pumuki 6.3.7

package/scripts/package-install-smoke-execution-steps-lib.ts

@@ -0,0 +1,46 @@
+import type { SmokeExpectation } from './package-install-smoke-contract';
+import { runGateStep, type SmokeGateStep } from './package-install-smoke-gate-lib';
+import type { SmokeWorkspace } from './package-install-smoke-workspace-contract';
+
+export type SmokeStepResult = {
+  label: SmokeGateStep['label'];
+  outcome: string;
+  exitCode: number;
+};
+
+export const DEFAULT_SMOKE_GATE_STEPS: ReadonlyArray<SmokeGateStep> = [
+  {
+    label: 'pre-commit',
+    command: 'npx',
+    args: ['--yes', 'pumuki-pre-commit'],
+    evidenceFile: 'pre-commit.ai_evidence.json',
+    stage: 'PRE_COMMIT',
+  },
+  {
+    label: 'pre-push',
+    command: 'npx',
+    args: ['--yes', 'pumuki-pre-push'],
+    evidenceFile: 'pre-push.ai_evidence.json',
+    stage: 'PRE_PUSH',
+  },
+  {
+    label: 'ci',
+    command: 'npx',
+    args: ['--yes', 'pumuki-ci'],
+    evidenceFile: 'ci.ai_evidence.json',
+    stage: 'CI',
+  },
+];
+
+export const runDefaultSmokeGateSteps = (params: {
+  workspace: SmokeWorkspace;
+  expectation: SmokeExpectation;
+}): ReadonlyArray<SmokeStepResult> =>
+  DEFAULT_SMOKE_GATE_STEPS.map((step) => {
+    const result = runGateStep(params.workspace, step, params.expectation);
+    return {
+      label: step.label,
+      outcome: result.outcome,
+      exitCode: result.exitCode,
+    };
+  });

package/scripts/package-install-smoke-execution-summary-lib.ts

@@ -0,0 +1,51 @@
+import type { SmokeMode } from './package-install-smoke-contract';
+import type { SmokeWorkspace } from './package-install-smoke-workspace-contract';
+import type { SmokeStepResult } from './package-install-smoke-execution-steps-lib';
+
+export const appendSmokeWorkspaceMetadata = (params: {
+  workspace: SmokeWorkspace;
+  mode: SmokeMode;
+  tarballId: string;
+}): void => {
+  params.workspace.summary.push(`- Repository root: \`${params.workspace.repoRoot}\``);
+  params.workspace.summary.push(`- Temporary workspace: \`${params.workspace.tmpRoot}\``);
+  params.workspace.summary.push('');
+  params.workspace.summary.push(`- Smoke mode: \`${params.mode}\``);
+  params.workspace.summary.push(`- Packed tarball: \`${params.tarballId}\``);
+};
+
+const findStepResult = (
+  results: ReadonlyArray<SmokeStepResult>,
+  label: SmokeStepResult['label']
+): SmokeStepResult => {
+  const result = results.find((entry) => entry.label === label);
+  if (!result) {
+    throw new Error(`Missing smoke step result for ${label}`);
+  }
+  return result;
+};
+
+export const appendSmokeSuccessSummary = (params: {
+  workspace: SmokeWorkspace;
+  results: ReadonlyArray<SmokeStepResult>;
+  lifecycleStatusSnapshot: string;
+  lifecycleStatusAfterUninstall: string;
+}): void => {
+  const renderStatusSnapshot = (value: string): string =>
+    value.length === 0 ? '(clean)' : value.split('\n').join(' ; ');
+  const preCommit = findStepResult(params.results, 'pre-commit');
+  const prePush = findStepResult(params.results, 'pre-push');
+  const ci = findStepResult(params.results, 'ci');
+
+  params.workspace.summary.push('- Status: PASS');
+  params.workspace.summary.push(`- pre-commit exit: \`${preCommit.exitCode}\` (${preCommit.outcome})`);
+  params.workspace.summary.push(`- pre-push exit: \`${prePush.exitCode}\` (${prePush.outcome})`);
+  params.workspace.summary.push(`- ci exit: \`${ci.exitCode}\` (${ci.outcome})`);
+  params.workspace.summary.push(
+    `- lifecycle status before install: \`${renderStatusSnapshot(params.lifecycleStatusSnapshot)}\``
+  );
+  params.workspace.summary.push(
+    `- lifecycle status after uninstall: \`${renderStatusSnapshot(params.lifecycleStatusAfterUninstall)}\``
+  );
+  params.workspace.summary.push(`- Artifact root: \`${params.workspace.reportsDir}\``);
+};

package/scripts/package-install-smoke-file-lib.ts

@@ -0,0 +1,33 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const REPORTS_DIR_ROOT = join('.audit-reports', 'package-smoke');
+
+export const ensureDirectory = (path: string): void => {
+  mkdirSync(path, { recursive: true });
+};
+
+export const writeReportFile = (
+  repoRoot: string,
+  relativePath: string,
+  content: string
+): void => {
+  const filePath = join(repoRoot, relativePath);
+  ensureDirectory(join(filePath, '..'));
+  writeFileSync(filePath, content, 'utf8');
+};
+
+export const parseEvidence = (
+  filePath: string
+): { version: string; stage: string; outcome: string } => {
+  const parsed = JSON.parse(readFileSync(filePath, 'utf8')) as {
+    version?: string;
+    snapshot?: { stage?: string; outcome?: string };
+  };
+
+  return {
+    version: parsed.version ?? 'missing',
+    stage: parsed.snapshot?.stage ?? 'missing',
+    outcome: parsed.snapshot?.outcome ?? 'missing',
+  };
+};

package/scripts/package-install-smoke-fixtures-content-lib.ts

@@ -0,0 +1,57 @@
+export const SMOKE_BASELINE_FILE = {
+  path: 'apps/backend/src/baseline.ts',
+  content: ["export const baseline = (): string => 'ok';", ''].join('\n'),
+};
+
+export const SMOKE_RANGE_PAYLOAD_FILES: Record<string, string> = {
+  'apps/backend/src/range-smoke.ts': [
+    'export const backendRangeSmoke = (): string => {',
+    "  console.log('backend-range-smoke');",
+    "  return 'ok';",
+    '};',
+    '',
+  ].join('\n'),
+  'apps/web/src/range-smoke.tsx': [
+    'export function FrontendRangeSmoke(): string {',
+    "  console.log('frontend-range-smoke');",
+    "  return 'ok';",
+    '}',
+    '',
+  ].join('\n'),
+  'apps/android/app/src/main/java/com/example/RangeSmoke.kt': [
+    'package com.example',
+    '',
+    'class RangeSmoke {',
+    '  fun block(): String {',
+    '    Thread.sleep(1000)',
+    '    return "ok"',
+    '  }',
+    '}',
+    '',
+  ].join('\n'),
+  'apps/ios/RangeSmoke.swift': [
+    'import Foundation',
+    '',
+    'func rangeSmoke() -> String {',
+    '  let value: String? = "ok"',
+    '  return value!',
+    '}',
+    '',
+  ].join('\n'),
+};
+
+export const SMOKE_STAGED_ONLY_FILE = {
+  path: 'apps/backend/src/staged-smoke.ts',
+  content: ['export const stagedSmoke = (): string => "ok";', ''].join('\n'),
+};
+
+export const SMOKE_STAGED_ONLY_VIOLATION_FILE = {
+  path: 'apps/backend/src/staged-smoke.ts',
+  content: [
+    'export const stagedSmoke = (): string => {',
+    "  console.log('backend-staged-smoke');",
+    "  return 'ok';",
+    '};',
+    '',
+  ].join('\n'),
+};

package/scripts/package-install-smoke-fixtures-lib.ts

@@ -0,0 +1,41 @@
+import {
+  SMOKE_BASELINE_FILE,
+  SMOKE_RANGE_PAYLOAD_FILES,
+  SMOKE_STAGED_ONLY_FILE,
+  SMOKE_STAGED_ONLY_VIOLATION_FILE,
+} from './package-install-smoke-fixtures-content-lib';
+import { writeSmokeFixtureFile } from './package-install-smoke-fixtures-write-lib';
+
+export const writeBaselineFile = (consumerRepo: string): void => {
+  writeSmokeFixtureFile({
+    consumerRepo,
+    relativePath: SMOKE_BASELINE_FILE.path,
+    content: SMOKE_BASELINE_FILE.content,
+  });
+};
+
+export const writeRangePayloadFiles = (consumerRepo: string): void => {
+  for (const [relativePath, content] of Object.entries(SMOKE_RANGE_PAYLOAD_FILES)) {
+    writeSmokeFixtureFile({
+      consumerRepo,
+      relativePath,
+      content,
+    });
+  }
+};
+
+export const writeStagedOnlyFile = (consumerRepo: string): string => {
+  return writeSmokeFixtureFile({
+    consumerRepo,
+    relativePath: SMOKE_STAGED_ONLY_FILE.path,
+    content: SMOKE_STAGED_ONLY_FILE.content,
+  });
+};
+
+export const writeStagedOnlyViolationFile = (consumerRepo: string): string => {
+  return writeSmokeFixtureFile({
+    consumerRepo,
+    relativePath: SMOKE_STAGED_ONLY_VIOLATION_FILE.path,
+    content: SMOKE_STAGED_ONLY_VIOLATION_FILE.content,
+  });
+};

package/scripts/package-install-smoke-fixtures-write-lib.ts

@@ -0,0 +1,14 @@
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ensureDirectory } from './package-install-smoke-runner-common';
+
+export const writeSmokeFixtureFile = (params: {
+  consumerRepo: string;
+  relativePath: string;
+  content: string;
+}): string => {
+  const filePath = join(params.consumerRepo, params.relativePath);
+  ensureDirectory(join(filePath, '..'));
+  writeFileSync(filePath, params.content, 'utf8');
+  return params.relativePath;
+};

package/scripts/package-install-smoke-gate-lib.ts

@@ -0,0 +1,64 @@
+import { copyFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { SmokeExpectation } from './package-install-smoke-contract';
+import {
+  assertNoFatalOutput,
+  parseEvidence,
+  runCommand,
+} from './package-install-smoke-runner-common';
+import {
+  pushCommandLog,
+  type SmokeWorkspace,
+} from './package-install-smoke-workspace-lib';
+
+export type SmokeGateStep = {
+  label: 'pre-commit' | 'pre-push' | 'ci';
+  command: string;
+  args: string[];
+  evidenceFile: string;
+  stage: 'PRE_COMMIT' | 'PRE_PUSH' | 'CI';
+};
+
+export const runGateStep = (
+  workspace: SmokeWorkspace,
+  step: SmokeGateStep,
+  expectation: SmokeExpectation
+): { outcome: string; exitCode: number } => {
+  const result = runCommand({
+    cwd: workspace.consumerRepo,
+    executable: step.command,
+    args: step.args,
+    env: step.label === 'ci' ? { GITHUB_BASE_REF: 'main' } : undefined,
+  });
+
+  pushCommandLog(workspace.commandLog, result);
+  assertNoFatalOutput(result, `pumuki-${step.label}`);
+  if (result.exitCode !== expectation.expectedExitCode) {
+    throw new Error(
+      `pumuki-${step.label} expected exit code ${expectation.expectedExitCode}, got ${result.exitCode}`
+    );
+  }
+
+  copyFileSync(
+    join(workspace.consumerRepo, '.ai_evidence.json'),
+    join(workspace.reportRoot, step.evidenceFile)
+  );
+
+  const evidence = parseEvidence(join(workspace.reportRoot, step.evidenceFile));
+  if (evidence.version !== '2.1' || evidence.stage !== step.stage) {
+    throw new Error(
+      `Invalid ${step.stage} evidence metadata: version=${evidence.version} stage=${evidence.stage}`
+    );
+  }
+
+  if (evidence.outcome !== expectation.expectedOutcome) {
+    throw new Error(
+      `Unexpected ${step.stage} evidence outcome for mode: ${evidence.outcome}`
+    );
+  }
+
+  return {
+    outcome: evidence.outcome,
+    exitCode: result.exitCode,
+  };
+};

package/scripts/package-install-smoke-lib.ts

@@ -0,0 +1,3 @@
+export type { SmokeExpectation, SmokeMode } from './package-install-smoke-contract';
+export { parsePackageInstallSmokeMode, resolveSmokeExpectation } from './package-install-smoke-mode-lib';
+export { runPackageInstallSmoke } from './package-install-smoke-execution-lib';

package/scripts/package-install-smoke-lifecycle-lib.ts

@@ -0,0 +1,91 @@
+import {
+  assertNoFatalOutput,
+  assertSuccess,
+  runCommand,
+} from './package-install-smoke-runner-common';
+import { pushCommandLog, type SmokeWorkspace } from './package-install-smoke-workspace-lib';
+
+const normalizeStatus = (value: string): string =>
+  value
+    .split('\n')
+    .map((line) => line.trimEnd())
+    .filter((line) => line.length > 0)
+    .join('\n');
+
+const getShortStatus = (workspace: SmokeWorkspace): string => {
+  const statusResult = runCommand({
+    cwd: workspace.consumerRepo,
+    executable: 'git',
+    args: ['status', '--short'],
+  });
+  pushCommandLog(workspace.commandLog, statusResult);
+  assertSuccess(statusResult, 'git status --short snapshot');
+  return normalizeStatus(statusResult.stdout);
+};
+
+export const captureLifecycleStatusSnapshot = (workspace: SmokeWorkspace): string =>
+  getShortStatus(workspace);
+
+export const runLifecycleInstallStep = (workspace: SmokeWorkspace): void => {
+  const result = runCommand({
+    cwd: workspace.consumerRepo,
+    executable: 'npx',
+    args: ['--yes', 'pumuki', 'install'],
+  });
+  pushCommandLog(workspace.commandLog, result);
+  assertNoFatalOutput(result, 'pumuki lifecycle install');
+  assertSuccess(result, 'pumuki lifecycle install');
+};
+
+export const runLifecycleUninstallStep = (workspace: SmokeWorkspace): void => {
+  const result = runCommand({
+    cwd: workspace.consumerRepo,
+    executable: 'npx',
+    args: ['--yes', 'pumuki', 'uninstall', '--purge-artifacts'],
+  });
+  pushCommandLog(workspace.commandLog, result);
+  assertNoFatalOutput(result, 'pumuki lifecycle uninstall');
+  assertSuccess(result, 'pumuki lifecycle uninstall');
+};
+
+export const assertLifecycleStatusMatchesSnapshot = (params: {
+  workspace: SmokeWorkspace;
+  snapshot: string;
+}): string => {
+  const current = getShortStatus(params.workspace);
+  if (params.snapshot !== current) {
+    throw new Error(
+      [
+        'pumuki lifecycle smoke left repository status dirty after uninstall.',
+        `before install:\n${params.snapshot || '(clean)'}`,
+        `after uninstall:\n${current || '(clean)'}`,
+      ].join('\n\n')
+    );
+  }
+  return current;
+};
+
+export const assertLifecycleStatusRoundTrip = (workspace: SmokeWorkspace): {
+  beforeInstall: string;
+  afterUninstall: string;
+} => {
+  const beforeInstall = getShortStatus(workspace);
+  runLifecycleInstallStep(workspace);
+  runLifecycleUninstallStep(workspace);
+  const afterUninstall = getShortStatus(workspace);
+
+  if (beforeInstall !== afterUninstall) {
+    throw new Error(
+      [
+        'pumuki lifecycle smoke left repository status dirty after uninstall.',
+        `before install:\n${beforeInstall || '(clean)'}`,
+        `after uninstall:\n${afterUninstall || '(clean)'}`,
+      ].join('\n\n')
+    );
+  }
+
+  return {
+    beforeInstall,
+    afterUninstall,
+  };
+};

package/scripts/package-install-smoke-mode-lib.ts

@@ -0,0 +1,31 @@
+import type { SmokeExpectation, SmokeMode } from './package-install-smoke-contract';
+
+export const parsePackageInstallSmokeMode = (
+  args: ReadonlyArray<string>
+): SmokeMode => {
+  const modeArg = args.find((argument) => argument.startsWith('--mode='));
+  if (!modeArg) {
+    return 'block';
+  }
+
+  const value = modeArg.slice('--mode='.length).trim();
+  if (value === 'block' || value === 'minimal') {
+    return value;
+  }
+
+  throw new Error(`Unsupported --mode value "${value}". Allowed values: block, minimal`);
+};
+
+export const resolveSmokeExpectation = (mode: SmokeMode): SmokeExpectation => {
+  if (mode === 'block') {
+    return {
+      expectedExitCode: 1,
+      expectedOutcome: 'BLOCK',
+    };
+  }
+
+  return {
+    expectedExitCode: 0,
+    expectedOutcome: 'PASS',
+  };
+};

package/scripts/package-install-smoke-repo-setup-lib.ts

@@ -0,0 +1,2 @@
+export { setupConsumerRepository, writeStagedPayload } from './package-install-smoke-consumer-repo-setup-lib';
+export { createTarball } from './package-install-smoke-tarball-lib';

package/scripts/package-install-smoke-runner-common.ts

@@ -0,0 +1,12 @@
+export {
+  assertNoFatalOutput,
+  assertSuccess,
+  runCommand,
+  type RunCommandResult,
+} from './package-install-smoke-command-lib';
+export {
+  REPORTS_DIR_ROOT,
+  ensureDirectory,
+  parseEvidence,
+  writeReportFile,
+} from './package-install-smoke-file-lib';

package/scripts/package-install-smoke-tarball-lib.ts

@@ -0,0 +1,34 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  assertSuccess,
+  runCommand,
+} from './package-install-smoke-runner-common';
+import {
+  pushCommandLog,
+  type SmokeWorkspace,
+} from './package-install-smoke-workspace-lib';
+
+export const createTarball = (
+  workspace: SmokeWorkspace
+): { id: string; tarballPath: string } => {
+  const packResult = runCommand({
+    cwd: workspace.repoRoot,
+    executable: 'npm',
+    args: ['pack', '--json'],
+  });
+  pushCommandLog(workspace.commandLog, packResult);
+  assertSuccess(packResult, 'npm pack --json');
+
+  const packInfo = JSON.parse(packResult.stdout) as Array<{ filename: string; id: string }>;
+  if (!Array.isArray(packInfo) || packInfo.length === 0 || !packInfo[0]?.filename) {
+    throw new Error('npm pack --json did not return a valid tarball payload');
+  }
+
+  const tarballPath = join(workspace.repoRoot, packInfo[0].filename);
+  if (!existsSync(tarballPath)) {
+    throw new Error(`Packed tarball not found at ${tarballPath}`);
+  }
+
+  return { id: packInfo[0].id, tarballPath };
+};

package/scripts/package-install-smoke-workspace-contract.ts

@@ -0,0 +1,11 @@
+export type SmokeWorkspace = {
+  repoRoot: string;
+  reportsDir: string;
+  reportRoot: string;
+  tmpRoot: string;
+  consumerRepo: string;
+  bareRemote: string;
+  commandLog: string[];
+  summary: string[];
+  tarballPath?: string;
+};

package/scripts/package-install-smoke-workspace-factory-lib.ts

@@ -0,0 +1,38 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import type { SmokeMode } from './package-install-smoke-contract';
+import {
+  REPORTS_DIR_ROOT,
+  ensureDirectory,
+} from './package-install-smoke-runner-common';
+import type { SmokeWorkspace } from './package-install-smoke-workspace-contract';
+
+export const createSmokeWorkspace = (mode: SmokeMode): SmokeWorkspace => {
+  const repoRoot = resolve(process.cwd());
+  const reportsDir = join(REPORTS_DIR_ROOT, mode);
+  const reportRoot = join(repoRoot, reportsDir);
+  ensureDirectory(reportRoot);
+
+  const tmpRoot = mkdtempSync(join(tmpdir(), 'pumuki-package-smoke-'));
+  const consumerRepo = join(tmpRoot, 'consumer');
+  const bareRemote = join(tmpRoot, 'origin.git');
+
+  return {
+    repoRoot,
+    reportsDir,
+    reportRoot,
+    tmpRoot,
+    consumerRepo,
+    bareRemote,
+    commandLog: [],
+    summary: ['# Package Install Smoke Report', ''],
+  };
+};
+
+export const cleanupWorkspace = (workspace: SmokeWorkspace): void => {
+  if (workspace.tarballPath) {
+    rmSync(workspace.tarballPath, { force: true });
+  }
+  rmSync(workspace.tmpRoot, { recursive: true, force: true });
+};

package/scripts/package-install-smoke-workspace-lib.ts

@@ -0,0 +1,7 @@
+export { cleanupWorkspace, createSmokeWorkspace } from './package-install-smoke-workspace-factory-lib';
+export {
+  pushCommandLog,
+  writeFailureReport,
+  writeSuccessReport,
+} from './package-install-smoke-workspace-report-lib';
+export type { SmokeWorkspace } from './package-install-smoke-workspace-contract';

package/scripts/package-install-smoke-workspace-report-lib.ts

@@ -0,0 +1,44 @@
+import { join } from 'node:path';
+import {
+  writeReportFile,
+  type RunCommandResult,
+} from './package-install-smoke-runner-common';
+import type { SmokeWorkspace } from './package-install-smoke-workspace-contract';
+
+export const pushCommandLog = (
+  commandLog: string[],
+  result: RunCommandResult
+): void => {
+  commandLog.push(`$ ${result.command}\n${result.combined}`.trim());
+};
+
+export const writeFailureReport = (
+  workspace: SmokeWorkspace,
+  error: Error
+): void => {
+  workspace.summary.push('- Status: FAIL');
+  workspace.summary.push(`- Error: ${error.message}`);
+  writeReportFile(
+    workspace.repoRoot,
+    join(workspace.reportsDir, 'command.log'),
+    workspace.commandLog.join('\n\n')
+  );
+  writeReportFile(
+    workspace.repoRoot,
+    join(workspace.reportsDir, 'summary.md'),
+    workspace.summary.join('\n')
+  );
+};
+
+export const writeSuccessReport = (workspace: SmokeWorkspace): void => {
+  writeReportFile(
+    workspace.repoRoot,
+    join(workspace.reportsDir, 'command.log'),
+    workspace.commandLog.join('\n\n')
+  );
+  writeReportFile(
+    workspace.repoRoot,
+    join(workspace.reportsDir, 'summary.md'),
+    workspace.summary.join('\n')
+  );
+};

package/scripts/package-install-smoke.ts

@@ -0,0 +1,7 @@
+import {
+  parsePackageInstallSmokeMode,
+  runPackageInstallSmoke,
+} from './package-install-smoke-lib';
+
+const mode = parsePackageInstallSmokeMode(process.argv.slice(2));
+runPackageInstallSmoke(mode);

package/scripts/package-manifest-lib.ts

@@ -0,0 +1,44 @@
+export const REQUIRED_PACKAGE_PATHS = [
+  'bin/pumuki.js',
+  'bin/pumuki-framework.js',
+  'bin/pumuki-pre-commit.js',
+  'bin/pumuki-pre-push.js',
+  'bin/pumuki-ci.js',
+  'bin/pumuki-mcp-evidence.js',
+  'core/utils/stableStringify.ts',
+  'core/facts/detectors/typescript/index.ts',
+  'core/rules/presets/heuristics/typescript.ts',
+  'scripts/package-install-smoke.ts',
+  'integrations/git/runPlatformGate.ts',
+  'integrations/lifecycle/cli.ts',
+  'integrations/evidence/buildEvidence.ts',
+];
+
+export const FORBIDDEN_PACKAGE_PATTERNS: RegExp[] = [
+  /^legacy\//,
+  /\/__tests__\//,
+  /^docs\/validation\/archive\//,
+  /^\.audit-reports\//,
+  /^\.audit_tmp\//,
+];
+
+export type PackageManifestReport = {
+  missingRequired: string[];
+  forbiddenMatches: string[];
+};
+
+export const inspectPackageManifestPaths = (
+  filePaths: ReadonlyArray<string>
+): PackageManifestReport => {
+  const missingRequired = REQUIRED_PACKAGE_PATHS.filter(
+    (requiredPath) => !filePaths.includes(requiredPath)
+  );
+  const forbiddenMatches = filePaths.filter((path) =>
+    FORBIDDEN_PACKAGE_PATTERNS.some((pattern) => pattern.test(path))
+  );
+
+  return {
+    missingRequired,
+    forbiddenMatches,
+  };
+};