@karajan-family/code 5.0.1 → 5.0.3

package/README.md

@@ -83,6 +83,10 @@ git config core.hooksPath .karajan/hooks
 
 Requires git and at least one AI agent CLI — two enables cross-AI review; three enables arbitration. The npm route is `npm install -g @karajan-family/code` (published as `karajan-code` before joining the scope; the legacy name still installs the same versions). All install routes (npm, binaries, brew, Python wrapper) in the [install docs](https://karajancode.com/docs/v4/install/).
 
+### Verify what you installed
+
+Since 5.0.0 every release is published from GitHub Actions with signed provenance (SLSA), tied to the tagged commit that built it. Check the npm package with `npm audit signatures` in the folder where kj is installed (kj must be listed with verified attestations), and a standalone binary with `gh attestation verify kj-linux-x64 --repo manufosela/karajan-code` (GitHub CLI 2.49+). Details in the [install docs](https://karajancode.com/docs/v4/install/#verify-what-you-installed).
+
 ## The daily loop
 
 1. You describe what you want. Your agent creates the card (`kj hu add`), queries the RAG, writes the failing test, then the code.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karajan-family/code",
-  "version": "5.0.1",
+  "version": "5.0.3",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/scripts/postinstall.js

@@ -7,7 +7,7 @@
  * - Idempotent: safe to run many times.
  * - Never fails hard (exits 0 even on error) so `npm install` is not blocked.
  */
-import { existsSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -140,7 +140,21 @@ async function setupCodexMcp(kjHome) {
   await fs.writeFile(configPath, updated, "utf8");
 }
 
+// KJC-BUG-0474 (#3128): a git worktree (a kj lane) has a `.git` FILE. `npm ci` there runs this
+// script, and registering would point every session of the machine at the lane's server.
+function insideLinkedWorktree(dir = ROOT_DIR) {
+  try {
+    return statSync(path.join(dir, ".git")).isFile();
+  } catch {
+    return false;
+  }
+}
+
 async function main() {
+  if (insideLinkedWorktree()) {
+    process.stderr.write("karajan-mcp: not registered from a git worktree (a lane); the global MCP keeps pointing at the installed kj\n");
+    return;
+  }
   const claudeConfig = await readClaudeConfig();
   const kjHome = await resolveKjHome(claudeConfig.mcpServers?.["karajan-mcp"]);
 

package/src/checks/config-files.js

@@ -8,7 +8,7 @@
  *     ~/.karajan/kj.config.yml (strategy: manual — structural fixes needed)
  */
 
-import { existsSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -146,6 +146,19 @@ export function karajanMcpServerPath(config) {
   return args.find((a) => typeof a === "string" && /[\\/]mcp[\\/]server\.js$/.test(a)) ?? null;
 }
 
+/**
+ * KJC-BUG-0474 (#3128): whether a file lives in a linked git worktree (a kj lane). The
+ * nearest `.git` up the tree decides: a worktree's is a file, a normal checkout's a folder.
+ */
+export function inLinkedWorktree(file) {
+  for (let dir = path.dirname(path.resolve(file)); ; dir = path.dirname(dir)) {
+    try {
+      return statSync(path.join(dir, ".git")).isFile();
+    } catch { /* no .git here: keep climbing */ }
+    if (path.dirname(dir) === dir) return false;
+  }
+}
+
 /**
  * Repair a stale karajan-mcp registration in place: re-point it to this
  * install's server when that server exists, or drop the dead entry when this
@@ -191,12 +204,19 @@ function createStaleMcpPathCheck() {
       }
       const registered = karajanMcpServerPath(config);
       if (!registered) return { ok: true, severity: "info", detail: "karajan-mcp not registered (skipped)" };
-      if (await exists(registered)) return { ok: true, severity: "info", detail: "karajan-mcp path valid" };
+      // KJC-BUG-0474 (#3128): a path inside a lane works until the lane goes, and meanwhile runs its code everywhere.
+      const inLane = inLinkedWorktree(registered);
+      if (!inLane && (await exists(registered))) return { ok: true, severity: "info", detail: "karajan-mcp path valid" };
       const correct = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "mcp", "server.js");
+      if (inLane && inLinkedWorktree(correct)) {
+        return { ok: false, severity: "warn", detail: `karajan-mcp runs a lane's server: ${registered}`, fix: "Run kj doctor from the installed kj (not from a lane) to re-point it" };
+      }
       return {
         ok: false,
         severity: "warn",
-        detail: `karajan-mcp points at a path that no longer exists: ${registered} — this is the CONNECTION_CLOSED cause`,
+        detail: inLane
+          ? `karajan-mcp runs a lane's server (${registered}): every session runs that lane's code, and removing the lane breaks it`
+          : `karajan-mcp points at a path that no longer exists: ${registered} — this is the CONNECTION_CLOSED cause`,
         fix: `Re-point karajan-mcp to ${correct} (or remove the entry) in ~/.claude.json`,
         extra: { claudeJsonPath, correct },
       };

package/src/checks/repo-state.js

@@ -29,6 +29,29 @@ const shellQuote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
 const git = (projectDir, args) => execFileSync("git", ["-C", projectDir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
 const gitOk = (projectDir, args) => { try { git(projectDir, args); return true; } catch { return false; } };
 
+/**
+ * KJC-BUG-0473 (#3080): the main branch is main, always. With master as the default branch,
+ * every gate kj writes for [main] never runs, and nothing says so. Read from origin/HEAD when
+ * the clone knows it; with no origin, from a local master that has no main beside it.
+ * @returns {{branch: string, detail: string, fix: string} | null}
+ */
+export function defaultBranchProblem(projectDir) {
+  let branch = null;
+  try {
+    branch = git(projectDir, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]).trim().replace(/^origin\//, "");
+  } catch {
+    if (gitOk(projectDir, ["rev-parse", "--verify", "-q", "refs/heads/master"])
+      && !gitOk(projectDir, ["rev-parse", "--verify", "-q", "refs/heads/main"])) branch = "master";
+  }
+  if (!branch || branch === "main") return null;
+  return {
+    branch,
+    detail: `la rama por defecto es ${branch}, no main: los gates que kj escribe para main no se lanzan nunca`,
+    fix: `renombra ${branch} a main (en GitHub: Settings > Branches > Rename; si no existe, crea main) y actualiza el clon: `
+      + `git branch -m ${branch} main && git fetch origin && git branch -u origin/main main && git remote set-head origin -a`,
+  };
+}
+
 /** @internal Exported for dynamic import from tests. */
 export function createRepoStateCheck({ projectDir }) {
   return {
@@ -100,10 +123,14 @@ export function createRepoStateCheck({ projectDir }) {
         });
       }
 
+      const notMain = defaultBranchProblem(dir);
+      // KJC-BUG-0481 (#3080, point 3): a failure until it is fixed, not a warning, so doctor exits 1.
+      if (notMain) symptoms.push({ detail: notMain.detail, fix: notMain.fix, fails: true });
+
       if (symptoms.length === 0) return { ok: true, severity: "info", detail: "el repositorio está en orden" };
       return {
         ok: false,
-        severity: "warn",
+        severity: symptoms.some((s) => s.fails) ? "fail" : "warn",
         detail: symptoms.map((s) => s.detail).join(" · "),
         fix: symptoms.map((s) => s.fix).join("  ·  "),
       };

package/src/commands/init.js

@@ -32,6 +32,7 @@ import { installKarajanCommands } from "./init-atril.js";
 import { hardenCommand } from "./harden.js";
 import { contractChanges } from "../environment/contract-commit.js";
 import { detectProjectStack } from "../utils/stack-detect.js";
+import { defaultBranchProblem } from "../checks/repo-state.js";
 import { bootstrapSonarToken } from "../sonar/token-bootstrap.js";
 
 /**
@@ -775,6 +776,15 @@ export async function resolveConfigScope({ flags, interactive }) {
   return { configPath: getConfigPath(), scope: "global" };
 }
 
+/** KJC-BUG-0473 (#3080): said at the close, so a master repo never ends init looking governed. */
+export function warnIfDefaultBranchNotMain({ projectDir, logger }) {
+  const problem = defaultBranchProblem(projectDir);
+  if (!problem) return false;
+  logger.warn(`⚠ ${problem.detail}`);
+  logger.warn(`  Fix: ${problem.fix}`);
+  return true;
+}
+
 /**
  * KJC-BUG-0187: the enforcement gates live in git hooks, so a project without
  * a repo gets no harness at all. Init creates it, exactly like `kj run` does
@@ -1017,6 +1027,7 @@ export async function initCommand({ logger, flags = {} }) {
   logger.info(hardened || skipHarden
     ? "✓ Karajan is set up in this project."
     : "⚠ Karajan is set up EXCEPT the quality harness — without it there are no gates.");
+  warnIfDefaultBranchNotMain({ projectDir: process.cwd(), logger });
   logger.info("  Next:  ask your agent for the work; it follows the method kj installed");
   logger.info("  More:  kj --help   ·   kj doctor (check your setup)");
 }

package/src/harden/sentinel/sentinel-lib.mjs

@@ -134,9 +134,22 @@ export const holdLane = (top, now = Date.now()) => {
     return "(no se pudo reclamar " + top + ")";
   }
 };
+// KJC-BUG-0475 (#3125): during a rebase HEAD is detached; the branch being rebased is in head-name.
+const rebasingBranch = (top) => {
+  for (const dir of ["rebase-merge", "rebase-apply"]) {
+    try {
+      const file = execSync("git rev-parse --path-format=absolute --git-path " + dir + "/head-name", { cwd: top, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+      const name = readFileSync(file, "utf8").trim();
+      if (name.startsWith("refs/heads/")) return name.slice("refs/heads/".length);
+    } catch { /* no rebase of this kind in progress */ }
+  }
+  return null;
+};
 export const branchOf = (top = laneTop()) => {
-  try { return execSync("git rev-parse --abbrev-ref HEAD", { cwd: top, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); }
+  let branch;
+  try { branch = execSync("git rev-parse --abbrev-ref HEAD", { cwd: top, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); }
   catch { return null; }
+  return branch === "HEAD" ? (rebasingBranch(top) ?? branch) : branch;
 };
 // ADR 0034 (KJC-TSK-1243): the lane a write lands in is the worktree holding its path when
 // that worktree is of this repo; any other path is judged in the session's lane. It walks up

package/src/review/publish-pr.js

@@ -53,7 +53,10 @@ export async function publishPrReview({ projectDir, pr, run = runCommand, sealed
   await labelKarajanPr({ url: String(pr), cwd: projectDir, run });
   const reviews = await json(run, "gh", ["api", `repos/{owner}/{repo}/pulls/${pr}/reviews`], projectDir);
   // KJC-BUG-0456: one a non-member posted (gh switched to another account) does not count in CI.
-  if ((reviews ?? []).some((r) => TRUSTED.has(r.author_association) && String(r.body ?? "").includes(MARKER(info.headRefOid)))) {
+  // KJC-BUG-0477 (#3127): nor does one that misses a commit the PR gained under the same head
+  // (a stacked PR retargeted to main); verify-pr adds up every kj review, so publish another.
+  const listsAll = (body) => [...rows, ...seals].every((c) => body.includes(`\`${c.oid.slice(0, 7)}\``));
+  if ((reviews ?? []).some((r) => TRUSTED.has(r.author_association) && String(r.body ?? "").includes(MARKER(info.headRefOid)) && listsAll(String(r.body)))) {
     return { published: false, reason: `a kj review for head ${info.headRefOid.slice(0, 7)} is already published` };
   }
   const body = [

package/src/review/solomon-arbitration.js

@@ -23,11 +23,16 @@ const SECURITY_PATTERN = /injection|xss|csrf|secret|credential|password|token le
 // Structured signal first (`category: "security"` — part of the reviewer's
 // JSON schema since AB-E); the free-text pattern stays as a fail-closed net
 // for verdicts recorded before the schema carried categories.
-function isSecurityIssue(issue) {
-  return issue.category === "security"
-    || SECURITY_PATTERN.test(`${issue.id || ""} ${issue.description || ""}`);
+// KJC-BUG-0476 (#3137): returns why the issue counts as security, or null.
+function securityReason(issue) {
+  if (issue.category === "security") return "category security";
+  const match = SECURITY_PATTERN.exec(`${issue.id || ""} ${issue.description || ""}`);
+  return match ? `matches "${match[0]}"` : null;
 }
 
+const describeSecurityIssue = (issue) =>
+  `${issue.id || "?"} (${securityReason(issue)}): ${String(issue.description || "").slice(0, 160)}`;
+
 export async function pickThirdParty({ config, hostAgent, reviewerAgent, detectAgents = detectAvailableAgents }) {
   const excluded = new Set([hostAgent, reviewerAgent]);
   const configured = config?.roles?.solomon?.provider;
@@ -52,13 +57,14 @@ export async function runSolomonArbitration({
   }
 
   // ABSOLUTE RULE: security findings are never overridable.
-  const securityIssues = (verdict.issues || []).filter(isSecurityIssue);
+  const securityIssues = (verdict.issues || []).filter((issue) => securityReason(issue));
   if (securityIssues.length > 0) {
+    const named = securityIssues.map(describeSecurityIssue).join("; ");
     const record = await saveVerdict(projectDir, diff, {
       ...verdict,
-      arbitration: { position, ruling: "reject", reasoning: "security issues from the reviewer are never overridable", solomon: null },
+      arbitration: { position, ruling: "reject", reasoning: `security issues from the reviewer are never overridable: ${named}`, solomon: null },
     });
-    return { ruling: "reject", reasoning: "security issues are never overridable — fix them", solomon: null, record };
+    return { ruling: "reject", reasoning: `security issues are never overridable, fix them: ${named}`, solomon: null, record };
   }
 
   const solomon = await pickThirdParty({ config, hostAgent, reviewerAgent: verdict.reviewer, detectAgents });