karajan-code 3.12.1 → 3.12.3

package/README.md

@@ -190,7 +190,7 @@ None of these are required. Karajan auto-skips any scanner that isn't installed,
 | Tool | Scope | Install | Installable from `kj init`? | What you get |
 |------|-------|---------|-----------------------------|--------------|
 | **SonarQube** | Any stack | `docker compose -f ~/sonarqube/docker-compose.yml up -d` | ✅ Yes (wizard configures Docker container + token) | Code quality + security rules with line-precision in `kj audit` |
-| **OSV-Scanner** | Any stack | `go install github.com/google/osv-scanner@latest` | ❌ No (install manually) | Dependency CVE coverage broader than `npm audit` |
+| **OSV-Scanner** | Any stack | `go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest` | ❌ No (install manually) | Dependency CVE coverage broader than `npm audit` |
 | **Semgrep** | Any stack | `pipx install semgrep` | ❌ No (install manually) | SAST: XSS, SQLi, taint flow, secrets — equivalent to `snyk code`, free for OSS |
 | **Lighthouse** | **Frontend only** | `npm install -g lighthouse` | ❌ No (install manually) | Core Web Vitals + opportunities for `kj webperf` (auto-feeds `kj audit`) |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "3.12.1",
+  "version": "3.12.3",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -98,7 +98,6 @@
   },
   "dependencies": {
     "@babel/parser": "^7.29.7",
-    "@karajan/core": "*",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^5.0.0",
@@ -108,15 +107,13 @@
     "express-rate-limit": "^8.5.0",
     "helmet": "^8.1.0",
     "js-yaml": "^4.2.0",
+    "karajan-core": "^1.0.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",
     "sqlite-vec": "^0.1.9",
     "valibot": "^1.4.1",
     "web-tree-sitter": "^0.26.9"
   },
-  "bundleDependencies": [
-    "@karajan/core"
-  ],
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@vitest/coverage-v8": "^4.1.8",

package/packages/hu-board/package.json

@@ -13,7 +13,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@karajan/core": "*",
+    "karajan-core": "*",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^5.0.0",
     "express": "^5.1.0",

package/packages/hu-board/src/plan-mutations.js

@@ -17,13 +17,13 @@
 import { readFileSync, existsSync, readdirSync, mkdirSync, openSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
-import { writeJsonAtomicSync } from '@karajan/core/atomic-write';
+import { writeJsonAtomicSync } from 'karajan-core/atomic-write';
 import { spawn } from 'node:child_process';
 import { trackRun, untrack } from './run-tracker.js';
 import { getHuBoardRunsDir } from './db.js';
 import { fileURLToPath } from 'node:url';
-import { updateHuStatus, certifyAllHus, updateHu } from '@karajan/core/plan-hu-ops';
-import { validateBlockedByChange } from '@karajan/core/plan-validation';
+import { updateHuStatus, certifyAllHus, updateHu } from 'karajan-core/plan-hu-ops';
+import { validateBlockedByChange } from 'karajan-core/plan-validation';
 import { syncPlanFile } from './sync.js';
 import { getDb } from './db.js';
 
@@ -230,7 +230,7 @@ export async function revertHuFromSnapshot({ planId, huId, projectId }) {
   const projectDir = plan.projectDir;
   if (!projectDir) return { ok: false, error: 'plan sin projectDir' };
 
-  const { restoreHuSnapshot } = await import('@karajan/core/hu-snapshot');
+  const { restoreHuSnapshot } = await import('karajan-core/hu-snapshot');
   const restore = await restoreHuSnapshot({ projectDir, huId });
   if (!restore.ok) return { ok: false, error: `restore falló: ${restore.error}` };
 

package/packages/hu-board/src/routes/api.js

@@ -1361,7 +1361,7 @@ router.post('/rag/query', async (req, res) => {
     return res.status(400).json({ error: "'text' is required (non-empty string)" });
   }
   try {
-    const { openVecStore, countChunks } = await import('@karajan/core/vec-store');
+    const { openVecStore, countChunks } = await import('karajan-core/vec-store');
     const { makeEmbedder } = await import('../../../../src/rag/embedders/factory.js');
     const { query } = await import('../../../../src/rag/retriever.js');
     const db = openVecStore({ dim: 768 });

package/packages/hu-board/src/routes/rag.js

@@ -5,7 +5,7 @@
 import { Router } from "express";
 import { existsSync, statSync } from "node:fs";
 import Database from "better-sqlite3";
-import { dbPath } from "@karajan/core/vec-store";
+import { dbPath } from "karajan-core/vec-store";
 import { readConfig } from "../config-yaml.js";
 
 const router = Router();

package/packages/hu-board/src/routes/wiki.js

@@ -4,7 +4,7 @@
 // 503 with installable:true so the front renders an "Install QMD" CTA
 // instead of a generic error when the binary is missing.
 import { Router } from "express";
-import { runCommand } from "@karajan/core/process";
+import { runCommand } from "karajan-core/process";
 
 const router = Router();
 const QMD_NOT_INSTALLED = /command not found|ENOENT|not recognized as/i;

package/packages/hu-board/src/run-tracker.js

@@ -16,7 +16,7 @@
  * se borran como cleanup (responsabilidad de run-registry).
  */
 
-import { listActiveRuns as fsList } from "@karajan/core/run-registry";
+import { listActiveRuns as fsList } from "karajan-core/run-registry";
 
 const runs = new Map();
 let reaperTimer = null;

package/packages/hu-board/src/server.js

@@ -17,7 +17,7 @@ import { reapZombieSessions } from './zombie-reaper.js';
 import { reapZombieHus } from './hu-zombie-reaper.js';
 import { setHuStatus as setHuStatusPlanMutation, setHuFailResult as setHuFailResultPlanMutation } from './plan-mutations.js';
 import { cleanupEphemeralProjects } from './ephemeral-cleaner.js';
-import { findAvailablePort as findAvailablePortBase } from '@karajan/core/port-check';
+import { findAvailablePort as findAvailablePortBase } from 'karajan-core/port-check';
 
 /**
  * Path to the PID file the CLI's `kj board start` / `kj board stop`
@@ -238,7 +238,7 @@ async function main() {
   //   - cooldownUntil > now  → re-programa setTimeout que dispara en cooldown
   // Idempotente (lockfile per session). Cero polling.
   try {
-    const { reconcileAll } = await import('@karajan/core/standby-scheduler');
+    const { reconcileAll } = await import('karajan-core/standby-scheduler');
     const { spawn } = await import('node:child_process');
     const { join, dirname } = await import('node:path');
     const { fileURLToPath } = await import('node:url');

package/packages/hu-board/src/sync.js

@@ -14,7 +14,7 @@ import {
   removeTombstone,
 } from './db.js';
 import { publish as publishEvent } from './event-bus.js';
-import { getSharedPlansDir, SHARED_DIR_NAME, isSharedPath } from '@karajan/core/shared-paths';
+import { getSharedPlansDir, SHARED_DIR_NAME, isSharedPath } from 'karajan-core/shared-paths';
 import { readConfig } from './config-yaml.js';
 
 /**

package/scripts/build-sea.mjs

@@ -19,7 +19,7 @@
  */
 
 import { execSync } from "node:child_process";
-import { cpSync, mkdirSync, writeFileSync, statSync } from "node:fs";
+import { cpSync, mkdirSync, writeFileSync, statSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -59,10 +59,32 @@ async function main() {
 
     // ── Step 2: Generate SEA blob ───────────────────────────────────
     console.log("[2/5] Generating SEA preparation blob...");
+    // Templates travel as SEA assets (KJC-BUG-0104): the binary ships no
+    // templates/ directory, so kj init / role prompts / onboard resolved
+    // paths like $HOME/templates/skills and hit ENOENT. The runtime
+    // (src/utils/templates-root.js) reads the index asset and extracts
+    // the files to ~/.karajan/embedded-templates/<version>/ on first use.
+    const { collectTemplateFiles } = await import("./esbuild-sea.config.mjs");
+    const pkgVersion = JSON.parse(
+      readFileSync(path.join(ROOT, "package.json"), "utf8"),
+    ).version;
+    const templateFiles = collectTemplateFiles();
+    writeFileSync(
+      path.join(DIST, "templates-index.json"),
+      JSON.stringify({ version: pkgVersion, files: templateFiles }),
+    );
+    // Absolute paths: node resolves asset paths against the CWD (not the
+    // config file), so anything relative is ambiguous.
+    const assets = { "templates-index.json": path.join(DIST, "templates-index.json") };
+    for (const rel of templateFiles) {
+      assets[`templates/${rel}`] = path.join(ROOT, "templates", rel);
+    }
+    console.log(`      -> ${templateFiles.length} template assets embedded.`);
     const seaConfig = {
       main: "dist/kj-bundle.cjs",
       output: "dist/sea-prep.blob",
       disableExperimentalSEAWarning: true,
+      assets,
     };
     writeFileSync(
       path.join(DIST, "sea-config.json"),

package/scripts/esbuild-sea.config.mjs

@@ -10,7 +10,7 @@
 
 import path from "node:path";
 import fs from "node:fs/promises";
-import { readFileSync } from "node:fs";
+import { readFileSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -213,6 +213,27 @@ const auditHistoryStubPlugin = {
 };
 
 /** @type {import('esbuild').BuildOptions} */
+/**
+ * List every built-in template file, as paths relative to templates/
+ * (KJC-BUG-0104). The SEA binary ships them as SEA assets — build-sea.mjs
+ * turns this list into the sea-config `assets` map plus an index the
+ * runtime (src/utils/templates-root.js) uses to extract them on first use.
+ * Exported (instead of living in build-sea.mjs, which runs main() on
+ * import) so tests can exercise it.
+ */
+export function collectTemplateFiles(rootDir = path.join(ROOT, "templates")) {
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const p = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(p);
+      else files.push(path.relative(rootDir, p));
+    }
+  };
+  walk(rootDir);
+  return files.sort();
+}
+
 export const seaBuildOptions = {
   entryPoints: ["src/cli.js"],
   outfile: "dist/kj-bundle.cjs",

package/scripts/verify-pack.mjs

@@ -3,7 +3,7 @@
  * Pre-publish tarball smoke gate (KJC-TSK-0553).
  *
  * WHY: the test suite runs against the linked workspace, where
- * `@karajan/core` and its deps resolve via symlink — so a broken
+ * `karajan-core` and its deps resolve via symlink — so a broken
  * PUBLISHED artifact (bundleDependencies dragging in sqlite-vec without
  * its entry point, KJC-BUG-0082 / 0086) passed CI yet failed on every
  * clean `npm install`. v3.2.0, v3.3.0 and v3.4.1 all shipped unable to
@@ -50,6 +50,7 @@ function fail(msg, detail) {
 
 let tgzPath = null;
 let tmpDir = null;
+let gTmp = null;
 let pnpmTmp = null;
 try {
   console.log(`verify-pack: packing karajan-code@${expectedVersion}…`);
@@ -92,15 +93,16 @@ try {
   console.log("verify-pack: kj --help ✓");
 
   // 3. The deps that broke before must resolve in the installed tree.
-  const installedRoot = path.join(tmpDir, "node_modules", "karajan-code");
+  // karajan-core is a registry dep since KJC-BUG-0103 (no bundling), so it
+  // hoists to the consumer's top-level node_modules like everything else.
   const checks = [
     path.join(tmpDir, "node_modules", "sqlite-vec", "index.mjs"),
-    path.join(installedRoot, "node_modules", "@karajan", "core", "src", "vec-store.js"),
+    path.join(tmpDir, "node_modules", "karajan-core", "src", "vec-store.js"),
   ];
   for (const p of checks) {
     if (!fs.existsSync(p)) fail(`expected resolved path missing in install: ${p}`);
   }
-  console.log("verify-pack: sqlite-vec + @karajan/core resolve ✓");
+  console.log("verify-pack: sqlite-vec + karajan-core resolve ✓");
 
   // 4. kj-trash (ai-trash safety binary) must ship + link onto PATH and boot
   // without a module-resolution crash. It was silently absent from the tarball
@@ -115,9 +117,38 @@ try {
   }
   console.log("verify-pack: kj-trash ships + boots ✓");
 
-  // 5. pnpm install smoke (KJC-TSK-0580). pnpm's layout differs from npm's
+  // 5. GLOBAL install smoke (KJC-BUG-0103). `npm install -g` nests every dep
+  // under karajan-code/node_modules; with bundleDependencies present, npm
+  // treated that whole subtree as "already in the tarball" and skipped
+  // fetching better-sqlite3 & friends — EMPTY dirs whose install scripts then
+  // crashed. Local installs hoist and never hit it, which is exactly why the
+  // check above stayed green for ~15 broken releases. A fresh global install
+  // must succeed and kj must boot.
+  gTmp = fs.mkdtempSync(path.join(os.tmpdir(), "kj-verify-g-"));
+  console.log(`verify-pack: installing the tarball GLOBALLY into ${gTmp}…`);
+  try {
+    run("npm", ["install", "-g", tgzPath, "--no-audit", "--no-fund", "--silent", "--prefix", gTmp]);
+  } catch (err) {
+    fail("`npm install -g` of the tarball failed (KJC-BUG-0103 class)", err.stderr || err.message);
+  }
+  const gBin = process.platform === "win32"
+    ? path.join(gTmp, "kj.cmd")
+    : path.join(gTmp, "bin", "kj");
+  if (!fs.existsSync(gBin)) fail(`kj binary missing after global install: ${gBin}`);
+  let gVersion;
+  try {
+    gVersion = run(gBin, ["--version"]).trim();
+  } catch (err) {
+    fail("`kj --version` crashed on a fresh GLOBAL install", err.stderr || err.message);
+  }
+  if (!gVersion.includes(expectedVersion)) {
+    fail(`kj --version (global) returned "${gVersion}", expected ${expectedVersion}`);
+  }
+  console.log(`verify-pack: global install + kj --version → ${gVersion} ✓`);
+
+  // 6. pnpm install smoke (KJC-TSK-0580). pnpm's layout differs from npm's
   // (a symlinked virtual store), so it can break resolution of the bundled
-  // @karajan/core the way npm packaging breakage did before (KJC-BUG-0082/0086).
+  // karajan-core the way npm packaging breakage did before (KJC-BUG-0082/0086).
   // Verify a pnpm install resolves the JS tree and `kj --version` boots — every
   // release catches a pnpm packaging regression. (pnpm also blocks
   // better-sqlite3's native build by default, so DB-backed commands need
@@ -158,5 +189,6 @@ try {
 } finally {
   if (tgzPath && fs.existsSync(tgzPath)) fs.rmSync(tgzPath, { force: true });
   if (tmpDir && fs.existsSync(tmpDir)) fs.rmSync(tmpDir, { recursive: true, force: true });
+  if (gTmp && fs.existsSync(gTmp)) fs.rmSync(gTmp, { recursive: true, force: true });
   if (pnpmTmp && fs.existsSync(pnpmTmp)) fs.rmSync(pnpmTmp, { recursive: true, force: true });
 }

package/src/audit/osv-findings.js

@@ -48,7 +48,7 @@ export async function collectOsvFindings(projectDir, logger = null) {
     // err.code 1 is NORMAL — we still want the stdout. Real failures are
     // ENOENT (binary missing) or stdout empty.
     if (err.code === "ENOENT") {
-      if (logger?.warn) logger.warn("osv-scanner not found in PATH — install via 'go install github.com/google/osv-scanner@latest'");
+      if (logger?.warn) logger.warn("osv-scanner not found in PATH — install via 'go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest'");
       return { available: false, reason: "osv-scanner not installed" };
     }
     if (err.killed) {

package/src/brain/standby-scheduler.js

@@ -1,8 +1,8 @@
-// Shim de compatibilidad: standby-scheduler vive ahora en @karajan/core.
+// Shim de compatibilidad: standby-scheduler vive ahora en karajan-core.
 // Mantiene la ruta para callers internos del CLI.
 export {
   _resetScheduledForTests,
   scheduleResume,
   cancelScheduled,
   reconcileAll,
-} from "@karajan/core/standby-scheduler";
+} from "karajan-core/standby-scheduler";

package/src/brain/standby-store.js

@@ -1,4 +1,4 @@
-// Shim de compatibilidad: standby-store vive ahora en @karajan/core.
+// Shim de compatibilidad: standby-store vive ahora en karajan-core.
 // Mantiene la ruta para callers internos del CLI.
 export {
   standbyDir,
@@ -9,4 +9,4 @@ export {
   listPendingStandby,
   markStandbyDone,
   acquireStandbyLock,
-} from "@karajan/core/standby-store";
+} from "karajan-core/standby-store";

package/src/commands/init.js

@@ -7,6 +7,7 @@ import { ollamaUp, waitForOllamaReady, normalizeOllamaConfig } from "../rag/olla
 import { checkOllamaCapability, pullOllamaModel } from "../rag/ollama-capability.js";
 import { exists, ensureDir } from "../utils/fs.js";
 import { getKarajanHome } from "../utils/paths.js";
+import { getTemplatesRoot } from "../utils/templates-root.js";
 import { detectAvailableAgents } from "../utils/agent-detect.js";
 import { createWizard, isTTY } from "../utils/wizard.js";
 import { runCommand } from "../utils/process.js";
@@ -441,7 +442,7 @@ async function ensureReviewRules(reviewRulesPath, logger) {
 
 async function ensureCoderRules(coderRulesPath, logger) {
   if (await exists(coderRulesPath)) return;
-  const templatePath = path.resolve(import.meta.dirname, "../../templates/coder-rules.md");
+  const templatePath = path.join(getTemplatesRoot(), "coder-rules.md");
   let content;
   try {
     content = await fs.readFile(templatePath, "utf8");
@@ -537,7 +538,7 @@ async function scaffoldCiGateway(config, flags, logger) {
   const workflowDir = path.join(projectDir, ".github", "workflows");
   await ensureDir(workflowDir);
 
-  const templatesDir = path.resolve(import.meta.dirname, "../../templates/workflows");
+  const templatesDir = path.join(getTemplatesRoot(), "workflows");
   const workflows = ["kj-ci-gateway.yml", "automerge.yml", "houston-override.yml"];
 
   for (const wf of workflows) {
@@ -611,7 +612,7 @@ async function bootstrapOllama({ flags, config, logger, interactive }) {
 async function installSkills(logger, interactive) {
   const projectDir = process.cwd();
   const commandsDir = path.join(projectDir, ".claude", "commands");
-  const skillsTemplateDir = path.resolve(import.meta.dirname, "../../templates/skills");
+  const skillsTemplateDir = path.join(getTemplatesRoot(), "skills");
 
   let doInstall = true;
   if (interactive) {

package/src/commands/onboard.js

@@ -6,6 +6,7 @@ import { collectAll } from "../onboarder/collectors/index.js";
 import { OnboarderRole } from "../roles/onboarder-role.js";
 import { resolveRole } from "../config.js";
 import { getKarajanHome } from "../utils/paths.js";
+import { getTemplatesRoot } from "../utils/templates-root.js";
 
 export function briefPath(projectDir) {
   const slug = path.basename(projectDir).replace(/[^a-zA-Z0-9._-]/g, "-").toLowerCase() || "project";
@@ -28,7 +29,7 @@ export async function onboardCommand({ config, logger, flags = {} }) {
     return { path: out, bundle, brief: null };
   }
   const roleCfg = resolveRole(config, "onboarder") || resolveRole(config, "architect");
-  const templatePath = new URL("../../templates/roles/onboarder.md", import.meta.url).pathname;
+  const templatePath = path.join(getTemplatesRoot(), "roles", "onboarder.md");
   const instructions = existsSync(templatePath) ? await readFile(templatePath, "utf8") : "";
   const role = new OnboarderRole({ instructions, config, ...roleCfg });
   // KJC-BUG-0061 Bug B: BaseRole.run() refuses to execute unless init()

package/src/git/hu-snapshot.js

@@ -1,4 +1,4 @@
-// Shim de compatibilidad: hu-snapshot vive ahora en @karajan/core.
+// Shim de compatibilidad: hu-snapshot vive ahora en karajan-core.
 // Mantenemos esta ruta para que callers internos del CLI (orchestrator,
 // runners) sigan funcionando sin tocar imports.
 export {
@@ -7,4 +7,4 @@ export {
   hasHuSnapshot,
   restoreHuSnapshot,
   removeHuSnapshot,
-} from "@karajan/core/hu-snapshot";
+} from "karajan-core/hu-snapshot";

package/src/orchestrator/config-init.js

@@ -10,6 +10,7 @@ import { buildCoderPrompt } from "../prompts/coder.js";
 import { buildReviewerPrompt } from "../prompts/reviewer.js";
 import { resolveRole } from "../config.js";
 import { emitProgress, makeEvent } from "../utils/events.js";
+import { getTemplatesRoot } from "../utils/templates-root.js";
 import { BudgetTracker, extractUsageMetrics } from "../utils/budget.js";
 import { computeKjComparison } from "../budget/comparison.js";
 import { resolveRoleMdPath, loadFirstExisting } from "../roles/base-role.js";
@@ -76,7 +77,7 @@ export async function autoInit(projectDir, logger) {
   logger.info("No .karajan/ found — auto-initializing project scaffolding");
   await ensureDir(karajanDir);
 
-  const templatesDir = path.resolve(path.dirname(new URL(import.meta.url).pathname), "..", "..", "templates");
+  const templatesDir = getTemplatesRoot();
 
   const filesToCopy = [
     { src: "coder-rules.md", dest: "coder-rules.md" },

package/src/plan/plan-hu-ops.js

@@ -1,4 +1,4 @@
-// Shim: plan-hu-ops now lives in @karajan/core/plan-hu-ops so the
+// Shim: plan-hu-ops now lives in karajan-core/plan-hu-ops so the
 // hu-board workspace can consume it without a relative dep on the CLI
 // src tree. KJC-TSK-0511 PR5.
 export {
@@ -13,4 +13,4 @@ export {
   computePlanOutcome,
   certifyAllHus,
   reorderHus,
-} from "@karajan/core/plan-hu-ops";
+} from "karajan-core/plan-hu-ops";

package/src/plan/plan-id.js

@@ -1,4 +1,4 @@
-// Shim: plan-id primitives now live in @karajan/core/plan-id so the
+// Shim: plan-id primitives now live in karajan-core/plan-id so the
 // hu-board workspace can consume them without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR5.
-export { generatePlanId, generateHuId, normaliseAlias } from "@karajan/core/plan-id";
+export { generatePlanId, generateHuId, normaliseAlias } from "karajan-core/plan-id";

package/src/plan/plan-validation.js

@@ -1,4 +1,4 @@
-// Shim: plan-validation now lives in @karajan/core/plan-validation so
+// Shim: plan-validation now lives in karajan-core/plan-validation so
 // the hu-board workspace can consume it without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR6.
-export { validateBlockedByChange } from "@karajan/core/plan-validation";
+export { validateBlockedByChange } from "karajan-core/plan-validation";

package/src/prompts/prompt-resolver.js

@@ -26,8 +26,8 @@
 
 import fs from "node:fs/promises";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { getKarajanHome } from "../utils/paths.js";
+import { getTemplatesRoot } from "../utils/templates-root.js";
 import { normalizeProvider } from "../utils/provider-env.js";
 
 /**
@@ -50,14 +50,7 @@ export function resolveRolePromptPaths(role, provider, projectDir) {
   if (projectDir) homes.push(path.join(projectDir, ".karajan", "roles"));
   homes.push(path.join(getKarajanHome(), "roles"));
 
-  const builtInRoot = path.resolve(
-    path.dirname(fileURLToPath(import.meta.url)),
-    "..",
-    "..",
-    "templates",
-    "roles"
-  );
-  homes.push(builtInRoot);
+  homes.push(path.join(getTemplatesRoot(), "roles"));
 
   const perProvider = [];
   const defaults = [];

package/src/rag/vec-store.js

@@ -1,4 +1,4 @@
-// Shim: vec-store primitives now live in @karajan/core/vec-store so
+// Shim: vec-store primitives now live in karajan-core/vec-store so
 // the hu-board workspace can consume them without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR4.
 export {
@@ -14,4 +14,4 @@ export {
   findChunkByHash,
   countChunks,
   searchBM25,
-} from "@karajan/core/vec-store";
+} from "karajan-core/vec-store";

package/src/utils/atomic-write.js

@@ -1,6 +1,6 @@
-// Shim — the real implementation now lives in @karajan/core/atomic-write.
+// Shim — the real implementation now lives in karajan-core/atomic-write.
 // Kept here so CLI callers (src/**/*.js) keep importing
 // "#utils/atomic-write.js" without churn during KJC-TSK-0511 (decouple
 // @karajan/hu-board). Will be retired once every consumer migrates to
-// the @karajan/core import.
-export { writeJsonAtomic, writeJsonAtomicSync } from "@karajan/core/atomic-write";
+// the karajan-core import.
+export { writeJsonAtomic, writeJsonAtomicSync } from "karajan-core/atomic-write";

package/src/utils/install-hints.js

@@ -97,7 +97,11 @@ const INSTALL_CANDIDATES = {
     { manager: "pip", command: "pip install semgrep" },
   ],
   "osv-scanner": [
-    { manager: "go", command: "go install github.com/google/osv-scanner@latest" },
+    // The module root has no main package — the binary lives in the cmd/
+    // subpackage, and since v2 the module path carries the /v2 suffix.
+    // `go install github.com/google/osv-scanner@latest` resolves the module
+    // (v1.x) but fails with "does not contain package" (KJC-BUG-0105).
+    { manager: "go", command: "go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest" },
     { manager: "brew", command: "brew install osv-scanner" },
   ],
   lighthouse: [

package/src/utils/paths.js

@@ -1,4 +1,4 @@
-// Shim: paths primitives now live in @karajan/core/paths so the
+// Shim: paths primitives now live in karajan-core/paths so the
 // hu-board workspace can consume them without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR3.
 export {
@@ -10,4 +10,4 @@ export {
   getOllamaComposePath,
   getWebperfDir,
   getPromptsDir,
-} from "@karajan/core/paths";
+} from "karajan-core/paths";

package/src/utils/port-check.js

@@ -1,6 +1,6 @@
-// Shim — the real implementation now lives in @karajan/core/port-check.
+// Shim — the real implementation now lives in karajan-core/port-check.
 // Kept here so CLI callers (src/**/*.js) keep importing
 // "../utils/port-check.js" without churn during KJC-TSK-0511 (decouple
 // @karajan/hu-board). Will be retired once every consumer migrates to
-// the @karajan/core import.
-export { isPortAvailable, findAvailablePort } from "@karajan/core/port-check";
+// the karajan-core import.
+export { isPortAvailable, findAvailablePort } from "karajan-core/port-check";

package/src/utils/process.js

@@ -1,4 +1,4 @@
-// Shim: process runner now lives in @karajan/core/process so the
+// Shim: process runner now lives in karajan-core/process so the
 // hu-board workspace can consume it without a relative dep on the CLI
 // src tree. KJC-TSK-0511 PR6.
-export { runCommand } from "@karajan/core/process";
+export { runCommand } from "karajan-core/process";

package/src/utils/run-registry.js

@@ -1,4 +1,4 @@
-// Shim: run-registry now lives in @karajan/core/run-registry so the
+// Shim: run-registry now lives in karajan-core/run-registry so the
 // hu-board workspace can consume it without a relative dep on the CLI
 // src tree. KJC-TSK-0511 PR3.
 export {
@@ -6,4 +6,4 @@ export {
   registerRun,
   unregisterRun,
   listActiveRuns,
-} from "@karajan/core/run-registry";
+} from "karajan-core/run-registry";

package/src/utils/shared-paths.js

@@ -1,12 +1,12 @@
-// Shim — the real implementation now lives in @karajan/core/shared-paths.
+// Shim — the real implementation now lives in karajan-core/shared-paths.
 // Kept here so CLI callers (src/**/*.js) keep importing
 // "../utils/shared-paths.js" without churn during KJC-TSK-0511 (decouple
 // @karajan/hu-board). Will be retired once every consumer migrates to
-// the @karajan/core import.
+// the karajan-core import.
 export {
   SHARED_DIR_NAME,
   getSharedRoot,
   getSharedPlansDir,
   getSharedHuStoriesDir,
   isSharedPath,
-} from "@karajan/core/shared-paths";
+} from "karajan-core/shared-paths";