karajan-code 1.59.1 → 2.0.1

package/src/sonar/scanner.js

@@ -150,7 +150,7 @@ async function resolveSonarTokenWithFallback(config, apiHost) {
   return null;
 }
 
-export async function ensureSonarProjectProperties(cwd = process.cwd()) {
+async function ensureSonarProjectProperties(cwd = process.cwd()) {
   const propsPath = path.join(cwd, "sonar-project.properties");
   try {
     await fsPromises.access(propsPath);

package/src/utils/display.js

@@ -99,7 +99,10 @@ export function printHeader({ task, config }) {
   if (pipeline.researcher?.enabled) activeRoles.push(`Researcher (${config.roles?.researcher?.provider || "?"})`);
   if (pipeline.tester?.enabled) activeRoles.push("Tester");
   if (pipeline.security?.enabled) activeRoles.push("Security");
-  if (pipeline.solomon?.enabled) activeRoles.push(`Solomon (${config.roles?.solomon?.provider || "?"})`);
+  if (pipeline.solomon?.enabled) {
+    const solomonProvider = config.roles?.solomon?.provider;
+    activeRoles.push(solomonProvider ? `Solomon (${solomonProvider})` : "Solomon");
+  }
   if (activeRoles.length > 0) {
     const separator = ` ${ANSI.dim}|${ANSI.reset} `;
     console.log(`${ANSI.bold}Pipeline:${ANSI.reset} ${activeRoles.join(separator)}`);
@@ -256,7 +259,14 @@ function printSessionRtkSavings(rtkSavings) {
   const tokens = rtkSavings.estimatedTokensSaved ?? 0;
   const ratio = rtkSavings.savedPct ?? 0;
   const commands = rtkSavings.callCount ?? 0;
-  console.log(`  ${ANSI.dim}\u26a1 RTK: saved ~${tokens} tokens (${ratio}% compression, ${commands} commands)${ANSI.reset}`);
+  const original = rtkSavings.originalBytes ?? 0;
+  const compressed = rtkSavings.rtkBytes ?? 0;
+
+  if (tokens === 0 || ratio === 0) {
+    console.log(`  ${ANSI.dim}⚡ RTK: ${commands} commands wrapped, 0% savings — output was already minimal (${original} bytes in, ${compressed} bytes out)${ANSI.reset}`);
+  } else {
+    console.log(`  ${ANSI.dim}⚡ RTK: saved ~${tokens.toLocaleString()} tokens (${ratio}% compression, ${commands} commands, ${original.toLocaleString()} → ${compressed.toLocaleString()} bytes)${ANSI.reset}`);
+  }
 }
 
 function printSessionBudget(budget) {
@@ -267,11 +277,15 @@ function printSessionBudget(budget) {
   }
   const estPrefix = budget.includes_estimates ? "~" : "";
   const estNote = budget.includes_estimates ? " (includes estimates)" : "";
-  console.log(`  ${ANSI.dim}\ud83d\udcb0 Total tokens: ${estPrefix}${budget.total_tokens ?? 0}${estNote}${ANSI.reset}`);
+  const fmtTokens = (n) => Number(n || 0).toLocaleString("en-US");
+  console.log(`  ${ANSI.dim}\ud83d\udcb0 Total tokens: ${estPrefix}${fmtTokens(budget.total_tokens)}${estNote}${ANSI.reset}`);
   console.log(`  ${ANSI.dim}\ud83d\udcb0 Total cost: ${estPrefix}$${Number(budget.total_cost_usd || 0).toFixed(2)}${ANSI.reset}`);
   for (const [role, metrics] of Object.entries(budget.breakdown_by_role || {})) {
+    const tokens = Number(metrics.total_tokens || 0);
+    const cost = Number(metrics.total_cost_usd || 0);
+    if (tokens === 0 && cost === 0) continue; // skip roles with no usage
     console.log(
-      `  ${ANSI.dim}   - ${role}: ${estPrefix}${metrics.total_tokens ?? 0} tokens, ${estPrefix}$${Number(metrics.total_cost_usd || 0).toFixed(2)}${ANSI.reset}`
+      `  ${ANSI.dim}   - ${role}: ${estPrefix}${fmtTokens(tokens)} tokens, ${estPrefix}$${cost.toFixed(2)}${ANSI.reset}`
     );
   }
 }
@@ -327,6 +341,10 @@ const EVENT_HANDLERS = {
 
   "tdd:result": (event, icon) => {
     const tdd = event.detail || {};
+    if (tdd.reason === "no_diff_available") {
+      console.log(`  \u251c\u2500 ${icon} TDD policy: ${ANSI.yellow}SKIP${ANSI.reset} ${ANSI.dim}(no diff available)${ANSI.reset}`);
+      return;
+    }
     const label = tdd.ok ? `${ANSI.green}PASS${ANSI.reset}` : `${ANSI.red}FAIL${ANSI.reset}`;
     const files = tdd.sourceFiles === undefined ? "" : ` (${tdd.sourceFiles} src, ${tdd.testFiles} test)`;
     const executor = formatExecutor(event.detail);
@@ -434,14 +452,16 @@ const EVENT_HANDLERS = {
     const max = Number(d.max_budget_usd);
     const pct = Number(d.pct_used ?? 0);
     const warn = Number(d.warn_threshold_pct ?? 80);
-    const hasEntries = (d.entries?.length ?? 0) > 0 || Object.keys(d.breakdown_by_role || {}).length > 0;
-    if (hasEntries && totalTokens === 0 && total === 0) {
-      console.log(`  \u251c\u2500 ${icon} Budget: ${ANSI.dim}N/A (provider does not report usage)${ANSI.reset}`);
-      return;
-    }
+    // Don't show N/A — just skip budget display when there's nothing to report
+    if (total === 0 && totalTokens === 0) return;
+    const fmtTokens = (n) => n.toLocaleString("en-US");
+    const tokenStr = totalTokens > 0 ? ` / ${fmtTokens(totalTokens)} tokens` : "";
+    const costStr = `$${total.toFixed(2)}`;
     const color = budgetColor(max, pct, warn);
-    if (Number.isFinite(max) && max >= 0) {
-      console.log(`  \u251c\u2500 ${icon} Budget: ${color}$${total.toFixed(2)} / $${max.toFixed(2)} (${pct.toFixed(1)}%)${ANSI.reset}`);
+    if (Number.isFinite(max) && max > 0) {
+      console.log(`  \u251c\u2500 ${icon} Budget: ${color}${costStr}${tokenStr} / $${max.toFixed(2)} (${pct.toFixed(1)}%)${ANSI.reset}`);
+    } else {
+      console.log(`  \u251c\u2500 ${icon} Budget: ${color}${costStr}${tokenStr}${ANSI.reset}`);
     }
   },
 
@@ -568,9 +588,9 @@ const EVENT_HANDLERS = {
     }
   },
 
-  "becaria:pr-created": (event) => {
+  "ci:pr-created": (event) => {
     const url = event.detail?.prUrl || "";
-    console.log(`  \u251c\u2500 ${ANSI.green}\ud83d\ude80 BecarIA PR created: ${url}${ANSI.reset}`);
+    console.log(`  \u251c\u2500 ${ANSI.green}\ud83d\ude80 CI PR created: ${url}${ANSI.reset}`);
   },
 
   "solomon:alert": (event) => {
@@ -596,7 +616,6 @@ const QUIET_SUPPRESSED = new Set([
   "skills:auto-install",
   "context:loaded",
   "rtk:detected",
-  "proxy:started",
   "board:started",
   "plan:loaded",
   "tdd:auto-detect",

package/src/utils/injection-guard.js

@@ -148,14 +148,29 @@ export function scanForInjection(text, opts = {}) {
 export function scanDiff(diff, opts = {}) {
   if (!diff) return { clean: true, findings: [], summary: "Empty diff" };
 
-  // Extract only added lines (skip diff headers like +++ b/file)
-  const addedLines = diff
-    .split("\n")
-    .filter((l) => l.startsWith("+") && !l.startsWith("+++"))
-    .map((l) => l.slice(1))
-    .join("\n");
-
-  return scanForInjection(addedLines, opts);
+  // Split diff into per-file chunks to avoid false positives from
+  // concatenated added-lines across unrelated files.
+  const files = diff.split(/^diff --git /m).filter(Boolean);
+
+  const allFindings = [];
+  for (const fileChunk of files) {
+    const addedLines = fileChunk
+      .split("\n")
+      .filter((l) => l.startsWith("+") && !l.startsWith("+++"))
+      .map((l) => l.slice(1))
+      .join("\n");
+
+    if (!addedLines) continue;
+    const result = scanForInjection(addedLines, opts);
+    if (!result.clean) allFindings.push(...result.findings);
+  }
+
+  const clean = allFindings.length === 0;
+  return {
+    clean,
+    findings: allFindings,
+    summary: clean ? "No injection patterns detected" : `${allFindings.length} injection pattern(s) detected across diff`
+  };
 }
 
 // --- Helpers ---

package/src/utils/logger.js

@@ -19,7 +19,12 @@ const LEVEL_COLORS = {
 };
 
 function timestamp() {
-  return new Date().toISOString().slice(11, 23);
+  const now = new Date();
+  const h = String(now.getHours()).padStart(2, "0");
+  const m = String(now.getMinutes()).padStart(2, "0");
+  const s = String(now.getSeconds()).padStart(2, "0");
+  const ms = String(now.getMilliseconds()).padStart(3, "0");
+  return `${h}:${m}:${s}.${ms}`;
 }
 
 function formatContext(ctx) {

package/src/utils/process.js

@@ -76,10 +76,9 @@ async function awaitWithTimeout(subprocess, timeout, getStdout) {
 
 export async function runCommand(command, args = [], options = {}) {
   const { timeout, onOutput, silenceTimeoutMs, partialOutputFlushMs, ...rest } = options;
-  // Always detach stdin: KJ subprocesses never need interactive input.
-  // Without this, a subprocess prompting for input (sonar credentials,
-  // agent approval, npm prompts) hangs forever since there is no TTY.
-  if (!rest.stdin) rest.stdin = "ignore";
+  // Detach stdin unless the caller provides input (e.g. Codex uses input: prompt).
+  // Without this, a subprocess prompting for input hangs forever since there is no TTY.
+  if (!rest.stdin && !rest.input) rest.stdin = "ignore";
   const subprocess = execa(command, args, { reject: false, ...rest });
 
   let stdoutAccum = "";

package/src/utils/role-assigner.js

@@ -0,0 +1,131 @@
+// Smart role assignment based on available AI agents.
+// Used by both kj init (interactive) and auto-init (non-interactive).
+
+import { detectAvailableAgents } from "./agent-detect.js";
+
+// Agent capability tiers (higher = more capable for complex reasoning)
+const CAPABILITY_TIERS = {
+  claude: 5, // Best for reasoning, orchestration, complex tasks
+  codex: 4,  // Strong coder, good reviewer
+  gemini: 3, // Good general purpose
+  aider: 2,  // Good coder, limited reasoning
+  opencode: 2 // Similar to aider
+};
+
+// Role requirements: what capability level is ideal for each role
+const ROLE_PREFERENCES = {
+  brain: { minTier: 4, prefer: "claude", description: "Karajan Brain (orchestrator)" },
+  solomon: { minTier: 3, prefer: "gemini", description: "Solomon (judge/arbiter)" },
+  coder: { minTier: 2, prefer: "claude", description: "Coder" },
+  reviewer: { minTier: 3, prefer: "codex", description: "Reviewer" },
+  planner: { minTier: 4, prefer: "claude", description: "Planner" },
+  researcher: { minTier: 3, prefer: "claude", description: "Researcher" },
+  architect: { minTier: 4, prefer: "claude", description: "Architect" },
+  tester: { minTier: 3, prefer: "claude", description: "Tester" },
+  security: { minTier: 3, prefer: "claude", description: "Security" },
+  triage: { minTier: 3, prefer: "claude", description: "Triage" }
+};
+
+/**
+ * Assign the best available agent to a role.
+ * Prefers the role's preferred agent if available, then falls back by capability tier.
+ */
+function assignRole(roleName, availableAgents) {
+  const pref = ROLE_PREFERENCES[roleName];
+  if (!pref) return availableAgents[0]?.name || "claude";
+
+  // Preferred agent available?
+  if (availableAgents.find(a => a.name === pref.prefer)) {
+    return pref.prefer;
+  }
+
+  // Sort by capability tier (descending) and pick the best available
+  const sorted = [...availableAgents].sort(
+    (a, b) => (CAPABILITY_TIERS[b.name] || 1) - (CAPABILITY_TIERS[a.name] || 1)
+  );
+
+  return sorted[0]?.name || "claude";
+}
+
+/**
+ * Try to diversify: if possible, use a different agent for reviewer than coder.
+ */
+function diversifyReviewer(coderAgent, availableAgents) {
+  const alternatives = availableAgents.filter(a => a.name !== coderAgent);
+  if (alternatives.length === 0) return coderAgent;
+
+  const sorted = [...alternatives].sort(
+    (a, b) => (CAPABILITY_TIERS[b.name] || 1) - (CAPABILITY_TIERS[a.name] || 1)
+  );
+  return sorted[0].name;
+}
+
+/**
+ * Auto-assign all roles based on detected agents. Non-interactive.
+ * Returns a config-ready object with role assignments.
+ */
+export async function autoAssignRoles(logger) {
+  const agents = await detectAvailableAgents();
+  const available = agents.filter(a => a.available);
+
+  if (available.length === 0) {
+    logger?.warn?.("No AI agents detected. Using claude as default for all roles.");
+    return { assignments: getDefaultAssignments("claude"), agents, available: [] };
+  }
+
+  logger?.info?.(`Detected ${available.length} AI agent(s): ${available.map(a => `${a.name} (${a.version})`).join(", ")}`);
+
+  const coder = assignRole("coder", available);
+  const reviewer = available.length > 1 ? diversifyReviewer(coder, available) : coder;
+  const brain = assignRole("brain", available);
+  const solomon = available.length > 1 ? diversifyReviewer(brain, available) : brain;
+
+  const assignments = {
+    brain,
+    solomon,
+    coder,
+    reviewer,
+    planner: assignRole("planner", available),
+    researcher: assignRole("researcher", available),
+    architect: assignRole("architect", available),
+    tester: assignRole("tester", available),
+    security: assignRole("security", available),
+    triage: assignRole("triage", available)
+  };
+
+  logger?.info?.(`Role assignments: Brain=${brain}, Solomon=${solomon}, Coder=${coder}, Reviewer=${reviewer}`);
+
+  return { assignments, agents, available };
+}
+
+function getDefaultAssignments(agent) {
+  return {
+    brain: agent, solomon: agent, coder: agent, reviewer: agent,
+    planner: agent, researcher: agent, architect: agent,
+    tester: agent, security: agent, triage: agent
+  };
+}
+
+/**
+ * Apply role assignments to a Karajan config object.
+ */
+export function applyRoleAssignments(config, assignments) {
+  config.coder = assignments.coder;
+  config.reviewer = assignments.reviewer;
+
+  const roleNames = ["coder", "reviewer", "planner", "researcher", "architect",
+    "tester", "security", "triage", "solomon"];
+
+  for (const role of roleNames) {
+    config.roles = config.roles || {};
+    config.roles[role] = config.roles[role] || {};
+    config.roles[role].provider = assignments[role] || assignments.coder;
+  }
+
+  // Brain is a new top-level config (not in roles yet — will be when KarajanBrainRole is implemented)
+  config.brain = { provider: assignments.brain };
+
+  return config;
+}
+
+export { CAPABILITY_TIERS, ROLE_PREFERENCES };

package/src/utils/update-check.js

@@ -20,7 +20,11 @@ export async function checkForUpdate(currentVersion) {
       const cache = JSON.parse(raw);
       if (cache.checkedAt && Date.now() - cache.checkedAt < CACHE_TTL_MS) {
         if (!cache.latest || cache.latest === currentVersion) return null;
-        return { updateAvailable: true, latest: cache.latest, current: currentVersion };
+        // Only show update if latest is actually NEWER than current
+        if (compareVersions(cache.latest, currentVersion) > 0) {
+          return { updateAvailable: true, latest: cache.latest, current: currentVersion };
+        }
+        return null;
       }
     } catch { /* no cache or expired */ }
 

package/src/webperf/devtools-detect.js

@@ -1,32 +1,81 @@
-/**
- * Chrome DevTools MCP detection and WebPerf skill auto-installation.
- */
+// Chrome DevTools MCP detection and WebPerf skill auto-installation.
 
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
 import { isOpenSkillsAvailable, installSkill, listSkills } from "../skills/openskills-client.js";
 
-/** Skill names to auto-install when WebPerf is enabled. */
+/** Skill names relevant for WebPerf analysis. Already installed globally via openskills. */
 export const WEBPERF_SKILLS = [
-  "webperf",
-  "webperf-core-web-vitals",
-  "webperf-loading"
+  "optimize",
+  "audit",
+  "polish"
 ];
 
 /**
  * Check whether Chrome DevTools MCP is configured and available.
- * Since Karajan runs as an MCP server itself, it cannot directly call other MCPs.
- * Instead, we check the config flag `webperf.devtools_mcp`.
- * @param {object} config — merged Karajan config
+ * Checks: (1) config flag, (2) Claude MCP config (~/.claude.json), (3) VS Code MCP settings.
+ * @param {object} config - merged Karajan config
  * @returns {boolean}
  */
 export function isDevToolsMcpAvailable(config) {
-  return Boolean(config?.webperf?.devtools_mcp);
+  // Explicit config flag takes priority
+  if (config?.webperf?.devtools_mcp === true) return true;
+  if (config?.webperf?.devtools_mcp === false) return false;
+
+  // Check cached detection result
+  if (_devToolsDetected !== null) return _devToolsDetected;
+
+  // Not yet detected - return false (async detection runs at init)
+  return false;
+}
+
+let _devToolsDetected = null;
+
+/**
+ * Auto-detect Chrome DevTools MCP from system configuration.
+ * Checks ~/.claude.json and VS Code MCP settings.
+ * Call once at pipeline init.
+ */
+export async function detectDevToolsMcp(logger) {
+  // Check Claude MCP config
+  const claudeConfigPath = path.join(os.homedir(), ".claude.json");
+  try {
+    const raw = await fs.readFile(claudeConfigPath, "utf8");
+    const parsed = JSON.parse(raw);
+    const mcpServers = parsed?.mcpServers || parsed?.mcp_servers || {};
+    if (mcpServers["chrome-devtools"] || mcpServers["chrome_devtools"]) {
+      _devToolsDetected = true;
+      logger?.info?.("Chrome DevTools MCP detected in ~/.claude.json");
+      return true;
+    }
+  } catch { /* file not found or parse error */ }
+
+  // Check VS Code MCP settings
+  const vscodePaths = [
+    path.join(os.homedir(), ".vscode", "settings.json"),
+    path.join(process.cwd(), ".vscode", "settings.json")
+  ];
+  for (const vscPath of vscodePaths) {
+    try {
+      const raw = await fs.readFile(vscPath, "utf8");
+      if (raw.includes("chrome-devtools") || raw.includes("chrome_devtools")) {
+        _devToolsDetected = true;
+        logger?.info?.(`Chrome DevTools MCP detected in ${vscPath}`);
+        return true;
+      }
+    } catch { /* not found */ }
+  }
+
+  _devToolsDetected = false;
+  return false;
 }
 
 /**
  * Ensure WebPerf skills are installed via OpenSkills.
  * Installs any missing skills from WEBPERF_SKILLS.
- * @param {string} projectDir — absolute path to the project root
- * @param {object} [logger] — optional logger ({ info, warn })
+ * @param {string} projectDir - absolute path to the project root
+ * @param {object} [logger] - optional logger ({ info, warn })
  * @returns {Promise<{ installed: string[], alreadyInstalled: string[], skipped: string[] }>}
  */
 export async function ensureWebPerfSkills(projectDir, logger) {
@@ -34,12 +83,12 @@ export async function ensureWebPerfSkills(projectDir, logger) {
 
   const available = await isOpenSkillsAvailable();
   if (!available) {
-    logger?.warn?.("OpenSkills CLI not available — skipping WebPerf skill installation");
+    logger?.debug?.("OpenSkills CLI not available - WebPerf skills unavailable");
     result.skipped = [...WEBPERF_SKILLS];
     return result;
   }
 
-  // Get currently installed skills
+  // List skills (includes global installs)
   const listResult = await listSkills({ projectDir });
   const installedNames = new Set(
     (listResult.ok ? listResult.skills : []).map(s => s.name)
@@ -48,18 +97,16 @@ export async function ensureWebPerfSkills(projectDir, logger) {
   for (const skill of WEBPERF_SKILLS) {
     if (installedNames.has(skill)) {
       result.alreadyInstalled.push(skill);
-      continue;
-    }
-
-    const installResult = await installSkill(skill, { projectDir });
-    if (installResult.ok) {
-      result.installed.push(skill);
-      logger?.info?.(`Installed WebPerf skill: ${skill}`);
     } else {
+      // Skills should be installed globally via `openskills install owner/repo`
+      // Don't attempt auto-install with bare names — just note they're missing
       result.skipped.push(skill);
-      logger?.warn?.(`Failed to install WebPerf skill "${skill}": ${installResult.error}`);
     }
   }
 
+  if (result.alreadyInstalled.length > 0) {
+    logger?.info?.(`WebPerf skills available: ${result.alreadyInstalled.join(", ")}`);
+  }
+
   return result;
 }

package/templates/roles/coder.md

@@ -45,6 +45,13 @@ Before reporting done, verify that ALL parts of the task are addressed:
 - If unintended changes are detected, revert immediately with `git checkout -- <file>`.
 - Pay special attention to CSS, HTML, and config files where full rewrites destroy prior work.
 
+## Code Quality Rules
+
+- Follow SOLID principles. Write small, focused functions (< 30 lines).
+- Make atomic commits: 1 logical change = 1 commit. Keep PRs small and reviewable.
+- Security: use httpOnly cookies for auth tokens, validate all input, parameterize queries, never expose secrets.
+- No console.log in production code -- use a structured logger. No 'any' types -- use JSDoc annotations.
+
 ## Output format
 
 Return a JSON object:

package/templates/roles/karajan-brain.md

@@ -0,0 +1,95 @@
+# Karajan Brain — Central Pipeline Orchestrator
+
+You are the central intelligence of the Karajan pipeline. Every role output passes through you. You decide what happens next.
+
+## Your responsibilities
+
+1. **Route** — decide which role runs next based on current state
+2. **Enrich** — transform vague feedback into concrete, actionable instructions
+3. **Verify** — check that each role actually did its job before moving on
+4. **Act directly** — execute commands when a full role invocation isn't needed
+5. **Consult Solomon** — only when facing a genuine dilemma
+
+## Skills
+
+### 1. route-decision
+Decide the next role based on pipeline state.
+- If coder just finished successfully → reviewer
+- If reviewer approved → next quality gate (tester/security/impeccable) or done
+- If reviewer rejected with issues → coder (with enriched feedback)
+- If tester/security failed → coder (with specific fix instructions)
+- If max iterations reached and still failing → consult Solomon
+- If approved and all gates pass → done
+
+### 2. prompt-enrichment
+When feedback is vague, make it actionable.
+- Identify concrete file paths from the project structure
+- Add line numbers when possible
+- Suggest specific code changes
+- Break complex feedback into numbered steps
+- Include test commands to run
+
+Example transformation:
+- Vague: "auth test suite missing refresh token coverage"
+- Enriched: "In packages/server/tests/auth/, create refresh-token.test.js. Test cases: (1) POST /auth/refresh with valid token returns new pair, (2) expired token returns 401, (3) invalid token returns 401. Reference packages/server/src/auth/jwt.js for the refresh logic."
+
+### 3. output-verification
+Check that coder produced real changes before advancing.
+- `git diff --name-only baseRef` should show > 0 files
+- If 0 files changed: do NOT advance, retry with more explicit prompt
+- If same error 2+ times: consult Solomon or attempt direct fix
+
+### 4. direct-action
+Execute commands without invoking a full role when appropriate:
+- `npm install` when node_modules/ missing and package.json exists
+- `.gitignore` updates when stack-specific patterns needed
+- `git add <specific files>` for staging
+- File creation for boilerplate (.env.example, README stub)
+
+Don't use direct actions for anything that requires reasoning — delegate those to the coder.
+
+### 5. rtk-compression
+Before passing role outputs as context to the next role:
+- Extract essentials (findings, risks, patterns) from verbose outputs
+- Drop repeated explanations
+- Keep file paths, line numbers, concrete values
+- Target 40-60% reduction in token count
+
+### 6. stack-detection
+From planner/architect output, identify:
+- Language (js/ts, python, java, go, rust, etc.)
+- Framework (express, django, spring, gin, etc.)
+- Package manager (npm, pip, maven, cargo)
+- Test framework (vitest, pytest, junit)
+
+Use this to configure .gitignore, install commands, test commands.
+
+### 7. dependency-management
+Track project dependencies to avoid false positives:
+- Test/build tooling is always allowed (vitest, jest, eslint, typescript)
+- Runtime deps should match the task description
+- Flag truly suspicious additions (random packages not in the task)
+
+## Decision format
+
+Always return a JSON object:
+```json
+{
+  "nextRole": "coder|reviewer|tester|security|impeccable|sonar|audit|solomon|done",
+  "enrichedPrompt": "string or null",
+  "directActions": [{"type": "...", "params": {}}],
+  "reasoning": "why this decision",
+  "consultSolomon": false,
+  "dilemma": null
+}
+```
+
+## When to consult Solomon
+
+Set `consultSolomon: true` and describe the `dilemma` ONLY for:
+- Security vs deadline tradeoffs
+- Two quality gates giving contradictory feedback
+- Stalled loops where you've tried 3+ approaches with no progress
+- Unclear risk evaluation (is this blocking or cosmetic?)
+
+For everything else, decide yourself. Solomon is the lawyer you consult on tough calls — not the CEO.