karajan-code 1.59.0 → 2.0.0

package/src/roles/triage-role.js

@@ -1,5 +1,4 @@
-import { BaseRole } from "./base-role.js";
-import { createAgent as defaultCreateAgent } from "../agents/index.js";
+import { AgentRole } from "./agent-role.js";
 import { buildTriagePrompt } from "../prompts/triage.js";
 import { VALID_TASK_TYPES } from "../guards/policy-resolver.js";
 import { extractFirstJson } from "../utils/json-extract.js";
@@ -7,18 +6,7 @@ import { extractFirstJson } from "../utils/json-extract.js";
 const VALID_LEVELS = new Set(["trivial", "simple", "medium", "complex"]);
 const VALID_ROLES = new Set(["planner", "researcher", "refactorer", "reviewer", "tester", "security", "impeccable"]);
 const FALLBACK_TASK_TYPE = "sw";
-
-function resolveProvider(config) {
-  return (
-    config?.roles?.triage?.provider ||
-    config?.roles?.coder?.provider ||
-    "claude"
-  );
-}
-
-function parseTriageOutput(raw) {
-  return extractFirstJson(raw);
-}
+const FALLBACK_RESULT = { level: "medium", roles: ["reviewer"], taskType: FALLBACK_TASK_TYPE, shouldDecompose: false };
 
 function normalizeRoles(roles) {
   if (!Array.isArray(roles)) return [];
@@ -27,115 +15,66 @@ function normalizeRoles(roles) {
 
 function normalizeSubtasks(subtasks) {
   if (!Array.isArray(subtasks)) return [];
-  return subtasks
-    .map((s) => (typeof s === "string" ? s.trim() : ""))
-    .filter(Boolean)
-    .slice(0, 5);
+  return subtasks.map((s) => (typeof s === "string" ? s.trim() : "")).filter(Boolean).slice(0, 5);
 }
 
 function normalizeDomainHints(hints) {
   if (!Array.isArray(hints)) return [];
-  return hints
-    .map((h) => (typeof h === "string" ? h.trim().toLowerCase() : ""))
-    .filter(Boolean);
+  return hints.map((h) => (typeof h === "string" ? h.trim().toLowerCase() : "")).filter(Boolean);
 }
 
-export class TriageRole extends BaseRole {
-  constructor({ config, logger, emitter = null, createAgentFn = null }) {
-    super({ name: "triage", config, logger, emitter });
-    this._createAgent = createAgentFn || defaultCreateAgent;
+export class TriageRole extends AgentRole {
+  constructor(opts) {
+    super({ ...opts, name: "triage" });
   }
 
-  async execute(input) {
-    const task = typeof input === "string"
-      ? input
-      : input?.task || this.context?.task || "";
-    const onOutput = typeof input === "string" ? null : input?.onOutput || null;
-
-    const provider = resolveProvider(this.config);
-    const agent = this._createAgent(provider, this.config, this.logger);
-
-    const prompt = buildTriagePrompt({ task, instructions: this.instructions });
-    const runArgs = { prompt, role: "triage" };
-    if (onOutput) runArgs.onOutput = onOutput;
-    const result = await agent.runTask(runArgs);
+  async buildPrompt({ task }) {
+    return { prompt: buildTriagePrompt({ task, instructions: this.instructions }) };
+  }
 
-    if (!result.ok) {
-      return {
-        ok: false,
-        result: {
-          error: result.error || result.output || "Triage failed",
-          provider
-        },
-        summary: `Triage failed: ${result.error || "unknown error"}`,
-        usage: result.usage
-      };
+  parseOutput(raw) { return extractFirstJson(raw); }
+
+  buildSuccessResult(parsed, provider) {
+    const level = VALID_LEVELS.has(parsed.level) ? parsed.level : "medium";
+    const roles = normalizeRoles(parsed.roles);
+    const reasoning = String(parsed.reasoning || "").trim() || "No reasoning provided.";
+    const shouldDecompose = Boolean(parsed.shouldDecompose);
+    const subtasks = normalizeSubtasks(parsed.subtasks);
+    const taskType = VALID_TASK_TYPES.has(parsed.taskType) ? parsed.taskType : FALLBACK_TASK_TYPE;
+    const domainHints = normalizeDomainHints(parsed.domainHints);
+
+    const result = { level, roles, reasoning, taskType, domainHints, provider };
+    if (shouldDecompose && subtasks.length > 0) {
+      result.shouldDecompose = true;
+      result.subtasks = subtasks;
+    } else {
+      result.shouldDecompose = false;
     }
+    return result;
+  }
 
-    try {
-      const parsed = parseTriageOutput(result.output);
-      if (!parsed) {
-        return {
-          ok: true,
-          result: {
-            level: "medium",
-            roles: ["reviewer"],
-            reasoning: "Unstructured output, using safe defaults.",
-            taskType: FALLBACK_TASK_TYPE,
-            provider,
-            raw: result.output
-          },
-          summary: "Triage complete (fallback defaults)",
-          usage: result.usage
-        };
-      }
-
-      const level = VALID_LEVELS.has(parsed.level) ? parsed.level : "medium";
-      const roles = normalizeRoles(parsed.roles);
-      const reasoning = String(parsed.reasoning || "").trim() || "No reasoning provided.";
-      const shouldDecompose = Boolean(parsed.shouldDecompose);
-      const subtasks = normalizeSubtasks(parsed.subtasks);
-      const taskType = VALID_TASK_TYPES.has(parsed.taskType) ? parsed.taskType : FALLBACK_TASK_TYPE;
-
-      const domainHints = normalizeDomainHints(parsed.domainHints);
-
-      const triageResult = {
-        level,
-        roles,
-        reasoning,
-        taskType,
-        domainHints,
-        provider
-      };
+  buildSummary(parsed) {
+    const level = VALID_LEVELS.has(parsed.level) ? parsed.level : "medium";
+    const roles = normalizeRoles(parsed.roles);
+    const decomposeNote = parsed.shouldDecompose ? " — decomposition recommended" : "";
+    return `Triage: ${level} (${roles.length} role${roles.length === 1 ? "" : "s"})${decomposeNote}`;
+  }
 
-      if (shouldDecompose && subtasks.length > 0) {
-        triageResult.shouldDecompose = true;
-        triageResult.subtasks = subtasks;
-      } else {
-        triageResult.shouldDecompose = false;
-      }
+  handleParseNull(agentResult, provider) {
+    return {
+      ok: true,
+      result: { ...FALLBACK_RESULT, reasoning: "Unstructured output, using safe defaults.", provider, raw: agentResult.output },
+      summary: "Triage complete (fallback defaults)",
+      usage: agentResult.usage
+    };
+  }
 
-      const decomposeNote = shouldDecompose ? " — decomposition recommended" : "";
-      return {
-        ok: true,
-        result: triageResult,
-        summary: `Triage: ${level} (${roles.length} role${roles.length === 1 ? "" : "s"})${decomposeNote}`,
-        usage: result.usage
-      };
-    } catch { /* agent output is not structured JSON */
-      return {
-        ok: true,
-        result: {
-          level: "medium",
-          roles: ["reviewer"],
-          reasoning: "Failed to parse triage output, using safe defaults.",
-          taskType: FALLBACK_TASK_TYPE,
-          provider,
-          raw: result.output
-        },
-        summary: "Triage complete (fallback defaults)",
-        usage: result.usage
-      };
-    }
+  handleParseError(_err, agentResult, provider) {
+    return {
+      ok: true,
+      result: { ...FALLBACK_RESULT, reasoning: "Failed to parse triage output, using safe defaults.", provider, raw: agentResult.output },
+      summary: "Triage complete (fallback defaults)",
+      usage: agentResult.usage
+    };
   }
 }

package/src/session-store.js

@@ -5,7 +5,7 @@ import { getSessionRoot } from "./utils/paths.js";
 
 const SESSION_ROOT = getSessionRoot();
 
-export function newSessionId() {
+function newSessionId() {
   const now = new Date();
   const stamp = now.toISOString().replaceAll(/[:.]/g, "-");
   return `s_${stamp}`;

package/src/skills/skill-detector.js

@@ -63,6 +63,8 @@ const TASK_TEXT_PATTERNS = [
   { pattern: /\bgo(?:lang)?\b/i, skill: "go" },
   { pattern: /\brust\b/i, skill: "rust" },
   { pattern: /\bpython\b/i, skill: "python" },
+  { pattern: /\bdjango\b/i, skill: "python" },
+  { pattern: /\bflask\b/i, skill: "python" },
   { pattern: /\bruby\b/i, skill: "ruby" },
   { pattern: /\bflutter\b/i, skill: "flutter" },
   { pattern: /\bswift\b/i, skill: "swift" },
@@ -76,6 +78,15 @@ const TASK_TEXT_PATTERNS = [
   { pattern: /\breport\b/i, skill: "data-report" },
   { pattern: /\banalysis\b/i, skill: "data-report" },
   { pattern: /\bfindings\b/i, skill: "data-report" },
+  // Frontend/backend broad categories
+  { pattern: /\bfrontend\b/i, skill: "frontend-design" },
+  { pattern: /\bCSS\b/i, skill: "frontend-design" },
+  { pattern: /\bHTML\b/i, skill: "frontend-design" },
+  { pattern: /\bbackend\b/i, skill: "express" },
+  { pattern: /\bnode\.?js\b/i, skill: "express" },
+  { pattern: /\bAPI\b/, skill: "express" },
+  { pattern: /\bwebsocket\b/i, skill: "express" },
+  { pattern: /\breal[- ]time\b/i, skill: "express" },
 ];
 
 /**

package/src/sonar/config-resolver.js

@@ -27,6 +27,8 @@ export function resolveSonarHost(rawHost) {
  *   2. config.sonarqube.token
  *   3. SONAR_TOKEN env var
  *
+ * For async resolution (including credentials file), use resolveSonarTokenAsync.
+ *
  * @param {object} [config={}] - Karajan config object
  * @returns {string|null} Token string or null if none found
  */
@@ -39,6 +41,22 @@ export function resolveSonarToken(config = {}) {
   return token || null;
 }
 
+/**
+ * Async version of resolveSonarToken that also checks the credentials file
+ * for previously generated tokens.
+ *
+ * @param {object} [config={}] - Karajan config object
+ * @returns {Promise<string|null>} Token string or null if none found
+ */
+export async function resolveSonarTokenAsync(config = {}) {
+  const syncToken = resolveSonarToken(config);
+  if (syncToken) return syncToken;
+
+  // Check credentials file for persisted token
+  const fileCreds = (await loadSonarCredentials()) || {};
+  return fileCreds.token || null;
+}
+
 /**
  * Resolve SonarQube admin credentials from (in priority order):
  *   1. Env vars: KJ_SONAR_ADMIN_USER / KJ_SONAR_ADMIN_PASSWORD
@@ -57,12 +75,13 @@ export async function resolveSonarCredentials(config = {}) {
     process.env.KJ_SONAR_ADMIN_USER ||
     config.sonarqube?.admin_user ||
     fileCreds.user ||
-    null;
+    "admin"; // Default for fresh SonarQube installs
 
   const candidates = [
     process.env.KJ_SONAR_ADMIN_PASSWORD,
     config.sonarqube?.admin_password,
     fileCreds.password,
+    "admin", // Default password for fresh SonarQube installs (zero-config)
   ].filter(Boolean);
 
   return { user, passwords: [...new Set(candidates)] };

package/src/sonar/credentials.js

@@ -33,3 +33,20 @@ export async function loadSonarCredentials() {
 export function credentialsPath() {
   return path.join(getKarajanHome(), CREDENTIALS_FILENAME);
 }
+
+/**
+ * Save a generated token to ~/.karajan/sonar-credentials.json so it persists across sessions.
+ * Merges with existing credentials (preserves user/password if present).
+ */
+export async function saveSonarToken(token) {
+  const filePath = path.join(getKarajanHome(), CREDENTIALS_FILENAME);
+  let existing = {};
+  try {
+    const raw = await fs.readFile(filePath, "utf8");
+    existing = JSON.parse(raw);
+  } catch { /* file may not exist */ }
+  existing.token = token;
+  const dir = getKarajanHome();
+  await fs.mkdir(dir, { recursive: true });
+  await fs.writeFile(filePath, JSON.stringify(existing, null, 2), "utf8");
+}

package/src/sonar/project-key.js

@@ -9,7 +9,7 @@ function slug(value) {
     .replaceAll(/(^-+)|(-+$)/g, "");
 }
 
-export function normalizeProjectKey(value) {
+function normalizeProjectKey(value) {
   const out = slug(value);
   if (!out) return "kj-default";
   return /[a-z]/.test(out) ? out : `kj-${out}`;

package/src/sonar/scanner.js

@@ -150,7 +150,7 @@ async function resolveSonarTokenWithFallback(config, apiHost) {
   return null;
 }
 
-export async function ensureSonarProjectProperties(cwd = process.cwd()) {
+async function ensureSonarProjectProperties(cwd = process.cwd()) {
   const propsPath = path.join(cwd, "sonar-project.properties");
   try {
     await fsPromises.access(propsPath);

package/src/utils/banner.js

@@ -0,0 +1,66 @@
+/**
+ * Karajan Code ASCII banner with brand colors.
+ *
+ * Brand palette:
+ *   #AACCEE  steel blue (primary text)
+ *   #88CC88  green (accents, robot eyes)
+ *   #464000  dark olive
+ *   #444411  charcoal (secondary text)
+ */
+
+const C = {
+  blue:     "\x1b[38;2;170;204;238m",  // #AACCEE
+  green:    "\x1b[38;2;100;190;100m",   // green accents
+  gray:     "\x1b[38;2;140;140;140m",   // borders/dim
+  white:    "\x1b[38;2;220;220;220m",   // bright text
+  charcoal: "\x1b[38;2;100;100;80m",    // #444411 approx
+  bold:     "\x1b[1m",
+  dim:      "\x1b[2m",
+  reset:    "\x1b[0m"
+};
+
+const R = C.reset;
+
+const BANNER_LINES = [
+  ``,
+  `${C.gray}        ╭───────────╮`,
+  `${C.gray}        │  ${C.green}~${C.gray}        │`,
+  `${C.gray}        │  ${C.green}|${C.gray}     ${C.green}|${C.gray}  │  ${C.charcoal}|`,
+  `${C.gray}        |     ${C.green}v${C.gray}     │ ${C.charcoal}/`,
+  `${C.gray}      ${C.charcoal}\\${C.gray} ╰───────────╯${C.charcoal}/`,
+  `${C.charcoal}       \\${C.gray} ╭───${C.white}⋈${C.gray}───╮ ${C.charcoal}/`,
+  `${C.charcoal}        \\${C.gray}        ${C.charcoal}/`,
+  `${C.gray}         ╰───────╯`,
+  ``,
+  `  ${C.bold}${C.blue}╦╔═ ╔═╗ ╦═╗ ╔═╗  ╦ ╔═╗ ╔╗╔${R}`,
+  `  ${C.bold}${C.blue}╠╩╗ ╠═╣ ╠╦╝ ╠═╣  ║ ╠═╣ ║║║${R}`,
+  `  ${C.bold}${C.blue}╩ ╩ ╩ ╩ ╩╚═ ╩ ╩ ╚╝ ╩ ╩ ╝╚╝${R}`,
+  `  ${C.bold}${C.white}        C O D E${R}  %%VERSION%%`,
+  `  ${C.charcoal}multiagent coding orchestrator${R}`,
+  ``,
+];
+
+/**
+ * Print the Karajan Code ASCII banner.
+ * @param {string} version - Package version to display
+ * @param {object} [opts]
+ * @param {boolean} [opts.compact] - Skip mascot, show only text
+ * @param {boolean} [opts.force] - Print even without TTY
+ */
+export function printBanner(version, opts = {}) {
+  if (!opts.force && !process.stdout.isTTY) return;
+
+  const versionTag = `${C.dim}v${version}${R}`;
+
+  if (opts.compact) {
+    console.log();
+    for (const line of BANNER_LINES.slice(10)) {
+      console.log(line.replace("%%VERSION%%", versionTag));
+    }
+    return;
+  }
+
+  for (const line of BANNER_LINES) {
+    console.log(line.replace("%%VERSION%%", versionTag));
+  }
+}

package/src/utils/display.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { printBanner } from "./banner.js";
 
 // TODO: i18n display messages
 const DISPLAY_PKG_PATH = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json");
@@ -83,9 +84,7 @@ const BAR = `${ANSI.dim}\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u
 
 export function printHeader({ task, config }) {
   const version = DISPLAY_VERSION;
-  console.log(BAR);
-  console.log(`${ANSI.bold}${ANSI.cyan}\u25b6 Karajan Code v${version}${ANSI.reset}`);
-  console.log(BAR);
+  printBanner(version);
   console.log(`${ANSI.bold}Task:${ANSI.reset} ${task}`);
   console.log(
     `${ANSI.bold}Coder:${ANSI.reset} ${config.roles?.coder?.provider || config.coder} ${ANSI.dim}|${ANSI.reset} ${ANSI.bold}Reviewer:${ANSI.reset} ${config.roles?.reviewer?.provider || config.reviewer}`
@@ -100,7 +99,10 @@ export function printHeader({ task, config }) {
   if (pipeline.researcher?.enabled) activeRoles.push(`Researcher (${config.roles?.researcher?.provider || "?"})`);
   if (pipeline.tester?.enabled) activeRoles.push("Tester");
   if (pipeline.security?.enabled) activeRoles.push("Security");
-  if (pipeline.solomon?.enabled) activeRoles.push(`Solomon (${config.roles?.solomon?.provider || "?"})`);
+  if (pipeline.solomon?.enabled) {
+    const solomonProvider = config.roles?.solomon?.provider;
+    activeRoles.push(solomonProvider ? `Solomon (${solomonProvider})` : "Solomon");
+  }
   if (activeRoles.length > 0) {
     const separator = ` ${ANSI.dim}|${ANSI.reset} `;
     console.log(`${ANSI.bold}Pipeline:${ANSI.reset} ${activeRoles.join(separator)}`);
@@ -257,7 +259,14 @@ function printSessionRtkSavings(rtkSavings) {
   const tokens = rtkSavings.estimatedTokensSaved ?? 0;
   const ratio = rtkSavings.savedPct ?? 0;
   const commands = rtkSavings.callCount ?? 0;
-  console.log(`  ${ANSI.dim}\u26a1 RTK: saved ~${tokens} tokens (${ratio}% compression, ${commands} commands)${ANSI.reset}`);
+  const original = rtkSavings.originalBytes ?? 0;
+  const compressed = rtkSavings.rtkBytes ?? 0;
+
+  if (tokens === 0 || ratio === 0) {
+    console.log(`  ${ANSI.dim}⚡ RTK: ${commands} commands wrapped, 0% savings — output was already minimal (${original} bytes in, ${compressed} bytes out)${ANSI.reset}`);
+  } else {
+    console.log(`  ${ANSI.dim}⚡ RTK: saved ~${tokens.toLocaleString()} tokens (${ratio}% compression, ${commands} commands, ${original.toLocaleString()} → ${compressed.toLocaleString()} bytes)${ANSI.reset}`);
+  }
 }
 
 function printSessionBudget(budget) {
@@ -268,11 +277,15 @@ function printSessionBudget(budget) {
   }
   const estPrefix = budget.includes_estimates ? "~" : "";
   const estNote = budget.includes_estimates ? " (includes estimates)" : "";
-  console.log(`  ${ANSI.dim}\ud83d\udcb0 Total tokens: ${estPrefix}${budget.total_tokens ?? 0}${estNote}${ANSI.reset}`);
+  const fmtTokens = (n) => Number(n || 0).toLocaleString("en-US");
+  console.log(`  ${ANSI.dim}\ud83d\udcb0 Total tokens: ${estPrefix}${fmtTokens(budget.total_tokens)}${estNote}${ANSI.reset}`);
   console.log(`  ${ANSI.dim}\ud83d\udcb0 Total cost: ${estPrefix}$${Number(budget.total_cost_usd || 0).toFixed(2)}${ANSI.reset}`);
   for (const [role, metrics] of Object.entries(budget.breakdown_by_role || {})) {
+    const tokens = Number(metrics.total_tokens || 0);
+    const cost = Number(metrics.total_cost_usd || 0);
+    if (tokens === 0 && cost === 0) continue; // skip roles with no usage
     console.log(
-      `  ${ANSI.dim}   - ${role}: ${estPrefix}${metrics.total_tokens ?? 0} tokens, ${estPrefix}$${Number(metrics.total_cost_usd || 0).toFixed(2)}${ANSI.reset}`
+      `  ${ANSI.dim}   - ${role}: ${estPrefix}${fmtTokens(tokens)} tokens, ${estPrefix}$${cost.toFixed(2)}${ANSI.reset}`
     );
   }
 }
@@ -328,6 +341,10 @@ const EVENT_HANDLERS = {
 
   "tdd:result": (event, icon) => {
     const tdd = event.detail || {};
+    if (tdd.reason === "no_diff_available") {
+      console.log(`  \u251c\u2500 ${icon} TDD policy: ${ANSI.yellow}SKIP${ANSI.reset} ${ANSI.dim}(no diff available)${ANSI.reset}`);
+      return;
+    }
     const label = tdd.ok ? `${ANSI.green}PASS${ANSI.reset}` : `${ANSI.red}FAIL${ANSI.reset}`;
     const files = tdd.sourceFiles === undefined ? "" : ` (${tdd.sourceFiles} src, ${tdd.testFiles} test)`;
     const executor = formatExecutor(event.detail);
@@ -435,14 +452,16 @@ const EVENT_HANDLERS = {
     const max = Number(d.max_budget_usd);
     const pct = Number(d.pct_used ?? 0);
     const warn = Number(d.warn_threshold_pct ?? 80);
-    const hasEntries = (d.entries?.length ?? 0) > 0 || Object.keys(d.breakdown_by_role || {}).length > 0;
-    if (hasEntries && totalTokens === 0 && total === 0) {
-      console.log(`  \u251c\u2500 ${icon} Budget: ${ANSI.dim}N/A (provider does not report usage)${ANSI.reset}`);
-      return;
-    }
+    // Don't show N/A — just skip budget display when there's nothing to report
+    if (total === 0 && totalTokens === 0) return;
+    const fmtTokens = (n) => n.toLocaleString("en-US");
+    const tokenStr = totalTokens > 0 ? ` / ${fmtTokens(totalTokens)} tokens` : "";
+    const costStr = `$${total.toFixed(2)}`;
     const color = budgetColor(max, pct, warn);
-    if (Number.isFinite(max) && max >= 0) {
-      console.log(`  \u251c\u2500 ${icon} Budget: ${color}$${total.toFixed(2)} / $${max.toFixed(2)} (${pct.toFixed(1)}%)${ANSI.reset}`);
+    if (Number.isFinite(max) && max > 0) {
+      console.log(`  \u251c\u2500 ${icon} Budget: ${color}${costStr}${tokenStr} / $${max.toFixed(2)} (${pct.toFixed(1)}%)${ANSI.reset}`);
+    } else {
+      console.log(`  \u251c\u2500 ${icon} Budget: ${color}${costStr}${tokenStr}${ANSI.reset}`);
     }
   },
 
@@ -569,9 +588,9 @@ const EVENT_HANDLERS = {
     }
   },
 
-  "becaria:pr-created": (event) => {
+  "ci:pr-created": (event) => {
     const url = event.detail?.prUrl || "";
-    console.log(`  \u251c\u2500 ${ANSI.green}\ud83d\ude80 BecarIA PR created: ${url}${ANSI.reset}`);
+    console.log(`  \u251c\u2500 ${ANSI.green}\ud83d\ude80 CI PR created: ${url}${ANSI.reset}`);
   },
 
   "solomon:alert": (event) => {
@@ -597,7 +616,6 @@ const QUIET_SUPPRESSED = new Set([
   "skills:auto-install",
   "context:loaded",
   "rtk:detected",
-  "proxy:started",
   "board:started",
   "plan:loaded",
   "tdd:auto-detect",

package/src/utils/injection-guard.js

@@ -148,14 +148,29 @@ export function scanForInjection(text, opts = {}) {
 export function scanDiff(diff, opts = {}) {
   if (!diff) return { clean: true, findings: [], summary: "Empty diff" };
 
-  // Extract only added lines (skip diff headers like +++ b/file)
-  const addedLines = diff
-    .split("\n")
-    .filter((l) => l.startsWith("+") && !l.startsWith("+++"))
-    .map((l) => l.slice(1))
-    .join("\n");
-
-  return scanForInjection(addedLines, opts);
+  // Split diff into per-file chunks to avoid false positives from
+  // concatenated added-lines across unrelated files.
+  const files = diff.split(/^diff --git /m).filter(Boolean);
+
+  const allFindings = [];
+  for (const fileChunk of files) {
+    const addedLines = fileChunk
+      .split("\n")
+      .filter((l) => l.startsWith("+") && !l.startsWith("+++"))
+      .map((l) => l.slice(1))
+      .join("\n");
+
+    if (!addedLines) continue;
+    const result = scanForInjection(addedLines, opts);
+    if (!result.clean) allFindings.push(...result.findings);
+  }
+
+  const clean = allFindings.length === 0;
+  return {
+    clean,
+    findings: allFindings,
+    summary: clean ? "No injection patterns detected" : `${allFindings.length} injection pattern(s) detected across diff`
+  };
 }
 
 // --- Helpers ---

package/src/utils/logger.js

@@ -19,7 +19,12 @@ const LEVEL_COLORS = {
 };
 
 function timestamp() {
-  return new Date().toISOString().slice(11, 23);
+  const now = new Date();
+  const h = String(now.getHours()).padStart(2, "0");
+  const m = String(now.getMinutes()).padStart(2, "0");
+  const s = String(now.getSeconds()).padStart(2, "0");
+  const ms = String(now.getMilliseconds()).padStart(3, "0");
+  return `${h}:${m}:${s}.${ms}`;
 }
 
 function formatContext(ctx) {

package/src/utils/process.js

@@ -76,10 +76,9 @@ async function awaitWithTimeout(subprocess, timeout, getStdout) {
 
 export async function runCommand(command, args = [], options = {}) {
   const { timeout, onOutput, silenceTimeoutMs, partialOutputFlushMs, ...rest } = options;
-  // Always detach stdin: KJ subprocesses never need interactive input.
-  // Without this, a subprocess prompting for input (sonar credentials,
-  // agent approval, npm prompts) hangs forever since there is no TTY.
-  if (!rest.stdin) rest.stdin = "ignore";
+  // Detach stdin unless the caller provides input (e.g. Codex uses input: prompt).
+  // Without this, a subprocess prompting for input hangs forever since there is no TTY.
+  if (!rest.stdin && !rest.input) rest.stdin = "ignore";
   const subprocess = execa(command, args, { reject: false, ...rest });
 
   let stdoutAccum = "";