karajan-code 2.33.0 → 3.0.0

package/src/rag/watcher.js

@@ -1,23 +1,25 @@
 // KJC-TSK-0441 (RAG v2.28.0 PR1) — chokidar watcher. Live re-index of plans
 // + onboarding + (opt) sources, debounced. PID file arbitrates a single daemon.
+// KJC-TSK-0482 — source matcher derivado del registry (multi-lang: JS/Py/Rust/Go/Java).
 import { writeFileSync, readFileSync, existsSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { extname, join } from "node:path";
 import chokidar from "chokidar";
 import { openVecStore, deleteChunksBySource, projectSlug } from "./vec-store.js";
 import { makeEmbedder } from "./embedders/factory.js";
 import { indexFile } from "./indexer.js";
 import { getKarajanHome } from "../utils/paths.js";
+import { getAllCodeExtensions } from "../lang/registry.js";
 
 const PIDFILE = () => join(getKarajanHome(), "watcher.pid");
 const DEFAULT_DEBOUNCE_MS = 1000;
 const SKIP_SEGMENTS = new Set(["node_modules", ".git", "dist", "build", "coverage", ".karajan", ".next", ".kj", "_diet"]);
-const SOURCE_RE = /\.(js|mjs|cjs|ts|tsx|jsx)$/;
+const SOURCE_EXTS = new Set(getAllCodeExtensions().map((e) => e.toLowerCase()));
 
-function isWatchable(path) {
+export function isWatchable(path) {
   if (path.includes("/.karajan/onboarding/")) return /\.md$/.test(path);
   if (path.includes("/.karajan/plans/")) return /\.json$/.test(path);
   if (path.split("/").some((seg) => SKIP_SEGMENTS.has(seg))) return false;
-  return SOURCE_RE.test(path);
+  return SOURCE_EXTS.has(extname(path).toLowerCase());
 }
 
 export function startWatcher({ projectDir, config, logger = console, debounceMs = DEFAULT_DEBOUNCE_MS, withSources = false } = {}) {

package/src/roles/audit-role.js

@@ -8,6 +8,7 @@ import { collectOsvFindings } from "../audit/osv-findings.js";
 import { collectSemgrepFindings } from "../audit/semgrep-findings.js";
 import { collectCircularDeps } from "../audit/circular-deps.js";
 import { collectDeadExports } from "../audit/dead-exports.js";
+import { collectInjectionFindings } from "../audit/injection-findings.js";
 
 function parseDimensions(dimensionsStr) {
   if (!dimensionsStr || dimensionsStr === "all") return null;
@@ -51,6 +52,7 @@ export class AuditRole extends AgentRole {
     const noSemgrep = typeof input === "object" ? Boolean(input?.noSemgrep) : false;
     const noMadge = typeof input === "object" ? Boolean(input?.noMadge) : false;
     const noKnip = typeof input === "object" ? Boolean(input?.noKnip) : false;
+    const noInjectionScan = typeof input === "object" ? Boolean(input?.noInjectionScan) : false;
     const projectDir = this.config?.projectDir || process.cwd();
     let basalCost = null;
     let growthDelta = null;
@@ -61,6 +63,7 @@ export class AuditRole extends AgentRole {
     let semgrepFindings = null;
     let circularDeps = null;
     let deadExports = null;
+    let injectionFindings = null;
     try {
       basalCost = await measureBasalCost(projectDir);
       const previous = await loadPreviousAudit(projectDir);
@@ -108,7 +111,12 @@ export class AuditRole extends AgentRole {
         deadExports = await collectDeadExports(projectDir, stack, this.config, this.logger);
       } catch { /* knip is best-effort */ }
     }
-    return { projectDir, basalCost, growthDelta, stack, sonarFindings, webperf, osvFindings, semgrepFindings, circularDeps, deadExports };
+    if (!noInjectionScan) {
+      try {
+        injectionFindings = await collectInjectionFindings(projectDir, this.logger);
+      } catch { /* injection scan is best-effort (KJC-TSK-0498) */ }
+    }
+    return { projectDir, basalCost, growthDelta, stack, sonarFindings, webperf, osvFindings, semgrepFindings, circularDeps, deadExports, injectionFindings };
   }
 
   /**

package/src/sonar/scanner.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import fsPromises from "node:fs/promises";
 import path from "node:path";
+import os from "node:os";
 import { runCommand } from "../utils/process.js";
 import { sonarUp } from "./manager.js";
 import { resolveSonarProjectKey } from "./project-key.js";
@@ -10,6 +11,32 @@ import {
   resolveSonarCredentials,
 } from "./config-resolver.js";
 
+export async function findNativeSonarScanner() {
+  const which = await runCommand("sh", ["-c", "command -v sonar-scanner"]);
+  if (which.exitCode === 0) {
+    const bin = String(which.stdout || "").trim();
+    if (bin) return bin;
+  }
+  return null;
+}
+
+export async function pickSonarScanner(scannerConfig = {}, deps = {}) {
+  const find = deps.findNativeSonarScanner || findNativeSonarScanner;
+  const arch = deps.arch || os.arch();
+  const forced = String(scannerConfig.command || "").trim().toLowerCase();
+  if (forced === "docker") return { type: "docker" };
+  if (forced === "native" || forced === "sonar-scanner" || forced.endsWith("/sonar-scanner")) {
+    const bin = (forced === "native" || forced === "sonar-scanner") ? await find() : forced;
+    if (bin) return { type: "native", bin };
+    return { type: "docker", reason: "native sonar-scanner not found on PATH" };
+  }
+  if (arch === "arm64") {
+    const bin = await find();
+    if (bin) return { type: "native", bin, reason: "ARM64 host — preferring native binary" };
+  }
+  return { type: "docker" };
+}
+
 export function buildScannerOpts(projectKey, scanner = {}) {
   const opts = [`-Dsonar.projectKey=${projectKey}`];
   if (scanner.sources) opts.push(`-Dsonar.sources=${scanner.sources}`);
@@ -236,31 +263,39 @@ export async function runSonarScan(config, projectKey = null) {
     ...coverage.scannerPatch
   });
 
-  const args = [
-    "run",
-    "--rm",
-    "-v",
-    `${process.cwd()}:/usr/src`,
-    ...(isLocalHost ? ["--add-host", "host.docker.internal:host-gateway"] : []),
-    ...(isLocalHost || isExternalSonar ? [] : ["--network", sonarNetwork]),
-    "-e", "SONAR_HOST_URL",
-    "-e", "SONAR_TOKEN",
-    "-e", "SONAR_SCANNER_OPTS",
-    "sonarsource/sonar-scanner-cli"
-  ];
-
-  // Pass secrets via process env, not CLI args — invisible in `ps aux`
+  const pick = await pickSonarScanner(sonarConfig.scanner);
   const env = {
     ...process.env,
-    SONAR_HOST_URL: host,
+    SONAR_HOST_URL: pick.type === "native" ? rawHost : host,
     SONAR_TOKEN: token || "",
     SONAR_SCANNER_OPTS: buildScannerOpts(effectiveProjectKey, scannerConfig)
   };
 
-  const result = await runCommand("docker", args, { timeout: scannerTimeout, env });
+  let cmd, args;
+  if (pick.type === "native") {
+    cmd = pick.bin;
+    args = [];
+  } else {
+    cmd = "docker";
+    args = [
+      "run",
+      "--rm",
+      "-v",
+      `${process.cwd()}:/usr/src`,
+      ...(isLocalHost ? ["--add-host", "host.docker.internal:host-gateway"] : []),
+      ...(isLocalHost || isExternalSonar ? [] : ["--network", sonarNetwork]),
+      "-e", "SONAR_HOST_URL",
+      "-e", "SONAR_TOKEN",
+      "-e", "SONAR_SCANNER_OPTS",
+      "sonarsource/sonar-scanner-cli"
+    ];
+  }
+
+  const result = await runCommand(cmd, args, { timeout: scannerTimeout, env });
   return {
     ok: result.exitCode === 0,
     projectKey: effectiveProjectKey,
+    scanner: pick.type,
     stdout: result.stdout,
     stderr: result.stderr,
     exitCode: result.exitCode

package/src/utils/manifest-sniff.js

@@ -0,0 +1,82 @@
+// KJC-TSK-0476 — Multi-stack manifest sniffer. Sin libs externas: JSON.parse
+// para package.json, regex para TOML y go.mod. Lo consumen audit (basal-cost)
+// y, vía PR-D, el onboarder.
+import fs from "node:fs/promises";
+import path from "node:path";
+
+async function readMaybe(file) {
+  try { return await fs.readFile(file, "utf8"); } catch { return null; }
+}
+
+async function sniffNode(dir) {
+  const raw = await readMaybe(path.join(dir, "package.json"));
+  if (!raw) return null;
+  try {
+    const pkg = JSON.parse(raw);
+    return { stack: "node", manifest: "package.json", name: pkg.name || null,
+      deps: Object.keys(pkg.dependencies || {}).length,
+      devDeps: Object.keys(pkg.devDependencies || {}).length };
+  } catch {
+    return { stack: "node", manifest: "package.json", name: null, deps: 0, devDeps: 0, malformed: true };
+  }
+}
+
+// Cuerpo TOML de `[section]` hasta el siguiente `\n[` o EOF. Lookahead con `/m`
+// cambia el significado de `$` y producía capturas vacías.
+function tomlSection(toml, section) {
+  const i = toml.indexOf(`[${section}]`);
+  if (i === -1) return "";
+  const rest = toml.slice(i + section.length + 2);
+  const n = rest.search(/\n\[/);
+  return n === -1 ? rest : rest.slice(0, n);
+}
+
+const DEP_LINE_RE = /^\s*[A-Za-z0-9_-]+\s*=/;
+const countDepLines = (block, excludePython) => block.split("\n")
+  .filter((l) => DEP_LINE_RE.test(l) && !(excludePython && /^\s*python\s*=/.test(l))).length;
+
+async function sniffPython(dir) {
+  const py = await readMaybe(path.join(dir, "pyproject.toml"));
+  if (py) {
+    const name = /^name\s*=\s*["']([^"']+)["']/m.exec(py)?.[1] || null;
+    const projectDeps = /\[project\][\s\S]*?dependencies\s*=\s*\[([^\]]*)\]/m.exec(py)?.[1] || "";
+    const projectCount = projectDeps.split(",").map((s) => s.trim()).filter(Boolean).length;
+    const poetryCount = countDepLines(tomlSection(py, "tool.poetry.dependencies"), true);
+    return { stack: "python", manifest: "pyproject.toml", name, deps: projectCount + poetryCount, devDeps: 0 };
+  }
+  const req = await readMaybe(path.join(dir, "requirements.txt"));
+  if (!req) return null;
+  const lines = req.split("\n").map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean);
+  return { stack: "python", manifest: "requirements.txt", name: null, deps: lines.length, devDeps: 0 };
+}
+
+async function sniffRust(dir) {
+  const toml = await readMaybe(path.join(dir, "Cargo.toml"));
+  if (!toml) return null;
+  return { stack: "rust", manifest: "Cargo.toml",
+    name: /^name\s*=\s*["']([^"']+)["']/m.exec(toml)?.[1] || null,
+    deps: countDepLines(tomlSection(toml, "dependencies")),
+    devDeps: countDepLines(tomlSection(toml, "dev-dependencies")) };
+}
+
+async function sniffGo(dir) {
+  const mod = await readMaybe(path.join(dir, "go.mod"));
+  if (!mod) return null;
+  const block = /require\s*\(([\s\S]*?)\)/m.exec(mod)?.[1] || "";
+  const blockCount = block.split("\n").filter((l) => /\S/.test(l) && !l.trim().startsWith("//")).length;
+  const singleCount = mod.split("\n").filter((l) => /^require\s+\S+\s+\S+/.test(l)).length;
+  return { stack: "go", manifest: "go.mod",
+    name: /^module\s+(\S+)/m.exec(mod)?.[1] || null,
+    deps: blockCount + singleCount, devDeps: 0 };
+}
+
+export async function sniffManifests(dir) {
+  const r = await Promise.all([sniffNode(dir), sniffPython(dir), sniffRust(dir), sniffGo(dir)]);
+  return r.filter(Boolean);
+}
+
+export function summariseStack(manifests) {
+  if (!manifests.length) return { primary: null, multi: false, manifests: [] };
+  const ranked = [...manifests].sort((a, b) => (b.deps + b.devDeps) - (a.deps + a.devDeps));
+  return { primary: ranked[0].stack, multi: manifests.length > 1, manifests };
+}

package/src/utils/quota-simulator.js

@@ -0,0 +1,56 @@
+// KJ_SIMULATE_QUOTA — testing hook for the standby flow. See
+// docs/quota-simulation.md. KJC-TSK-0493.
+
+let _warned = false;
+
+export function parseQuotaSimulationConfig(env = process.env) {
+  const trigger = env.KJ_SIMULATE_QUOTA;
+  if (!trigger) return null;
+  const m = /^after-iter-(\d+)$/i.exec(String(trigger).trim());
+  if (!m) {
+    if (!_warned) {
+      // eslint-disable-next-line no-console
+      console.warn(`[KJ_SIMULATE_QUOTA] Ignoring malformed value "${trigger}". Expected "after-iter-<N>".`);
+      _warned = true;
+    }
+    return null;
+  }
+  return {
+    afterIter: Number.parseInt(m[1], 10),
+    resetIso: env.KJ_SIMULATE_QUOTA_RESET || new Date(Date.now() + 3600_000).toISOString(),
+    agent: String(env.KJ_SIMULATE_QUOTA_AGENT || "claude").toLowerCase(),
+  };
+}
+
+const SYNTHETIC_MSG = {
+  claude: (iso) => `[KJ_SIMULATE_QUOTA] Claude Pro usage limit reached. weekly limit. resets at ${iso}`,
+  codex: () => `[KJ_SIMULATE_QUOTA] You have exceeded your current quota. retry after 60 seconds`,
+  gemini: () => `[KJ_SIMULATE_QUOTA] Resource exhausted: quota exceeded. retry after 60 seconds`,
+};
+
+export function buildSyntheticQuotaMessage(agent, resetIso) {
+  return (SYNTHETIC_MSG[agent] || SYNTHETIC_MSG.claude)(resetIso);
+}
+
+export function shouldSimulateQuota({ iteration, agent }, env = process.env) {
+  const cfg = parseQuotaSimulationConfig(env);
+  if (!cfg) return null;
+  if (Number(iteration) < cfg.afterIter) return null;
+  const a = String(agent || "").toLowerCase();
+  if (cfg.agent !== "any" && cfg.agent !== a) return null;
+  return { resetIso: cfg.resetIso, agent: a || cfg.agent };
+}
+
+// Mutates execResult: forces ok=false and prepends the synthetic quota
+// line to result.error so the existing detectRateLimit branch fires.
+export function applyQuotaSimulation(execResult, { iteration, agent }, env = process.env) {
+  const fire = shouldSimulateQuota({ iteration, agent }, env);
+  if (!fire || !execResult || typeof execResult !== "object") return false;
+  if (!execResult.result || typeof execResult.result !== "object") execResult.result = {};
+  execResult.result.error = `${buildSyntheticQuotaMessage(fire.agent, fire.resetIso)}\n${execResult.result.error || ""}`;
+  execResult.ok = false;
+  return true;
+}
+
+// Test seam — reset the one-shot warning between unit tests.
+export function _resetSimulatorWarning() { _warned = false; }

package/src/utils/telemetry.js

@@ -1,4 +1,30 @@
-const TELEMETRY_ENDPOINT = "https://karajan-code.web.app/api/telemetry";
+export const TELEMETRY_ENDPOINT = "https://karajan-code.web.app/api/telemetry";
+
+/**
+ * Build the exact JSON payload that would be POSTed for an event.
+ * Pure function: deterministic given (eventName, data) — exposed so
+ * `kj telemetry preview` can render the literal bytes the backend
+ * receives without performing any network call.
+ *
+ * The `data.version` field is folded into `v`; the rest of the
+ * event-specific keys ride through `...data` after the common ones,
+ * matching the order sent over the wire.
+ *
+ * @param {string} eventName
+ * @param {object} [data]
+ * @returns {object}
+ */
+export function buildTelemetryPayload(eventName, data = {}) {
+  const { version, ...rest } = data;
+  return {
+    event: eventName,
+    v: version || "unknown",
+    os: process.platform,
+    node: process.version,
+    ts: Date.now(),
+    ...rest
+  };
+}
 
 /**
  * Send an anonymous telemetry event. Non-blocking, fire-and-forget.
@@ -12,14 +38,7 @@ export async function sendTelemetryEvent(eventName, data, config) {
   if (!isTelemetryEnabled(config)) return;
 
   try {
-    const payload = {
-      event: eventName,
-      v: data.version || "unknown",
-      os: process.platform,
-      node: process.version,
-      ts: Date.now(),
-      ...data
-    };
+    const payload = buildTelemetryPayload(eventName, data);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3000);
     try {
@@ -48,12 +67,15 @@ export async function sendTelemetryEvent(eventName, data, config) {
 }
 
 /**
- * Check if telemetry is enabled (opt-out model).
- * Returns false only when the user explicitly sets telemetry: false.
+ * Check if telemetry is enabled (opt-in model).
+ *
+ * Returns true ONLY when the user explicitly answered "yes" in the
+ * `kj init` wizard and we persisted `telemetry: true` to their config.
+ * Anything else — undefined, null, missing key, false — disables sending.
  *
  * @param {object} [config] - Karajan config
  * @returns {boolean}
  */
 export function isTelemetryEnabled(config) {
-  return config?.telemetry !== false;
+  return config?.telemetry === true;
 }

package/templates/roles/onboarder.md

@@ -14,7 +14,10 @@ If the project is greenfield (no git, no configs, empty tree) emit
 
 ## Input
 
-JSON bundle with `projectDir`, `stack`, `tree`, `git` (or null), `configs`,
+JSON bundle with `projectDir`, `stack`, `manifests` (per-stack: node /
+python / rust / go with deps count), `frameworksMultiLang` (Django / Flask /
+FastAPI / Axum / Actix / Rocket / Gin / Echo / Fiber + Rust crate type + Go
+module path + canonical layout dirs), `tree`, `git` (or null), `configs`,
 `adrs`. Slots may be null/empty.
 
 ## Output
@@ -24,6 +27,8 @@ Markdown only — skip any section without data:
 ```markdown
 # Architecture Brief — <projectDir>
 ## Stack
+## Manifests           # only when manifests has entries beyond node
+## Frameworks          # only when frameworksMultiLang has entries
 ## Layout
 ## Configs
 ## Git history
@@ -32,5 +37,9 @@ Markdown only — skip any section without data:
 ## Recommendations for new work
 ```
 
+For non-Node stacks (`frameworksMultiLang[].stack` in {python, rust, go}),
+mention the detected framework(s), crate type or module path, and canonical
+layout dirs (apps/, cmd/, internal/, src/, tests/) when present.
+
 Be conservative: only assert what the bundle shows. "Likely" / "appears to"
 are fine; invention is not. Aim for ~40–80 lines total.

package/vendor/tree-sitter-grammars/README.md

@@ -0,0 +1,21 @@
+# Vendored tree-sitter grammars
+
+WASM binaries used by `src/lang/tree-sitter-loader.js`. Vendored (rather
+than pulled as runtime deps) so the npm package and the SEA binary ship
+exactly the grammars we support — adding all of `@vscode/tree-sitter-wasm`
+would balloon the install by ~22 MB for languages we never chunk.
+
+Source: extracted from `@vscode/tree-sitter-wasm@0.3.1`. That package
+re-builds upstream `tree-sitter-*` grammars against the tree-sitter
+0.25.x ABI, which matches the runtime `web-tree-sitter@0.26.x` we depend
+on. Older prebuilds (e.g. `tree-sitter-wasms@0.1.13`) target an older ABI
+and fail to load.
+
+Re-extract with:
+
+    npm pack @vscode/tree-sitter-wasm
+    tar -xzf vscode-tree-sitter-wasm-*.tgz
+    cp package/wasm/tree-sitter-python.wasm vendor/tree-sitter-grammars/python.wasm
+    cp package/wasm/tree-sitter-rust.wasm   vendor/tree-sitter-grammars/rust.wasm
+    cp package/wasm/tree-sitter-go.wasm     vendor/tree-sitter-grammars/go.wasm
+    cp package/wasm/tree-sitter-java.wasm   vendor/tree-sitter-grammars/java.wasm