@karajan-family/code 4.55.0 → 4.57.0

package/src/review/third-party-review.js

@@ -0,0 +1,67 @@
+/**
+ * KJC-TSK-1075 (#2227): review someone else's PR. kj's reviewer, the target
+ * repo's rules (.karajan) and the provider the agent picks run over
+ * base...head; no own-work gate applies (card, tests, policy, session RAG) and
+ * no verdict is stored, so this mode never unlocks a commit (ADR 0015). The
+ * own-work gate, reviewGateCommand, stays untouched.
+ */
+import { runCommand } from "../utils/process.js";
+import { resolveRole } from "../config/role-resolver.js";
+import { runOneShotReview } from "./one-shot-review.js";
+import { prRequirementChecks } from "./pr-requirements.js";
+import { prSecurityChecks } from "./pr-security.js";
+import { sonarCheck } from "./pr-sonar.js";
+
+const gitDiffOf = async (projectDir, range) => {
+  const res = await runCommand("git", ["diff", range], { cwd: projectDir });
+  if (res.exitCode !== 0) throw new Error(`git diff ${range} failed: ${(res.stderr || "").trim()}`);
+  return res.stdout;
+};
+
+const finding = (i) => ({
+  file: i.file ?? null, line: i.line ?? null, severity: i.severity ?? null,
+  description: i.description ?? "", suggested_fix: i.suggested_fix ?? null,
+});
+
+/** The review as data: verdict, findings, suggestions and the PR-requirement checks. */
+export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck }) {
+  const diff = await gitDiff(projectDir, range);
+  // KJC-TSK-1076/1077: the PR's requirements and its security, with no tokens; they never stop the review.
+  const checks = [...await requirements({ range, projectDir, config }), ...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
+  const record = await run({
+    diff, task, config, logger, projectDir,
+    reviewerOverride: resolveRole(config, "reviewer").provider || null,
+    persist: false,
+  });
+  return {
+    mode: "third-party",
+    range,
+    reviewer: record.reviewer,
+    verdict: { approved: record.verdict === "approved", summary: record.summary ?? "" },
+    findings: (record.issues ?? []).map(finding),
+    suggestions: record.suggestions ?? [],
+    checks,
+  };
+}
+
+/**
+ * The CLI side: stdout carries exactly one JSON document, logs go to stderr.
+ * Exit 0 whatever the PR's verdict (the agent decides what to post); non-zero
+ * only when kj itself fails.
+ */
+export async function thirdPartyReviewCommand({ flags, config, out = process.stdout, err = process.stderr, review = thirdPartyReview }) {
+  const print = (doc) => out.write(`${JSON.stringify(doc)}\n`);
+  if (!flags.range) {
+    print({ error: "--third-party reviews a range: pass --range <base>...<head>" });
+    return 1;
+  }
+  const log = (msg) => err.write(`${msg}\n`);
+  const logger = { info: log, warn: log, error: log, debug: () => {} };
+  try {
+    print(await review({ range: flags.range, config, projectDir: config.projectDir || process.cwd(), logger, task: flags.task ?? null }));
+    return 0;
+  } catch (e) {
+    print({ error: e.message });
+    return 1;
+  }
+}

package/src/steward/gate.js

@@ -0,0 +1,31 @@
+/**
+ * KJC-TSK-1086: the Steward's block (STW-C, KJC-TSK-0791) at commit too. Only
+ * where the project adopted it (method_gates.steward: block), only the hard
+ * invariants (vulnerable dependencies, a persistently red main), and never on
+ * an invariant whose verdict is unknown. Having declared block, a missing or
+ * unreadable report blocks too: the sweep has to run.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const HARD = new Set(["vulnerable-deps", "main-ci"]);
+
+/** @returns {{ sweptAt: string, hard: object[], reason: string } | null} */
+export function stewardBlocking({ projectDir, config }) {
+  if (config?.method_gates?.steward !== "block") return null;
+  const file = join(projectDir, ".karajan", "steward", "report.json");
+  let rep;
+  try {
+    rep = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    // block was adopted explicitly: a missing or unreadable report is never a silent pass.
+    return { sweptAt: null, hard: [], reason: `steward cannot read ${file} (${err.message}) — rerun kj steward sweep; while it is unreadable the block stands` };
+  }
+  if (!Array.isArray(rep?.invariants)) {
+    return { sweptAt: rep?.sweptAt ?? null, hard: [], reason: `steward report ${file} has no invariants list — rerun kj steward sweep; while it is malformed the block stands` };
+  }
+  const hard = rep.invariants.filter((r) => r?.verdict === "broken" && HARD.has(r.id));
+  if (hard.length === 0) return null;
+  const lines = hard.map((r) => `${r.id}: ${r.evidence || ""} -> ${r.remedy || r.renew || "kj steward sweep"}`);
+  return { sweptAt: rep.sweptAt, hard, reason: `steward (sweep ${rep.sweptAt}) blocks: ${lines.join("; ")} — if the work goes on, your user sets method_gates.steward to inform` };
+}

package/src/utils/git.js

@@ -307,8 +307,10 @@ export async function hasRemote(cwd = null) {
   return res.exitCode === 0;
 }
 
+// KJC-TSK-1093: no -u, which writes the upstream into .git/config, read-only inside
+// the host sandbox. Nothing in kj reads a feature branch's upstream.
 export async function pushBranch(branch, cwd = null) {
-  await runGit(["push", "-u", "origin", branch], cwd ? { cwd } : {});
+  await runGit(["push", "origin", branch], cwd ? { cwd } : {});
 }
 
 export async function createPullRequest({ baseBranch, branch, title, body, cwd = null }) {