);
+  if (!existsSync(filePath)) {
+    return undefined;
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(filePath, 'utf8'));
+    return parseSkillsLock(parsed);
+  } catch {
+    return undefined;
+  }
+};