karajan-code 3.10.1 → 3.10.2

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "karajan-code",
-  "version": "3.10.1",
+  "version": "3.10.2",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
-  "author": "Manu Fosela <mjfosela@gmail.com>",
+  "author": "manufosela (https://github.com/manufosela)",
   "homepage": "https://github.com/manufosela/karajan-code#readme",
   "repository": {
     "type": "git",

package/src/orchestrator/direct-actions.js

@@ -26,6 +26,18 @@ const ALLOWED_COMMANDS = [
   "bundle install", "composer install", "dotnet restore"
 ];
 
+/**
+ * True when `target` resolves to a path inside `base` (or is `base` itself).
+ * Uses path.relative instead of a string prefix check: a naive
+ * `resolved.startsWith(base)` lets a sibling with a shared prefix slip through
+ * (base `/repo/app` would accept `/repo/app2`). Also rejects absolute paths
+ * pointing outside the project.
+ */
+function isInsideBase(target, base) {
+  const rel = path.relative(base, target);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
 /**
  * Validate that a shell command is in the allow-list.
  * Prevents arbitrary command execution.
@@ -74,7 +86,7 @@ async function createFile({ filePath, content, cwd, overwrite = false }) {
     // Path traversal guard
     const resolved = path.resolve(fullPath);
     const base = path.resolve(cwd || process.cwd());
-    if (!resolved.startsWith(base)) {
+    if (!isInsideBase(resolved, base)) {
       return { ok: false, error: "Path traversal denied", action: "create_file" };
     }
 
@@ -130,9 +142,10 @@ async function gitAdd({ files, cwd }) {
   }
 
   try {
-    // Only allow relative paths (no absolute paths, no shell metacharacters)
+    // Reject shell metacharacters and anything that resolves outside the project.
+    const base = path.resolve(cwd || process.cwd());
     for (const f of files) {
-      if (typeof f !== "string" || f.includes("..") || /[;&|`$]/.test(f)) {
+      if (typeof f !== "string" || /[;&|`$]/.test(f) || !isInsideBase(path.resolve(base, f), base)) {
         return { ok: false, error: `Invalid file path: ${f}`, action: "git_add" };
       }
     }

package/src/orchestrator/stages/triage-stage.js

@@ -11,6 +11,20 @@ import { createStallDetector } from "../../utils/stall-detector.js";
 
 const ROLE_NAMES = ["planner", "researcher", "architect", "refactorer", "reviewer", "tester", "security", "impeccable"];
 
+// What each role is for. Used to explain — deterministically — why triage would
+// or would not turn a role on. These describe the role's trigger, never a claim
+// about the current task, so the rationale is never invented per run.
+const ROLE_PURPOSE = {
+  planner: "planificación multi-fichero",
+  researcher: "investigación de contexto externo",
+  architect: "decisiones de arquitectura",
+  refactorer: "refactor de código existente",
+  reviewer: "revisión de cambios",
+  tester: "cobertura de tests dedicada",
+  security: "auditoría de seguridad",
+  impeccable: "auditoría de diseño"
+};
+
 function buildRoleOverrides(recommendedRoles, pipelineConfig) {
   const overrides = {};
   for (const role of ROLE_NAMES) {
@@ -19,6 +33,28 @@ function buildRoleOverrides(recommendedRoles, pipelineConfig) {
   return overrides;
 }
 
+// Per-role explanation of the activate/skip decision, mirroring buildRoleOverrides.
+// When triage failed, recommendations are unavailable: roles resolve from config
+// alone and skipped ones get a neutral "sin datos de triage" reason.
+function buildRoleRationale(recommendedRoles, pipelineConfig, triageOk) {
+  return ROLE_NAMES.map((role) => {
+    const forced = Boolean(pipelineConfig[role]?.enabled);
+    const recommended = triageOk && recommendedRoles.has(role);
+    const purpose = ROLE_PURPOSE[role];
+
+    if (recommended) {
+      return { role, enabled: true, source: "triage", reason: `recomendado por triage — ${purpose}` };
+    }
+    if (forced) {
+      return { role, enabled: true, source: "config", reason: `forzado por configuración — ${purpose}` };
+    }
+    const reason = triageOk
+      ? `no recomendado — ${purpose} sin aplicar`
+      : `sin datos de triage — ${purpose} sin evaluar`;
+    return { role, enabled: false, source: "none", reason };
+  });
+}
+
 function applyModelSelection(triageOutput, config, emitter, eventBase) {
   if (!triageOutput.ok || !config?.model_selection?.enabled) return null;
   const level = triageOutput.result?.level;
@@ -104,7 +140,8 @@ export async function runTriageStage({ config, logger, emitter, eventBase, sessi
     taskType: triageOutput.result?.taskType || "sw",
     shouldDecompose,
     subtasks,
-    domainHints
+    domainHints,
+    roleRationale: buildRoleRationale(recommendedRoles, config.pipeline || {}, triageOutput.ok)
   };
 
   const modelSelection = applyModelSelection(triageOutput, config, emitter, eventBase);

package/src/utils/display/event-handlers.js

@@ -69,6 +69,20 @@ export const EVENT_HANDLERS = {
     console.log(`  \u251c\u2500 ${icon} TDD policy: ${label}${files}${executor}`);
   },
 
+  "triage:end": (event, icon, elapsed, status) => {
+    const detail = event.detail || {};
+    const level = detail.level ? ` ${detail.level}` : "";
+    const onCount = detail.roles?.length || 0;
+    console.log(
+      `  \u251c\u2500 ${icon} ${status} Triage${level}${ANSI.dim} \u2014 ${onCount} role(s) on${ANSI.reset}  ${elapsed}`
+    );
+    // Per-role rationale: why each role was activated or skipped (KJC-TSK-0601).
+    for (const entry of detail.roleRationale || []) {
+      const mark = entry.enabled ? `${ANSI.green}\u2713${ANSI.reset}` : `${ANSI.dim}\u2717${ANSI.reset}`;
+      console.log(`  \u2502    ${mark} ${ANSI.dim}${entry.role}: ${entry.reason}${ANSI.reset}`);
+    }
+  },
+
   "researcher:start": (event, icon) => {
     console.log(`  \u251c\u2500 ${icon} Researcher (${event.detail?.researcher || "?"}) investigating...`);
   },