karajan-code 1.58.1 → 1.59.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "1.58.1",
+  "version": "1.59.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/aider-agent.js

@@ -1,6 +1,7 @@
 import { BaseAgent } from "./base-agent.js";
 import { runCommand } from "../utils/process.js";
 import { resolveBin } from "./resolve-bin.js";
+import { getProxyEnv } from "../proxy/proxy-lifecycle.js";
 
 export class AiderAgent extends BaseAgent {
   async runTask(task) {
@@ -28,7 +29,13 @@ export class AiderAgent extends BaseAgent {
   async _exec(task, model) {
     const args = ["--yes", "--message", task.prompt];
     if (model) args.push("--model", model);
+    const proxyEnv = getProxyEnv();
+    if (proxyEnv) {
+      args.push("--api-base", proxyEnv.OPENAI_BASE_URL);
+    }
+    const env = proxyEnv ? { ...process.env, ...proxyEnv } : undefined;
     const res = await runCommand(resolveBin("aider"), args, {
+      ...(env && { env }),
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs

package/src/agents/claude-agent.js

@@ -1,6 +1,7 @@
 import { BaseAgent } from "./base-agent.js";
 import { runCommand } from "../utils/process.js";
 import { resolveBin } from "./resolve-bin.js";
+import { getProxyEnv } from "../proxy/proxy-lifecycle.js";
 
 /**
  * Safely parse a JSON line, returning null on failure.
@@ -134,6 +135,8 @@ function createStreamJsonFilter(onOutput) {
  */
 function cleanExecaOpts(extra = {}) {
   const { CLAUDECODE, ...env } = process.env;
+  const proxyEnv = getProxyEnv();
+  if (proxyEnv) Object.assign(env, proxyEnv);
   return { env, stdin: "ignore", ...extra };
 }
 

package/src/agents/codex-agent.js

@@ -1,6 +1,7 @@
 import { BaseAgent } from "./base-agent.js";
 import { runCommand } from "../utils/process.js";
 import { resolveBin } from "./resolve-bin.js";
+import { getProxyEnv } from "../proxy/proxy-lifecycle.js";
 
 /**
  * Extract token usage from Codex CLI stdout.
@@ -45,7 +46,10 @@ export class CodexAgent extends BaseAgent {
     if (model) args.push("--model", model);
     if (role !== "reviewer" && this.isAutoApproveEnabled(role)) args.push("--full-auto");
     args.push("-");
+    const proxyEnv = getProxyEnv();
+    const env = proxyEnv ? { ...process.env, ...proxyEnv } : undefined;
     const res = await runCommand(resolveBin("codex"), args, {
+      ...(env && { env }),
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs,

package/src/agents/gemini-agent.js

@@ -1,6 +1,7 @@
 import { BaseAgent } from "./base-agent.js";
 import { runCommand } from "../utils/process.js";
 import { resolveBin } from "./resolve-bin.js";
+import { getProxyEnv } from "../proxy/proxy-lifecycle.js";
 
 export class GeminiAgent extends BaseAgent {
   async runTask(task) {
@@ -29,7 +30,10 @@ export class GeminiAgent extends BaseAgent {
     const args = ["-p", task.prompt];
     if (mode === "review") args.push("--output-format", "json");
     if (model) args.push("--model", model);
+    const proxyEnv = getProxyEnv();
+    const env = proxyEnv ? { ...process.env, ...proxyEnv } : undefined;
     const res = await runCommand(resolveBin("gemini"), args, {
+      ...(env && { env }),
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs

package/src/agents/opencode-agent.js

@@ -1,6 +1,7 @@
 import { BaseAgent } from "./base-agent.js";
 import { runCommand } from "../utils/process.js";
 import { resolveBin } from "./resolve-bin.js";
+import { getProxyEnv } from "../proxy/proxy-lifecycle.js";
 
 export class OpenCodeAgent extends BaseAgent {
   async runTask(task) {
@@ -30,7 +31,10 @@ export class OpenCodeAgent extends BaseAgent {
     if (jsonFormat) args.push("--format", "json");
     if (model) args.push("--model", model);
     args.push(task.prompt);
+    const proxyEnv = getProxyEnv();
+    const env = proxyEnv ? { ...process.env, ...proxyEnv } : undefined;
     const res = await runCommand(resolveBin("opencode"), args, {
+      ...(env && { env }),
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs

package/src/bootstrap.js

@@ -42,12 +42,22 @@ async function checkGitRepo() {
   } catch { /* git may not be installed */
     ok = false;
   }
-  return {
-    name: "gitRepo",
-    ok,
-    detail: ok ? "Inside a git repository" : "Not a git repository",
-    fix: "Run 'git init' in your project directory."
-  };
+
+  if (!ok) {
+    // Auto-init: initialize git repo for new projects
+    const initResult = await runCommand("git", ["init"]);
+    if (initResult.exitCode !== 0) {
+      return {
+        name: "gitRepo",
+        ok: false,
+        detail: "Not a git repository and git init failed",
+        fix: "Ensure git is installed and you have write permissions to this directory."
+      };
+    }
+    return { name: "gitRepo", ok: true, detail: "Initialized new git repository", fix: null };
+  }
+
+  return { name: "gitRepo", ok: true, detail: "Inside a git repository", fix: null };
 }
 
 async function checkGitRemote() {
@@ -57,11 +67,12 @@ async function checkGitRemote() {
       return { name: "gitRemote", ok: true, detail: res.stdout.trim(), fix: null };
     }
   } catch { /* fall through */ }
+  // No remote is acceptable for new projects — non-blocking
   return {
     name: "gitRemote",
-    ok: false,
-    detail: "origin remote not configured",
-    fix: "Run 'git remote add origin <your-repo-url>'."
+    ok: true,
+    detail: "No remote configured (new project)",
+    fix: null
   };
 }
 

package/src/commands/doctor.js

@@ -12,6 +12,7 @@ import { ensureGitRepo } from "../utils/git.js";
 import { checkBinary, KNOWN_AGENTS } from "../utils/agent-detect.js";
 import { getInstallCommand } from "../utils/os-detect.js";
 import { withDocLink } from "../utils/doc-links.js";
+import { isProxyRunning } from "../proxy/proxy-lifecycle.js";
 
 function getPackageVersion() {
   const pkgPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json");
@@ -342,6 +343,23 @@ async function checkAgentConfigs() {
   return checks;
 }
 
+async function checkProxy(config) {
+  if (config.proxy?.enabled === false) {
+    return { name: "proxy", label: "Proxy", ok: true, detail: "Disabled in config", fix: null };
+  }
+  let running = false;
+  try {
+    running = await isProxyRunning();
+  } catch { /* proxy check failed */ }
+  return {
+    name: "proxy",
+    label: "Proxy",
+    ok: true,
+    detail: running ? "Running" : "Available (starts on kj run)",
+    fix: null
+  };
+}
+
 export async function runChecks({ config }) {
   const checks = [];
 
@@ -366,6 +384,7 @@ export async function runChecks({ config }) {
   checks.push(...await checkAgentConfigs());
   checks.push(...await checkRuleFiles(config));
   checks.push(await checkRtk());
+  checks.push(await checkProxy(config));
 
   return checks;
 }

package/src/commands/report.js

@@ -153,6 +153,7 @@ async function buildReport(dir, sessionId) {
   if (session.pg_task_id) report.pg_task_id = session.pg_task_id;
   if (session.pg_project_id) report.pg_project_id = session.pg_project_id;
   if (session.rtk_savings) report.rtk_savings = session.rtk_savings;
+  if (session.proxy_stats) report.proxy_stats = session.proxy_stats;
   return report;
 }
 
@@ -199,6 +200,7 @@ function printTextReport(report) {
   console.log(formatBudgetText(report.budget_consumed));
   console.log("Commits Generated:");
   console.log(formatCommitsText(report.commits_generated));
+  printProxyStats(report.proxy_stats);
 }
 
 function formatDuration(ms) {
@@ -327,6 +329,16 @@ async function resolveTraceOptions(currency) {
   return { cur, rate };
 }
 
+function printProxyStats(proxyStats) {
+  if (!proxyStats) return;
+  const orig = proxyStats.originalTokens ?? 0;
+  const comp = proxyStats.compressedTokens ?? 0;
+  const pct = orig > 0 ? ((1 - comp / orig) * 100).toFixed(1) : "0.0";
+  const hits = proxyStats.cacheHits ?? 0;
+  console.log("");
+  console.log(`Proxy: ${orig} original tokens, ${comp} compressed tokens, ${pct}% savings, ${hits} cache hits`);
+}
+
 function printRtkSavings(rtkSavings) {
   if (!rtkSavings || !rtkSavings.callCount) return;
   const tokens = rtkSavings.estimatedTokensSaved ?? 0;
@@ -345,6 +357,7 @@ function printTraceReport(report, currency, exchangeRate) {
   console.log("");
   printTraceTable(report.budget_trace, { currency, exchangeRate });
   printRtkSavings(report.rtk_savings);
+  printProxyStats(report.proxy_stats);
 }
 
 async function handlePgTaskReport({ dir, pgTask, list, sessionId, format, trace, currency }) {

package/src/commands/status.js

@@ -5,6 +5,7 @@
 import { readRunLog } from "../utils/run-log.js";
 import { loadMostRecentSession } from "../session-store.js";
 import { buildDashboard } from "../utils/status-dashboard.js";
+import { getProxyStats } from "../proxy/proxy-lifecycle.js";
 
 /**
  * Run the `kj status` command: print a human-readable dashboard to stdout.
@@ -32,4 +33,10 @@ export async function statusCommand({ lines = 50, projectDir } = {}) {
 
   const dashboard = buildDashboard(session, logResult.lines || [], { stories });
   console.log(dashboard);
+
+  const proxyStats = getProxyStats();
+  if (proxyStats) {
+    console.log("");
+    console.log(`Proxy: port ${proxyStats.port}, ${proxyStats.requests} requests, ${proxyStats.bytes_in} bytes in, ${proxyStats.bytes_out} bytes out`);
+  }
 }

package/src/config.js

@@ -172,6 +172,37 @@ const DEFAULTS = {
     thresholds: { lcp: 2500, cls: 0.1, inp: 200 }
   },
   telemetry: true,
+  proxy: {
+    enabled: true,
+    port: "auto",
+    compression: {
+      enabled: true,
+      ai_compression: false,
+      ai_model: "haiku",
+      ai_provider: "anthropic",
+      layers: {
+        git: true,
+        tests: true,
+        build: true,
+        infra: true,
+        packages: true,
+        read_dedup: true,
+        glob_truncate: true,
+        grep_collapse: true,
+      },
+      pressure_thresholds: {
+        low: 0.5,
+        medium: 0.8,
+        high: 0.9,
+      },
+    },
+    cache: {
+      persist_to_disk: true,
+      flush_interval_ms: 5000,
+    },
+    inject_prompts: true,
+    monitor: true,
+  },
   guards: {
     output: {
       enabled: true,
@@ -401,6 +432,10 @@ function applyMiscOverrides(out, flags) {
   if (flags.pgTask) out.planning_game.enabled = true;
   if (flags.pgProject) out.planning_game.project_id = flags.pgProject;
 
+  out.proxy = out.proxy || {};
+  if (flags.noProxy) out.proxy.enabled = false;
+  if (flags.proxyPort) out.proxy.port = flags.proxyPort;
+
   out.model_selection = out.model_selection || { enabled: true, tiers: {}, role_overrides: {} };
   if (flags.smartModels === true) out.model_selection.enabled = true;
   if (flags.smartModels === false || flags.noSmartModels === true) out.model_selection.enabled = false;

package/src/git/automation.js

@@ -7,6 +7,7 @@ import { addCheckpoint } from "../session-store.js";
 import {
   ensureGitRepo,
   currentBranch,
+  hasCommits,
   fetchBase,
   syncBaseBranch,
   ensureBranchUpToDateWithBase,
@@ -34,18 +35,45 @@ export async function prepareGitAutomation({ config, task, logger, session }) {
 
   const baseBranch = config.base_branch;
   const autoRebase = config.git.auto_rebase !== false;
-  await fetchBase(baseBranch);
+  const repoHasCommits = await hasCommits();
+
+  // New repo without commits: create branch directly (no fetch/sync possible)
+  if (!repoHasCommits) {
+    const created = buildBranchName(config.git.branch_prefix || "feat/", task);
+    // git checkout -b works even without commits (creates orphan-like branch on first commit)
+    await createBranch(created);
+    logger.info(`New repo — created working branch: ${created}`);
+    await addCheckpoint(session, { stage: "git-prep", branch: created, created: true, newRepo: true });
+    return { enabled: true, branch: created, baseBranch, autoRebase };
+  }
+
+  await fetchBase(baseBranch).catch(() => {
+    // No remote — skip fetch (new project without push)
+    logger.info("No remote configured — skipping fetch");
+  });
+
+  let branch;
+  try {
+    branch = await currentBranch();
+  } catch {
+    // HEAD exists but branch detection failed — unusual, treat as main
+    branch = baseBranch;
+  }
 
-  let branch = await currentBranch();
   if (branch === baseBranch) {
-    await syncBaseBranch({ baseBranch, autoRebase });
+    await syncBaseBranch({ baseBranch, autoRebase }).catch(() => {
+      // No remote tracking — skip sync for new projects
+    });
     const created = buildBranchName(config.git.branch_prefix || "feat/", task);
     await createBranch(created);
     branch = created;
     logger.info(`Created working branch: ${branch}`);
     await addCheckpoint(session, { stage: "git-prep", branch, created: true });
   } else {
-    await ensureBranchUpToDateWithBase({ branch, baseBranch, autoRebase });
+    await ensureBranchUpToDateWithBase({ branch, baseBranch, autoRebase }).catch(() => {
+      // No remote tracking — skip rebase for new projects
+      logger.info("No remote tracking — skipping rebase check");
+    });
     await addCheckpoint(session, { stage: "git-prep", branch, created: false });
   }
 

package/src/guards/policy-guard.js

@@ -0,0 +1,90 @@
+/**
+ * Policy guard for kj_resume answers.
+ *
+ * Detects host-AI attempts to bypass pipeline policies (skip TDD, ignore
+ * reviewer, disable security, etc.) and rejects them with context-aware
+ * suggestions for valid alternatives.
+ */
+
+const BYPASS_PATTERNS = [
+  { regex: /\b(?:skip|omit|drop)\s+(?:the\s+)?(?:tests?|tdd|testing)\b/i, policy: "tdd" },
+  { regex: /\bdisable\s+(?:the\s+)?(?:tests?|tdd|testing)\b/i, policy: "tdd" },
+  { regex: /\b(?:don'?t|do\s+not|no\s+need\s+(?:for|to))\s+(?:run\s+)?tests?\b/i, policy: "tdd" },
+  { regex: /\bcontinue\s+without\s+test/i, policy: "tdd" },
+  { regex: /\bswitch\s+(?:to\s+)?(?:standard\s+)?methodology/i, policy: "tdd" },
+  { regex: /\bswitch\s+methodology/i, policy: "tdd" },
+  { regex: /\b(?:skip|ignore|bypass|disable)\s+(?:the\s+)?(?:review(?:er)?|code\s+review)\b/i, policy: "reviewer" },
+  { regex: /\b(?:approve|pass)\s+without\s+review/i, policy: "reviewer" },
+  { regex: /\bmark\s+as\s+approved\b/i, policy: "reviewer" },
+  { regex: /\bjust\s+ship\s+it/i, policy: "reviewer" },
+  { regex: /\bignore\s+(?:the\s+)?(?:review(?:er)?\s+)?feedback\b/i, policy: "reviewer" },
+  { regex: /\b(?:skip|ignore|bypass|disable)\s+(?:the\s+)?(?:sonar|sonarqube|quality\s+gate)/i, policy: "sonar" },
+  { regex: /\bignore\s+sonar\s+issues?\b/i, policy: "sonar" },
+  { regex: /\b(?:skip|ignore|bypass|disable)\s+(?:the\s+)?security(?:\s+checks?)?\b/i, policy: "security" },
+];
+
+const SUGGESTIONS_BY_POLICY = {
+  tdd: [
+    "Provide specific guidance for the coder on how to fix the failing tests",
+    "Describe the expected behavior so the coder can write correct tests",
+    "Suggest a different approach to implement the feature that is easier to test",
+  ],
+  reviewer: [
+    "Provide technical guidance to address the reviewer's feedback",
+    "Explain why the current approach is correct if you disagree with the review",
+    "Suggest alternative implementations that satisfy the reviewer's concerns",
+  ],
+  sonar: [
+    "Provide guidance on how to resolve the SonarQube issues",
+    "Explain the code changes needed to satisfy quality gate requirements",
+  ],
+  security: [
+    "Provide guidance on how to fix the security issues found",
+    "Explain the secure alternative for the flagged pattern",
+  ],
+};
+
+const CONTEXT_SUGGESTIONS = {
+  reviewer_fail_fast: [
+    "Provide specific technical guidance for the coder to address the reviewer's feedback",
+    "Suggest a different approach that resolves the reviewer's concerns",
+  ],
+  max_iterations: [
+    "Provide focused guidance to help the coder converge on a solution",
+    "Narrow the scope: specify exactly which file/function to change and how",
+    "Continue with additional iterations by choosing option 1 or 2",
+  ],
+  standby_exhausted: [
+    "Wait and retry — the provider may be temporarily overloaded",
+    "Continue to resume from where the pipeline left off",
+  ],
+};
+
+/**
+ * Validate a resume answer against pipeline policies.
+ *
+ * @param {string|null} answer - The resume answer from the host
+ * @param {string} [pauseContext] - The context of the pause (e.g. "reviewer_fail_fast")
+ * @returns {{ valid: boolean, reason?: string, suggestions?: string[] }}
+ */
+export function validatePolicyCompliance(answer, pauseContext) {
+  if (answer == null || answer === "") return { valid: true };
+  if (typeof answer !== "string") return { valid: true };
+
+  const text = answer.trim();
+  for (const { regex, policy } of BYPASS_PATTERNS) {
+    if (regex.test(text)) {
+      const suggestions = [
+        ...(CONTEXT_SUGGESTIONS[pauseContext] || []),
+        ...(SUGGESTIONS_BY_POLICY[policy] || []),
+      ];
+      return {
+        valid: false,
+        reason: `Pipeline policy "${policy}" cannot be bypassed. Provide technical guidance instead.`,
+        suggestions: [...new Set(suggestions)],
+      };
+    }
+  }
+
+  return { valid: true };
+}

package/src/mcp/handlers/run-handler.js

@@ -8,6 +8,7 @@ import { runFlow, resumeFlow } from "../../orchestrator.js";
 import { loadConfig, applyRunOverrides, validateConfig, resolveRole } from "../../config.js";
 import { createLogger } from "../../utils/logger.js";
 import { assertAgentsAvailable } from "../../agents/availability.js";
+import { validatePolicyCompliance } from "../../guards/policy-guard.js";
 import { createRunLog } from "../../utils/run-log.js";
 import { buildProgressHandler, buildProgressNotifier, buildPipelineTracker } from "../progress.js";
 import { isPreflightAcked, ackPreflight, getSessionOverrides } from "../preflight.js";
@@ -113,7 +114,7 @@ function collectRequiredProviders(config) {
 
 export async function handleRunDirect(a, server, extra) {
   const config = await buildConfig(a);
-  await assertNotOnBaseBranch(config);
+  await assertNotOnBaseBranch(config, { allowForRun: true });
   const logger = createLogger(config.output.log_level, "mcp");
 
   // Best-effort session cleanup before starting
@@ -203,7 +204,7 @@ const RESUME_INJECTION_PATTERNS = [
   /force\s+(approve|merge|push|commit)\b/i,
 ];
 
-export function validateResumeAnswer(answer) {
+export function validateResumeAnswer(answer, pauseContext) {
   if (answer == null || answer === "") return { valid: true, sanitized: answer ?? null };
   if (typeof answer !== "string") return { valid: true, sanitized: String(answer) };
   if (answer.length > RESUME_MAX_ANSWER_LENGTH) {
@@ -214,6 +215,14 @@ export function validateResumeAnswer(answer) {
       return { valid: false, reason: "Answer rejected: matches guardrail bypass pattern" };
     }
   }
+  // Policy compliance: reject attempts to bypass TDD, reviewer, security, etc.
+  const policy = validatePolicyCompliance(answer, pauseContext);
+  if (!policy.valid) {
+    const suggestionsText = policy.suggestions.length > 0
+      ? `\nValid alternatives:\n${policy.suggestions.map(s => `  - ${s}`).join("\n")}`
+      : "";
+    return { valid: false, reason: `${policy.reason}${suggestionsText}` };
+  }
   return { valid: true, sanitized: answer.trim() };
 }
 
@@ -240,7 +249,15 @@ export async function handleResume(a, server, extra) {
   }
   await runBootstrapGate(server, a);
   if (a.answer) {
-    const validation = validateResumeAnswer(a.answer);
+    // Load session to get pause context for policy-aware validation
+    let pauseContext;
+    try {
+      const { loadSession } = await import("../../session-store.js");
+      const session = await loadSession(a.sessionId);
+      const ctx = session?.paused_state?.context;
+      pauseContext = typeof ctx === "string" ? ctx : ctx?.reason;
+    } catch { /* session read error — validate without context */ }
+    const validation = validateResumeAnswer(a.answer, pauseContext);
     if (!validation.valid) {
       return failPayload(`Resume answer rejected: ${validation.reason}`);
     }

package/src/mcp/shared-helpers.js

@@ -67,15 +67,17 @@ export function failPayload(message, details = {}) {
   };
 }
 
-export async function assertNotOnBaseBranch(config) {
+export async function assertNotOnBaseBranch(config, { allowForRun = false } = {}) {
   const baseBranch = config?.base_branch || "main";
   let branch;
   try {
     branch = await currentBranch();
   } catch {
-    return;
+    return; // No git repo or no commits — bootstrap/orchestrator will handle it
   }
   if (branch === baseBranch) {
+    // kj_run creates its own branch via prepareGitAutomation — allow it
+    if (allowForRun) return;
     throw new Error(
       `You are on the base branch '${baseBranch}'. Karajan needs a feature branch to compute the diff for review. ` +
       `Create a new branch first (e.g. 'git checkout -b feat/<task-description>') and then run this command again. ` +