pumuki 6.3.9 → 6.3.11

package/README.md

@@ -118,6 +118,8 @@ The `pumuki` binary provides repository lifecycle operations:
 | `pumuki doctor` | Safety checks (hook drift, tracked `node_modules`, lifecycle state) |
 | `pumuki status` | Current lifecycle snapshot |
 
+`pumuki remove` is dependency-safe by design: it never deletes non-Pumuki third-party dependencies and preserves pre-existing third-party empty directories.
+
 ## Gate Commands
 
 Dedicated gate binaries are available:

package/VERSION

@@ -1 +1 @@
-v6.3.9
+v6.3.11

package/docs/REFRACTOR_PROGRESS.md

@@ -153,7 +153,16 @@ Estado consolidado del refactor con seguimiento de tareas y evidencia del avance
 - ✅ Corregir `Quick Start` del `README.md` para consumo real por npm (`pumuki`) y comandos ejecutables de lifecycle/gates.
 - ✅ Auditar `README.md` con criterios enterprise (profesionalismo, claridad, estructura y completitud) y generar backlog de mejoras priorizado.
 - ✅ Reescribir `README.md` de forma integral con estándar enterprise (audiencia consumer/framework separada, comandos reales y estructura consistente).
-- 🚧 Ejecutar matriz E2E completa en `pumuki-mock-consumer` (`install -> pre-commit/pre-push/ci -> remove`) sobre escenarios `clean`, `violations` y `mixed`.
+- ✅ Publicar `pumuki@6.3.9` en npm (tags `latest` y `next`) para reflejar la documentación enterprise reescrita.
+- ✅ Ejecutar matriz E2E completa en `pumuki-mock-consumer` (`install -> pre-commit/pre-push/ci -> remove`) sobre escenarios `clean`, `violations` y `mixed`.
+- ✅ Endurecer `pumuki-mock-consumer` con fixtures multiarchivo por plataforma y runner único `npm run pumuki:matrix`.
+- ✅ Endurecer `pumuki remove` para podar residuos vacíos de `node_modules` sin borrar dependencias reales de terceros.
+- ✅ Restringir poda de vacíos en `node_modules` a repos sin dependencias externas declaradas (seguridad enterprise reforzada).
+- ✅ Publicar `pumuki@6.3.10` con hardening de desinstalación (`latest` y `next`).
+- ✅ Refinar `pumuki remove` para eliminar vacíos nuevos tras uninstall manteniendo vacíos preexistentes de terceros.
+- ✅ Endurecer `pumuki remove` para limpiar trazas del árbol de dependencias de Pumuki sin borrar dependencias ajenas (incluyendo vacíos no relacionados).
+- 🚧 Publicar `pumuki@6.3.11` con la limpieza estricta de trazas y revalidar ciclo install/remove en consumidor mock.
+- 🚧 Integrar MCP en `pumuki-mock-consumer` y validar consumo real de `ai_evidence` desde cliente MCP externo.
 
 ## Notas
 - Estrategia obligatoria: commits atómicos por tarea.

package/integrations/lifecycle/consumerPackage.ts

@@ -7,6 +7,8 @@ export type ConsumerDependencySource = 'dependencies' | 'devDependencies' | 'non
 type ConsumerPackageJson = {
   dependencies?: Record<string, string>;
   devDependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
 };
 
 const readPackageJson = (repoRoot: string): ConsumerPackageJson => {
@@ -46,3 +48,23 @@ export const resolveCurrentPumukiDependency = (repoRoot: string): {
     source: 'none',
   };
 };
+
+export const hasDeclaredDependenciesBeyondPumuki = (repoRoot: string): boolean => {
+  const pkg = readPackageJson(repoRoot);
+  const pumukiPackage = getCurrentPumukiPackageName();
+  const ignoredPackages = new Set([pumukiPackage, 'pumuki-ast-hooks']);
+
+  const hasExternalDependency = (section?: Record<string, string>): boolean => {
+    if (!section) {
+      return false;
+    }
+    return Object.keys(section).some((dependencyName) => !ignoredPackages.has(dependencyName));
+  };
+
+  return (
+    hasExternalDependency(pkg.dependencies) ||
+    hasExternalDependency(pkg.devDependencies) ||
+    hasExternalDependency(pkg.optionalDependencies) ||
+    hasExternalDependency(pkg.peerDependencies)
+  );
+};

package/integrations/lifecycle/remove.ts

@@ -1,5 +1,5 @@
-import { existsSync, readdirSync, rmSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readFileSync, readdirSync, rmSync, unlinkSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { resolveCurrentPumukiDependency } from './consumerPackage';
 import { LifecycleGitService, type ILifecycleGitService } from './gitService';
 import { LifecycleNpmService, type ILifecycleNpmService } from './npmService';
@@ -13,6 +13,138 @@ export type LifecycleRemoveResult = {
   removedArtifacts: ReadonlyArray<string>;
 };
 
+type NodePackageManifest = {
+  dependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+};
+
+const readManifestDependencyNames = (packageDirectory: string): ReadonlyArray<string> => {
+  const packageJsonPath = join(packageDirectory, 'package.json');
+  if (!existsSync(packageJsonPath)) {
+    return [];
+  }
+
+  try {
+    const manifest = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as NodePackageManifest;
+    const dependencyNames = new Set<string>();
+    const sections = [manifest.dependencies, manifest.optionalDependencies, manifest.peerDependencies];
+    for (const section of sections) {
+      if (!section) {
+        continue;
+      }
+      for (const dependencyName of Object.keys(section)) {
+        dependencyNames.add(dependencyName);
+      }
+    }
+    return Array.from(dependencyNames);
+  } catch {
+    return [];
+  }
+};
+
+const resolveInstalledDependencyDirectory = (params: {
+  dependencyName: string;
+  fromPackageDirectory: string;
+  nodeModulesPath: string;
+}): string | undefined => {
+  const repoRoot = dirname(params.nodeModulesPath);
+  let currentDirectory = params.fromPackageDirectory;
+
+  while (currentDirectory.startsWith(repoRoot)) {
+    const candidate = join(currentDirectory, 'node_modules', params.dependencyName);
+    if (existsSync(join(candidate, 'package.json'))) {
+      return candidate;
+    }
+
+    if (currentDirectory === repoRoot) {
+      break;
+    }
+
+    const parentDirectory = dirname(currentDirectory);
+    if (parentDirectory === currentDirectory) {
+      break;
+    }
+    currentDirectory = parentDirectory;
+  }
+
+  const topLevelCandidate = join(params.nodeModulesPath, params.dependencyName);
+  if (existsSync(join(topLevelCandidate, 'package.json'))) {
+    return topLevelCandidate;
+  }
+
+  return undefined;
+};
+
+const collectPumukiTraceDirectories = (params: {
+  repoRoot: string;
+  packageName: string;
+}): ReadonlySet<string> => {
+  const nodeModulesPath = join(params.repoRoot, 'node_modules');
+  const rootPackageDirectory = join(nodeModulesPath, params.packageName);
+  if (!existsSync(join(rootPackageDirectory, 'package.json'))) {
+    return new Set<string>();
+  }
+
+  const traceDirectories = new Set<string>();
+  const pending = [rootPackageDirectory];
+
+  while (pending.length > 0) {
+    const packageDirectory = pending.pop();
+    if (!packageDirectory || traceDirectories.has(packageDirectory)) {
+      continue;
+    }
+    traceDirectories.add(packageDirectory);
+
+    const dependencyNames = readManifestDependencyNames(packageDirectory);
+    for (const dependencyName of dependencyNames) {
+      const resolvedDependencyDirectory = resolveInstalledDependencyDirectory({
+        dependencyName,
+        fromPackageDirectory: packageDirectory,
+        nodeModulesPath,
+      });
+      if (!resolvedDependencyDirectory) {
+        continue;
+      }
+      pending.push(resolvedDependencyDirectory);
+    }
+  }
+
+  return traceDirectories;
+};
+
+type EmptyDirectoryCleanupResult = 'removed' | 'missing' | 'not-empty';
+
+const removeDirectoryIfEmpty = (directoryPath: string): EmptyDirectoryCleanupResult => {
+  if (!existsSync(directoryPath)) {
+    return 'missing';
+  }
+
+  if (readdirSync(directoryPath).length > 0) {
+    return 'not-empty';
+  }
+
+  rmSync(directoryPath, { recursive: true, force: true });
+  return 'removed';
+};
+
+const cleanupTraceAncestors = (params: {
+  tracePath: string;
+  nodeModulesPath: string;
+}): void => {
+  let currentDirectory = dirname(params.tracePath);
+  while (
+    currentDirectory.startsWith(params.nodeModulesPath) &&
+    currentDirectory !== params.nodeModulesPath
+  ) {
+    const cleanupResult = removeDirectoryIfEmpty(currentDirectory);
+    if (cleanupResult === 'not-empty') {
+      break;
+    }
+    currentDirectory = dirname(currentDirectory);
+  }
+};
+
 const cleanupNodeModulesIfOnlyLockfile = (repoRoot: string): void => {
   const nodeModulesPath = join(repoRoot, 'node_modules');
   if (!existsSync(nodeModulesPath)) {
@@ -39,8 +171,7 @@ const cleanupNodeModulesIfOnlyLockfile = (repoRoot: string): void => {
   const binEntry = entries.find((entry) => entry.name === '.bin' && entry.isDirectory());
   if (binEntry) {
     const binPath = join(nodeModulesPath, '.bin');
-    const binEntries = readdirSync(binPath);
-    if (binEntries.length > 0) {
+    if (readdirSync(binPath).length > 0) {
       return;
     }
     rmSync(binPath, { recursive: true, force: true });
@@ -55,6 +186,30 @@ const cleanupNodeModulesIfOnlyLockfile = (repoRoot: string): void => {
   }
 };
 
+const cleanupPumukiTraceDirectories = (params: {
+  repoRoot: string;
+  traceDirectories: ReadonlySet<string>;
+}): void => {
+  const nodeModulesPath = join(params.repoRoot, 'node_modules');
+  if (!existsSync(nodeModulesPath)) {
+    return;
+  }
+
+  const orderedTraceDirectories = Array.from(params.traceDirectories).sort(
+    (left, right) => right.length - left.length
+  );
+
+  for (const traceDirectory of orderedTraceDirectories) {
+    removeDirectoryIfEmpty(traceDirectory);
+    cleanupTraceAncestors({
+      tracePath: traceDirectory,
+      nodeModulesPath,
+    });
+  }
+
+  cleanupNodeModulesIfOnlyLockfile(params.repoRoot);
+};
+
 export const runLifecycleRemove = (params?: {
   cwd?: string;
   git?: ILifecycleGitService;
@@ -72,9 +227,16 @@ export const runLifecycleRemove = (params?: {
 
   const currentDependency = resolveCurrentPumukiDependency(repoRoot);
   const packageName = getCurrentPumukiPackageName();
+  const pumukiTraceDirectories = collectPumukiTraceDirectories({
+    repoRoot,
+    packageName,
+  });
 
   if (currentDependency.source === 'none') {
-    cleanupNodeModulesIfOnlyLockfile(repoRoot);
+    cleanupPumukiTraceDirectories({
+      repoRoot,
+      traceDirectories: pumukiTraceDirectories,
+    });
     return {
       repoRoot,
       packageRemoved: false,
@@ -84,7 +246,10 @@ export const runLifecycleRemove = (params?: {
   }
 
   npm.runNpm(['uninstall', packageName], repoRoot);
-  cleanupNodeModulesIfOnlyLockfile(repoRoot);
+  cleanupPumukiTraceDirectories({
+    repoRoot,
+    traceDirectories: pumukiTraceDirectories,
+  });
 
   return {
     repoRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.9",
+  "version": "6.3.11",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {