karajan-code 2.8.0 → 2.10.0

package/src/commands/audit.js

@@ -1,11 +1,36 @@
 import path from "node:path";
-import { createAgent } from "../agents/index.js";
+import fs from "node:fs/promises";
+import readline from "node:readline";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 import { assertAgentsAvailable } from "../agents/availability.js";
 import { resolveRole } from "../config.js";
-import { buildAuditPrompt, parseAuditOutput, AUDIT_DIMENSIONS } from "../prompts/audit.js";
+import { AUDIT_DIMENSIONS } from "../prompts/audit.js";
+import { AuditRole } from "../roles/audit-role.js";
 import { withCliRunLog } from "../utils/cli-run-log.js";
 import { createCliProgressReporter } from "../utils/cli-progress.js";
 import { runAgentReadiness, formatAgentReadinessReport } from "../audit/agent-readiness.js";
+import { formatDeterministicSummary } from "../audit/deterministic-summary.js";
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * Prompt the user (TTY only) to decide whether to continue with the LLM
+ * phase after deterministic findings have been printed. KJC-TSK-0364.
+ *
+ * @returns {Promise<boolean>} true to continue with LLM, false to skip
+ */
+function promptContinueWithLlm({ promptFn = null } = {}) {
+  if (typeof promptFn === "function") return promptFn();
+  return new Promise((resolve) => {
+    if (!process.stdin.isTTY) { resolve(true); return; } // CI / piped input → continue
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question("Continue with LLM analysis? [y/N] ", (answer) => {
+      rl.close();
+      resolve(/^y(es)?$/i.test((answer || "").trim()));
+    });
+  });
+}
 
 function formatFindings(findings) {
   const lines = [];
@@ -45,10 +70,11 @@ const DIMENSION_LABELS = {
   codeQuality: "Code Quality",
   performance: "Performance",
   architecture: "Architecture",
-  testing: "Testing"
+  testing: "Testing",
+  accessibility: "Accessibility (WCAG 2.x)"
 };
 
-function formatAudit(parsed) {
+function formatAudit(parsed, usage = null) {
   const lines = [];
   lines.push("## Codebase Health Report");
   lines.push(`**Overall Health:** ${parsed.summary.overallHealth}`);
@@ -66,10 +92,119 @@ function formatAudit(parsed) {
   }
 
   if (parsed.textSummary) lines.push(`---\n${parsed.textSummary}`);
+
+  const usageBlock = formatUsageSummary(usage);
+  if (usageBlock) {
+    lines.push("");
+    lines.push(usageBlock);
+  }
+
+  return lines.join("\n");
+}
+
+/**
+ * Format the LLM token + cost summary that closes every audit report.
+ * KJC-TSK-0363: makes the LLM cost visible (was silently discarded
+ * pre-patch — auditCommand never read roleResult.usage).
+ *
+ * @param {object|null} usage - shape produced by AuditRole's extractUsage
+ * @returns {string|null} markdown block, or null when there's nothing useful to show
+ */
+function formatUsageSummary(usage) {
+  if (!usage) return null;
+  const lines = ["## LLM Usage"];
+  lines.push(`- Provider: ${usage.provider}${usage.model ? ` (${usage.model})` : ""}`);
+  if (typeof usage.durationMs === "number") {
+    lines.push(`- Duration: ${(usage.durationMs / 1000).toFixed(1)}s`);
+  }
+  if (!usage.available) {
+    lines.push(`- Tokens: usage data not available — ${usage.reason || "provider does not report it"}`);
+    return lines.join("\n");
+  }
+  // Force en-US locale so the comma grouping is deterministic across CI
+  // machines (Node's default Intl.NumberFormat depends on the runtime
+  // locale; without this the rendering would look like "1234" on
+  // locale-less Node and "1,234" on a US-locale workstation).
+  const fmt = (n) => n.toLocaleString("en-US");
+  lines.push(`- Tokens: ${fmt(usage.total_tokens)} total (${fmt(usage.tokens_in)} in, ${fmt(usage.tokens_out)} out)`);
+  if (typeof usage.cost_usd === "number") {
+    lines.push(`- Estimated cost: $${usage.cost_usd.toFixed(4)} USD`);
+  }
   return lines.join("\n");
 }
 
-export async function auditCommand({ task, config, logger, dimensions, json, agentReadiness, path: pathArg }) {
+/**
+ * Resolve where to write the audit report on disk, given a flag value, an
+ * env override, and the desired format. Returns null if no write target
+ * was requested. Creates parent directories on demand.
+ *
+ * Resolution rules (KJC-TSK-0362):
+ *   - flag undefined + no env → null (legacy behaviour, stdout only)
+ *   - flag is a directory → write `audit-<ISO>.{md,json}` inside it
+ *   - flag is a non-directory path → use it verbatim (extension drives format
+ *     when --json/--md not explicit)
+ *   - flag is undefined but env $KJ_AUDIT_REPORT_DIR is set → treat env as dir
+ */
+async function resolveReportFilePath(flagValue, isJson) {
+  const envDir = process.env.KJ_AUDIT_REPORT_DIR;
+  const target = flagValue || (envDir ? envDir : null);
+  if (!target) return null;
+
+  const ext = isJson ? "json" : "md";
+  let stats = null;
+  try { stats = await fs.stat(target); } catch { /* not a directory yet */ }
+  const isDir = stats?.isDirectory() || target.endsWith(path.sep) || target === envDir;
+
+  let resolved;
+  if (isDir) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    resolved = path.resolve(target, `audit-${stamp}.${ext}`);
+  } else {
+    resolved = path.resolve(target);
+  }
+
+  await fs.mkdir(path.dirname(resolved), { recursive: true });
+  return resolved;
+}
+
+/**
+ * Build the markdown header that prefixes a persisted report — captures
+ * timestamp + repo state + invocation flags so the file is reproducible.
+ */
+async function buildReportHeader(projectDir, invocation) {
+  const lines = ["# Karajan Audit Report", ""];
+  lines.push(`- **Generated:** ${new Date().toISOString()}`);
+  lines.push(`- **Project:** ${projectDir || process.cwd()}`);
+
+  // Best-effort git info — silent if outside a repo.
+  try {
+    const branch = (await execFileAsync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: projectDir, timeout: 2000 })).stdout.trim();
+    const commit = (await execFileAsync("git", ["rev-parse", "--short", "HEAD"], { cwd: projectDir, timeout: 2000 })).stdout.trim();
+    lines.push(`- **Branch:** ${branch}`);
+    lines.push(`- **Commit:** ${commit}`);
+  } catch { /* not a git repo or git missing */ }
+
+  if (invocation) lines.push(`- **Invocation:** \`${invocation}\``);
+  lines.push("");
+  lines.push("---");
+  lines.push("");
+  return lines.join("\n");
+}
+
+function describeInvocation({ task, dimensions, noSonar, noOsv, noSemgrep, json, deterministicOnly, yes }) {
+  const parts = ["kj audit"];
+  if (task && task !== "Analyze the full codebase") parts.push(JSON.stringify(task));
+  if (dimensions && dimensions !== "all") parts.push(`--dimensions=${dimensions}`);
+  if (noSonar) parts.push("--no-sonar");
+  if (noOsv) parts.push("--no-osv");
+  if (noSemgrep) parts.push("--no-semgrep");
+  if (deterministicOnly) parts.push("--deterministic-only");
+  if (yes) parts.push("--yes");
+  if (json) parts.push("--json");
+  return parts.join(" ");
+}
+
+export async function auditCommand({ task, config, logger, dimensions, json, agentReadiness, path: pathArg, noSonar = false, noOsv = false, noSemgrep = false, reportFile = null, deterministicOnly = false, yes = false, promptFn = null }) {
   // --agent-readiness is a STANDALONE, deterministic, LLM-free audit
   // dimension. It scores any third-party repo for AI-agent readability
   // (llms.txt presence, page token budgets, robots allowlist, etc.).
@@ -88,44 +223,120 @@ export async function auditCommand({ task, config, logger, dimensions, json, age
   }
 
   return withCliRunLog("audit", { projectDir: config?.projectDir, logger }, async ({ runLog }) => {
-    const auditRole = resolveRole(config, "audit");
-    await assertAgentsAvailable([auditRole.provider]);
-    logger.info(`Audit (${auditRole.provider}) starting...`);
-    runLog.logText(`[audit] provider=${auditRole.provider} dimensions=${dimensions || "all"}`);
+    const auditRoleConfig = resolveRole(config, "audit");
+    await assertAgentsAvailable([auditRoleConfig.provider]);
+    logger.info(`Audit (${auditRoleConfig.provider}) starting...`);
+    runLog.logText(`[audit] provider=${auditRoleConfig.provider} dimensions=${dimensions || "all"} deterministicOnly=${deterministicOnly}`);
 
-    const agent = createAgent(auditRole.provider, config, logger);
-    const dimList = dimensions && dimensions !== "all"
-      ? dimensions.split(",").map(d => d.trim().toLowerCase()).map(d => d === "quality" ? "codeQuality" : d).filter(d => AUDIT_DIMENSIONS.includes(d))
-      : null;
+    // Two-phase audit (KJC-TSK-0364) — collect deterministic findings
+    // first; show them; ask the user (when TTY + not --yes + not
+    // --deterministic-only) whether to spend tokens on the LLM analysis.
+    // CI / piped input / --yes / --deterministic-only never prompts.
+    const role = new AuditRole({ config, logger });
+    const roleInput = {
+      task: task || "Analyze the full codebase",
+      dimensions: dimensions || null,
+      noSonar,
+      noOsv,
+      noSemgrep,
+    };
+    const deterministicCtx = await role.collectDeterministic(roleInput);
+    const deterministicMd = formatDeterministicSummary(deterministicCtx);
 
-    const prompt = buildAuditPrompt({ task: task || "Analyze the full codebase", dimensions: dimList });
+    // --json suppresses the interactive flow regardless: it would mangle
+    // a script's stdout. JSON consumers always get the full audit unless
+    // they explicitly pass deterministicOnly.
+    const reportPath = await resolveReportFilePath(reportFile, json);
+    let runLlm = !deterministicOnly;
+    if (runLlm && !json && !yes) {
+      console.log(deterministicMd);
+      console.log("");
+      const ok = await promptContinueWithLlm({ promptFn });
+      runLlm = ok;
+      if (!ok) logger.info("LLM analysis skipped (deterministic-only mode).");
+    }
+
+    if (!runLlm) {
+      // Deterministic-only path. Produce the report from what we already
+      // have, persist it (md or json), and exit. Zero tokens spent.
+      const stdoutContent = json
+        ? JSON.stringify({ deterministic: deterministicCtx, mode: "deterministic-only" }, null, 2)
+        : (deterministicOnly ? deterministicMd : ""); // already printed above when interactive
+      if (json || deterministicOnly) console.log(stdoutContent);
+
+      if (reportPath) {
+        let payload;
+        if (reportPath.endsWith(".json")) {
+          payload = JSON.stringify({ deterministic: deterministicCtx, mode: "deterministic-only" }, null, 2);
+        } else {
+          const header = await buildReportHeader(config?.projectDir, describeInvocation({ task, dimensions, noSonar, noOsv, noSemgrep, json, deterministicOnly, yes }));
+          payload = header + deterministicMd + "\n";
+        }
+        await fs.writeFile(reportPath, payload, "utf8");
+        runLog.logText(`[audit] report written (deterministic-only) → ${reportPath}`);
+        logger.info(`Audit report written: ${reportPath}`);
+      }
+      logger.info("Audit completed (deterministic-only).");
+      return { ok: true, mode: "deterministic-only", reportPath: reportPath || undefined };
+    }
+
+    // Continue with the LLM phase using the already-collected context.
     const progress = createCliProgressReporter({ role: "auditor" });
-    let result;
+    let roleResult;
     try {
-      result = await agent.runTask({ prompt, onOutput: progress.onOutput, role: "audit" });
-      progress.finish(result.ok ? "done" : "failed");
+      roleResult = await role.executeWithDeterministic({ ...roleInput, onOutput: progress.onOutput }, deterministicCtx);
+      progress.finish(roleResult.ok ? "done" : "failed");
     } catch (err) { progress.finish("failed"); throw err; }
 
-    if (!result.ok) {
-      throw new Error(result.error || result.output || "Audit failed");
+    if (!roleResult.ok) {
+      const err = roleResult.result?.error || "Audit failed";
+      throw new Error(err);
     }
 
-    const parsed = parseAuditOutput(result.output);
-    if (parsed?.summary) {
+    const parsed = roleResult.result;
+    const usage = roleResult.usage;
+    if (parsed?.summary?.overallHealth) {
       runLog.logText(`[audit] findings=${parsed.summary.totalFindings} (critical=${parsed.summary.critical}, high=${parsed.summary.high})`);
     }
+    if (usage?.available) {
+      runLog.logText(`[audit] usage tokens=${usage.total_tokens} cost=$${(usage.cost_usd ?? 0).toFixed(4)} duration=${(usage.durationMs / 1000).toFixed(1)}s`);
+    }
 
+    let stdoutContent;
     if (json) {
-      console.log(JSON.stringify(parsed || result.output, null, 2));
-      return { ok: true };
+      const jsonPayload = parsed
+        ? { ...parsed, usage: usage || undefined }
+        : { ...roleResult, usage: usage || undefined };
+      stdoutContent = JSON.stringify(jsonPayload, null, 2);
+    } else if (parsed?.summary?.overallHealth) {
+      stdoutContent = formatAudit(parsed, usage);
+    } else if (parsed?.raw) {
+      stdoutContent = parsed.raw + (usage ? `\n\n${formatUsageSummary(usage) || ""}` : "");
+    } else {
+      stdoutContent = roleResult.summary || "Audit complete.";
     }
+    console.log(stdoutContent);
 
-    if (parsed?.summary) {
-      console.log(formatAudit(parsed));
-    } else {
-      console.log(result.output);
+    if (reportPath) {
+      let payload;
+      if (reportPath.endsWith(".json")) {
+        const jsonPayload = parsed
+          ? { ...parsed, usage: usage || undefined }
+          : { ...roleResult, usage: usage || undefined };
+        payload = JSON.stringify(jsonPayload, null, 2);
+      } else {
+        const header = await buildReportHeader(config?.projectDir, describeInvocation({ task, dimensions, noSonar, noOsv, noSemgrep, json, deterministicOnly, yes }));
+        payload = header + stdoutContent + "\n";
+      }
+      await fs.writeFile(reportPath, payload, "utf8");
+      runLog.logText(`[audit] report written → ${reportPath}`);
+      logger.info(`Audit report written: ${reportPath}`);
     }
+
     logger.info("Audit completed.");
-    return { ok: true };
+    return { ok: true, reportPath: reportPath || undefined };
   });
 }
+
+// Exposed for tests — kept module-private otherwise.
+export { formatAudit, formatUsageSummary, AUDIT_DIMENSIONS };

package/src/commands/board.js

@@ -89,7 +89,7 @@ function buildBoardUrl(port, projectSlug) {
 }
 
 export async function startBoard(desiredPort = 4000, opts = {}) {
-  const { projectSlug = null } = opts;
+  const { projectSlug = null, bind = "127.0.0.1" } = opts;
   const existingPid = readPid();
   if (existingPid && isProcessAlive(existingPid)) {
     // Trust the saved PID — port info comes from the PID file if present
@@ -129,7 +129,7 @@ export async function startBoard(desiredPort = 4000, opts = {}) {
   // Use process.execPath (absolute path to current node binary) instead of "node".
   // Fixes ENOENT on nvm setups where `node` is not in the spawned process's PATH.
   const child = spawn(process.execPath, [serverPath], {
-    env: { ...process.env, PORT: String(port) },
+    env: { ...process.env, PORT: String(port), BIND_HOST: bind },
     detached: true,
     stdio: "ignore",
     cwd: BOARD_DIR
@@ -265,14 +265,17 @@ export function renderBoardBanner({ url, status, projectName }) {
   return ["", rule, ...content, rule, ""].join("\n");
 }
 
-export async function boardCommand({ action = "start", port = 4000, logger }) {
+export async function boardCommand({ action = "start", port = 4000, bind = "127.0.0.1", logger }) {
   switch (action) {
     case "start": {
-      const result = await startBoard(port);
+      const result = await startBoard(port, { bind });
       if (result.alreadyRunning) {
         logger.info(`HU Board already running (PID ${result.pid}) at ${result.url}`);
       } else {
         logger.info(`HU Board started (PID ${result.pid}) at ${result.url}`);
+        if (bind !== "127.0.0.1" && bind !== "localhost") {
+          logger.warn(`HU Board bound to ${bind} — token auth enforced for non-loopback peers. Token: ~/.karajan/hu-board/token`);
+        }
       }
       return result;
     }

package/src/commands/doctor.js

@@ -77,7 +77,7 @@ function confirmViaTty(describe) {
  * @param {{ config: Object, checkOnly?: boolean, yes?: boolean, onConfirm?: Function, logger?: Object }} args
  * @returns {Promise<import("../checks/types.js").RunReport>}
  */
-export async function runDoctor({ config, checkOnly = false, yes = false, onConfirm, logger }) {
+async function runDoctor({ config, checkOnly = false, yes = false, onConfirm, logger }) {
   const checks = buildChecks(config);
   return runCheckPipeline(checks, { config }, {
     mode: checkOnly ? "check-only" : "fix",

package/src/commands/webperf.js

@@ -0,0 +1,164 @@
+/**
+ * `kj webperf <url>` — KJC-TSK-0149.
+ *
+ * Headless Lighthouse wrapper. Produces structured CWV + opportunities
+ * JSON. Writes the result into `~/.karajan/webperf/<projectSlug>/last.json`
+ * so future `kj audit` runs can surface the verdict via the existing
+ * WebPerf section (KJC-TSK-0360 cwv-result mode).
+ */
+
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import yaml from "js-yaml";
+import { runWebperfScan } from "../webperf/scanner.js";
+import { withCliRunLog } from "../utils/cli-run-log.js";
+
+// Resolve home each call so tests that override $HOME for hermetic
+// tmp dirs work without re-importing the module.
+function defaultReportDir() {
+  return path.join(os.homedir(), ".karajan", "webperf");
+}
+
+/**
+ * Slug a project directory the same way audit/basal-cost.js and
+ * plan/plan-store.js do, so the per-project webperf history aligns
+ * with audit history under ~/.karajan/.
+ */
+function projectSlug(projectDir) {
+  return path.basename(projectDir || process.cwd()).replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+
+function formatHumanReport(result) {
+  if (!result.ok) {
+    return `WebPerf scan FAILED — ${result.reason}`;
+  }
+  const lines = ["## WebPerf Scan", ""];
+  lines.push(`- URL: ${result.url}`);
+  lines.push(`- Preset: ${result.preset}`);
+  lines.push(`- Captured: ${result.capturedAt}`);
+  if (result.lighthouseVersion) lines.push(`- Lighthouse: v${result.lighthouseVersion}`);
+  if (typeof result.performanceScore === "number") {
+    lines.push(`- Performance score: ${result.performanceScore}/100`);
+  }
+  lines.push("");
+  lines.push(`### Verdict: ${result.cwv.pass ? "PASS" : "FAIL"}`);
+  lines.push("");
+  lines.push("### Core Web Vitals");
+  for (const [metric, score] of Object.entries(result.cwv.scores || {})) {
+    const value = formatMetricValue(metric, score.value);
+    lines.push(`- ${metric.toUpperCase()}: ${value} (${score.rating})`);
+  }
+  if (result.cwv.blocking?.length) {
+    lines.push("");
+    lines.push("### Blocking metrics (above poor threshold)");
+    for (const b of result.cwv.blocking) {
+      lines.push(`- ${b.metric.toUpperCase()}: ${formatMetricValue(b.metric, b.value)} > ${formatMetricValue(b.metric, b.threshold)}`);
+    }
+  }
+  if (result.issues?.length) {
+    lines.push("");
+    lines.push(`### Top opportunities (${result.issues.length})`);
+    for (const issue of result.issues.slice(0, 10)) {
+      const savings = issue.savingsMs ? ` (saves ~${Math.round(issue.savingsMs)}ms)` : "";
+      lines.push(`- [${issue.severity.toUpperCase()}] ${issue.id}${savings}: ${issue.title}`);
+    }
+    if (result.issues.length > 10) {
+      lines.push(`- ... and ${result.issues.length - 10} more`);
+    }
+  }
+  return lines.join("\n");
+}
+
+function formatMetricValue(metric, value) {
+  if (typeof value !== "number") return "n/a";
+  if (metric === "cls") return value.toFixed(3);
+  return `${Math.round(value)}ms`;
+}
+
+/**
+ * Persist the scan result into ~/.karajan/webperf/<slug>/last.json so
+ * `kj audit` can read it via collectWebPerfInput (KJC-TSK-0360).
+ */
+async function persistResult(result, projectDir) {
+  if (!result.ok) return null;
+  const dir = path.join(defaultReportDir(), projectSlug(projectDir));
+  await fs.mkdir(dir, { recursive: true });
+  const filePath = path.join(dir, "last.json");
+  await fs.writeFile(filePath, JSON.stringify(result, null, 2), "utf8");
+  return filePath;
+}
+
+/**
+ * Optionally update kj.config.yml so `kj audit` finds the result by
+ * default (mirrors how sonar config is wired). Best-effort: never
+ * fails the command; absence of config file or write error is logged.
+ */
+async function patchConfigLastResult(configPath, lastResultPath, logger) {
+  if (!configPath || !lastResultPath) return false;
+  let raw;
+  try { raw = await fs.readFile(configPath, "utf8"); } catch { return false; }
+  let parsed;
+  try { parsed = yaml.load(raw) || {}; } catch (err) {
+    if (logger?.warn) logger.warn(`webperf: cannot parse ${configPath}: ${err.message}`);
+    return false;
+  }
+  parsed.webperf = parsed.webperf || {};
+  parsed.webperf.lastResultPath = lastResultPath;
+  try {
+    await fs.writeFile(configPath, yaml.dump(parsed), "utf8");
+    return true;
+  } catch (err) {
+    if (logger?.warn) logger.warn(`webperf: cannot write ${configPath}: ${err.message}`);
+    return false;
+  }
+}
+
+export async function webperfCommand({ url, config, logger, json = false, mobile = false, persist = true, thresholds = null }) {
+  if (!url) {
+    throw new Error("kj webperf: <url> is required (e.g. http://localhost:3000)");
+  }
+  return withCliRunLog("webperf", { projectDir: config?.projectDir, logger }, async ({ runLog }) => {
+    logger.info(`Running webperf scan against ${url} (preset: ${mobile ? "mobile" : "desktop"})`);
+    runLog.logText(`[webperf] scan url=${url} preset=${mobile ? "mobile" : "desktop"}`);
+
+    const scanThresholds = thresholds || config?.webperf?.thresholds || null;
+    const result = await runWebperfScan(url, {
+      preset: mobile ? "mobile" : "desktop",
+      thresholds: scanThresholds,
+      logger,
+    });
+
+    if (json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(formatHumanReport(result));
+    }
+
+    if (!result.ok) {
+      runLog.logText(`[webperf] failed reason=${result.reason}`);
+      return { ok: false, reason: result.reason };
+    }
+
+    runLog.logText(`[webperf] verdict=${result.cwv.pass ? "PASS" : "FAIL"} score=${result.performanceScore}`);
+
+    let savedPath = null;
+    if (persist) {
+      try {
+        savedPath = await persistResult(result, config?.projectDir);
+        if (savedPath) {
+          logger.info(`WebPerf result saved: ${savedPath}`);
+          // Wire into kj.config.yml so `kj audit` picks it up automatically.
+          const configPath = config?.configFilePath
+            || path.join(config?.projectDir || process.cwd(), ".karajan", "kj.config.yml");
+          await patchConfigLastResult(configPath, savedPath, logger);
+        }
+      } catch (err) {
+        logger.warn(`webperf: persist failed (non-blocking): ${err.message}`);
+      }
+    }
+
+    // Exit code: 0 for PASS, 1 for FAIL. Lets CI gate on it.
+    return { ok: result.cwv.pass, result, savedPath };
+  });
+}

package/src/config/defaults.js

@@ -37,6 +37,7 @@ const DEFAULTS = {
     tester: { enabled: true },
     security: { enabled: true },
     impeccable: { enabled: false },
+    perf: { enabled: false },
     triage: { enabled: true },
     discover: { enabled: false },
     architect: { enabled: false },

package/src/config/overrides.js

@@ -37,6 +37,7 @@ const PIPELINE_ENABLE_FLAGS = [
   ["enablePlanner", "planner"], ["enableRefactorer", "refactorer"],
   ["enableSolomon", "solomon"], ["enableResearcher", "researcher"],
   ["enableTester", "tester"], ["enableSecurity", "security"], ["enableImpeccable", "impeccable"],
+  ["enablePerf", "perf"],
   ["enableTriage", "triage"], ["enableDiscover", "discover"],
   ["enableArchitect", "architect"],
   ["enableHuReviewer", "hu_reviewer"]

package/src/config/schema.js

@@ -89,6 +89,7 @@ const PipelineMap = v.optional(v.looseObject({
   tester: v.optional(PipelineEntry),
   security: v.optional(PipelineEntry),
   impeccable: v.optional(PipelineEntry),
+  perf: v.optional(PipelineEntry),
   triage: v.optional(PipelineEntry),
   discover: v.optional(PipelineEntry),
   architect: v.optional(PipelineEntry),

package/src/config/test-harness.js

@@ -76,4 +76,3 @@ export function resolveTestHarness(explicit = {}) {
   return Object.freeze(out);
 }
 
-export { PROD_DEFAULTS, GLOBAL_KEYS };

package/src/mcp/handlers/run-handler.js

@@ -263,7 +263,7 @@ export async function handleResume(a, server, extra) {
     }
     a.answer = validation.sanitized;
   }
-  applySessionOverrides(a, ["coder", "reviewer", "tester", "security", "solomon", "enableTester", "enableSecurity", "enableImpeccable"]);
+  applySessionOverrides(a, ["coder", "reviewer", "tester", "security", "solomon", "enableTester", "enableSecurity", "enableImpeccable", "enablePerf"]);
   return handleResumeDirect(a, server, extra);
 }
 
@@ -303,6 +303,6 @@ export async function handleRun(a, server, extra) {
     const logger = createLogger("info", "mcp");
     logger.info("Preflight auto-acknowledged with default agent config");
   }
-  applySessionOverrides(a, ["coder", "reviewer", "tester", "security", "solomon", "enableTester", "enableSecurity", "enableImpeccable"]);
+  applySessionOverrides(a, ["coder", "reviewer", "tester", "security", "solomon", "enableTester", "enableSecurity", "enableImpeccable", "enablePerf"]);
   return handleRunDirect(a, server, extra);
 }

package/src/mcp/run-kj.js

@@ -50,6 +50,7 @@ export async function runKjCommand({ command, commandArgs = [], options = {}, en
   normalizeBoolFlag(options.enableTester, "--enable-tester", args);
   normalizeBoolFlag(options.enableSecurity, "--enable-security", args);
   normalizeBoolFlag(options.enableImpeccable, "--enable-impeccable", args);
+  normalizeBoolFlag(options.enablePerf, "--enable-perf", args);
   normalizeBoolFlag(options.design, "--design", args);
   normalizeBoolFlag(options.enableTriage, "--enable-triage", args);
   normalizeBoolFlag(options.enableDiscover, "--enable-discover", args);

package/src/mcp/sovereignty-guard.js

@@ -14,7 +14,7 @@ const ALLOWED_PARAMS = new Set([
   "planner", "coder", "reviewer", "refactorer",
   "plannerModel", "coderModel", "reviewerModel", "refactorerModel",
   "enablePlanner", "enableReviewer", "enableRefactorer", "enableResearcher",
-  "enableTester", "enableSecurity", "enableImpeccable",
+  "enableTester", "enableSecurity", "enableImpeccable", "enablePerf",
   "enableDiscover", "enableArchitect",
   "architectModel", "huFile",
   "enableSerena", "enableCi",

package/src/mcp/tools.js

@@ -76,6 +76,7 @@ export const tools = [
         enableTester: { type: "boolean" },
         enableSecurity: { type: "boolean" },
         enableImpeccable: { type: "boolean" },
+        enablePerf: { type: "boolean" },
         enableTriage: { type: "boolean" },
         enableDiscover: { type: "boolean" },
         enableArchitect: { type: "boolean" },

package/src/orchestrator/ci-integration.js

@@ -86,7 +86,7 @@ export async function handleCiEarlyPrOrPush({ ciEnabled, config, session, emitte
   }
 }
 
-export function formatBlockingIssues(issues) {
+function formatBlockingIssues(issues) {
   return issues?.map((x) => `- ${x.id || "ISSUE"} [${x.severity || ""}] ${x.description}`).join("\n") || "";
 }
 

package/src/orchestrator/config-init.js

@@ -217,6 +217,7 @@ export function resolvePipelineFlags(config) {
     testerEnabled: Boolean(config.pipeline?.tester?.enabled),
     securityEnabled: Boolean(config.pipeline?.security?.enabled),
     impeccableEnabled: Boolean(config.pipeline?.impeccable?.enabled),
+    perfEnabled: Boolean(config.pipeline?.perf?.enabled),
     reviewerEnabled: config.pipeline?.reviewer?.enabled !== false,
     discoverEnabled: Boolean(config.pipeline?.discover?.enabled),
     architectEnabled: Boolean(config.pipeline?.architect?.enabled),
@@ -225,7 +226,7 @@ export function resolvePipelineFlags(config) {
 }
 
 export async function handleDryRun({ task, config, flags, emitter, pipelineFlags }) {
-  const { plannerEnabled, refactorerEnabled, researcherEnabled, testerEnabled, securityEnabled, impeccableEnabled, reviewerEnabled, discoverEnabled, architectEnabled, huReviewerEnabled } = pipelineFlags;
+  const { plannerEnabled, refactorerEnabled, researcherEnabled, testerEnabled, securityEnabled, impeccableEnabled, perfEnabled, reviewerEnabled, discoverEnabled, architectEnabled, huReviewerEnabled } = pipelineFlags;
   const plannerRole = resolveRole(config, "planner");
   const coderRole = resolveRole(config, "coder");
   const reviewerRole = resolveRole(config, "reviewer");
@@ -259,6 +260,7 @@ export async function handleDryRun({ task, config, flags, emitter, pipelineFlags
       tester_enabled: testerEnabled,
       security_enabled: securityEnabled,
       impeccable_enabled: impeccableEnabled,
+      perf_enabled: perfEnabled,
       solomon_enabled: Boolean(config.pipeline?.solomon?.enabled),
       hu_reviewer_enabled: huReviewerEnabled
     },

package/src/orchestrator/direct-actions.js

@@ -190,4 +190,4 @@ export function getAllowedActionTypes() {
   return Object.keys(ACTION_HANDLERS);
 }
 
-export { ALLOWED_COMMANDS, isCommandAllowed };
+export { isCommandAllowed };