karajan-code 1.59.1 → 2.0.1

package/src/orchestrator/solomon-rules.js

@@ -4,7 +4,6 @@
  */
 
 const DEFAULT_RULES = {
-  max_files_per_iteration: 10,
   max_stale_iterations: 3,
   no_new_dependencies_without_task: true,
   scope_guard: true,
@@ -16,17 +15,7 @@ export function evaluateRules(context, rulesConfig = {}) {
   const rules = { ...DEFAULT_RULES, ...rulesConfig };
   const alerts = [];
 
-  // Rule 1: Too many files modified
-  if (rules.max_files_per_iteration && context.filesChanged > rules.max_files_per_iteration) {
-    alerts.push({
-      rule: "max_files_per_iteration",
-      severity: "critical",
-      message: `Coder modified ${context.filesChanged} files (limit: ${rules.max_files_per_iteration}). Possible scope drift.`,
-      detail: { filesChanged: context.filesChanged, limit: rules.max_files_per_iteration }
-    });
-  }
-
-  // Rule 2: Stale iterations (no progress)
+  // Rule 1: Stale iterations (no progress)
   if (rules.max_stale_iterations && context.staleIterations >= rules.max_stale_iterations) {
     alerts.push({
       rule: "max_stale_iterations",
@@ -36,11 +25,15 @@ export function evaluateRules(context, rulesConfig = {}) {
     });
   }
 
-  // Rule 3: New dependencies not in task
+  // Rule 3: New dependencies not in task (only flag suspicious runtime deps, not dev/test tooling)
   if (rules.no_new_dependencies_without_task && context.newDependencies?.length > 0) {
-    const depsNotInTask = context.newDependencies.filter(
-      dep => !context.task?.toLowerCase().includes(dep.toLowerCase())
-    );
+    const testTooling = /vitest|jest|mocha|coverage|eslint|prettier|typescript|@types\//i;
+    const buildTooling = /webpack|vite|rollup|esbuild|tsup|unbuild/i;
+    const depsNotInTask = context.newDependencies.filter(dep => {
+      if (testTooling.test(dep) || buildTooling.test(dep)) return false;
+      if (dep.startsWith("dev:") || dep.startsWith("@vitest/") || dep.startsWith("@types/")) return false;
+      return !context.task?.toLowerCase().includes(dep.toLowerCase());
+    });
     if (depsNotInTask.length > 0) {
       alerts.push({
         rule: "no_new_dependencies_without_task",
@@ -135,10 +128,16 @@ export async function buildRulesContext({ session, task, iteration, blockingIssu
       context.filesChanged = files.length;
 
       // Detect scope: config files, CI/CD, etc. that are often out of scope
-      const scopePatterns = [".github/", ".gitlab-ci", "docker-compose", ".env", "firebase.json", "firestore.rules"];
-      context.outOfScopeFiles = files.filter(f =>
-        scopePatterns.some(pattern => f.includes(pattern))
-      );
+      // Exclude .env.example (legitimate for new projects) and files within projectDir
+      const scopePatterns = [".github/", ".gitlab-ci", "docker-compose", "firebase.json", "firestore.rules"];
+      const projectDir = session?.config_snapshot?.projectDir || null;
+      context.outOfScopeFiles = files.filter(f => {
+        // Files inside projectDir are always in scope
+        if (projectDir && f.startsWith(projectDir.replace(/^\.\//, ""))) return false;
+        // .env (but not .env.example) is out of scope
+        if (f.endsWith(".env") && !f.endsWith(".env.example")) return true;
+        return scopePatterns.some(pattern => f.includes(pattern));
+      });
 
       // Detect new dependencies
       if (files.includes("package.json")) {
@@ -159,21 +158,21 @@ export async function buildRulesContext({ session, task, iteration, blockingIssu
   } catch { /* git not available */ }
 
   // Count stale iterations from session checkpoints
+  // "Stale" means TRULY no progress: same exact feedback AND zero files changed
   const checkpoints = session.checkpoints || [];
-  const recentCoderCheckpoints = checkpoints
-    .filter(cp => cp.stage === "coder" || cp.stage === "reviewer")
-    .slice(-6); // Last 3 iterations (coder+reviewer each)
-
-  // Simple heuristic: if last N reviewer checkpoints all have the same note/feedback, it's stale
-  if (recentCoderCheckpoints.length >= 4) {
-    const lastFeedbacks = checkpoints
-      .filter(cp => cp.stage === "reviewer")
-      .slice(-3)
-      .map(cp => cp.note || "");
-    const uniqueFeedbacks = new Set(lastFeedbacks);
-    if (uniqueFeedbacks.size === 1 && lastFeedbacks.length >= 2) {
-      context.staleIterations = lastFeedbacks.length;
+  const reviewerCps = checkpoints.filter(cp => cp.stage === "reviewer").slice(-3);
+  const coderCps = checkpoints.filter(cp => cp.stage === "coder").slice(-3);
+
+  if (reviewerCps.length >= 3) {
+    const feedbacks = reviewerCps.map(cp => cp.note || "");
+    const uniqueFeedbacks = new Set(feedbacks);
+    const filesChanged = coderCps.some(cp => (cp.filesChanged || 0) > 0);
+
+    // Only stale if feedback is identical AND no files changed
+    if (uniqueFeedbacks.size === 1 && !filesChanged) {
+      context.staleIterations = reviewerCps.length;
     }
+    // If issues are changing between iterations, there IS progress
   }
 
   return context;

package/src/orchestrator/stages/coder-stage.js

@@ -16,7 +16,7 @@ import { invokeSolomon } from "../solomon-escalation.js";
 import { detectRateLimit } from "../../utils/rate-limit-detector.js";
 import { createStallDetector } from "../../utils/stall-detector.js";
 
-export async function runCoderStage({ coderRoleInstance, coderRole, config, logger, emitter, eventBase, session, plannedTask, trackBudget, iteration }) {
+export async function runCoderStage({ coderRoleInstance, coderRole, config, logger, emitter, eventBase, session, plannedTask, trackBudget, iteration, brainCtx }) {
   logger.setContext({ iteration, stage: "coder" });
   emitProgress(
     emitter,
@@ -26,6 +26,17 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
     })
   );
 
+  // Brain: if enabled and queue has entries, use enriched feedback instead of flat string
+  let reviewerFeedback = session.last_reviewer_feedback;
+  if (brainCtx?.enabled) {
+    const { buildCoderFeedbackPrompt } = await import("../brain-coordinator.js");
+    const enriched = buildCoderFeedbackPrompt(brainCtx);
+    if (enriched) {
+      reviewerFeedback = enriched;
+      logger.info(`Brain: using enriched feedback (${brainCtx.feedbackQueue.entries.length} entries)`);
+    }
+  }
+
   const coderOnOutput = ({ stream, line }) => {
     emitProgress(emitter, makeEvent("agent:output", { ...eventBase, stage: "coder" }, {
       message: line,
@@ -40,7 +51,7 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   try {
     coderExecResult = await coderRoleInstance.execute({
       task: plannedTask,
-      reviewerFeedback: session.last_reviewer_feedback,
+      reviewerFeedback,
       sonarSummary: session.last_sonar_summary,
       deferredContext: buildDeferredContext(session.deferred_issues),
       onOutput: coderStall.onOutput
@@ -123,14 +134,48 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
     throw new Error(`Coder failed: ${details}`);
   }
 
-  await addCheckpoint(session, { stage: "coder", iteration, note: "Coder applied changes", provider: coderRole.provider, model: coderRole.model || null });
+  // Measure files changed so stale detection (solomon-rules) has accurate data
+  let filesChanged = 0;
+  try {
+    const { verifyCoderOutput } = await import("../verification-gate.js");
+    const verif = verifyCoderOutput({
+      baseRef: session.session_start_sha,
+      projectDir: config.projectDir || process.cwd()
+    });
+    filesChanged = verif.filesChanged || 0;
+  } catch { /* ignore verification errors */ }
+
+  await addCheckpoint(session, { stage: "coder", iteration, note: "Coder applied changes", provider: coderRole.provider, model: coderRole.model || null, filesChanged });
   emitProgress(
     emitter,
     makeEvent("coder:end", { ...eventBase, stage: "coder" }, {
       message: "Coder completed",
-      detail: { provider: coderRole.provider, executorType: "agent" }
+      detail: { provider: coderRole.provider, executorType: "agent", filesChanged }
     })
   );
+
+  // Brain: verify coder produced real changes + clear feedback queue (now addressed)
+  if (brainCtx?.enabled) {
+    const { verifyCoderRan, clearFeedback } = await import("../brain-coordinator.js");
+    const result = verifyCoderRan(brainCtx, {
+      baseRef: session.session_start_sha,
+      projectDir: config.projectDir || process.cwd()
+    });
+    const maxFailures = config.brain?.max_consecutive_verification_failures ?? 2;
+    if (!result.passed) {
+      logger.warn(`Brain verification: coder made 0 changes (consecutive failures: ${brainCtx.verificationTracker.consecutiveFailures}/${maxFailures})`);
+      emitProgress(emitter, makeEvent("brain:verification", { ...eventBase, stage: "coder" }, {
+        message: `Brain: coder produced no changes (${brainCtx.verificationTracker.consecutiveFailures}/${maxFailures} consecutive failures)`,
+        detail: { filesChanged: result.filesChanged, consecutiveFailures: brainCtx.verificationTracker.consecutiveFailures }
+      }));
+      if (brainCtx.verificationTracker.consecutiveFailures >= maxFailures) {
+        await markSessionStatus(session, "stalled");
+        throw new Error(`Brain: ${maxFailures} consecutive coder iterations with 0 file changes — pipeline stalled`);
+      }
+    } else {
+      clearFeedback(brainCtx);
+    }
+  }
 }
 
 export async function runRefactorerStage({ refactorerRole, config, logger, emitter, eventBase, session, plannedTask, trackBudget, iteration }) {

package/src/orchestrator/stages/reviewer-stage.js

@@ -15,7 +15,7 @@ import { createStallDetector } from "../../utils/stall-detector.js";
 
 function categorizeIssues(issues) {
   const categories = { security: 0, correctness: 0, tests: 0, style: 0, other: 0 };
-  const securityKw = /inject|xss|csrf|secret|credential|auth|vulnerab|exploit/i;
+  const securityKw = /inject(?:ion)?|xss|csrf|secret.?leak|credential.?expos|auth(?:entication|orization).?(?:bypass|fail|miss|broken|weak)|vulnerab|exploit|httponly|token.?expos/i;
   const styleKw = /naming|name|rename|style|format|indent|spacing|convention|cosmetic|readability|comment|jsdoc|whitespace/i;
   const testKw = /test|coverage|assert|spec|mock/i;
 
@@ -37,6 +37,17 @@ function buildReviewHistory(session) {
 }
 
 async function handleReviewerStalledSolomon({ review, repeatCounts, repeatState, config, logger, emitter, eventBase, session, iteration, task, askQuestion, budgetSummary, repeatDetector }) {
+  // DETERMINISTIC GUARD: security issues NEVER go to Solomon — always return to coder
+  const categories = categorizeIssues(review.blocking_issues);
+  if (categories.security > 0) {
+    logger.info(`Reviewer found ${categories.security} security issue(s) — returning to coder (Solomon bypassed)`);
+    emitProgress(emitter, makeEvent("reviewer:security-block", { ...eventBase, stage: "reviewer" }, {
+      message: `${categories.security} security issue(s) detected — must be fixed before approval`,
+      detail: { securityCount: categories.security, blockingIssues: review.blocking_issues }
+    }));
+    return { review, solomonApproved: false };
+  }
+
   const logPrefix = repeatState.stalled
     ? `Reviewer stalled (${repeatCounts.reviewer} repeats)`
     : `Reviewer rejected (first rejection)`;
@@ -106,12 +117,38 @@ async function handleReviewerStalledSolomon({ review, repeatCounts, repeatState,
   return { review, stalled: true, stalledResult: { approved: false, sessionId: session.id, reason: "stalled" } };
 }
 
-async function handleReviewerRejection({ review, repeatDetector, config, logger, emitter, eventBase, session, iteration, task, askQuestion, budgetSummary }) {
+async function handleReviewerRejection({ review, repeatDetector, config, logger, emitter, eventBase, session, iteration, task, askQuestion, budgetSummary, brainCtx }) {
   repeatDetector.addIteration([], review.blocking_issues);
   const repeatState = repeatDetector.isStalled();
 
   const solomonEnabled = Boolean(config.pipeline?.solomon?.enabled);
 
+  // Brain: if enabled and bypass_solomon_on_correctness, push issues to queue and skip Solomon
+  // for non-style rejections. Solomon is still consulted on genuine dilemmas (style-only, deadlock).
+  if (brainCtx?.enabled && config.brain?.bypass_solomon_on_correctness !== false) {
+    const cats = categorizeIssues(review.blocking_issues);
+    const nonStyleIssues = cats.security + cats.correctness + cats.tests;
+    const styleIssues = cats.style;
+    // Only bypass if there ARE non-style issues (correctness, tests, security, or "other" is correctness)
+    // If it's style-only, let Solomon evaluate whether to override
+    if (nonStyleIssues > 0 || cats.other > 0) {
+      const { processRoleOutput } = await import("../brain-coordinator.js");
+      processRoleOutput(brainCtx, { roleName: "reviewer", output: review, iteration });
+      logger.info(`Brain: reviewer rejected with ${nonStyleIssues} non-style issue(s) — bypassing Solomon, returning to coder`);
+      emitProgress(emitter, makeEvent("brain:bypass-solomon", { ...eventBase, stage: "reviewer" }, {
+        message: `Brain: ${nonStyleIssues} non-style issue(s) — sending to coder without Solomon`,
+        detail: { categories: cats, queueSize: brainCtx.feedbackQueue.entries.length }
+      }));
+      // Persist flat feedback for compat with non-Brain flow
+      session.last_reviewer_feedback = review.blocking_issues
+        .map((x, idx) => `R-${idx + 1} [${x.severity || "medium"}]: ${x.description}`)
+        .join("\n");
+      await saveSession(session);
+      return null; // null = continue to next iteration (coder fixes)
+    }
+    logger.info("Brain: reviewer rejected with style-only issues — consulting Solomon for dilemma");
+  }
+
   // When Solomon is disabled, only act on stalls (legacy behavior)
   if (!solomonEnabled) {
     if (!repeatState.stalled) return null;
@@ -139,16 +176,16 @@ async function handleReviewerRejection({ review, repeatDetector, config, logger,
 }
 
 export async function fetchReviewDiff(session, logger) {
-  if (session.becaria_pr_number) {
-    const { getPrDiff } = await import("../../becaria/pr-diff.js");
-    const diff = await getPrDiff(session.becaria_pr_number);
-    logger.info(`Reviewer reading PR diff #${session.becaria_pr_number}`);
+  if (session.ci_pr_number) {
+    const { getPrDiff } = await import("../../ci/pr-diff.js");
+    const diff = await getPrDiff(session.ci_pr_number);
+    logger.info(`Reviewer reading PR diff #${session.ci_pr_number}`);
     return diff;
   }
   return generateDiff({ baseRef: session.session_start_sha, stageNewFiles: true });
 }
 
-export async function runReviewerStage({ reviewerRole, config, logger, emitter, eventBase, session, trackBudget, iteration, reviewRules, task, repeatDetector, budgetSummary, askQuestion }) {
+export async function runReviewerStage({ reviewerRole, config, logger, emitter, eventBase, session, trackBudget, iteration, reviewRules, task, repeatDetector, budgetSummary, askQuestion, brainCtx }) {
   logger.setContext({ iteration, stage: "reviewer" });
   emitProgress(
     emitter,
@@ -315,13 +352,19 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
     });
   }
 
+  // Feedback signature for stale detection: concatenated issue descriptions
+  const feedbackSignature = review.blocking_issues
+    .map(x => (x.description || "").slice(0, 120))
+    .join("|") || "approved";
+
   await addCheckpoint(session, {
     stage: "reviewer",
     iteration,
     approved: review.approved,
     blocking_issues: review.blocking_issues.length,
     provider: reviewerRole.provider,
-    model: reviewerRole.model || null
+    model: reviewerRole.model || null,
+    note: feedbackSignature
   });
 
   emitProgress(
@@ -342,7 +385,7 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
   );
 
   if (!review.approved) {
-    const rejectionResult = await handleReviewerRejection({ review, repeatDetector, config, logger, emitter, eventBase, session, iteration, task, askQuestion, budgetSummary });
+    const rejectionResult = await handleReviewerRejection({ review, repeatDetector, config, logger, emitter, eventBase, session, iteration, task, askQuestion, budgetSummary, brainCtx });
     if (rejectionResult) return rejectionResult;
   }
 

package/src/orchestrator/stages/sonar-stage.js

@@ -162,7 +162,6 @@ export async function runSonarStage({ config, logger, emitter, eventBase, sessio
       ? "SonarQube is running but no authentication token is configured. Fix: run 'kj init' to configure it, or set KJ_SONAR_TOKEN env var, or add sonarqube.token to ~/.karajan/kj.config.yml."
       : `Sonar scan failed: ${sonarResult.error}`;
 
-    await markSessionStatus(session, "failed");
     emitProgress(
       emitter,
       makeEvent("sonar:end", { ...eventBase, stage: "sonar" }, {
@@ -170,6 +169,30 @@ export async function runSonarStage({ config, logger, emitter, eventBase, sessio
         message: errorMessage
       })
     );
+
+    // Let Solomon decide: continue without sonar or stop
+    const solomonResult = await invokeSolomon({
+      config, logger, emitter, eventBase, stage: "sonar_error", askQuestion, session, iteration,
+      conflict: {
+        stage: "sonar_error",
+        task: session.task,
+        iterationCount: iteration,
+        maxIterations: config.max_iterations,
+        history: [{ agent: "sonar", feedback: errorMessage }]
+      }
+    });
+
+    if (solomonResult.action === "approve" || solomonResult.action === "continue") {
+      logger.info(`Solomon decided to continue without SonarQube: ${solomonResult.ruling?.result?.conditions?.join(", ") || "no conditions"}`);
+      return { action: "continue" };
+    }
+
+    if (solomonResult.action === "pause") {
+      return { action: "return", result: { paused: true, sessionId: session.id, question: solomonResult.question, context: "sonar_error" } };
+    }
+
+    // Solomon couldn't resolve — fail
+    await markSessionStatus(session, "failed");
     throw new Error(errorMessage);
   }
 

package/src/orchestrator/verification-gate.js

@@ -0,0 +1,146 @@
+// Verification gate: checks whether the coder actually produced changes.
+// Prevents advancing the pipeline when coder iterations produce 0 file changes.
+
+import { execSync } from "node:child_process";
+
+/**
+ * @typedef {Object} VerificationResult
+ * @property {boolean} passed - true if coder produced real changes
+ * @property {number} filesChanged - count of modified/added/deleted files
+ * @property {number} linesChanged - total lines added/deleted
+ * @property {string[]} files - list of changed file paths
+ * @property {string} reason - explanation when not passed
+ * @property {string} [retryStrategy] - suggested retry approach when not passed
+ */
+
+/**
+ * Count files and lines changed since a base reference.
+ * Uses git diff --numstat to get both file and line counts.
+ */
+export function countChangesSince(baseRef, projectDir = null) {
+  try {
+    const scope = projectDir ? `-- ${projectDir}` : "";
+    const output = execSync(
+      `git diff --numstat ${baseRef} ${scope}`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+
+    if (!output) return { files: [], filesChanged: 0, linesAdded: 0, linesDeleted: 0 };
+
+    const lines = output.split("\n");
+    const files = [];
+    let linesAdded = 0;
+    let linesDeleted = 0;
+
+    for (const line of lines) {
+      const [added, deleted, file] = line.split("\t");
+      if (!file) continue;
+      files.push(file);
+      linesAdded += Number(added) || 0;
+      linesDeleted += Number(deleted) || 0;
+    }
+
+    return { files, filesChanged: files.length, linesAdded, linesDeleted };
+  } catch {
+    return { files: [], filesChanged: 0, linesAdded: 0, linesDeleted: 0 };
+  }
+}
+
+/**
+ * Also count untracked files (new files not yet added to git).
+ */
+export function countUntrackedFiles(projectDir = null) {
+  try {
+    const scope = projectDir || ".";
+    const output = execSync(
+      `git ls-files --others --exclude-standard ${scope}`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+
+    if (!output) return [];
+    return output.split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Verify that the coder produced real changes.
+ * Counts both tracked changes and untracked files.
+ *
+ * @param {Object} params
+ * @param {string} params.baseRef - git reference to compare against
+ * @param {string} [params.projectDir] - directory scope
+ * @param {number} [params.minFiles=1] - minimum files that must change
+ * @param {number} [params.minLines=1] - minimum lines that must change
+ * @returns {VerificationResult}
+ */
+export function verifyCoderOutput({ baseRef, projectDir = null, minFiles = 1, minLines = 1 }) {
+  const tracked = countChangesSince(baseRef, projectDir);
+  const untracked = countUntrackedFiles(projectDir);
+
+  const totalFiles = tracked.filesChanged + untracked.length;
+  const totalLines = tracked.linesAdded + tracked.linesDeleted;
+  const allFiles = [...tracked.files, ...untracked];
+
+  const passed = totalFiles >= minFiles && (untracked.length > 0 || totalLines >= minLines);
+
+  if (passed) {
+    return {
+      passed: true,
+      filesChanged: totalFiles,
+      linesChanged: totalLines,
+      files: allFiles,
+      reason: "",
+      retryStrategy: null
+    };
+  }
+
+  return {
+    passed: false,
+    filesChanged: totalFiles,
+    linesChanged: totalLines,
+    files: allFiles,
+    reason: totalFiles === 0
+      ? "Coder produced 0 file changes"
+      : `Only ${totalFiles} file(s) and ${totalLines} line(s) changed (below minimum)`,
+    retryStrategy: buildRetryStrategy(totalFiles, totalLines)
+  };
+}
+
+/**
+ * Build a retry strategy based on the verification failure.
+ */
+function buildRetryStrategy(filesChanged, linesChanged) {
+  if (filesChanged === 0) {
+    return "Rephrase the feedback with explicit file paths. List specific files to create/modify. Include example code snippets.";
+  }
+  return "Expand the prompt with more specific instructions. Break the task into smaller concrete steps.";
+}
+
+/**
+ * Track consecutive verification failures to detect stuck loops.
+ */
+export class VerificationTracker {
+  constructor() {
+    this.consecutiveFailures = 0;
+    this.history = [];
+  }
+
+  record(result) {
+    this.history.push({ ...result, timestamp: Date.now() });
+    if (result.passed) {
+      this.consecutiveFailures = 0;
+    } else {
+      this.consecutiveFailures += 1;
+    }
+  }
+
+  isStuck(threshold = 2) {
+    return this.consecutiveFailures >= threshold;
+  }
+
+  getLastFailure() {
+    return [...this.history].reverse().find(h => !h.passed) || null;
+  }
+}