karajan-code 1.59.0 → 2.0.0

package/src/orchestrator/solomon-rules.js

@@ -4,7 +4,6 @@
  */
 
 const DEFAULT_RULES = {
-  max_files_per_iteration: 10,
   max_stale_iterations: 3,
   no_new_dependencies_without_task: true,
   scope_guard: true,
@@ -16,17 +15,7 @@ export function evaluateRules(context, rulesConfig = {}) {
   const rules = { ...DEFAULT_RULES, ...rulesConfig };
   const alerts = [];
 
-  // Rule 1: Too many files modified
-  if (rules.max_files_per_iteration && context.filesChanged > rules.max_files_per_iteration) {
-    alerts.push({
-      rule: "max_files_per_iteration",
-      severity: "critical",
-      message: `Coder modified ${context.filesChanged} files (limit: ${rules.max_files_per_iteration}). Possible scope drift.`,
-      detail: { filesChanged: context.filesChanged, limit: rules.max_files_per_iteration }
-    });
-  }
-
-  // Rule 2: Stale iterations (no progress)
+  // Rule 1: Stale iterations (no progress)
   if (rules.max_stale_iterations && context.staleIterations >= rules.max_stale_iterations) {
     alerts.push({
       rule: "max_stale_iterations",
@@ -36,11 +25,15 @@ export function evaluateRules(context, rulesConfig = {}) {
     });
   }
 
-  // Rule 3: New dependencies not in task
+  // Rule 3: New dependencies not in task (only flag suspicious runtime deps, not dev/test tooling)
   if (rules.no_new_dependencies_without_task && context.newDependencies?.length > 0) {
-    const depsNotInTask = context.newDependencies.filter(
-      dep => !context.task?.toLowerCase().includes(dep.toLowerCase())
-    );
+    const testTooling = /vitest|jest|mocha|coverage|eslint|prettier|typescript|@types\//i;
+    const buildTooling = /webpack|vite|rollup|esbuild|tsup|unbuild/i;
+    const depsNotInTask = context.newDependencies.filter(dep => {
+      if (testTooling.test(dep) || buildTooling.test(dep)) return false;
+      if (dep.startsWith("dev:") || dep.startsWith("@vitest/") || dep.startsWith("@types/")) return false;
+      return !context.task?.toLowerCase().includes(dep.toLowerCase());
+    });
     if (depsNotInTask.length > 0) {
       alerts.push({
         rule: "no_new_dependencies_without_task",
@@ -135,10 +128,16 @@ export async function buildRulesContext({ session, task, iteration, blockingIssu
       context.filesChanged = files.length;
 
       // Detect scope: config files, CI/CD, etc. that are often out of scope
-      const scopePatterns = [".github/", ".gitlab-ci", "docker-compose", ".env", "firebase.json", "firestore.rules"];
-      context.outOfScopeFiles = files.filter(f =>
-        scopePatterns.some(pattern => f.includes(pattern))
-      );
+      // Exclude .env.example (legitimate for new projects) and files within projectDir
+      const scopePatterns = [".github/", ".gitlab-ci", "docker-compose", "firebase.json", "firestore.rules"];
+      const projectDir = session?.config_snapshot?.projectDir || null;
+      context.outOfScopeFiles = files.filter(f => {
+        // Files inside projectDir are always in scope
+        if (projectDir && f.startsWith(projectDir.replace(/^\.\//, ""))) return false;
+        // .env (but not .env.example) is out of scope
+        if (f.endsWith(".env") && !f.endsWith(".env.example")) return true;
+        return scopePatterns.some(pattern => f.includes(pattern));
+      });
 
       // Detect new dependencies
       if (files.includes("package.json")) {
@@ -159,21 +158,21 @@ export async function buildRulesContext({ session, task, iteration, blockingIssu
   } catch { /* git not available */ }
 
   // Count stale iterations from session checkpoints
+  // "Stale" means TRULY no progress: same exact feedback AND zero files changed
   const checkpoints = session.checkpoints || [];
-  const recentCoderCheckpoints = checkpoints
-    .filter(cp => cp.stage === "coder" || cp.stage === "reviewer")
-    .slice(-6); // Last 3 iterations (coder+reviewer each)
-
-  // Simple heuristic: if last N reviewer checkpoints all have the same note/feedback, it's stale
-  if (recentCoderCheckpoints.length >= 4) {
-    const lastFeedbacks = checkpoints
-      .filter(cp => cp.stage === "reviewer")
-      .slice(-3)
-      .map(cp => cp.note || "");
-    const uniqueFeedbacks = new Set(lastFeedbacks);
-    if (uniqueFeedbacks.size === 1 && lastFeedbacks.length >= 2) {
-      context.staleIterations = lastFeedbacks.length;
+  const reviewerCps = checkpoints.filter(cp => cp.stage === "reviewer").slice(-3);
+  const coderCps = checkpoints.filter(cp => cp.stage === "coder").slice(-3);
+
+  if (reviewerCps.length >= 3) {
+    const feedbacks = reviewerCps.map(cp => cp.note || "");
+    const uniqueFeedbacks = new Set(feedbacks);
+    const filesChanged = coderCps.some(cp => (cp.filesChanged || 0) > 0);
+
+    // Only stale if feedback is identical AND no files changed
+    if (uniqueFeedbacks.size === 1 && !filesChanged) {
+      context.staleIterations = reviewerCps.length;
     }
+    // If issues are changing between iterations, there IS progress
   }
 
   return context;

package/src/orchestrator/stages/reviewer-stage.js

@@ -15,7 +15,7 @@ import { createStallDetector } from "../../utils/stall-detector.js";
 
 function categorizeIssues(issues) {
   const categories = { security: 0, correctness: 0, tests: 0, style: 0, other: 0 };
-  const securityKw = /inject|xss|csrf|secret|credential|auth|vulnerab|exploit/i;
+  const securityKw = /inject(?:ion)?|xss|csrf|secret.?leak|credential.?expos|auth(?:entication|orization).?(?:bypass|fail|miss|broken|weak)|vulnerab|exploit|httponly|token.?expos/i;
   const styleKw = /naming|name|rename|style|format|indent|spacing|convention|cosmetic|readability|comment|jsdoc|whitespace/i;
   const testKw = /test|coverage|assert|spec|mock/i;
 
@@ -37,6 +37,17 @@ function buildReviewHistory(session) {
 }
 
 async function handleReviewerStalledSolomon({ review, repeatCounts, repeatState, config, logger, emitter, eventBase, session, iteration, task, askQuestion, budgetSummary, repeatDetector }) {
+  // DETERMINISTIC GUARD: security issues NEVER go to Solomon — always return to coder
+  const categories = categorizeIssues(review.blocking_issues);
+  if (categories.security > 0) {
+    logger.info(`Reviewer found ${categories.security} security issue(s) — returning to coder (Solomon bypassed)`);
+    emitProgress(emitter, makeEvent("reviewer:security-block", { ...eventBase, stage: "reviewer" }, {
+      message: `${categories.security} security issue(s) detected — must be fixed before approval`,
+      detail: { securityCount: categories.security, blockingIssues: review.blocking_issues }
+    }));
+    return { review, solomonApproved: false };
+  }
+
   const logPrefix = repeatState.stalled
     ? `Reviewer stalled (${repeatCounts.reviewer} repeats)`
     : `Reviewer rejected (first rejection)`;
@@ -139,10 +150,10 @@ async function handleReviewerRejection({ review, repeatDetector, config, logger,
 }
 
 export async function fetchReviewDiff(session, logger) {
-  if (session.becaria_pr_number) {
-    const { getPrDiff } = await import("../../becaria/pr-diff.js");
-    const diff = await getPrDiff(session.becaria_pr_number);
-    logger.info(`Reviewer reading PR diff #${session.becaria_pr_number}`);
+  if (session.ci_pr_number) {
+    const { getPrDiff } = await import("../../ci/pr-diff.js");
+    const diff = await getPrDiff(session.ci_pr_number);
+    logger.info(`Reviewer reading PR diff #${session.ci_pr_number}`);
     return diff;
   }
   return generateDiff({ baseRef: session.session_start_sha, stageNewFiles: true });

package/src/orchestrator/stages/sonar-stage.js

@@ -162,7 +162,6 @@ export async function runSonarStage({ config, logger, emitter, eventBase, sessio
       ? "SonarQube is running but no authentication token is configured. Fix: run 'kj init' to configure it, or set KJ_SONAR_TOKEN env var, or add sonarqube.token to ~/.karajan/kj.config.yml."
       : `Sonar scan failed: ${sonarResult.error}`;
 
-    await markSessionStatus(session, "failed");
     emitProgress(
       emitter,
       makeEvent("sonar:end", { ...eventBase, stage: "sonar" }, {
@@ -170,6 +169,30 @@ export async function runSonarStage({ config, logger, emitter, eventBase, sessio
         message: errorMessage
       })
     );
+
+    // Let Solomon decide: continue without sonar or stop
+    const solomonResult = await invokeSolomon({
+      config, logger, emitter, eventBase, stage: "sonar_error", askQuestion, session, iteration,
+      conflict: {
+        stage: "sonar_error",
+        task: session.task,
+        iterationCount: iteration,
+        maxIterations: config.max_iterations,
+        history: [{ agent: "sonar", feedback: errorMessage }]
+      }
+    });
+
+    if (solomonResult.action === "approve" || solomonResult.action === "continue") {
+      logger.info(`Solomon decided to continue without SonarQube: ${solomonResult.ruling?.result?.conditions?.join(", ") || "no conditions"}`);
+      return { action: "continue" };
+    }
+
+    if (solomonResult.action === "pause") {
+      return { action: "return", result: { paused: true, sessionId: session.id, question: solomonResult.question, context: "sonar_error" } };
+    }
+
+    // Solomon couldn't resolve — fail
+    await markSessionStatus(session, "failed");
     throw new Error(errorMessage);
   }
 

package/src/orchestrator/verification-gate.js

@@ -0,0 +1,146 @@
+// Verification gate: checks whether the coder actually produced changes.
+// Prevents advancing the pipeline when coder iterations produce 0 file changes.
+
+import { execSync } from "node:child_process";
+
+/**
+ * @typedef {Object} VerificationResult
+ * @property {boolean} passed - true if coder produced real changes
+ * @property {number} filesChanged - count of modified/added/deleted files
+ * @property {number} linesChanged - total lines added/deleted
+ * @property {string[]} files - list of changed file paths
+ * @property {string} reason - explanation when not passed
+ * @property {string} [retryStrategy] - suggested retry approach when not passed
+ */
+
+/**
+ * Count files and lines changed since a base reference.
+ * Uses git diff --numstat to get both file and line counts.
+ */
+export function countChangesSince(baseRef, projectDir = null) {
+  try {
+    const scope = projectDir ? `-- ${projectDir}` : "";
+    const output = execSync(
+      `git diff --numstat ${baseRef} ${scope}`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+
+    if (!output) return { files: [], filesChanged: 0, linesAdded: 0, linesDeleted: 0 };
+
+    const lines = output.split("\n");
+    const files = [];
+    let linesAdded = 0;
+    let linesDeleted = 0;
+
+    for (const line of lines) {
+      const [added, deleted, file] = line.split("\t");
+      if (!file) continue;
+      files.push(file);
+      linesAdded += Number(added) || 0;
+      linesDeleted += Number(deleted) || 0;
+    }
+
+    return { files, filesChanged: files.length, linesAdded, linesDeleted };
+  } catch {
+    return { files: [], filesChanged: 0, linesAdded: 0, linesDeleted: 0 };
+  }
+}
+
+/**
+ * Also count untracked files (new files not yet added to git).
+ */
+export function countUntrackedFiles(projectDir = null) {
+  try {
+    const scope = projectDir || ".";
+    const output = execSync(
+      `git ls-files --others --exclude-standard ${scope}`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+
+    if (!output) return [];
+    return output.split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Verify that the coder produced real changes.
+ * Counts both tracked changes and untracked files.
+ *
+ * @param {Object} params
+ * @param {string} params.baseRef - git reference to compare against
+ * @param {string} [params.projectDir] - directory scope
+ * @param {number} [params.minFiles=1] - minimum files that must change
+ * @param {number} [params.minLines=1] - minimum lines that must change
+ * @returns {VerificationResult}
+ */
+export function verifyCoderOutput({ baseRef, projectDir = null, minFiles = 1, minLines = 1 }) {
+  const tracked = countChangesSince(baseRef, projectDir);
+  const untracked = countUntrackedFiles(projectDir);
+
+  const totalFiles = tracked.filesChanged + untracked.length;
+  const totalLines = tracked.linesAdded + tracked.linesDeleted;
+  const allFiles = [...tracked.files, ...untracked];
+
+  const passed = totalFiles >= minFiles && (untracked.length > 0 || totalLines >= minLines);
+
+  if (passed) {
+    return {
+      passed: true,
+      filesChanged: totalFiles,
+      linesChanged: totalLines,
+      files: allFiles,
+      reason: "",
+      retryStrategy: null
+    };
+  }
+
+  return {
+    passed: false,
+    filesChanged: totalFiles,
+    linesChanged: totalLines,
+    files: allFiles,
+    reason: totalFiles === 0
+      ? "Coder produced 0 file changes"
+      : `Only ${totalFiles} file(s) and ${totalLines} line(s) changed (below minimum)`,
+    retryStrategy: buildRetryStrategy(totalFiles, totalLines)
+  };
+}
+
+/**
+ * Build a retry strategy based on the verification failure.
+ */
+function buildRetryStrategy(filesChanged, linesChanged) {
+  if (filesChanged === 0) {
+    return "Rephrase the feedback with explicit file paths. List specific files to create/modify. Include example code snippets.";
+  }
+  return "Expand the prompt with more specific instructions. Break the task into smaller concrete steps.";
+}
+
+/**
+ * Track consecutive verification failures to detect stuck loops.
+ */
+export class VerificationTracker {
+  constructor() {
+    this.consecutiveFailures = 0;
+    this.history = [];
+  }
+
+  record(result) {
+    this.history.push({ ...result, timestamp: Date.now() });
+    if (result.passed) {
+      this.consecutiveFailures = 0;
+    } else {
+      this.consecutiveFailures += 1;
+    }
+  }
+
+  isStuck(threshold = 2) {
+    return this.consecutiveFailures >= threshold;
+  }
+
+  getLastFailure() {
+    return [...this.history].reverse().find(h => !h.passed) || null;
+  }
+}