@karajan-family/code 4.67.0 → 4.68.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karajan-family/code",
-  "version": "4.67.0",
+  "version": "4.68.1",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/register-meta.js

@@ -1119,7 +1119,8 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--no-config", "Skip lint/format/commit config files (hooks only)")
     .option("--no-ci", "Skip CI quality workflows")
     .option("--no-guidelines", "Skip AI-agent guideline files (AGENTS.md/CLAUDE.md)")
-    .option("--no-sandbox", "Leave the host Bash sandbox alone (by default it is turned on where it can start)")
+    .option("--sandbox", "Turn the host Bash sandbox on where it can start (off by default: it blocks gh, push and Sonar)")
+    .option("--no-sandbox", "Leave the host Bash sandbox alone (the default; kept for existing scripts)")
     .option("--mutation", "Also seed an opt-in nightly/manual mutation CI job (never a PR gate)")
     .option("--only <dirs...>", "Harden only these language roots (e.g. frontend backend)")
     .option("--exclude <globs...>", "Skip language roots matching these globs (e.g. wrappers)")
@@ -1137,7 +1138,7 @@ export function registerMeta(program, { pkgVersion }) {
           config: flags.config !== false,
           ci: flags.ci !== false,
           guidelines: flags.guidelines !== false,
-          sandbox: flags.sandbox !== false,
+          sandbox: flags.sandbox === true,
           mutation: Boolean(flags.mutation),
           only: flags.only ?? [],
           exclude: flags.exclude ?? [],

package/src/cli.js

@@ -14,6 +14,10 @@ import { registerStandby } from "./cli/register-standby.js";
 import { printUpdateNotice } from "./utils/update-check.js";
 import { printWelcomeScreen } from "./utils/welcome.js";
 import { migrateKjToKarajan } from "./utils/home-migration.js";
+import { pinGitDiffFormat } from "./utils/git-diff-format.js";
+
+// KJC-BUG-0408: every git kj runs prints a/ and b/, whatever the user's gitconfig says.
+pinGitDiffFormat();
 
 const PKG_PATH = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../package.json");
 const PKG_VERSION = JSON.parse(readFileSync(PKG_PATH, "utf8")).version;

package/src/commands/harden.js

@@ -92,7 +92,7 @@ export async function hardenCommand({
   only = [],
   exclude = [],
   commitSupervisor = false,
-  sandbox = true,
+  sandbox = false,
   kjVersion = null,
   // KJC-BUG-0289: the contract files already dirty before anything was generated
   // (kj init captures them before writing its own). What is dirty NOW is the person's.
@@ -162,7 +162,8 @@ export async function hardenCommand({
       // sin sello, que es como una sesión se dejaba sin herramientas.
       const sh = installSentinelHooks({ projectDir, logger, human: commitSupervisor });
       result.sentinelHooks = sh.wired ? "wired" : "script-only";
-      // KJC-TSK-1092: the host sandbox, on by default wherever it can start here.
+      // KJC-TSK-1092/1241: the host sandbox, only when asked (kj harden --sandbox):
+      // inside it kj run cannot push, open the PR or reach Sonar on localhost.
       if (sandbox) result.sandbox = installSandbox({ projectDir, logger }).state;
     }
   } catch (err) {

package/src/git/symlink-targets.js

@@ -0,0 +1,57 @@
+/**
+ * KJC-BUG-0414 (#2606, from #2564): Solomon told the coder to drop a file from the commit as a
+ * mirror of another, but the other was a symlink to it: the link would be committed dangling.
+ * kj names the in-repo targets of the symlinks in a change, and a condition that takes one of
+ * them out of the commit is dropped before it reaches the coder.
+ */
+import { lstatSync, readlinkSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/** The in-repo target of each symlink among `paths` (relative to projectDir). */
+export function symlinkTargets(projectDir, paths) {
+  const root = resolve(projectDir);
+  return paths.flatMap((link) => {
+    try {
+      const abs = join(root, link);
+      if (!lstatSync(abs).isSymbolicLink()) return [];
+      const target = relative(root, resolve(dirname(abs), readlinkSync(abs)));
+      const outside = target === ".." || target.startsWith(`..${sep}`) || isAbsolute(target);
+      return target && !outside ? [{ link, target: target.split(sep).join("/") }] : [];
+    } catch {
+      return [];
+    }
+  });
+}
+
+// A `*` matches within one path segment, as in the shell.
+const segmentMatches = (pattern, name) => {
+  const parts = pattern.split("*");
+  if (parts.length === 1) return pattern === name;
+  if (!name.startsWith(parts[0]) || !name.endsWith(parts.at(-1))) return false;
+  let at = parts[0].length;
+  for (const part of parts.slice(1, -1)) {
+    const found = name.indexOf(part, at);
+    if (found < 0) return false;
+    at = found + part.length;
+  }
+  return at <= name.length - parts.at(-1).length;
+};
+const globMatches = (pattern, path) => {
+  const p = pattern.split("/");
+  const t = path.split("/");
+  return p.length === t.length && p.every((seg, i) => segmentMatches(seg, t[i]));
+};
+const REMOVES = /\b(unstage|remove|drop|exclude|delete|restore|reset|revert|rm|untrack|quitar|sacar|eliminar|excluir|borrar)\b/i;
+// Quoted strings are one token (a path may hold spaces); bare tokens lose surrounding punctuation.
+const TOKENS = /"([^"]+)"|'([^']+)'|`([^`]+)`|(\S+)/g;
+const tokensOf = (text) => [...String(text).matchAll(TOKENS)]
+  .map((m) => (m[1] ?? m[2] ?? m[3] ?? m[4]).replace(/^[([{]+/, "").replace(/[)\]}:;,]+$/, ""));
+// Named literally anywhere in the text (any character git allows), or by a glob token.
+const names = (condition, target) => String(condition).includes(target) || tokensOf(condition).some((t) => globMatches(t, target));
+
+/** Splits Solomon's conditions: the ones that would take a symlink's target out of the commit go to `dropped`. */
+export function keepSymlinkTargets(conditions, targets) {
+  const takesTargetOut = (condition) => REMOVES.test(condition) && targets.some(({ target }) => names(condition, target));
+  const dropped = targets.length ? conditions.filter(takesTargetOut) : [];
+  return { kept: conditions.filter((c) => !dropped.includes(c)), dropped };
+}

package/src/harden/hook-commands.js

@@ -8,7 +8,7 @@
  * commands depend on what the project defines). Unknown language ⇒ no commands,
  * leaving only the universal POSIX-shell checks.
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 // KJC-BUG-0411 (#2563): uv and poetry keep pytest and ruff in the project's
@@ -32,6 +32,23 @@ const FORMAT_WRITE_BY_LANGUAGE = {
   php: { command: "vendor/bin/php-cs-fixer fix", extensions: [".php"] },
 };
 
+// KJC-TSK-1239: JS/TS takes the formatter the project declares, from its node_modules.
+// Declared both? The one its scripts call wins; else prettier, the more common.
+const JS_TS = [".js", ".mjs", ".cjs", ".jsx", ".ts", ".mts", ".cts", ".tsx"];
+const JS_FORMATTERS = [
+  { pkg: "prettier", bin: "prettier", inScripts: /\bprettier\b/, command: "node_modules/.bin/prettier --write" },
+  { pkg: "@biomejs/biome", bin: "biome", inScripts: /\bbiome\b/, command: "node_modules/.bin/biome format --write" },
+];
+function jsFormatWrite(projectDir) {
+  let pkg;
+  try { pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8")); } catch { return null; }
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const scripts = Object.values(pkg.scripts ?? {}).join("\n");
+  const usable = JS_FORMATTERS.filter((f) => deps[f.pkg] && existsSync(join(projectDir, "node_modules", ".bin", f.bin)));
+  const chosen = usable.find((f) => f.inScripts.test(scripts)) ?? usable[0];
+  return chosen ? { command: chosen.command, extensions: JS_TS } : null;
+}
+
 const runnerFor = (language, projectDir) => (language === "python" && projectDir
   ? PYTHON_RUNNERS.find(([lock]) => existsSync(join(projectDir, lock)))?.[1] ?? null
   : null);
@@ -46,6 +63,7 @@ export function commandsForLanguage(language, projectDir = null) {
 
 /** The write-mode formatter of a language and the extensions it takes, or null. */
 export function formatWriteFor(language, projectDir = null) {
+  if (language === "javascript" || language === "typescript") return projectDir ? jsFormatWrite(projectDir) : null;
   const entry = FORMAT_WRITE_BY_LANGUAGE[language];
   if (!entry) return null;
   return { ...entry, command: [runnerFor(language, projectDir), entry.command].filter(Boolean).join(" ") };

package/src/mcp/server.js

@@ -7,6 +7,10 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { tools } from "./tools.js";
 import { handleToolCall, responseText, enrichedFailPayload } from "./server-handlers.js";
+import { pinGitDiffFormat } from "../utils/git-diff-format.js";
+
+// KJC-BUG-0408: every git the MCP server runs prints a/ and b/, whatever the user's gitconfig says.
+pinGitDiffFormat();
 
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_PATH = path.resolve(MODULE_DIR, "../../package.json");

package/src/orchestrator/solomon-escalation.js

@@ -3,12 +3,35 @@ import { addCheckpoint, pauseSession, saveSession } from "../session/store.js";
 import { setSuggestions } from "../session/mutators.js";
 import { emitProgress, makeEvent } from "../utils/events.js";
 import { msg, getLang } from "../utils/messages.js";
+import { listPendingPaths } from "../utils/git.js";
+import { keepSymlinkTargets, symlinkTargets } from "../git/symlink-targets.js";
 
 /**
  * @typedef {import("../types/solomon.js").Conflict} Conflict
  * @typedef {import("../types/solomon.js").SolomonResult} SolomonResult
  */
 
+// KJC-BUG-0414 (#2606): the symlinks among the pending paths, so Solomon never advises taking a
+// link's target out of the commit. Unlistable is said, and Solomon goes on without the fact.
+async function changeSymlinks(config, logger) {
+  const projectDir = config.projectDir || process.cwd();
+  try {
+    return symlinkTargets(projectDir, await listPendingPaths(projectDir));
+  } catch (err) {
+    logger.warn(`Solomon: the change's symlinks could not be listed (${err.message})`);
+    return [];
+  }
+}
+
+function dropSymlinkTargetConditions(ruling, symlinks, logger) {
+  const conditions = ruling?.result?.conditions;
+  if (!Array.isArray(conditions) || symlinks.length === 0) return;
+  const { kept, dropped } = keepSymlinkTargets(conditions, symlinks);
+  if (dropped.length === 0) return;
+  ruling.result.conditions = kept;
+  logger.warn(`Solomon: dropped ${dropped.length} condition(s) that took a symlink's target out of the commit: ${dropped.join(" | ")}`);
+}
+
 /**
  * Architectural invariant (DO NOT BREAK):
  * `invokeSolomon` MUST NOT be called directly from stages, rules or agent
@@ -147,12 +170,15 @@ export async function invokeSolomon({ config, logger, emitter, eventBase, stage,
   try {
     // Inject Solomon's own history so it doesn't repeat failed strategies
     const solomonHistory = extractSolomonHistory(session);
+    const symlinks = await changeSymlinks(config, logger);
     const enrichedConflict = {
       ...conflict,
       ...(pendingSuggestions && { hostSuggestions: pendingSuggestions }),
-      ...(solomonHistory.length > 0 && { previousSolomonRulings: solomonHistory })
+      ...(solomonHistory.length > 0 && { previousSolomonRulings: solomonHistory }),
+      ...(symlinks.length > 0 && { symlinkTargets: symlinks })
     };
     ruling = await solomon.run({ conflict: enrichedConflict });
+    dropSymlinkTargetConditions(ruling, symlinks, logger);
   } catch (err) {
     logger.warn(`Solomon threw: ${err.message}`);
     return escalateToHuman({

package/src/privacy/diff-scope.js

@@ -50,6 +50,9 @@ export function splitAddedByFile(diff) {
       out.push(current);
       continue;
     }
+    // KJC-BUG-0408: a file header in another shape (mnemonic or no prefix) would leave its lines
+    // unscanned and the gate passing. A diff that cannot be read fails closed.
+    if (line.startsWith("diff --git ")) throw new Error(`cannot read the file headers of this diff (${line}): refusing to scan it as empty`);
     if (!current) continue;
     // `+++ b/x` is the header, not content; `+` alone is an added blank line.
     if (line.startsWith("+") && !line.startsWith("+++")) current.lines.push(line.slice(1));

package/src/roles/solomon-role.js

@@ -144,6 +144,12 @@ function buildPrompt({ conflict, task, instructions }) {
     sections.push(`## Blocking issues\n${issueList}`);
   }
 
+  // KJC-BUG-0414 (#2606): taking a symlink's target out of the commit leaves the link dangling.
+  if (conflict?.symlinkTargets?.length) {
+    const links = conflict.symlinkTargets.map(({ link, target }) => `- ${link} -> ${target}`).join("\n");
+    sections.push(`## Symlinks in this change\n${links}\nEach target stays in the commit: never propose unstaging, removing or restoring it, or the link is committed dangling.`);
+  }
+
   if (task) {
     sections.push(`## Original task\n${task}`);
   }

package/src/utils/git-diff-format.js

@@ -0,0 +1,40 @@
+/**
+ * KJC-BUG-0408 (#2560): kj reads the diffs git prints for it (privacy, sonar, review, guards),
+ * and every parser expects `a/` and `b/`. A user's diff.mnemonicPrefix (c/, i/, w/), noprefix or
+ * srcPrefix changed those headers: the suite went red on that machine and the privacy gate saw
+ * no file and passed. kj pins the format of the git it runs through the environment (the
+ * GIT_CONFIG_COUNT protocol, git >= 2.31), so every child inherits it and no parser depends on
+ * the user's gitconfig. The pins are appended after whatever config the environment carries.
+ */
+
+// KJC-BUG-0415 (#2622): a verdict binds to the hash of the diff text, so every option that
+// changes that text is pinned to git's default too, or the hash kj review --staged records on a
+// machine with diff.algorithm=histogram is not the one CI recomputes.
+const PINS = [
+  ["diff.mnemonicPrefix", "false"],
+  ["diff.noprefix", "false"],
+  ["diff.srcPrefix", "a/"],
+  ["diff.dstPrefix", "b/"],
+  ["diff.algorithm", "myers"],
+  ["diff.context", "3"],
+  ["diff.interHunkContext", "0"],
+  ["diff.indentHeuristic", "true"],
+  ["diff.suppressBlankEmpty", "false"],
+  ["diff.renames", "true"],
+  ["diff.relative", "false"],
+  ["color.diff", "false"],
+];
+const PINNED = "KJ_GIT_DIFF_PINNED";
+
+/** Pin git's diff headers to a/ and b/ for every git that inherits `env`; idempotent. */
+export function pinGitDiffFormat(env = process.env) {
+  if (env[PINNED]) return env;
+  const count = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10) || 0;
+  PINS.forEach(([key, value], i) => {
+    env[`GIT_CONFIG_KEY_${count + i}`] = key;
+    env[`GIT_CONFIG_VALUE_${count + i}`] = value;
+  });
+  env.GIT_CONFIG_COUNT = String(count + PINS.length);
+  env[PINNED] = "1";
+  return env;
+}