karajan-code 1.57.0 → 1.57.2

package/README.md

@@ -60,8 +60,7 @@ npm install -g karajan-code
 
 **Homebrew** (macOS):
 ```bash
-brew tap manufosela/tap
-brew install karajan-code
+brew install manufosela/tap/karajan-code
 ```
 
 **One-liner** (detects OS, installs via npm):

package/docs/README.es.md

@@ -60,8 +60,7 @@ npm install -g karajan-code
 
 **Homebrew** (macOS):
 ```bash
-brew tap manufosela/tap
-brew install karajan-code
+brew install manufosela/tap/karajan-code
 ```
 
 **One-liner** (detecta SO, instala via npm):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "1.57.0",
+  "version": "1.57.2",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/scripts/ai-attribution-guard.yml

@@ -0,0 +1,77 @@
+# AI Attribution Guard — GitHub Action
+#
+# Copy this file to .github/workflows/ai-attribution-guard.yml in any repo.
+# Blocks PRs that contain AI attribution comments or Co-Authored-By lines.
+# No dependencies, no Node.js required. Pure bash + grep.
+
+name: AI Attribution Guard
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  scan:
+    name: Scan for AI attribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check PR diff for AI attribution
+        run: |
+          DIFF=$(git diff origin/${{ github.base_ref }}...HEAD \
+            -- ':!*.png' ':!*.jpg' ':!*.svg' ':!*.ico' \
+               ':!*.lock' ':!package-lock.json' ':!yarn.lock' \
+               ':!*.min.js' ':!*.min.css' \
+               ':!.githooks/*' \
+            | grep '^+' \
+            | grep -v '^+++' \
+            || true)
+
+          [ -z "$DIFF" ] && echo "No diff to scan" && exit 0
+
+          # Attribution patterns (not functional references like provider: "claude")
+          ATTR='(Generated|Created|Written|Made|Built|Authored|Assisted|Powered|Produced) (by|with|using|via) .*(Claude|Anthropic|OpenAI|ChatGPT|GPT-[0-9]|Copilot|Gemini|Cursor|Windsurf|Codeium)'
+          COAUTH='Co-Authored-By:.*\b(Claude|Anthropic|OpenAI|ChatGPT|Copilot|Gemini|Cursor|Windsurf|Codeium)\b'
+          COMMENT='(//|#|/\*|\*|<!--|--)\s*.*(Claude|Anthropic|OpenAI|ChatGPT|Copilot|Gemini).*(generated|assisted|helped|created|wrote|built|made)'
+
+          FOUND=""
+          for PAT in "$ATTR" "$COAUTH" "$COMMENT"; do
+            MATCH=$(echo "$DIFF" | grep -i -E "$PAT" || true)
+            [ -n "$MATCH" ] && FOUND="${FOUND}${MATCH}\n"
+          done
+
+          if [ -n "$FOUND" ]; then
+            echo "::error::AI attribution detected in PR diff"
+            echo -e "$FOUND"
+            echo ""
+            echo "Remove AI attribution comments/lines and push again."
+            exit 1
+          fi
+
+          echo "AI attribution guard: clean"
+
+      - name: Check commit messages
+        run: |
+          COMMITS=$(git log --format='%s%n%b' origin/${{ github.base_ref }}...HEAD)
+
+          COAUTH='Co-Authored-By:.*\b(Claude|Anthropic|OpenAI|ChatGPT|Copilot|Gemini|Cursor|Windsurf|Codeium)\b'
+          ATTR='(Generated|Created|Written|Built|Authored) (by|with|using) .*(Claude|Anthropic|OpenAI|ChatGPT|Copilot|Gemini|Cursor|Windsurf|Codeium)'
+
+          FOUND=""
+          for PAT in "$COAUTH" "$ATTR"; do
+            MATCH=$(echo "$COMMITS" | grep -i -E "$PAT" || true)
+            [ -n "$MATCH" ] && FOUND="${FOUND}${MATCH}\n"
+          done
+
+          if [ -n "$FOUND" ]; then
+            echo "::error::AI attribution detected in commit messages"
+            echo -e "$FOUND"
+            echo ""
+            echo "Amend commits to remove AI attribution and force-push."
+            exit 1
+          fi
+
+          echo "Commit messages: clean"

package/scripts/esbuild-sea.config.mjs

@@ -2,9 +2,90 @@
  * esbuild configuration for Node.js SEA (Single Executable Application) bundle.
  *
  * Bundles the entire CLI into a single CJS file suitable for SEA injection.
- * SEA requires CJS format — ESM entry points are transpiled by esbuild.
+ * A plugin handles:
+ *   1. import.meta.url / import.meta.dirname -> CJS equivalents
+ *   2. Top-level await in cli.js -> async IIFE wrapper
+ *   3. Runtime package.json reads -> inlined version string
  */
 
+import path from "node:path";
+import fs from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const PKG_VERSION = JSON.parse(readFileSync(path.join(ROOT, "package.json"), "utf8")).version;
+
+const seaTransformPlugin = {
+  name: "sea-transform",
+  setup(build) {
+    build.onLoad({ filter: /\.m?js$/ }, async (args) => {
+      let contents = await fs.readFile(args.path, "utf8");
+      let modified = false;
+
+      // Replace import.meta.dirname with __dirname
+      if (contents.includes("import.meta.dirname")) {
+        contents = contents.replaceAll("import.meta.dirname", "__dirname");
+        modified = true;
+      }
+
+      // Replace import.meta.url with CJS equivalent
+      if (contents.includes("import.meta.url")) {
+        contents = contents.replaceAll(
+          "import.meta.url",
+          'require("node:url").pathToFileURL(__filename).href'
+        );
+        modified = true;
+      }
+
+      // Inline version: replace any pattern that reads ../../package.json or ../package.json
+      // to extract the version, with the hardcoded version string.
+      // Covers cli.js, display.js, doctor.js, bootstrap.js, init.js, server.js
+      if (contents.includes("package.json") && contents.match(/["']\.\.\/.*package\.json/)) {
+        // Pattern: const X = path.resolve(..., "../../package.json");
+        //          const Y = JSON.parse(readFileSync(X, "utf8")).version;
+        // Replace both lines with: const Y = "1.57.0";
+        contents = contents.replace(
+          /const (\w+) = (?:path\.resolve|resolve)\(.*?["']\.\.\/.*?package\.json["']\);\s*\n\s*(?:const|return) (\w+) = JSON\.parse\(.*?readFileSync\(\1.*?\).*?\.version;/g,
+          `const $2 = ${JSON.stringify(PKG_VERSION)};`
+        );
+        // Single-line pattern: return JSON.parse(readFileSync(pkgPath...)).version
+        contents = contents.replace(
+          /const (\w+) = (?:path\.resolve|resolve)\(.*?["']\.\.\/.*?package\.json["']\);\s*\n\s*return JSON\.parse\(.*?readFileSync\(\1.*?\).*?\.version;/g,
+          `return ${JSON.stringify(PKG_VERSION)};`
+        );
+        // Pattern in cli.js: const PKG_PATH = ...; const PKG_VERSION = ...;
+        contents = contents.replace(
+          /const PKG_PATH = .*?package\.json.*?;\s*\nconst PKG_VERSION = .*?\.version;/,
+          `const PKG_VERSION = ${JSON.stringify(PKG_VERSION)};`
+        );
+        // Pattern in display.js: const DISPLAY_PKG_PATH = ...; const DISPLAY_VERSION = ...;
+        contents = contents.replace(
+          /const DISPLAY_PKG_PATH = .*?package\.json.*?;\s*\nconst DISPLAY_VERSION = .*?\.version;/,
+          `const DISPLAY_VERSION = ${JSON.stringify(PKG_VERSION)};`
+        );
+        // Pattern in server.js: const PKG_PATH = ...; (used later to read version)
+        contents = contents.replace(
+          /const PKG_PATH = .*?package\.json.*?;\s*\nconst PKG = JSON\.parse\(readFileSync\(PKG_PATH.*?\)\);/,
+          `const PKG = { version: ${JSON.stringify(PKG_VERSION)}, name: "karajan-code" };`
+        );
+        modified = true;
+      }
+
+      // Wrap top-level await in cli.js inside an async IIFE
+      if (args.path.endsWith("src/cli.js") || args.path.endsWith("src\\cli.js")) {
+        contents = contents.replace(
+          /^(try\s*\{[\s\S]*?await\s+program\.parseAsync\(\)[\s\S]*?^\})\s*$/m,
+          "(async () => {\n$1\n})();"
+        );
+        modified = true;
+      }
+
+      return modified ? { contents, loader: "js" } : undefined;
+    });
+  }
+};
+
 /** @type {import('esbuild').BuildOptions} */
 export const seaBuildOptions = {
   entryPoints: ["src/cli.js"],
@@ -14,20 +95,7 @@ export const seaBuildOptions = {
   target: "node20",
   bundle: true,
   minify: false,
-  // Bundle everything — no externals. The binary must be fully self-contained.
   external: [],
-  // Shim for CJS compatibility in the SEA context.
-  banner: {
-    js: [
-      "/* Karajan Code — SEA bundle */",
-      "/* eslint-disable */",
-      'const __importMetaUrl = require("node:url").pathToFileURL(__filename).href;',
-    ].join("\n"),
-  },
-  // Replace import.meta.url references with the CJS-compatible shim variable.
-  define: {
-    "import.meta.url": "__importMetaUrl",
-  },
-  // Log level for debugging build issues.
+  plugins: [seaTransformPlugin],
   logLevel: "info",
 };

package/scripts/install-guard-all-repos.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+#
+# Installs the AI Attribution Guard workflow in all repos of a GitHub user.
+# Requires: gh CLI authenticated with admin/push permissions.
+#
+# Usage:
+#   ./scripts/install-guard-all-repos.sh              # dry-run
+#   ./scripts/install-guard-all-repos.sh --apply       # install in all repos
+#
+# What it does:
+#   - Creates .github/workflows/ai-attribution-guard.yml in each repo
+#   - Skips repos that already have the file
+#   - Skips archived repos
+
+set -euo pipefail
+
+OWNER="${GH_OWNER:-manufosela}"
+APPLY=false
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+WORKFLOW_FILE="$SCRIPT_DIR/ai-attribution-guard.yml"
+
+if [[ "${1:-}" == "--apply" ]]; then
+  APPLY=true
+fi
+
+if [[ ! -f "$WORKFLOW_FILE" ]]; then
+  echo "ERROR: $WORKFLOW_FILE not found"
+  exit 1
+fi
+
+CONTENT=$(base64 -w 0 "$WORKFLOW_FILE")
+
+echo "=== Install AI Attribution Guard in all repos of $OWNER ==="
+echo ""
+
+if [[ "$APPLY" == false ]]; then
+  echo "  DRY RUN mode. Use --apply to actually install."
+  echo ""
+fi
+
+REPOS=$(gh repo list "$OWNER" --limit 500 --json name,isArchived \
+  --jq '.[] | select(.isArchived == false) | .name')
+
+TOTAL=0
+INSTALLED=0
+SKIPPED=0
+FAILED=0
+
+while read -r REPO; do
+  [ -z "$REPO" ] && continue
+  TOTAL=$((TOTAL + 1))
+
+  # Check if workflow already exists
+  EXISTS=$(gh api "repos/$OWNER/$REPO/contents/.github/workflows/ai-attribution-guard.yml" --jq '.sha' 2>/dev/null || echo "")
+
+  if [[ -n "$EXISTS" ]]; then
+    echo "  SKIP  $REPO — workflow already exists"
+    SKIPPED=$((SKIPPED + 1))
+    continue
+  fi
+
+  if [[ "$APPLY" == false ]]; then
+    echo "  WOULD $REPO"
+    continue
+  fi
+
+  if gh api "repos/$OWNER/$REPO/contents/.github/workflows/ai-attribution-guard.yml" -X PUT \
+    -f message="chore: add AI attribution guard workflow" \
+    -f content="$CONTENT" \
+    --jq '.commit.sha' 2>/dev/null; then
+    echo "  OK    $REPO"
+    INSTALLED=$((INSTALLED + 1))
+  else
+    echo "  FAIL  $REPO — check permissions"
+    FAILED=$((FAILED + 1))
+  fi
+
+done <<< "$REPOS"
+
+echo ""
+echo "=== Summary ==="
+echo "  Total:     $TOTAL"
+echo "  Installed: $INSTALLED"
+echo "  Skipped:   $SKIPPED"
+echo "  Failed:    $FAILED"

package/scripts/protect-all-repos.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+#
+# Configures branch protection on all repos of a GitHub user.
+# Requires: gh CLI authenticated with admin permissions.
+#
+# Usage:
+#   ./scripts/protect-all-repos.sh              # dry-run (shows what it would do)
+#   ./scripts/protect-all-repos.sh --apply      # apply protection rules
+#
+# What it does:
+#   - Require PRs before merging (no direct push to default branch)
+#   - Block force push
+#   - Block branch deletion
+#
+# Skips repos where branch protection is already configured.
+
+set -euo pipefail
+
+OWNER="${GH_OWNER:-manufosela}"
+APPLY=false
+
+if [[ "${1:-}" == "--apply" ]]; then
+  APPLY=true
+fi
+
+echo "=== Branch Protection for all repos of $OWNER ==="
+echo ""
+
+if [[ "$APPLY" == false ]]; then
+  echo "  DRY RUN mode. Use --apply to actually configure."
+  echo ""
+fi
+
+REPOS=$(gh repo list "$OWNER" --limit 500 --json name,defaultBranchRef,isArchived \
+  --jq '.[] | select(.isArchived == false) | "\(.name)\t\(.defaultBranchRef.name // "main")"')
+
+TOTAL=0
+PROTECTED=0
+SKIPPED=0
+FAILED=0
+
+while IFS=$'\t' read -r REPO BRANCH; do
+  TOTAL=$((TOTAL + 1))
+
+  # Check if already protected
+  STATUS=$(gh api "repos/$OWNER/$REPO/branches/$BRANCH/protection" --jq '.required_pull_request_reviews.required_approving_review_count // 0' 2>/dev/null || echo "none")
+
+  if [[ "$STATUS" != "none" ]]; then
+    echo "  SKIP  $REPO ($BRANCH) — already protected"
+    SKIPPED=$((SKIPPED + 1))
+    continue
+  fi
+
+  if [[ "$APPLY" == false ]]; then
+    echo "  WOULD $REPO ($BRANCH)"
+    continue
+  fi
+
+  # Apply protection
+  if gh api "repos/$OWNER/$REPO/branches/$BRANCH/protection" -X PUT \
+    --input - <<EOF 2>/dev/null; then
+{
+  "required_pull_request_reviews": {
+    "required_approving_review_count": 0,
+    "dismiss_stale_reviews": false
+  },
+  "enforce_admins": false,
+  "required_status_checks": null,
+  "restrictions": null,
+  "allow_force_pushes": false,
+  "allow_deletions": false
+}
+EOF
+    echo "  OK    $REPO ($BRANCH)"
+    PROTECTED=$((PROTECTED + 1))
+  else
+    echo "  FAIL  $REPO ($BRANCH) — check permissions"
+    FAILED=$((FAILED + 1))
+  fi
+
+done <<< "$REPOS"
+
+echo ""
+echo "=== Summary ==="
+echo "  Total:     $TOTAL"
+echo "  Protected: $PROTECTED"
+echo "  Skipped:   $SKIPPED"
+echo "  Failed:    $FAILED"

package/src/bootstrap.js

@@ -130,12 +130,16 @@ async function checkSonarQubeReady(config) {
     return { name: "sonarqube", ok: true, detail: `Reachable at ${host}`, fix: null };
   }
 
-  // Auto-remediation: try to start
+  // Auto-remediation: start and wait up to 60s for SonarQube to be ready
   try {
     await sonarUp(host);
-    reachable = await isSonarReachable(host);
-    if (reachable) {
-      return { name: "sonarqube", ok: true, detail: `Started and reachable at ${host}`, fix: null };
+    const deadline = Date.now() + 60000;
+    while (Date.now() < deadline) {
+      reachable = await isSonarReachable(host);
+      if (reachable) {
+        return { name: "sonarqube", ok: true, detail: `Started and reachable at ${host}`, fix: null };
+      }
+      await new Promise(r => setTimeout(r, 5000));
     }
   } catch { /* fall through */ }
 

package/src/commands/init.js

@@ -305,6 +305,35 @@ async function installSkills(logger, interactive) {
   }
 }
 
+const GITIGNORE_ENTRIES = [
+  { pattern: ".kj/", comment: "Karajan runtime (logs, worktrees)" },
+  { pattern: ".agent/", comment: "Agent skills (OpenSkills)" },
+  { pattern: ".scannerwork/", comment: "SonarQube scanner temp" },
+];
+
+async function ensureGitignoreEntries(projectDir, logger) {
+  const gitignorePath = path.join(projectDir, ".gitignore");
+  let content;
+  try {
+    content = await fs.readFile(gitignorePath, "utf8");
+  } catch {
+    // No .gitignore yet — will create one
+  }
+  if (!content) content = "";
+
+  const missing = GITIGNORE_ENTRIES.filter(e => !content.includes(e.pattern));
+  if (missing.length === 0) return;
+
+  const block = [
+    "",
+    "# Karajan Code",
+    ...missing.map(e => e.pattern)
+  ].join("\n") + "\n";
+
+  await fs.appendFile(gitignorePath, block, "utf8");
+  logger.info(`Added to .gitignore: ${missing.map(e => e.pattern).join(", ")}`);
+}
+
 export async function initCommand({ logger, flags = {} }) {
   const karajanHome = getKarajanHome();
   await ensureDir(karajanHome);
@@ -329,6 +358,7 @@ export async function initCommand({ logger, flags = {} }) {
   await handleConfigSetup({ config, configExists, interactive, configPath, logger });
   await ensureReviewRules(reviewRulesPath, logger);
   await ensureCoderRules(coderRulesPath, logger);
+  await ensureGitignoreEntries(process.cwd(), logger);
   await installSkills(logger, interactive);
 
   // Auto-detect project stack and preconfigure

package/src/config.js

@@ -221,7 +221,7 @@ export async function loadProjectConfig(projectDir = process.cwd()) {
     return null;
   }
   const raw = await fs.readFile(projectConfigPath, "utf8");
-  return yaml.load(raw) || {};
+  return yaml.load(raw, { json: true }) || {};
 }
 
 async function loadProjectPricingOverrides(projectDir = process.cwd()) {
@@ -231,7 +231,7 @@ async function loadProjectPricingOverrides(projectDir = process.cwd()) {
   }
 
   const raw = await fs.readFile(projectConfigPath, "utf8");
-  const parsed = yaml.load(raw) || {};
+  const parsed = yaml.load(raw, { json: true }) || {};
   const pricing = parsed?.budget?.pricing;
   if (!pricing || typeof pricing !== "object") {
     return null;
@@ -249,7 +249,7 @@ export async function loadConfig(projectDir) {
   const globalExists = await exists(configPath);
   if (globalExists) {
     const raw = await fs.readFile(configPath, "utf8");
-    globalConfig = yaml.load(raw) || {};
+    globalConfig = yaml.load(raw, { json: true }) || {};
   }
 
   // Load project config (.karajan/kj.config.yml)
@@ -469,6 +469,13 @@ const CODER_INHERITED_ROLES = new Set([
 
 function resolveProvider(roleConfig, role, roles, legacyCoder, legacyReviewer) {
   if (roleConfig.provider) return roleConfig.provider;
+
+  // If model has "provider/model" format (e.g. "gemini/pro"), extract the provider
+  if (roleConfig.model && roleConfig.model.includes("/")) {
+    const inferredProvider = roleConfig.model.split("/")[0].toLowerCase();
+    if (AGENT_MODEL_SIGNATURES[inferredProvider]) return inferredProvider;
+  }
+
   if (role === "coder") return legacyCoder;
   if (role === "reviewer") return legacyReviewer;
   if (CODER_INHERITED_ROLES.has(role)) return roles.coder?.provider || legacyCoder;
@@ -476,7 +483,13 @@ function resolveProvider(roleConfig, role, roles, legacyCoder, legacyReviewer) {
 }
 
 function resolveModel(roleConfig, role, config) {
-  if (roleConfig.model) return { model: roleConfig.model, inherited: false };
+  if (roleConfig.model) {
+    // Strip "provider/" prefix from models like "gemini/pro" → "pro"
+    const model = roleConfig.model.includes("/")
+      ? roleConfig.model.split("/").slice(1).join("/")
+      : roleConfig.model;
+    return { model, inherited: false };
+  }
   if (role === "coder") return { model: config?.coder_options?.model ?? null, inherited: false };
   if (role === "reviewer") return { model: config?.reviewer_options?.model ?? null, inherited: false };
   if (CODER_INHERITED_ROLES.has(role)) {
@@ -495,8 +508,8 @@ export function resolveRole(config, role) {
   const provider = resolveProvider(roleConfig, role, roles, legacyCoder, legacyReviewer);
   let { model, inherited: modelIsInherited } = resolveModel(roleConfig, role, config);
 
-  // Drop inherited model if incompatible with the resolved provider
-  if (modelIsInherited && provider && model && !isModelCompatible(provider, model)) {
+  // Drop model if incompatible with the resolved provider (inherited or explicit)
+  if (provider && model && !isModelCompatible(provider, model)) {
     model = null;
   }
 

package/src/orchestrator/preflight-checks.js

@@ -38,19 +38,30 @@ async function checkDocker() {
   };
 }
 
+const SONAR_STARTUP_POLL_MS = 5000;
+const SONAR_STARTUP_MAX_WAIT_MS = 60000;
+
+async function waitForSonar(host, maxWaitMs = SONAR_STARTUP_MAX_WAIT_MS) {
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    if (await isSonarReachable(host)) return true;
+    await new Promise(r => setTimeout(r, SONAR_STARTUP_POLL_MS));
+  }
+  return false;
+}
+
 async function checkSonarReachable(host) {
   const reachable = await isSonarReachable(host);
   if (reachable) {
     return { name: "sonar-reachable", ok: true, detail: `SonarQube reachable at ${host}`, remediated: false };
   }
 
-  // Auto-remediation: try to start SonarQube
+  // Auto-remediation: start SonarQube and wait for it to be ready
   try {
     const upResult = await sonarUp(host);
     if (upResult.exitCode === 0) {
-      // Verify it's actually reachable now
-      const reachableAfter = await isSonarReachable(host);
-      if (reachableAfter) {
+      // SonarQube needs 20-40s to start. Poll until ready.
+      if (await waitForSonar(host)) {
         return { name: "sonar-reachable", ok: true, detail: `SonarQube started and reachable at ${host}`, remediated: true };
       }
     }
@@ -58,7 +69,7 @@ async function checkSonarReachable(host) {
     // sonarUp failed, fall through
   }
 
-  return { name: "sonar-reachable", ok: false, detail: `SonarQube not reachable at ${host} (auto-start failed)` };
+  return { name: "sonar-reachable", ok: false, detail: `SonarQube not reachable at ${host} (auto-start failed after ${SONAR_STARTUP_MAX_WAIT_MS / 1000}s)` };
 }
 
 async function checkSonarAuth(config) {

package/src/utils/process.js

@@ -76,6 +76,10 @@ async function awaitWithTimeout(subprocess, timeout, getStdout) {
 
 export async function runCommand(command, args = [], options = {}) {
   const { timeout, onOutput, silenceTimeoutMs, partialOutputFlushMs, ...rest } = options;
+  // Always detach stdin: KJ subprocesses never need interactive input.
+  // Without this, a subprocess prompting for input (sonar credentials,
+  // agent approval, npm prompts) hangs forever since there is no TTY.
+  if (!rest.stdin) rest.stdin = "ignore";
   const subprocess = execa(command, args, { reject: false, ...rest });
 
   let stdoutAccum = "";