karajan-code 2.13.0 → 2.14.0

package/README.md

@@ -23,7 +23,9 @@
 
 ---
 
-> **v2.13.0 released** — HU Board hardening. Five PRs make the board resilient and self-healing after a dogfooding session uncovered four pathologies: a "Karajan needs an answer" prompt modal from days earlier blocking the entire UI, 18 zombi projects reappearing after every `kj board start`, the browser serving stale HTML/JS after a server restart, and the prompt modal showing a transparent background. Now: **tombstones** persist deletes across `fullScan` (`KJC-TSK-0380`), new endpoints `DELETE /api/prompts/:id`, `DELETE /api/plans/:planId`, `GET /api/tombstones`, `POST /api/tombstones/:type/:id/restore`; new command **`kj board cleanup`** sweeps ephemeral projects, orphan prompts and dangling session dirs in one pass; **`Cache-Control: no-store`** + `/api/version` polling auto-reloads the client when the server boot time changes; new **🧹 button** as manual escape hatch; CSS `--bg-secondary` finally declared so modals are opaque. 5 PRs (#654, #655, #656, #657, #658). 4522/4522 tests passing. Safe upgrade from 2.12.0.
+> **v2.14.0 released** — Quality pass. 16 PRs absorbing bug blockers (Solomon no longer rubber-stamps security issues misclassified as "style", coder filesystem-leak detection gains a second layer that catches `cd <abs> && pnpm init` even when the dir pre-existed, Sonar admin password rotation now surfaces silent failures), the four planner pathologies surfaced by the GRETA Plan 2 dogfooding (scope respect, transversal one-to-many deps, explicit `reuse` marker, and a brand-new **self-fix loop** where the plan-reviewer re-invokes the planner with structured feedback until zero issues remain), HU Board polish (zombie-TTL for crashed-runner prompts, less aggressive rate-limit with SSE exempt), and the first wave of `tests/` reorg (issue #368): ~93 files moved from root to mirror-subfolders. **4577/4577 tests passing**, **0 regressions** across all 16 PRs. Safe upgrade from 2.13.0.
+>
+> **v2.13.0** — HU Board hardening. Five PRs make the board resilient and self-healing after a dogfooding session uncovered four pathologies: a "Karajan needs an answer" prompt modal from days earlier blocking the entire UI, 18 zombi projects reappearing after every `kj board start`, the browser serving stale HTML/JS after a server restart, and the prompt modal showing a transparent background. Now: **tombstones** persist deletes across `fullScan` (`KJC-TSK-0380`), new endpoints `DELETE /api/prompts/:id`, `DELETE /api/plans/:planId`, `GET /api/tombstones`, `POST /api/tombstones/:type/:id/restore`; new command **`kj board cleanup`** sweeps ephemeral projects, orphan prompts and dangling session dirs in one pass; **`Cache-Control: no-store`** + `/api/version` polling auto-reloads the client when the server boot time changes; new **🧹 button** as manual escape hatch; CSS `--bg-secondary` finally declared so modals are opaque. 5 PRs (#654, #655, #656, #657, #658). 4522/4522 tests passing.
 >
 > **v2.12.0** — Quality-measurement release. Two new features land together: every `kj run` against a known plan now scores how faithfully the coder followed it (deterministic 0–100 **plan adherence** metric, four weighted components, rendered in `summary.md`), and a small **golden-tasks** regression suite (`todo-rest-api`, `npm-package-cli`, `react-counter-component`) catches output-quality drops between Karajan versions before npm publish. Plus the shrink-budget CI gate now exempts human-facing docs from its 200-LOC ceiling while keeping AI-rule files (CLAUDE.md, AGENTS.md, role prompts) capped. 3 PRs for plan adherence (#645–#647), 4 for golden tasks (#648, #650–#652), 1 for the CI policy (#649). 4522/4522 tests passing. Safe upgrade from 2.11.0.
 >

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/scripts/esbuild-sea.config.mjs

@@ -19,7 +19,10 @@ const PKG_VERSION = JSON.parse(readFileSync(path.join(ROOT, "package.json"), "ut
 const seaTransformPlugin = {
   name: "sea-transform",
   setup(build) {
-    build.onLoad({ filter: /\.m?js$/ }, async (args) => {
+    // Only process real files. Imports redirected by hu-board-stub (or any
+    // other namespaced plugin) MUST not pass through this transform —
+    // their `args.path` is a virtual id, not a path readFile can open.
+    build.onLoad({ filter: /\.m?js$/, namespace: "file" }, async (args) => {
       let contents = await fs.readFile(args.path, "utf8");
       let modified = false;
 
@@ -86,6 +89,56 @@ const seaTransformPlugin = {
   }
 };
 
+/**
+ * Stub plugin for the HU Board package (KJC-BUG-0040).
+ *
+ * The HU Board lives in `packages/hu-board/` and requires `better-sqlite3`
+ * — a native node-gyp module that esbuild cannot resolve at bundle time
+ * (it has no JS entry point, only `.node` binaries compiled per platform).
+ *
+ * The SEA binary is the lean CLI distribution. Users who want the HU
+ * Board install via `npm install -g karajan-code`, which installs
+ * better-sqlite3 normally. So the right answer is: do NOT include
+ * `packages/hu-board/` in the SEA bundle at all.
+ *
+ * This plugin intercepts every import / dynamic import that points into
+ * `packages/hu-board/src/*` and rewrites it to a stub module that throws
+ * a clear, actionable error when invoked at runtime — instead of failing
+ * silently during bundling.
+ */
+const huBoardStubPlugin = {
+  name: "hu-board-stub",
+  setup(build) {
+    build.onResolve({ filter: /packages[\\/]hu-board[\\/]src[\\/].*/ }, (args) => ({
+      path: args.path,
+      namespace: "hu-board-stub",
+    }));
+    build.onLoad({ filter: /.*/, namespace: "hu-board-stub" }, () => ({
+      contents: `
+        const NOT_AVAILABLE = "The HU Board is not available in this standalone binary.\\n" +
+          "Install karajan-code from npm to get the dashboard:\\n" +
+          "  npm install -g karajan-code\\n";
+        function notAvailable() { throw new Error(NOT_AVAILABLE); }
+        // Explicit named exports for every symbol the CLI imports from
+        // hu-board. Adding them by name (rather than relying on a Proxy)
+        // avoids esbuild's CJS↔ESM interop confusion: a Proxy that
+        // returns truthy for "__esModule" makes esbuild wrap the import
+        // and the destructured names resolve to undefined.
+        module.exports = {
+          __esModule: false,
+          initDb: notAvailable,
+          closeDb: notAvailable,
+          cleanupZombies: notAvailable,
+          // Catch-all default so \`import foo from\` and \`import * as foo\`
+          // also throw the same message instead of returning undefined.
+          default: notAvailable,
+        };
+      `,
+      loader: "js",
+    }));
+  },
+};
+
 /** @type {import('esbuild').BuildOptions} */
 export const seaBuildOptions = {
   entryPoints: ["src/cli.js"],
@@ -95,7 +148,12 @@ export const seaBuildOptions = {
   target: "node20",
   bundle: true,
   minify: false,
-  external: [],
-  plugins: [seaTransformPlugin],
+  // better-sqlite3 is a native module imported by packages/hu-board/src/db.js.
+  // The hu-board-stub plugin below replaces the whole hu-board package so
+  // this `external` entry is belt-and-braces — if any other dependency
+  // pulls better-sqlite3 in we want a clear "not bundled" error, not a
+  // silent half-bundle.
+  external: ["better-sqlite3"],
+  plugins: [seaTransformPlugin, huBoardStubPlugin],
   logLevel: "info",
 };

package/src/commands/init.js

@@ -397,6 +397,12 @@ async function setupSonarQube(config, logger, { interactive } = {}) {
       logger.info(`  -> Sonar token saved to ${result.savedTo}`);
       if (result.passwordRotated) {
         logger.info(`  -> Sonar admin password rotated. New value at ${result.passwordSavedTo}`);
+      } else if (result.passwordRotationError) {
+        // KJC-BUG-0035: rotation failed but token generation succeeded.
+        // admin/admin is still live — surface it loudly so the user can
+        // fix it manually before someone else exploits it.
+        logger.warn(`  -> SonarQube admin password NOT rotated: ${result.passwordRotationError}`);
+        logger.warn("     admin/admin remains active. Rotate it manually at http://localhost:9000/account/security");
       }
       return;
     }

package/src/commands/plan/generate.js

@@ -7,6 +7,7 @@ import { createCliProgressReporter } from "../../utils/cli-progress.js";
 import { runAutoGC, summarizeGC } from "../../utils/garbage-collector.js";
 import { promptProjectName } from "../../utils/prompt-project-name.js";
 import { deriveProjectNameFromCwd } from "../../utils/derive-project-name-from-cwd.js";
+import { applyReviewerFeedback, applyFixerPatch } from "../../plan/plan-fixer.js";
 import { formatPlan, formatHuTable } from "./_shared.js";
 
 /**
@@ -105,8 +106,19 @@ async function planGenerateImpl({ task, config, logger, json, context, runLog, f
   // the tests manually before executing.
   const { normaliseAcceptanceTests } = await import("../../plan/plan-schema.js");
   const steps = parsed?.steps || [];
-  let prevId = null;
   let stepsMissingTests = 0;
+
+  // Two-pass HU creation (KJC-TSK-0382 follow-up):
+  //   Pass 1 — create every HU with `blocked_by: []` and remember the
+  //            mapping `<symbolic id from planner> -> <stable hu id>`.
+  //   Pass 2 — translate the planner's `dependencies: [symbolicId, …]`
+  //            into the corresponding `blocked_by: [huId, …]`.
+  // The split is needed because `addHu` assigns the stable id at insertion
+  // time, so a forward reference (step B depends on step A whose hu id
+  // doesn't exist yet) would otherwise be impossible to resolve.
+  const symbolicToHuId = new Map();
+  const stepDeps = []; // parallel array: stepDeps[i] = array of symbolic dep ids
+  const stepReuse = []; // parallel array: stepReuse[i] = array of symbolic reuse ids (KJC-BUG-0044 / P3)
   for (const step of steps) {
     const desc = typeof step === "string" ? step : step.description || step.title || JSON.stringify(step);
     const rawTests = typeof step === "object" ? step.acceptance_tests : null;
@@ -116,13 +128,33 @@ async function planGenerateImpl({ task, config, logger, json, context, runLog, f
       title: desc.slice(0, 80),
       task_type: classifyTaskType(desc),
       scope: desc,
-      blocked_by: prevId ? [prevId] : [],
+      blocked_by: [],
       acceptance_tests: tests,
       // Spec mapping (PR C): preserve the planner's section citation
       // so the coder/reviewer / board can show "implements §5.3".
       spec_section: typeof step === "object" && typeof step.spec_section === "string" ? step.spec_section.trim() || null : null,
     });
-    prevId = hu.id;
+    if (typeof step === "object" && typeof step.id === "string" && step.id.trim()) {
+      symbolicToHuId.set(step.id.trim(), hu.id);
+    }
+    const deps = typeof step === "object" && Array.isArray(step.dependencies) ? step.dependencies : [];
+    stepDeps.push(deps);
+    const reuse = typeof step === "object" && Array.isArray(step.reuse) ? step.reuse : [];
+    stepReuse.push(reuse);
+  }
+  // Pass 2: resolve dependencies + reuse. Unknown symbolic ids are dropped
+  // silently (the plan-reviewer pass will flag them as gaps if they matter).
+  for (let i = 0; i < plan.hus.length; i++) {
+    const symbolicDeps = stepDeps[i] || [];
+    const resolvedDeps = symbolicDeps
+      .map((s) => typeof s === "string" ? symbolicToHuId.get(s.trim()) : null)
+      .filter(Boolean);
+    if (resolvedDeps.length > 0) plan.hus[i].blocked_by = resolvedDeps;
+    const symbolicReuse = stepReuse[i] || [];
+    const resolvedReuse = symbolicReuse
+      .map((s) => typeof s === "string" ? symbolicToHuId.get(s.trim()) : null)
+      .filter(Boolean);
+    if (resolvedReuse.length > 0) plan.hus[i].reuse = resolvedReuse;
   }
   // Tests-synthesizer pass (v2.7.5): the first planner call asks for
   // acceptance_tests inline, but Claude / Codex frequently skip that
@@ -202,6 +234,44 @@ async function planGenerateImpl({ task, config, logger, json, context, runLog, f
           ? `[planner] reviewer surfaced ${count} item(s): ${review.findings.summary || "(see plan.review for details)"}`
           : `[planner] reviewer found nothing actionable: ${review.findings.summary || "OK"}`
       );
+      // KJC-BUG-0045 / P4: self-fix loop. The reviewer is flag-only by
+      // contract; when it surfaces actionable issues, ask the planner to
+      // PATCH the plan, apply in-process, and re-review. Loop until 0
+      // findings or maxIterations. Skippable with --no-plan-fixer/--quick.
+      const skipFixer = Boolean(flags?.noPlanFixer || flags?.quick);
+      const maxFixerIterations = 2;
+      if (count > 0 && !skipFixer) {
+        for (let i = 1; i <= maxFixerIterations; i++) {
+          const currentCount = findingsCount(plan.review);
+          if (currentCount === 0) break;
+          runLog.logText(`[planner] self-fix iter ${i}/${maxFixerIterations} — patching ${currentCount} issue(s)`);
+          progress.onOutput?.({ line: `Self-fix iter ${i}: patching ${currentCount} issue(s)`, kind: "text" });
+          const fix = await applyReviewerFeedback({
+            agent: planner, task, hus: plan.hus, findings: plan.review,
+            onOutput: progress.onOutput, silenceTimeoutMs, timeoutMs,
+          });
+          if (!fix.ok) {
+            runLog.logText(`[planner] self-fix iter ${i} failed (non-blocking): ${fix.error}`);
+            break;
+          }
+          const ops = applyFixerPatch(plan, fix.patch);
+          runLog.logText(`[planner] self-fix iter ${i} applied: +${ops.added} HU, +${ops.depsAdded} dep, -${ops.deleted} HU`);
+          if (ops.added + ops.depsAdded + ops.deleted === 0) {
+            runLog.logText(`[planner] self-fix iter ${i} empty patch — stopping`);
+            break;
+          }
+          const review2 = await reviewPlan({
+            agent: planner, task, hus: plan.hus,
+            onOutput: progress.onOutput, silenceTimeoutMs, timeoutMs,
+          });
+          if (!review2.ok) {
+            runLog.logText(`[planner] re-review after iter ${i} failed: ${review2.error}`);
+            break;
+          }
+          plan.review = review2.findings;
+          runLog.logText(`[planner] after self-fix iter ${i}: ${findingsCount(review2.findings)} issue(s) remaining`);
+        }
+      }
     } else {
       runLog.logText(`[planner] reviewer pass failed (non-blocking): ${review.error}`);
     }

package/src/orchestrator/fs-leak-detector.js

@@ -128,6 +128,55 @@ export function verifyLeaksAgainstTranscript(leaks, transcript) {
   });
 }
 
+/**
+ * Layer 2 detection (KJC-BUG-0032): scan the coder's transcript for
+ * `cd <abs-path> && <write-cmd>` patterns where <abs-path> is OUTSIDE
+ * projectDir. Catches the bug class even when the target directory
+ * already existed (so snapshot-diff misses it) — e.g.
+ *   `cd /home/manu/assistant && pnpm init -y`
+ * when `~/assistant` was pre-existing.
+ *
+ * Filters applied:
+ *  - Only absolute paths (`/`, `~/`, `$HOME/`) — relative `cd subdir`
+ *    is assumed inside projectDir.
+ *  - Skips `/tmp/...` (ephemeral, legitimate scratch).
+ *  - Skips targets inside projectDir.
+ *  - Only flags if followed (same line, within 200 chars) by a
+ *    write/creation command: mkdir / touch / cp / mv / git init /
+ *    {pnpm,npm,yarn} init / {pnpm,npm,yarn,npx} create / cat > /
+ *    echo > / shell redirect (>, >>).
+ *  - Pure read commands (ls, which, cat <file>, grep) do NOT flag.
+ *
+ * @param {string|null|undefined} transcript
+ * @param {string|null} projectDir
+ * @returns {string[]} deduplicated absolute leak paths
+ */
+export function detectTranscriptCdLeaks(transcript, projectDir) {
+  if (!transcript || typeof transcript !== "string") return [];
+  const projectDirAbs = projectDir ? path.resolve(projectDir) : null;
+  const homeDir = os.homedir();
+  // Capture cd target + the next ~200 chars of the same line for write-cmd lookup.
+  const cdRegex = /\bcd\s+(~\/[^\s&|;`'"\n]+|\$HOME\/[^\s&|;`'"\n]+|\/[^\s&|;`'"\n]+)([^\n]{0,200})/g;
+  const writeCmdRegex = /\b(mkdir|touch|cp|mv|git\s+init|(?:pnpm|npm|yarn)\s+(?:init|create)|npx\s+create|cat\s*>|echo\s+[^|]*>|>>?\s*\S)/i;
+  const leaks = new Set();
+  let match;
+  while ((match = cdRegex.exec(transcript)) !== null) {
+    const original = match[1];
+    let target = original;
+    const rest = match[2] || "";
+    if (target.startsWith("~/")) target = path.join(homeDir, target.slice(2));
+    else if (target.startsWith("$HOME/")) target = path.join(homeDir, target.slice(6));
+    const abs = path.resolve(target);
+    // /tmp guard only applies to literal /tmp/... paths (ephemeral scratch),
+    // not to ~/ expansions that happen to land in /tmp during tests.
+    if (original === "/tmp" || original.startsWith("/tmp/")) continue;
+    if (projectDirAbs && (abs === projectDirAbs || abs.startsWith(projectDirAbs + path.sep))) continue;
+    if (!writeCmdRegex.test(rest)) continue;
+    leaks.add(abs);
+  }
+  return Array.from(leaks);
+}
+
 /**
  * Format a leak list into a multiline plain-Spanish error message.
  * Includes a hint about how to recover (move-or-delete) so the user

package/src/orchestrator/solomon-rules.js

@@ -68,8 +68,24 @@ export function evaluateRules(context, rulesConfig = {}) {
   // Rule 6: Reviewer style-only block — all blocking issues are style/naming/formatting, not security/correctness
   if (rules.reviewer_style_block && context.blockingIssues?.length > 0) {
     const styleKeywords = /\b(naming|name|rename|style|format|formatting|indent|spacing|camelCase|snake_case|convention|cosmetic|readability|comment|jsdoc|documentation|whitespace|semicolon|quotes|trailing)\b/i;
+    // Anti-style: if any of these match, the issue is NOT style — it's a real correctness/security concern.
+    // Fixes KJC-BUG-0026 (Solomon approving legitimate security blockers misclassified as "style").
+    const securityKeywords = /\b(sql\s*injection|xss|csrf|ssrf|rce|injection|vulnerab|exploit|sanitiz|escape\b|encod\b|cors|auth|authn|authz|password|secret|credential|token|api[-_\s]*key|private[-_\s]*key|hash|cipher|crypto|encrypt|decrypt|tls|ssl|certificate|leak|sensitive|pii|privacy|insecure|unsafe|race[-_\s]*condition|deadlock|memory[-_\s]*leak|null[-_\s]*deref|uaf|overflow|traversal|prototype[-_\s]*pollution|deserializ|eval\b|exec\b|spawn|shell|command[-_\s]*injection)\b/i;
+    const securityCategories = new Set(["security", "correctness", "bug", "vulnerability"]);
     const styleSeverities = new Set(["low", "minor"]);
+    const blockingSeverities = new Set(["critical", "high", "blocker", "major"]);
+    const isSecurityIssue = issue => {
+      const desc = issue.description || "";
+      const sev = (issue.severity || "").toLowerCase();
+      const cat = (issue.category || issue.type || "").toLowerCase();
+      const tags = Array.isArray(issue.tags) ? issue.tags.map(t => String(t).toLowerCase()) : [];
+      if (blockingSeverities.has(sev)) return true;
+      if (securityCategories.has(cat)) return true;
+      if (tags.some(t => securityCategories.has(t))) return true;
+      return securityKeywords.test(desc);
+    };
     const allStyle = context.blockingIssues.every(issue => {
+      if (isSecurityIssue(issue)) return false;
       const desc = issue.description || "";
       const sev = (issue.severity || "").toLowerCase();
       return styleSeverities.has(sev) || styleKeywords.test(desc);

package/src/orchestrator/stages/coder-stage.js

@@ -18,7 +18,7 @@ import { runCoderWithFallback } from "../agent-fallback.js";
 import { invokeSolomon } from "../solomon-escalation.js";
 import { detectRateLimit } from "../../utils/rate-limit-detector.js";
 import { createStallDetector } from "../../utils/stall-detector.js";
-import { snapshotHomeTopLevel, detectNewHomeEntries, formatLeakMessage, verifyLeaksAgainstTranscript } from "../fs-leak-detector.js";
+import { snapshotHomeTopLevel, detectNewHomeEntries, formatLeakMessage, verifyLeaksAgainstTranscript, detectTranscriptCdLeaks } from "../fs-leak-detector.js";
 
 export async function runCoderStage({ coderRoleInstance, coderRole, config, logger, emitter, eventBase, session, plannedTask, trackBudget, iteration, brainCtx, acceptanceTests = null, adrs = null, specSection = null, reviewerFindings = null, huId = null }) {
   logger.setContext({ iteration, stage: "coder" });
@@ -159,10 +159,14 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   // detected entries against the coder's transcript: only flag those
   // the coder demonstrably referenced.
   const coderTranscript = coderExecResult.result?.output || "";
-  const fsLeaks = verifyLeaksAgainstTranscript(candidateLeaks, coderTranscript);
-  if (candidateLeaks.length > 0 && fsLeaks.length === 0) {
+  const layer1Leaks = verifyLeaksAgainstTranscript(candidateLeaks, coderTranscript);
+  if (candidateLeaks.length > 0 && layer1Leaks.length === 0) {
     logger.warn(`fs-leak-detector: ${candidateLeaks.length} new $HOME entr(y/ies) detected but none referenced in the coder transcript — likely a concurrent host-side write, not flagging (#546).`);
   }
+  // Layer 2 (BUG-0032): scan the transcript for `cd <abs-out-of-project> && <write-cmd>`
+  // patterns the snapshot-diff misses (e.g. when target dir pre-existed).
+  const layer2Leaks = detectTranscriptCdLeaks(coderTranscript, projectDirAbs);
+  const fsLeaks = Array.from(new Set([...layer1Leaks, ...layer2Leaks]));
   if (fsLeaks.length > 0) {
     const msg = formatLeakMessage(fsLeaks, projectDirAbs);
     logger.error(msg);

package/src/plan/plan-fixer.js

@@ -0,0 +1,137 @@
+/**
+ * Plan fixer (KJC-BUG-0045 / P4) — self-fix loop after plan-reviewer.
+ *
+ * The reviewer is flag-only by contract. This module asks the planner
+ * to PATCH the plan with the missing pieces and applies the patch
+ * in-process. Patch shape:
+ *   - additions:    new HUs (planner-step shape, id is auto-assigned)
+ *   - deps_to_add:  blocked_by edges to declare on existing HUs
+ *   - deletions:    HU ids to drop (used for overlap resolution)
+ */
+
+import { extractFirstJson } from "../utils/json-extract.js";
+import { addHu, removeHu } from "./plan-hu-ops.js";
+import { normaliseAcceptanceTests } from "./plan-schema.js";
+
+export function buildFixerPrompt({ task, hus, findings }) {
+  const huSummary = hus.map((h) => {
+    const deps = Array.isArray(h.blocked_by) && h.blocked_by.length > 0
+      ? ` ← blocked_by: ${h.blocked_by.join(", ")}` : "";
+    return `- ${h.id}: ${h.title || "(untitled)"}${deps}`;
+  }).join("\n");
+
+  const missingHus = (findings?.missing_hus || [])
+    .map(m => `  - §${m.spec_section}: ${m.rationale}`).join("\n");
+  const missingDeps = (findings?.missing_dependencies || [])
+    .map(d => `  - ${d.from} should be blocked_by ${d.on} (${d.rationale})`).join("\n");
+  const overlaps = (findings?.scope_overlaps || [])
+    .map(o => `  - ${o.between.join(" ↔ ")}: ${o.rationale}`).join("\n");
+
+  return [
+    "A reviewer flagged the issues listed under \"Findings\". Your ONLY",
+    "job is to PATCH the plan to fix EXACTLY those issues:",
+    "- missing_hus → MUST add one HU each",
+    "- missing_dependencies → MUST declare each edge",
+    "- scope_overlaps → MUST drop one of the pair or merge them",
+    "Do NOT propose new features outside the findings list. Do not add new",
+    "tests/logging/refactors. The fixer is scoped to the report ONLY.",
+    "",
+    "Output MUST be a JSON object:",
+    "```json",
+    "{",
+    '  "additions": [',
+    '    { "id": "<symbolic>", "description": "<sentence>",',
+    '      "spec_section": "<ref>", "dependencies": ["<huId>"],',
+    '      "acceptance_tests": [ { "type":"gherkin","content":"…" } ],',
+    '      "reuse": [] }',
+    "  ],",
+    '  "deps_to_add": [ { "huId": "<huId>", "on": "<huId>" } ],',
+    '  "deletions": [ "<huId>" ]',
+    "}",
+    "```",
+    "Reference existing HUs by exact id. Empty arrays OK. JSON only.",
+    "",
+    "## Original Task",
+    task,
+    "",
+    "## Current plan",
+    huSummary,
+    "",
+    "## Findings to address",
+    missingHus ? `### missing_hus (MUST add)\n${missingHus}` : "",
+    missingDeps ? `### missing_dependencies (MUST declare)\n${missingDeps}` : "",
+    overlaps ? `### scope_overlaps (MUST drop or merge)\n${overlaps}` : "",
+  ].filter(Boolean).join("\n");
+}
+
+function normalisePatch(raw) {
+  const out = { additions: [], deps_to_add: [], deletions: [] };
+  if (!raw || typeof raw !== "object") return out;
+  if (Array.isArray(raw.additions)) {
+    out.additions = raw.additions
+      .filter(a => a && typeof a === "object" && typeof a.description === "string" && a.description.trim())
+      .map(a => ({
+        id: typeof a.id === "string" ? a.id.trim() : null,
+        description: String(a.description).trim(),
+        spec_section: typeof a.spec_section === "string" ? a.spec_section.trim() || null : null,
+        dependencies: Array.isArray(a.dependencies) ? a.dependencies.map(String) : [],
+        acceptance_tests: normaliseAcceptanceTests(a.acceptance_tests),
+        reuse: Array.isArray(a.reuse) ? a.reuse.map(String) : [],
+      }));
+  }
+  if (Array.isArray(raw.deps_to_add)) {
+    out.deps_to_add = raw.deps_to_add
+      .filter(d => d && typeof d.huId === "string" && typeof d.on === "string")
+      .map(d => ({ huId: d.huId.trim(), on: d.on.trim() }));
+  }
+  if (Array.isArray(raw.deletions)) {
+    out.deletions = raw.deletions.filter(d => typeof d === "string" && d.trim()).map(d => d.trim());
+  }
+  return out;
+}
+
+export async function applyReviewerFeedback({ agent, task, hus, findings, onOutput, silenceTimeoutMs, timeoutMs }) {
+  const prompt = buildFixerPrompt({ task, hus, findings });
+  const runArgs = { prompt, role: "planner" };
+  if (onOutput) runArgs.onOutput = onOutput;
+  if (silenceTimeoutMs) runArgs.silenceTimeoutMs = silenceTimeoutMs;
+  if (timeoutMs) runArgs.timeoutMs = timeoutMs;
+  const result = await agent.runTask(runArgs);
+  if (!result.ok) return { ok: false, error: result.error || "fixer agent failed" };
+  const parsed = extractFirstJson(result.output || "");
+  if (!parsed || typeof parsed !== "object") {
+    return { ok: false, error: "fixer returned no JSON object" };
+  }
+  return { ok: true, patch: normalisePatch(parsed) };
+}
+
+export function applyFixerPatch(plan, patch) {
+  const counts = { added: 0, depsAdded: 0, deleted: 0 };
+  for (const huId of patch.deletions || []) {
+    if (removeHu(plan, huId)) counts.deleted += 1;
+  }
+  for (const a of patch.additions || []) {
+    addHu(plan, {
+      title: (a.description || "").slice(0, 80),
+      scope: a.description,
+      spec_section: a.spec_section,
+      acceptance_tests: a.acceptance_tests,
+      reuse: a.reuse || [],
+    });
+    counts.added += 1;
+  }
+  const knownIds = new Set(plan.hus.map(h => h.id));
+  for (const { huId, on } of patch.deps_to_add || []) {
+    if (!knownIds.has(huId) || !knownIds.has(on)) continue;
+    const hu = plan.hus.find(h => h.id === huId);
+    if (!hu) continue;
+    const blocked = Array.isArray(hu.blocked_by) ? hu.blocked_by : [];
+    if (blocked.includes(on)) continue;
+    hu.blocked_by = [...blocked, on];
+    counts.depsAdded += 1;
+  }
+  if (counts.added + counts.depsAdded + counts.deleted > 0) {
+    plan.updatedAt = new Date().toISOString();
+  }
+  return counts;
+}

package/src/plan/plan-hu-ops.js

@@ -22,7 +22,7 @@ function nextSeq(plan) {
 /**
  * Add an HU to the plan. Auto-generates a globally unique ID.
  * @param {object} plan - v2 plan
- * @param {object} huData - { title, task_type?, scope?, acceptance_criteria?, acceptance_tests?, blocked_by? }
+ * @param {object} huData - { title, task_type?, scope?, acceptance_criteria?, acceptance_tests?, blocked_by?, reuse? }
  * @returns {object} the created HU (with id assigned)
  */
 export function addHu(plan, huData) {
@@ -34,6 +34,11 @@ export function addHu(plan, huData) {
     task_type: huData.task_type || "sw",
     status: "pending",
     blocked_by: huData.blocked_by || [],
+    // KJC-BUG-0044 / P3: ids of OTHER HUs whose implementation this HU
+    // piggy-backs on instead of reimplementing the same logic. Set by
+    // the planner; consumed by the coder prompt + plan-reviewer to
+    // avoid duplicate code generation.
+    reuse: huData.reuse || [],
     scope: huData.scope || null,
     acceptance_criteria: huData.acceptance_criteria || [],
     acceptance_tests: huData.acceptance_tests || [],
@@ -59,9 +64,10 @@ export function removeHu(plan, huId) {
   const idx = plan.hus.findIndex(h => h.id === huId);
   if (idx === -1) return false;
   plan.hus.splice(idx, 1);
-  // Clean up blocked_by refs
+  // Clean up blocked_by + reuse refs
   for (const hu of plan.hus) {
     hu.blocked_by = (hu.blocked_by || []).filter(dep => dep !== huId);
+    hu.reuse = (hu.reuse || []).filter(dep => dep !== huId);
   }
   plan.updatedAt = new Date().toISOString();
   return true;
@@ -77,7 +83,7 @@ export function removeHu(plan, huId) {
 export function updateHu(plan, huId, patch) {
   const hu = plan.hus.find(h => h.id === huId);
   if (!hu) return null;
-  const allowed = ["title", "task_type", "scope", "acceptance_criteria", "acceptance_tests", "blocked_by", "spec_section"];
+  const allowed = ["title", "task_type", "scope", "acceptance_criteria", "acceptance_tests", "blocked_by", "reuse", "spec_section"];
   for (const key of allowed) {
     if (patch[key] !== undefined) hu[key] = patch[key];
   }

package/src/prompts/planner.js

@@ -50,6 +50,61 @@ export function parsePlannerOutput(output) {
   return { title: state.title, approach: state.approach, steps };
 }
 
+/**
+ * KJC-BUG-0042 / P1: extract explicit scope exclusions from the task.
+ *
+ * The planner consistently produced HUs for items the user explicitly
+ * excluded ("NO incluye en este plan: vistas compartidas, …"). Once
+ * these phrases land in the task text, the LLM still generated steps
+ * for them — the rule was implicit, never made FORBIDDEN. This function
+ * harvests them so the prompt can echo them back literally.
+ *
+ * Detected patterns (inline comma-separated lists, case-insensitive):
+ *   - "NO incluye[...]: a, b, c"           (Spanish)
+ *   - "Fuera de(l) scope[...]: a, b, c"
+ *   - "Out of scope[...]: a, b, c"          (English)
+ *   - "Not in (this) plan[...]: a, b, c"
+ *   - "Plan N handles: a, b, c"             (cross-plan reference)
+ *   - "Reserved for plan[...]: a, b, c"
+ *
+ * @param {string} task
+ * @returns {string[]} deduplicated trimmed exclusion items
+ */
+export function extractScopeExclusions(task) {
+  if (!task || typeof task !== "string") return [];
+  const patterns = [
+    /\bNO\s+incluye[^:\n]{0,60}:\s*([^.\n]+)/gi,
+    /\bFuera\s+de(?:l)?\s+scope[^:\n]{0,60}:\s*([^.\n]+)/gi,
+    /\bOut\s+of\s+scope[^:\n]{0,60}:\s*([^.\n]+)/gi,
+    /\bNot\s+in\s+(?:this\s+)?plan[^:\n]{0,60}:\s*([^.\n]+)/gi,
+    /\bPlan\s+\d+\s+handles[^:\n]{0,60}:?\s*([^.\n]+)/gi,
+    /\bReserved\s+for\s+plan[^:\n]{0,60}:\s*([^.\n]+)/gi,
+  ];
+  const items = new Set();
+  for (const re of patterns) {
+    let m;
+    while ((m = re.exec(task)) !== null) {
+      const list = m[1] || "";
+      for (const raw of list.split(/,|;| y |\sand\s/)) {
+        const item = raw.trim().replace(/^[-*]\s*/, "").replace(/\.$/, "");
+        if (item && item.length < 120) items.add(item);
+      }
+    }
+  }
+  return Array.from(items);
+}
+
+function renderScopeExclusions(exclusions) {
+  if (!exclusions || exclusions.length === 0) return null;
+  const list = exclusions.map((e) => `  - ${e}`).join("\n");
+  return [
+    "## FORBIDDEN scope (out-of-scope items declared in the task)",
+    "The task explicitly excludes the following from this plan. Do NOT generate steps that implement them. If a step would touch any of these, drop it and put the item in `outOfScope` instead:",
+    "",
+    list,
+  ].join("\n");
+}
+
 function formatArchitectContext(architectContext) {
   if (!architectContext) return null;
   const arch = architectContext.architecture || {};
@@ -148,6 +203,12 @@ export function buildPlannerPrompt({ task, context, architectContext, productCon
     parts.push("## Context", context, "");
   }
 
+  const exclusions = extractScopeExclusions(task);
+  const exclusionsSection = renderScopeExclusions(exclusions);
+  if (exclusionsSection) {
+    parts.push(exclusionsSection, "");
+  }
+
   const archSection = formatArchitectContext(architectContext);
   if (archSection) {
     parts.push(archSection, "");
@@ -164,13 +225,38 @@ export function buildPlannerPrompt({ task, context, architectContext, productCon
     "Each step in `steps` has this shape:",
     "```json",
     "{",
+    '  "id": "<short symbolic identifier you choose for this step, e.g. \'INFRA-001\' or \'AUTH-SIGNUP\'>",',
     '  "description": "<what this step achieves, one sentence>",',
     '  "commit": "<conventional commit message>",',
     '  "spec_section": "<see rules below>",',
-    '  "acceptance_tests": [ /* see rules below */ ]',
+    '  "acceptance_tests": [ /* see rules below */ ],',
+    '  "dependencies": [ "<symbolic ids of OTHER steps this one waits for>" ],',
+    '  "reuse": [ "<symbolic ids of OTHER steps whose functionality this one piggy-backs on instead of reimplementing>" ]',
     "}",
     "```",
     "",
+    "### `id` (REQUIRED for cross-references)",
+    "- A short symbolic identifier you assign to this step (e.g. `INFRA-001`, `AUTH-SIGNUP`, `team-list-page`).",
+    "- It only has to be unique within this plan; the system maps it to a stable internal HU id afterwards.",
+    "- If the user spec already prefixes its bullets with `[INFRA-001]`, `[AUTH-005]`, etc., REUSE those exact strings as `id`.",
+    "",
+    "### `dependencies` (REQUIRED — empty array if none)",
+    "- The list of `id`s of OTHER steps in this same plan that MUST be completed before this one starts.",
+    "- Read the user's spec carefully: phrases like `Depende: X, Y`, `requires X`, `after X`, `blocked by X`, `needs X first` MUST be translated into entries here.",
+    "- If the spec says `Sin deps` or makes no mention of dependencies for a step, return `[]`. Do NOT invent dependencies. Do NOT chain steps by their order of appearance.",
+    "- Only reference `id`s that exist among the steps you are emitting in THIS response. External or vague references (e.g. `\"the design system\"`) belong in `risks`, not `dependencies`.",
+    "- **Transversal dependencies (KJC-BUG-0043 / P2)**: when a step's description or `acceptance_tests` requires ALL members of a category (e.g. `listado transversal de warnings filtrables por guardrail`, `list of all assessments`, `summary across all guardrails`, `dashboard que agrega todos los X`), declare `dependencies` to ALL step ids in that category — NOT just the first one, NOT just the index/master step.",
+    "  - Example: a step `LIST-WARNINGS` whose AC reads *\"todos los warnings filtrables por guardrail\"* MUST list every `GUARD-001`, `GUARD-002`, … `GUARD-N` step in its plan as dependencies. Listing only `GUARD-001` is a bug — at execution time the listado will run before the rest of the guardrails exist and the AC will fail.",
+    "  - The detection signal is the AC/description, not the step title. If the title is generic (\"List warnings\") but the AC requires aggregation across N concrete items, you MUST resolve the N concrete items and depend on each.",
+    "",
+    "### `reuse` (REQUIRED — empty array if none) — KJC-BUG-0044 / P3",
+    "- `reuse` is NOT the same as `dependencies`. `dependencies` means \"X must complete before me (ordering)\"; `reuse` means \"I piggy-back on X's implementation instead of reimplementing the same logic in my own code\".",
+    "- If the functionality your step needs is already provided by another step in this plan (versioning utility, hash helper, encryption envelope, cache layer, schema validator, etc.), declare `reuse: [\"<id>\"]` and do NOT regenerate the same code in your step's commit.",
+    "  - Example: a second step that needs prompt versioning MUST set `reuse: [\"ASSESS-003\"]` instead of reimplementing the versioning logic — `ASSESS-003` already produced it.",
+    "  - Example: every step that needs envelope encryption sets `reuse: [\"INFRA-CRYPTO\"]` instead of including a new key-derivation routine.",
+    "- If the spec describes a brand-new utility no other step produces, leave `reuse` as `[]`.",
+    "- A step's `reuse` ids MUST also appear in its `dependencies` (you can't piggy-back on something that runs after you).",
+    "",
     renderSpecSectionRules(specInfo),
     "",
     renderAcceptanceTestsRules(),

package/src/sonar/token-bootstrap.js

@@ -102,6 +102,10 @@ export async function bootstrapSonarToken({ host = "http://localhost:9000" } = {
   let pass = DEFAULT_PASS;
   let passwordRotated = false;
   let passwordSavedTo = null;
+  // KJC-BUG-0035: capture rotation failures so the caller can log them
+  // instead of swallowing the error silently. Pre-fix the rotation
+  // returned status 403/500/network were ignored and the user never knew.
+  let passwordRotationError = null;
 
   // 1) Probe: does admin/admin still work?
   const probe = await call(host, "/api/authentication/validate", { user, pass }).catch((err) => ({ status: 0, body: err.message }));
@@ -142,10 +146,19 @@ export async function bootstrapSonarToken({ host = "http://localhost:9000" } = {
       pass = longerPass;
       passwordRotated = true;
       passwordSavedTo = persistSecret("sonar.admin-password", pass);
+    } else {
+      passwordRotationError = `rotate-retry HTTP ${retry.status}: ${detailFromBody(retry.body)}`;
     }
-  } else if (change.status !== 0 && change.status !== 401) {
-    // Non-fatal: probably the admin already changed the password. We
-    // continue using whatever credentials worked at the probe step.
+  } else if (change.status === 401) {
+    // Expected: admin already changed password — not a failure.
+  } else if (change.status !== 0) {
+    // KJC-BUG-0035: ANY other non-success status (403, 500, 400-without-default, …)
+    // means the rotation didn't happen and admin/admin is still live on disk.
+    // Surface it via the result so the caller can warn the user.
+    passwordRotationError = `rotate HTTP ${change.status}: ${detailFromBody(change.body)}`;
+  } else {
+    // status === 0: network error before getting any HTTP response.
+    passwordRotationError = `rotate network error: ${detailFromBody(change.body)}`;
   }
 
   // 3) Token already exists? Revoke it so we can re-create cleanly.
@@ -178,5 +191,15 @@ export async function bootstrapSonarToken({ host = "http://localhost:9000" } = {
     savedTo,
     passwordRotated,
     passwordSavedTo: passwordRotated ? passwordSavedTo : null,
+    passwordRotationError,
   };
 }
+
+function detailFromBody(body) {
+  if (!body) return "no body";
+  if (typeof body === "string") return body.slice(0, 200);
+  if (Array.isArray(body.errors)) {
+    return body.errors.map(e => e?.msg || JSON.stringify(e)).join("; ").slice(0, 200);
+  }
+  try { return JSON.stringify(body).slice(0, 200); } catch { return "(unserialisable)"; }
+}