karajan-code 1.36.1 → 1.38.0

package/src/orchestrator/hu-sub-pipeline.js

@@ -0,0 +1,166 @@
+/**
+ * HU Sub-Pipeline — executes each certified HU as an independent sub-pipeline
+ * with per-HU state tracking, topological ordering, and dependency-aware blocking.
+ */
+import { topologicalSort } from "../hu/graph.js";
+import { updateStoryStatus, loadHuBatch, saveHuBatch, HU_STATUS } from "../hu/store.js";
+import { emitProgress, makeEvent } from "../utils/events.js";
+
+/**
+ * Determine whether the HU reviewer result requires a sub-pipeline
+ * (more than one certified story).
+ * @param {object|null} huReviewerResult - stageResults.huReviewer
+ * @returns {boolean}
+ */
+export function needsSubPipeline(huReviewerResult) {
+  if (!huReviewerResult?.ok) return false;
+  const certified = (huReviewerResult.stories || []).filter(
+    s => s.status === "certified"
+  );
+  return certified.length > 1;
+}
+
+/**
+ * Mark all stories that depend (directly or transitively) on a failed story as "blocked".
+ * @param {object} batch - The HU batch object.
+ * @param {string} failedId - The ID of the failed story.
+ * @returns {string[]} IDs of newly blocked stories.
+ */
+export function blockDependents(batch, failedId) {
+  const blocked = [];
+  const failedSet = new Set([failedId]);
+  // Iterate until no new blocked stories are found (handles transitive deps)
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const story of batch.stories) {
+      if (failedSet.has(story.id)) continue;
+      if (story.status === HU_STATUS.BLOCKED) continue;
+      const deps = story.blocked_by || [];
+      if (deps.some(dep => failedSet.has(dep))) {
+        updateStoryStatus(batch, story.id, HU_STATUS.BLOCKED);
+        failedSet.add(story.id);
+        blocked.push(story.id);
+        changed = true;
+      }
+    }
+  }
+  return blocked;
+}
+
+/**
+ * Build task description for the coder from a certified HU story.
+ * @param {object} story - A story object from the batch.
+ * @returns {string}
+ */
+function buildHuTask(story) {
+  if (story.certified?.text) return story.certified.text;
+  if (story.original?.text) return story.original.text;
+  return `Implement HU ${story.id}`;
+}
+
+/**
+ * Run all certified HUs as sub-pipelines in topological order.
+ *
+ * @param {object} params
+ * @param {object} params.huReviewerResult - stageResults.huReviewer (from pre-loop)
+ * @param {Function} params.runIterationFn - async (task) => { approved, result, ... }
+ *   Callback that runs the full coder→sonar→reviewer iteration loop for a given task.
+ *   Returns an object with at least { approved: boolean }.
+ * @param {object} params.emitter - Event emitter
+ * @param {object} params.eventBase - Base event fields
+ * @param {object} params.logger - Logger instance
+ * @returns {Promise<{approved: boolean, results: object[], blockedIds: string[]}>}
+ */
+export async function runHuSubPipeline({ huReviewerResult, runIterationFn, emitter, eventBase, logger }) {
+  const batchSessionId = huReviewerResult.batchSessionId;
+  let batch;
+  try {
+    batch = await loadHuBatch(batchSessionId);
+  } catch {
+    logger.warn("HU sub-pipeline: could not load batch, falling back to in-memory stories");
+    // Build a minimal batch from the stage result
+    batch = {
+      session_id: batchSessionId,
+      stories: huReviewerResult.stories || []
+    };
+  }
+
+  const certifiedStories = batch.stories.filter(s => s.status === HU_STATUS.CERTIFIED);
+  let orderedIds;
+  try {
+    orderedIds = topologicalSort(certifiedStories);
+  } catch {
+    orderedIds = certifiedStories.map(s => s.id);
+  }
+
+  const results = [];
+  const blockedIds = [];
+  let allApproved = true;
+
+  for (const storyId of orderedIds) {
+    const story = batch.stories.find(s => s.id === storyId);
+    if (!story) continue;
+
+    // Skip if already blocked by a failed dependency
+    if (story.status === HU_STATUS.BLOCKED) {
+      blockedIds.push(story.id);
+      continue;
+    }
+
+    const huTask = buildHuTask(story);
+
+    // --- hu:start ---
+    emitProgress(emitter, makeEvent("hu:start", { ...eventBase, stage: "hu-sub-pipeline" }, {
+      message: `Starting HU ${story.id}`,
+      detail: { huId: story.id, title: story.certified?.title || story.id }
+    }));
+
+    // Update status to coding
+    updateStoryStatus(batch, story.id, HU_STATUS.CODING);
+    await saveHuBatch(batchSessionId, batch);
+
+    try {
+      const iterResult = await runIterationFn(huTask);
+      const approved = Boolean(iterResult?.approved);
+
+      if (approved) {
+        updateStoryStatus(batch, story.id, HU_STATUS.DONE);
+        emitProgress(emitter, makeEvent("hu:end", { ...eventBase, stage: "hu-sub-pipeline" }, {
+          status: "ok",
+          message: `HU ${story.id} completed successfully`,
+          detail: { huId: story.id, approved: true }
+        }));
+        results.push({ huId: story.id, approved: true, result: iterResult });
+      } else {
+        updateStoryStatus(batch, story.id, HU_STATUS.FAILED);
+        const newlyBlocked = blockDependents(batch, story.id);
+        blockedIds.push(...newlyBlocked);
+        allApproved = false;
+
+        emitProgress(emitter, makeEvent("hu:end", { ...eventBase, stage: "hu-sub-pipeline" }, {
+          status: "fail",
+          message: `HU ${story.id} failed — ${newlyBlocked.length} dependent(s) blocked`,
+          detail: { huId: story.id, approved: false, blockedDependents: newlyBlocked, reason: iterResult?.reason }
+        }));
+        results.push({ huId: story.id, approved: false, result: iterResult, blockedDependents: newlyBlocked });
+      }
+    } catch (err) {
+      updateStoryStatus(batch, story.id, HU_STATUS.FAILED);
+      const newlyBlocked = blockDependents(batch, story.id);
+      blockedIds.push(...newlyBlocked);
+      allApproved = false;
+
+      emitProgress(emitter, makeEvent("hu:end", { ...eventBase, stage: "hu-sub-pipeline" }, {
+        status: "fail",
+        message: `HU ${story.id} threw: ${err.message}`,
+        detail: { huId: story.id, approved: false, error: err.message, blockedDependents: newlyBlocked }
+      }));
+      results.push({ huId: story.id, approved: false, error: err.message, blockedDependents: newlyBlocked });
+    }
+
+    await saveHuBatch(batchSessionId, batch);
+  }
+
+  return { approved: allApproved, results, blockedIds };
+}

package/src/orchestrator/iteration-stages.js

@@ -21,7 +21,7 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
     emitter,
     makeEvent("coder:start", { ...eventBase, stage: "coder" }, {
       message: `Coder (${coderRole.provider}) running`,
-      detail: { coder: coderRole.provider }
+      detail: { coder: coderRole.provider, provider: coderRole.provider, executorType: "agent" }
     })
   );
 
@@ -89,7 +89,8 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
           emitProgress(
             emitter,
             makeEvent("coder:end", { ...eventBase, stage: "coder" }, {
-              message: `Coder completed (fallback: ${fallbackCoder})`
+              message: `Coder completed (fallback: ${fallbackCoder})`,
+              detail: { provider: fallbackCoder, executorType: "agent" }
             })
           );
           return;
@@ -114,7 +115,8 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
       emitter,
       makeEvent("coder:end", { ...eventBase, stage: "coder" }, {
         status: "fail",
-        message: `Coder failed: ${details}`
+        message: `Coder failed: ${details}`,
+        detail: { provider: coderRole.provider, executorType: "agent" }
       })
     );
     throw new Error(`Coder failed: ${details}`);
@@ -124,7 +126,8 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   emitProgress(
     emitter,
     makeEvent("coder:end", { ...eventBase, stage: "coder" }, {
-      message: "Coder completed"
+      message: "Coder completed",
+      detail: { provider: coderRole.provider, executorType: "agent" }
     })
   );
 }
@@ -135,7 +138,7 @@ export async function runRefactorerStage({ refactorerRole, config, logger, emitt
     emitter,
     makeEvent("refactorer:start", { ...eventBase, stage: "refactorer" }, {
       message: `Refactorer (${refactorerRole.provider}) running`,
-      detail: { refactorer: refactorerRole.provider }
+      detail: { refactorer: refactorerRole.provider, provider: refactorerRole.provider, executorType: "agent" }
     })
   );
   const refactorerOnOutput = ({ stream, line }) => {
@@ -184,7 +187,8 @@ export async function runRefactorerStage({ refactorerRole, config, logger, emitt
       emitter,
       makeEvent("refactorer:end", { ...eventBase, stage: "refactorer" }, {
         status: "fail",
-        message: `Refactorer failed: ${details}`
+        message: `Refactorer failed: ${details}`,
+        detail: { provider: refactorerRole.provider, executorType: "agent" }
       })
     );
     throw new Error(`Refactorer failed: ${details}`);
@@ -193,7 +197,8 @@ export async function runRefactorerStage({ refactorerRole, config, logger, emitt
   emitProgress(
     emitter,
     makeEvent("refactorer:end", { ...eventBase, stage: "refactorer" }, {
-      message: "Refactorer completed"
+      message: "Refactorer completed",
+      detail: { provider: refactorerRole.provider, executorType: "agent" }
     })
   );
 }
@@ -287,7 +292,8 @@ export async function runTddCheckStage({ config, logger, emitter, eventBase, ses
         ok: tddEval.ok,
         reason: tddEval.reason,
         sourceFiles: tddEval.sourceFiles?.length || 0,
-        testFiles: tddEval.testFiles?.length || 0
+        testFiles: tddEval.testFiles?.length || 0,
+        executorType: "local"
       }
     })
   );
@@ -386,7 +392,8 @@ export async function runSonarStage({ config, logger, emitter, eventBase, sessio
   emitProgress(
     emitter,
     makeEvent("sonar:start", { ...eventBase, stage: "sonar" }, {
-      message: "SonarQube scanning"
+      message: "SonarQube scanning",
+      detail: { provider: "sonarqube", executorType: "local" }
     })
   );
 
@@ -470,7 +477,7 @@ export async function runSonarStage({ config, logger, emitter, eventBase, sessio
     makeEvent("sonar:end", { ...eventBase, stage: "sonar" }, {
       status: sonarResult.blocking ? "fail" : "ok",
       message: `Quality gate: ${sonarResult.gateStatus}`,
-      detail: { projectKey: sonarResult.projectKey, gateStatus: sonarResult.gateStatus, openIssues: sonarResult.openIssuesTotal }
+      detail: { projectKey: sonarResult.projectKey, gateStatus: sonarResult.gateStatus, openIssues: sonarResult.openIssuesTotal, provider: "sonarqube", executorType: "local" }
     })
   );
 
@@ -498,7 +505,8 @@ export async function runSonarCloudStage({ config, logger, emitter, eventBase, s
   emitProgress(
     emitter,
     makeEvent("sonarcloud:start", { ...eventBase, stage: "sonarcloud" }, {
-      message: "SonarCloud scanning"
+      message: "SonarCloud scanning",
+      detail: { provider: "sonarcloud", executorType: "local" }
     })
   );
 
@@ -532,7 +540,7 @@ export async function runSonarCloudStage({ config, logger, emitter, eventBase, s
     makeEvent("sonarcloud:end", { ...eventBase, stage: "sonarcloud" }, {
       status,
       message,
-      detail: { projectKey: result.projectKey, exitCode: result.exitCode }
+      detail: { projectKey: result.projectKey, exitCode: result.exitCode, provider: "sonarcloud", executorType: "local" }
     })
   );
 
@@ -681,7 +689,7 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
     emitter,
     makeEvent("reviewer:start", { ...eventBase, stage: "reviewer" }, {
       message: `Reviewer (${reviewerRole.provider}) running`,
-      detail: { reviewer: reviewerRole.provider }
+      detail: { reviewer: reviewerRole.provider, provider: reviewerRole.provider, executorType: "agent" }
     })
   );
 
@@ -692,6 +700,30 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
     logger.warn(`Review diff generation failed: ${err.message}`);
     return { approved: false, blocking_issues: [{ description: `Diff generation failed: ${err.message}` }], non_blocking_suggestions: [], summary: `Reviewer failed: cannot generate diff — ${err.message}`, confidence: 0 };
   }
+
+  // Injection guard: scan diff before sending to AI reviewer
+  const { scanDiff } = await import("../utils/injection-guard.js");
+  const guardResult = scanDiff(diff);
+  if (!guardResult.clean) {
+    logger.warn(`Injection guard: ${guardResult.summary}`);
+    emitProgress(emitter, makeEvent("guard:injection", { ...eventBase, stage: "reviewer" }, {
+      message: `Injection guard blocked review: ${guardResult.summary}`,
+      detail: { findings: guardResult.findings, summary: guardResult.summary }
+    }));
+    return {
+      approved: false,
+      blocking_issues: guardResult.findings.map((f) => ({
+        id: `INJECTION_${f.type.toUpperCase()}`,
+        severity: "critical",
+        description: `Potential prompt injection (${f.type}): ${f.snippet}`,
+        line: f.line,
+      })),
+      non_blocking_suggestions: [],
+      summary: `Review blocked by injection guard: ${guardResult.summary}`,
+      confidence: 1,
+    };
+  }
+
   const reviewerOnOutput = ({ stream, line }) => {
     emitProgress(emitter, makeEvent("agent:output", { ...eventBase, stage: "reviewer" }, {
       message: line,
@@ -754,7 +786,8 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
       emitter,
       makeEvent("reviewer:end", { ...eventBase, stage: "reviewer" }, {
         status: "fail",
-        message: `Reviewer failed: ${details}`
+        message: `Reviewer failed: ${details}`,
+        detail: { provider: reviewerRole.provider, executorType: "agent" }
       })
     );
     throw new Error(`Reviewer failed: ${details}`);
@@ -836,7 +869,9 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
         blockingCount: review.blocking_issues.length,
         issues: review.blocking_issues.map(
           (x) => `${x.id || "ISSUE"}: ${x.description || "Missing description"}`
-        )
+        ),
+        provider: reviewerRole.provider,
+        executorType: "agent"
       }
     })
   );

package/src/orchestrator/post-loop-stages.js

@@ -98,7 +98,8 @@ export async function runTesterStage({ config, logger, emitter, eventBase, sessi
   emitProgress(
     emitter,
     makeEvent("tester:start", { ...eventBase, stage: "tester" }, {
-      message: "Tester evaluating test quality"
+      message: "Tester evaluating test quality",
+      detail: { provider: config?.roles?.tester?.provider || config?.roles?.coder?.provider || config?.coder || "claude", executorType: "agent" }
     })
   );
 
@@ -126,11 +127,13 @@ export async function runTesterStage({ config, logger, emitter, eventBase, sessi
     attempts: attempts.length > 1 ? attempts : undefined
   });
 
+  const testerProvider = provider || coderRole.provider;
   emitProgress(
     emitter,
     makeEvent("tester:end", { ...eventBase, stage: "tester" }, {
       status: testerOutput.ok ? "ok" : "fail",
-      message: testerOutput.ok ? "Tester passed" : `Tester: ${testerOutput.summary}`
+      message: testerOutput.ok ? "Tester passed" : `Tester: ${testerOutput.summary}`,
+      detail: { ok: testerOutput.ok, summary: testerOutput.summary, provider: testerProvider, executorType: "agent" }
     })
   );
 
@@ -143,7 +146,7 @@ export async function runTesterStage({ config, logger, emitter, eventBase, sessi
       makeEvent("tester:auto-continue", { ...eventBase, stage: "tester" }, {
         status: "warn",
         message: `Tester issues are advisory (reviewer approved), continuing: ${testerOutput.summary}`,
-        detail: { summary: testerOutput.summary, auto_continued: true }
+        detail: { summary: testerOutput.summary, auto_continued: true, provider: testerProvider, executorType: "agent" }
       })
     );
     return { action: "ok", stageResult: { ok: false, summary: testerOutput.summary || "Tester issues (advisory)", auto_continued: true } };
@@ -158,7 +161,8 @@ export async function runSecurityStage({ config, logger, emitter, eventBase, ses
   emitProgress(
     emitter,
     makeEvent("security:start", { ...eventBase, stage: "security" }, {
-      message: "Security auditing code"
+      message: "Security auditing code",
+      detail: { provider: config?.roles?.security?.provider || config?.roles?.coder?.provider || config?.coder || "claude", executorType: "agent" }
     })
   );
 
@@ -186,11 +190,13 @@ export async function runSecurityStage({ config, logger, emitter, eventBase, ses
     attempts: attempts.length > 1 ? attempts : undefined
   });
 
+  const securityProvider = provider || coderRole.provider;
   emitProgress(
     emitter,
     makeEvent("security:end", { ...eventBase, stage: "security" }, {
       status: securityOutput.ok ? "ok" : "fail",
-      message: securityOutput.ok ? "Security audit passed" : `Security: ${securityOutput.summary}`
+      message: securityOutput.ok ? "Security audit passed" : `Security: ${securityOutput.summary}`,
+      detail: { ok: securityOutput.ok, summary: securityOutput.summary, provider: securityProvider, executorType: "agent" }
     })
   );
 
@@ -246,7 +252,8 @@ export async function runImpeccableStage({ config, logger, emitter, eventBase, s
   emitProgress(
     emitter,
     makeEvent("impeccable:start", { ...eventBase, stage: "impeccable" }, {
-      message: "Impeccable auditing frontend design quality"
+      message: "Impeccable auditing frontend design quality",
+      detail: { provider: config?.roles?.impeccable?.provider || coderRole.provider, executorType: "agent" }
     })
   );
 
@@ -277,13 +284,15 @@ export async function runImpeccableStage({ config, logger, emitter, eventBase, s
   });
 
   const verdict = impeccableOutput.result?.verdict || "APPROVED";
+  const impeccableProvider = config?.roles?.impeccable?.provider || coderRole.provider;
   emitProgress(
     emitter,
     makeEvent("impeccable:end", { ...eventBase, stage: "impeccable" }, {
       status: impeccableOutput.ok ? "ok" : "fail",
       message: impeccableOutput.ok
         ? (verdict === "IMPROVED" ? "Impeccable applied design fixes" : "Impeccable audit passed")
-        : `Impeccable: ${impeccableOutput.summary}`
+        : `Impeccable: ${impeccableOutput.summary}`,
+      detail: { provider: impeccableProvider, executorType: "agent" }
     })
   );
 
@@ -296,7 +305,8 @@ export async function runFinalAuditStage({ config, logger, emitter, eventBase, s
   emitProgress(
     emitter,
     makeEvent("audit:start", { ...eventBase, stage: "audit" }, {
-      message: "Final audit — verifying code quality"
+      message: "Final audit — verifying code quality",
+      detail: { provider: config?.roles?.audit?.provider || config?.roles?.coder?.provider || config?.coder || "claude", executorType: "agent" }
     })
   );
 
@@ -324,6 +334,7 @@ export async function runFinalAuditStage({ config, logger, emitter, eventBase, s
     attempts: attempts.length > 1 ? attempts : undefined
   });
 
+  const auditProvider = provider || coderRole.provider;
   if (!auditOutput.ok) {
     // Audit agent failed to run — treat as advisory, don't block pipeline
     logger.warn(`Audit agent error (advisory): ${auditOutput.summary}`);
@@ -331,7 +342,8 @@ export async function runFinalAuditStage({ config, logger, emitter, eventBase, s
       emitter,
       makeEvent("audit:end", { ...eventBase, stage: "audit" }, {
         status: "warn",
-        message: `Audit: agent error (advisory), continuing — ${auditOutput.summary}`
+        message: `Audit: agent error (advisory), continuing — ${auditOutput.summary}`,
+        detail: { provider: auditProvider, executorType: "agent" }
       })
     );
     return { action: "ok", stageResult: { ok: false, summary: auditOutput.summary || "Audit agent error (advisory)", auto_continued: true } };
@@ -374,7 +386,8 @@ export async function runFinalAuditStage({ config, logger, emitter, eventBase, s
       emitter,
       makeEvent("audit:end", { ...eventBase, stage: "audit" }, {
         status: "fail",
-        message: `Audit: ${criticalCount + highCount} issue(s) found, sending back to coder`
+        message: `Audit: ${criticalCount + highCount} issue(s) found, sending back to coder`,
+        detail: { provider: auditProvider, executorType: "agent" }
       })
     );
 
@@ -392,7 +405,8 @@ export async function runFinalAuditStage({ config, logger, emitter, eventBase, s
     emitter,
     makeEvent("audit:end", { ...eventBase, stage: "audit" }, {
       status: "ok",
-      message: certifiedMsg
+      message: certifiedMsg,
+      detail: { provider: auditProvider, executorType: "agent" }
     })
   );