karajan-code 3.4.0 → 3.4.1

package/src/golden/asserter.js

@@ -10,12 +10,14 @@
  * allowed_loc_range need filesystem access — PR-3a wires those.
  */
 
+import { escapeRegExp } from "../utils/escape-regexp.js";
+
 const COMMIT_LINE = /^- `([^`]+)`\s+(.*)$/;
 const SCORE_LINE = /^\*\*Score\*\*:\s*(\d+)\s*\/\s*100/m;
 const AUDIT_ROW = /^\|\s*`audit`\s*\|\s*([^|]+?)\s*\|/m;
 
 function extractSection(content, heading) {
-  const re = new RegExp(`^## ${heading}\\s*$([\\s\\S]*?)(?=^## |\\Z)`, "m");
+  const re = new RegExp(`^## ${escapeRegExp(heading)}\\s*$([\\s\\S]*?)(?=^## |\\Z)`, "m");
   const m = content.match(re);
   return m ? m[1].trim() : "";
 }

package/src/golden/schema.js

@@ -12,7 +12,7 @@ const NonNegInt = v.pipe(v.number(), v.integer(), v.minValue(0));
 const LocRangeSchema = v.pipe(v.array(NonNegInt), v.length(2),
   v.check((arr) => arr[0] <= arr[1], "allowed_loc_range: min must be <= max"));
 
-export const GoldenTaskSchema = v.looseObject({
+const GoldenTaskSchema = v.looseObject({
   id: v.pipe(NonEmptyString, v.regex(/^[a-z0-9_-]+$/, "id must be lowercase a-z0-9_-")),
   title: NonEmptyString,
   prompt: NonEmptyString,

package/src/hu/auto-generator.js

@@ -106,7 +106,7 @@ function filterConflictingHints(hints) {
  * @param {string[]} hints
  * @returns {"python"|"go"|"rust"|"javascript"}
  */
-export function resolveLanguageFromHints(hints) {
+function resolveLanguageFromHints(hints) {
   if (!hints || hints.length === 0) return "javascript";
   if (hints.some((h) => HINT_PYTHON.has(h))) return "python";
   if (hints.some((h) => HINT_GO.has(h))) return "go";

package/src/lang/tree-sitter-loader.js

@@ -24,7 +24,7 @@ async function initRuntime() {
   return runtimePromise;
 }
 
-export function grammarPath(id) {
+function grammarPath(id) {
   return resolve(GRAMMAR_DIR, `${id}.wasm`);
 }
 
@@ -43,7 +43,3 @@ export function getLoaded(id) {
   return cache.get(id) || null;
 }
 
-export function resetForTests() {
-  cache.clear();
-  runtimePromise = null;
-}

package/src/mcp/handlers/management-handlers.js

@@ -16,6 +16,7 @@ import {
 } from "../shared-helpers.js";
 import { buildDashboardJson } from "../../utils/status-dashboard.js";
 import { loadMostRecentSession } from "../../session/store.js";
+import { escapeRegExp } from "../../utils/escape-regexp.js";
 
 const AGENT_ROLES = new Set(["coder", "reviewer", "tester", "security", "solomon"]);
 
@@ -72,9 +73,9 @@ export async function handleAgents(a) {
 function parseHumanResponseOverrides(humanResponse, overrides) {
   for (const role of AGENT_ROLES) {
     const patterns = [
-      new RegExp(String.raw`use\s+(\w+)\s+(?:as|for)\s+${role}`, "i"),
-      new RegExp(String.raw`${role}\s*[:=]\s*(\w+)`, "i"),
-      new RegExp(String.raw`set\s+${role}\s+(?:to|=)\s*(\w+)`, "i")
+      new RegExp(String.raw`use\s+(\w+)\s+(?:as|for)\s+${escapeRegExp(role)}`, "i"),
+      new RegExp(String.raw`${escapeRegExp(role)}\s*[:=]\s*(\w+)`, "i"),
+      new RegExp(String.raw`set\s+${escapeRegExp(role)}\s+(?:to|=)\s*(\w+)`, "i")
     ];
     for (const pat of patterns) {
       const m = pat.exec(humanResponse);

package/src/orchestrator/drivers/post-loop.js

@@ -34,7 +34,6 @@ import { emitProgress, makeEvent } from "../../utils/events.js";
 import { runTesterStage, runSecurityStage, runFinalAuditStage } from "../post-loop-stages.js";
 import { invokeSolomon } from "../solomon-escalation.js";
 import { tryCiComment } from "../ci-integration.js";
-import { writeIterationsJournal } from "../session-journal.js";
 import { getIntegration } from "../integrations.js";
 
 export async function handlePostLoopStages({ config, session, emitter, eventBase, coderRole, trackBudget, i, task, stageResults, ciEnabled: _ciEnabled, testerEnabled, securityEnabled, askQuestion, logger, brainCtx }) {
@@ -129,103 +128,56 @@ export async function finalizeApprovedSession({ config, gitCtx, task, logger, se
   if (rtkSavings) setRtkSavings(session, rtkSavings);
   await saveSession(session);
 
-  // --- Journal: write final files ---
+  // --- Journal: write final files (shared writer, KJC-BUG-0084) ---
   const journalDir = session._journalDir;
   if (journalDir) {
+    // 2026-05-07 dogfooding: gitResult.commits only carries the post-loop
+    // commit (scaffold). Compute the full range from session_start_sha so
+    // every commit the run produced shows up in execution order.
+    let allCommits;
+    try { allCommits = (await listCommitsBetween(session.head_at_start || session.session_start_sha)) || []; }
+    catch { allCommits = gitResult?.commits || []; }
+    const summaryCommits = allCommits.length > 0 ? allCommits : (gitResult?.commits || []);
+
+    // KJC-TSK-0376 — plan adherence metric (deepeval-inspired). When the
+    // run executed against a known plan (`kj run --plan <id>`), score how
+    // faithfully the coder followed it. Pure offline; safe-by-default
+    // (try/catch swallows missing helper or unreadable plan).
+    let planAdherence = null;
     try {
-      await writeIterationsJournal(journalDir, session._journalIterations || []);
-      // decisions.md: writes only when Solomon was invoked (AC of KJC-TSK-0287).
-      // Pulls structured data from session.solomonRulings + session.brainDecisions.
-      const { writeDecisionsJournal: writeDecisionsJournalV2 } =
-        await import("../../session/journal/decisions-writer.js");
-      const decisionsResult = await writeDecisionsJournalV2(session, { journalDir, logger });
-      // KJC-TSK-0288: use the new tree-writer with directory grouping
-      const { writeTreeJournal: writeTreeJournalV2 } =
-        await import("../../session/journal/tree-writer.js");
-      const treeResult = await writeTreeJournalV2(journalDir, session.session_start_sha, { logger });
-
-      const journalFiles = [...(session._journalFiles || [])];
-      if (session._journalIterations?.length) journalFiles.push("iterations.md");
-      if (decisionsResult.written) journalFiles.push("decisions.md");
-      if (treeResult.written) journalFiles.push("tree.txt");
-
-      // KJC-TSK-0289: use the richer summary writer (stages table, budget
-      // breakdown, brain/solomon counts, typed links to other journal files).
-      const { writeSummaryJournal: writeSummaryJournalV2 } =
-        await import("../../session/journal/summary-writer.js");
-      const startedAt = session._startedAt ? new Date(session._startedAt).toISOString() : undefined;
-      // 2026-05-07 dogfooding: gitResult.commits only carries the post-loop
-      // commit (scaffold), not the coder's own commit. The summary's
-      // "Commits" section was therefore misleading — it claimed the run
-      // produced one chore commit when in fact the coder had also written
-      // a docs/feat commit. Compute the full range from session_start_sha
-      // so every commit between then and HEAD shows up in execution order.
-      // try/catch (instead of `.catch(...)`) so we tolerate both promise
-      // rejection AND a sync return of undefined — the latter happens
-      // when a test mocks listCommitsBetween with a plain vi.fn() that
-      // resetAllMocks has stripped of its mockResolvedValue.
-      let allCommits = [];
-      try { allCommits = (await listCommitsBetween(session.head_at_start || session.session_start_sha)) || []; }
-      catch { allCommits = gitResult?.commits || []; }
-      const summaryCommits = allCommits.length > 0 ? allCommits : (gitResult?.commits || []);
-
-      // KJC-TSK-0376 — plan adherence metric (deepeval-inspired). When the
-      // run executed against a known plan (`kj run --plan <id>`), score how
-      // faithfully the coder followed it. Pure offline; safe-by-default
-      // (try/catch swallows missing helper or unreadable plan).
-      let planAdherence = null;
-      try {
-        const planId = session._planRef?.planId
-          || stageResults?.huReviewer?.planId
-          || null;
-        if (planId) {
-          const projectDir = config?.projectDir
-            || session.config_snapshot?.projectDir
-            || process.cwd();
-          const plan = await loadPlan(projectDir, planId).catch(() => null);
-          if (plan && Array.isArray(plan.hus) && plan.hus.length > 0) {
-            const filesChanged = await listFilesChangedSince(
-              session.head_at_start || session.session_start_sha,
-            ).catch(() => []);
-            planAdherence = computePlanAdherenceScore({
-              commits: summaryCommits,
-              plan,
-              filesChanged,
-            });
-          }
+      const planId = session._planRef?.planId
+        || stageResults?.huReviewer?.planId
+        || null;
+      if (planId) {
+        const projectDir = config?.projectDir
+          || session.config_snapshot?.projectDir
+          || process.cwd();
+        const plan = await loadPlan(projectDir, planId).catch(() => null);
+        if (plan && Array.isArray(plan.hus) && plan.hus.length > 0) {
+          const filesChanged = await listFilesChangedSince(
+            session.head_at_start || session.session_start_sha,
+          ).catch(() => []);
+          planAdherence = computePlanAdherenceScore({
+            commits: summaryCommits,
+            plan,
+            filesChanged,
+          });
         }
-      } catch (err) {
-        logger?.warn?.(`Plan adherence calculation skipped: ${err.message}`);
       }
-
-      await writeSummaryJournalV2(journalDir, {
-        task: session.task,
-        result: "APPROVED",
-        sessionId: session.id,
-        iterations: i,
-        durationMs: Date.now() - (session._startedAt || Date.now()),
-        budget: budgetSummary(),
-        stages: stageResults,
-        commits: summaryCommits,
-        files: journalFiles,
-        startedAt,
-        finishedAt: new Date().toISOString(),
-        brainDecisions: Array.isArray(session.brainDecisions) ? session.brainDecisions.length : 0,
-        solomonInvocations: Array.isArray(session.solomonRulings) ? session.solomonRulings.length : 0,
-        // KJC-TSK-0327: surface skill-source decisions in the summary so the
-        // post-mortem shows which process skills (addyosmani) and stack skills
-        // (OpenSkills) actually shaped the role prompts.
-        skills: {
-          addyosmani: session.addyosmaniSkills,
-          installed: session.autoInstalledSkills,
-          recommended: session.skillsRecommended,
-        },
-        planAdherence,
-      }, { logger });
-      logger.info(`Session journal written to ${journalDir}`);
     } catch (err) {
-      logger.warn(`Journal write failed (non-blocking): ${err.message}`);
+      logger?.warn?.(`Plan adherence calculation skipped: ${err.message}`);
     }
+
+    const { writeSessionJournal } = await import("../../session/journal/write-all.js");
+    await writeSessionJournal({
+      session, logger,
+      result: "APPROVED",
+      iterations: i,
+      budget: budgetSummary(),
+      stages: stageResults,
+      commits: summaryCommits,
+      planAdherence,
+    });
   }
 
   // Mirror the same enriched commit list into the session:end event so the

package/src/orchestrator/flow-runner.js

@@ -247,6 +247,31 @@ async function _runFlowInner({ task, config, logger, flags = {}, emitter = null,
     await sealSessionStatusIfStillRunning(ctx.session, result);
     return result;
   } finally {
+    // --- Journal: best-effort write for non-approved endings (KJC-BUG-0084) ---
+    // finalizeApprovedSession writes the journal on the happy path and sets
+    // session._journalWritten. Every other terminal ending (sonar_repeat
+    // stall, stage_error, thrown stage, budget exceeded) used to leave only
+    // triage.md behind — losing the Cache hits table, budget breakdown and
+    // commits exactly on the runs where the post-mortem matters most.
+    // Paused sessions are skipped: they resume later and the eventual
+    // finalize overwrites the journal with the real outcome.
+    try {
+      const s = ctx.session;
+      if (s && s._journalDir && !s._journalWritten && s.status !== "paused") {
+        const { writeSessionJournal } = await import("../session/journal/write-all.js");
+        const badge = s.status && s.status !== "running" ? s.status.toUpperCase() : "FAILED";
+        await writeSessionJournal({
+          session: s, logger,
+          result: badge,
+          iterations: s._journalIterations?.length || 0,
+          budget: typeof ctx.budgetSummary === "function" ? ctx.budgetSummary() : null,
+          stages: ctx.stageResults || {},
+        });
+      }
+    } catch (err) {
+      logger.warn(`Final journal write failed (non-blocking): ${err.message}`);
+    }
+
     // --- Cleanup auto-installed skills ---
     const autoSkills = ctx.session?.autoInstalledSkills;
     if (autoSkills && autoSkills.length > 0) {

package/src/orchestrator/fs-leak-detector.js

@@ -156,11 +156,16 @@ export function detectTranscriptCdLeaks(transcript, projectDir) {
   const projectDirAbs = projectDir ? path.resolve(projectDir) : null;
   const homeDir = os.homedir();
   // Capture cd target + the next ~200 chars of the same line for write-cmd lookup.
-  const cdRegex = /\bcd\s+(~\/[^\s&|;`'"\n]+|\$HOME\/[^\s&|;`'"\n]+|\/[^\s&|;`'"\n]+)([^\n]{0,200})/g;
+  // Two-step (S5843, complexity 31): capture ANY cd target with one simple
+  // class, then filter to the absolute/home-rooted shapes the original
+  // single alternation required (~/, $HOME/, /).
+  const cdRegex = /\bcd\s+([^\s&|;`'"\n]+)([^\n]{0,200})/g;
+  const absoluteTargetRe = /^(?:~\/|\$HOME\/|\/)/;
   const writeCmdRegex = /\b(mkdir|touch|cp|mv|git\s+init|(?:pnpm|npm|yarn)\s+(?:init|create)|npx\s+create|cat\s*>|echo\s+[^|]*>|>>?\s*\S)/i;
   const leaks = new Set();
   let match;
   while ((match = cdRegex.exec(transcript)) !== null) {
+    if (!absoluteTargetRe.test(match[1])) continue;
     const original = match[1];
     let target = original;
     const rest = match[2] || "";

package/src/orchestrator/preflight-checks.js

@@ -11,6 +11,7 @@
 
 import { checkBinary } from "../utils/agent-detect.js";
 import { isSonarReachable, sonarUp } from "../sonar/manager.js";
+import { resolveSonarProjectKey, canResolveSonarProjectKey } from "../sonar/project-key.js";
 import { runCommand } from "../utils/process.js";
 import { emitProgress, makeEvent } from "../utils/events.js";
 import { msg, getLang } from "../utils/messages.js";
@@ -137,6 +138,28 @@ async function checkSonarAuth(config) {
   return { name: "sonar-auth", ok: false, detail: "Could not validate or generate Sonar token" };
 }
 
+/**
+ * KJC-BUG-0083 — run the real project-key resolver at preflight time so a
+ * repo Sonar cannot scan aborts BEFORE the first coder iteration instead
+ * of dying in sonar_repeat after burning tokens. Sonar stays mandatory
+ * for code tasks (v2.7.4 contract); this only moves the failure earlier.
+ */
+async function checkSonarProjectKey(config) {
+  // No remote at all (fresh local project): the SonarStage already skips
+  // cleanly via canResolveSonarProjectKey, so preflight must not block.
+  // The hard-fail case is the inconsistent one: a remote EXISTS but the
+  // resolver cannot parse it — that's what looped into sonar_repeat.
+  if (!(await canResolveSonarProjectKey(config))) {
+    return { name: "sonar-project-key", ok: true, detail: "No git remote — Sonar stage will skip cleanly" };
+  }
+  try {
+    const key = await resolveSonarProjectKey(config);
+    return { name: "sonar-project-key", ok: true, detail: `Project key resolved: ${key}` };
+  } catch (err) {
+    return { name: "sonar-project-key", ok: false, detail: err.message };
+  }
+}
+
 async function checkSecurityAgent(config) {
   const provider = config.roles?.security?.provider
     || config.roles?.coder?.provider
@@ -311,6 +334,34 @@ export async function runPreflightChecks({ config, logger, emitter, eventBase, r
     }
   }
 
+  // --- 3b. Sonar project key derivable (KJC-BUG-0083) ---
+  // The scanner derives its project key from git remote.origin.url. With
+  // an unparseable remote (local-path bare, exotic URL) and no explicit
+  // sonarqube.project_key, every iteration's scan threw, the run burned
+  // coder tokens and died in sonar_repeat. Run the REAL resolver here —
+  // canResolveSonarProjectKey() is weaker (any non-empty remote passes) —
+  // so the run fails fast with the actionable message before iteration 1.
+  if (sonarEnabled && result.ok) {
+    const keyCheck = await checkSonarProjectKey(config);
+    result.checks.push(keyCheck);
+
+    emitProgress(emitter, makeEvent("preflight:check", { ...eventBase, stage: "preflight" }, {
+      status: keyCheck.ok ? "ok" : "fail",
+      message: `Sonar project key: ${keyCheck.detail}`,
+      detail: keyCheck
+    }));
+
+    if (!keyCheck.ok) {
+      result.ok = false;
+      result.errors.push({
+        check: "sonar-project-key",
+        message: "Sonar cannot scan this repository: no project key can be derived.",
+        fix: withDocLink("Set sonarqube.project_key in kj.config.yml, or point remote.origin.url at a valid SSH/HTTPS remote.", "sonar_docker")
+      });
+      logger.error("Preflight: Sonar project key not derivable — failing fast before burning iterations");
+    }
+  }
+
   // --- 4. Security agent (graceful — only warning, not blocking) ---
   if (securityEnabled) {
     const secCheck = await checkSecurityAgent(config);

package/src/orchestrator/solomon-rules.js

@@ -70,7 +70,18 @@ export function evaluateRules(context, rulesConfig = {}) {
     const styleKeywords = /\b(naming|name|rename|style|format|formatting|indent|spacing|camelCase|snake_case|convention|cosmetic|readability|comment|jsdoc|documentation|whitespace|semicolon|quotes|trailing)\b/i;
     // Anti-style: if any of these match, the issue is NOT style — it's a real correctness/security concern.
     // Fixes KJC-BUG-0026 (Solomon approving legitimate security blockers misclassified as "style").
-    const securityKeywords = /\b(sql\s*injection|xss|csrf|ssrf|rce|injection|vulnerab|exploit|sanitiz|escape\b|encod\b|cors|auth|authn|authz|password|secret|credential|token|api[-_\s]*key|private[-_\s]*key|hash|cipher|crypto|encrypt|decrypt|tls|ssl|certificate|leak|sensitive|pii|privacy|insecure|unsafe|race[-_\s]*condition|deadlock|memory[-_\s]*leak|null[-_\s]*deref|uaf|overflow|traversal|prototype[-_\s]*pollution|deserializ|eval\b|exec\b|spawn|shell|command[-_\s]*injection)\b/i;
+    // Decomposed by concern (S5843, complexity 71 → 7 named groups).
+    // The union of tokens is byte-identical to the original alternation.
+    const SECURITY_KEYWORD_GROUPS = [
+      /\b(sql\s*injection|xss|csrf|ssrf|rce|injection|vulnerab|exploit)\b/i,
+      /\b(sanitiz|escape\b|encod\b|cors|traversal|prototype[-_\s]*pollution|deserializ)\b/i,
+      /\b(auth|authn|authz|password|secret|credential|token|api[-_\s]*key|private[-_\s]*key)\b/i,
+      /\b(hash|cipher|crypto|encrypt|decrypt|tls|ssl|certificate)\b/i,
+      /\b(leak|sensitive|pii|privacy|insecure|unsafe)\b/i,
+      /\b(race[-_\s]*condition|deadlock|memory[-_\s]*leak|null[-_\s]*deref|uaf|overflow)\b/i,
+      /\b(eval\b|exec\b|spawn|shell|command[-_\s]*injection)\b/i,
+    ];
+    const securityKeywords = { test: (text) => SECURITY_KEYWORD_GROUPS.some((re) => re.test(text)) };
     const securityCategories = new Set(["security", "correctness", "bug", "vulnerability"]);
     const styleSeverities = new Set(["low", "minor"]);
     const blockingSeverities = new Set(["critical", "high", "blocker", "major"]);

package/src/prompts/audit.js

@@ -49,13 +49,10 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
     const stackLines = ["## Project Stack"];
     if (stack.language) stackLines.push(`- Language: ${stack.language}`);
     if (stack.frameworks?.length) stackLines.push(`- Frameworks: ${stack.frameworks.join(", ")}`);
-    const tier = stack.isFullstack
-      ? "fullstack (frontend + backend)"
-      : stack.isFrontend
-        ? "frontend-only"
-        : stack.isBackend
-          ? "backend-only"
-          : "unknown";
+    let tier = "unknown";
+    if (stack.isFullstack) tier = "fullstack (frontend + backend)";
+    else if (stack.isFrontend) tier = "frontend-only";
+    else if (stack.isBackend) tier = "backend-only";
     stackLines.push(`- Tier: ${tier}`);
     if (stack.isFullstack) {
       stackLines.push("Apply BOTH backend heuristics (queries, sync I/O, caching) AND frontend heuristics (bundle size, lazy loading, render-blocking) where each layer applies.");
@@ -241,7 +238,8 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
         lines.push(`### ${severity} (${issues.length})`);
         const slice = issues.slice(0, Math.max(0, remaining));
         for (const issue of slice) {
-          const loc = issue.component ? `${issue.component}${issue.line ? `:${issue.line}` : ""}` : "";
+          const lineSuffix = issue.line ? `:${issue.line}` : "";
+          const loc = issue.component ? `${issue.component}${lineSuffix}` : "";
           const rule = issue.rule ? ` [${issue.rule}]` : "";
           lines.push(`  - ${loc}${rule} ${issue.message || ""}`.trim());
         }
@@ -332,8 +330,10 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
       lines.push(`### ${severity} (${findings.length})`);
       const slice = findings.slice(0, Math.max(0, remaining));
       for (const f of slice) {
-        const loc = f.file ? `${f.file}${f.line ? `:${f.line}` : ""}` : "";
-        const cwe = f.cwe ? ` (${Array.isArray(f.cwe) ? f.cwe.join(", ") : f.cwe})` : "";
+        const lineSuffix = f.line ? `:${f.line}` : "";
+        const loc = f.file ? `${f.file}${lineSuffix}` : "";
+        const cweText = Array.isArray(f.cwe) ? f.cwe.join(", ") : f.cwe;
+        const cwe = f.cwe ? ` (${cweText})` : "";
         lines.push(`  - ${loc} [${f.rule}]${cwe}: ${f.message || ""}`.trim());
       }
       if (findings.length > slice.length) {
@@ -355,7 +355,8 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
     lines.push(`- Unused files: ${(deadExports.files || []).length}`);
     const allItems = [...(deadExports.exports || []), ...(deadExports.files || [])].slice(0, 40);
     for (const item of allItems) {
-      const loc = `${item.path}${item.line ? `:${item.line}` : ""}`;
+      const lineSuffix = item.line ? `:${item.line}` : "";
+      const loc = `${item.path}${lineSuffix}`;
       const name = item.name ? ` \`${item.name}\`` : "";
       lines.push(`  - [${item.severity}] ${loc} [${item.rule}]${name}`);
     }

package/src/prompts/hu-reviewer.js

@@ -29,7 +29,7 @@ const DIMENSION_KEYS = [
  * identical across batches on the same project; the stories under
  * evaluation and the per-batch additional context go last.
  */
-export function buildHuReviewerPromptLayout({ stories, instructions, context = null, productContext = null, domainContext = null, hu_language = "en" }) {
+function buildHuReviewerPromptLayout({ stories, instructions, context = null, productContext = null, domainContext = null, hu_language = "en" }) {
   const langInstruction = getLanguageInstruction(hu_language);
 
   return buildPromptLayout([

package/src/prompts/planner.js

@@ -70,7 +70,7 @@ export function parsePlannerOutput(output) {
  * @param {string} task
  * @returns {string[]} deduplicated trimmed exclusion items
  */
-export function extractScopeExclusions(task) {
+function extractScopeExclusions(task) {
   if (!task || typeof task !== "string") return [];
   const patterns = [
     /\bNO\s+incluye[^:\n]{0,60}:\s*([^.\n]+)/gi,

package/src/rag/embedders/factory.js

@@ -27,4 +27,3 @@ export function makeEmbedder(config = {}) {
   return new spec.cls({ url: cfg.url, apiKey: cfg.api_key, model: cfg.model, dim, timeoutMs: cfg.timeout_ms });
 }
 
-export { PROVIDERS };

package/src/rag/retriever.js

@@ -124,4 +124,4 @@ export async function query(db, embedder, text, { topK = 5, scope = "all", kindB
   return reranked;
 }
 
-export { shouldBoostSources, isTestPath, fuseHits, cosineSim };
+export { fuseHits, cosineSim };

package/src/roles/agent-role.js

@@ -25,7 +25,7 @@ import { withBrainRecovery } from "../brain/with-brain-recovery.js";
  * @param {object} config
  * @returns {number|null}
  */
-export function resolveAgentSilenceTimeoutMs(config) {
+function resolveAgentSilenceTimeoutMs(config) {
   const minutes = Number(config?.session?.max_agent_silence_minutes);
   return Number.isFinite(minutes) && minutes > 0 ? Math.round(minutes * 60 * 1000) : null;
 }

package/src/roles/audit-role.js

@@ -205,11 +205,13 @@ export class AuditRole extends AgentRole {
  * result fields. Returns a single object so consumers (CLI formatter,
  * report-file writer, MCP) don't need to know about the spread shape.
  *
+ * Consumed by tests via vi.importActual (knip blind spot) — keep exported.
+ * @public
  * @param {object} result - raw agent.runTask() return
  * @param {{provider: string, durationMs: number}} ctx
- * @returns {{available: boolean, provider: string, model?: string, tokens_in?: number, tokens_out?: number, total_tokens?: number, cost_usd?: number, durationMs: number, reason?: string}}
+ * @returns {{available: boolean, provider: string, model?: string, tokens_in?: number, tokens_out?: number, cached_tokens?: number, total_tokens?: number, cost_usd?: number, durationMs: number, reason?: string}}
  */
-function extractUsage(result, { provider, durationMs }) {
+export function extractUsage(result, { provider, durationMs }) {
   if (!result || typeof result !== "object") {
     return { available: false, provider, durationMs, reason: "no agent result" };
   }
@@ -218,12 +220,18 @@ function extractUsage(result, { provider, durationMs }) {
   if (tokens_in === null && tokens_out === null) {
     return { available: false, provider, model: result.model, durationMs, reason: `provider "${provider}" did not report token usage` };
   }
+  // KJC-BUG-0085: cached_tokens must survive this consolidation — the
+  // budget chain (computeUsage → BudgetTracker → summary.md Cache hits →
+  // telemetry) reads it from `usage` and the audit is the most expensive
+  // role of the session.
+  const cached_tokens = Number.isFinite(result.cached_tokens) ? result.cached_tokens : 0;
   return {
     available: true,
     provider,
     model: result.model,
     tokens_in: tokens_in ?? 0,
     tokens_out: tokens_out ?? 0,
+    cached_tokens,
     total_tokens: (tokens_in ?? 0) + (tokens_out ?? 0),
     cost_usd: typeof result.cost_usd === "number" ? result.cost_usd : null,
     durationMs,

package/src/session/journal/write-all.js

@@ -0,0 +1,89 @@
+/**
+ * Session-journal writer shared by every terminal path (KJC-BUG-0084).
+ *
+ * Pre-fix, the iterations/decisions/tree/summary block lived inline in
+ * finalizeApprovedSession(), so a run that died on a stage error
+ * (sonar_repeat, gh pr create failure, thrown stage) left only triage.md
+ * behind — the Cache hits table, the budget breakdown and the commit list
+ * vanished exactly on the runs where they matter most. This module is the
+ * single writer; the approved path calls it with its enriched extras and
+ * flow-runner's `finally` calls it best-effort for every other ending.
+ *
+ * Never throws: a journal failure must not mask the run's real result.
+ */
+
+import { writeIterationsJournal } from "../../orchestrator/session-journal.js";
+import { listCommitsBetween } from "../../utils/git.js";
+import { writeDecisionsJournal } from "./decisions-writer.js";
+import { writeTreeJournal } from "./tree-writer.js";
+import { writeSummaryJournal } from "./summary-writer.js";
+
+/**
+ * Write iterations.md, decisions.md, tree.txt and summary.md for a session.
+ *
+ * @param {object} args
+ * @param {object} args.session - live session (needs _journalDir to write)
+ * @param {{info?: Function, warn?: Function}} [args.logger]
+ * @param {string} [args.result] - summary badge: APPROVED | FAILED | STOPPED…
+ * @param {number} [args.iterations]
+ * @param {object|null} [args.budget] - budgetSummary() snapshot
+ * @param {object} [args.stages] - stageResults map
+ * @param {Array}  [args.commits] - precomputed commit list; computed from
+ *   session_start_sha when omitted
+ * @param {object|null} [args.planAdherence]
+ * @returns {Promise<{written: boolean, reason?: string}>}
+ */
+export async function writeSessionJournal({ session, logger, result = "APPROVED", iterations = 0, budget = null, stages = {}, commits = null, planAdherence = null }) {
+  const journalDir = session?._journalDir;
+  if (!journalDir) return { written: false, reason: "no journal dir" };
+
+  try {
+    await writeIterationsJournal(journalDir, session._journalIterations || []);
+    const decisionsResult = await writeDecisionsJournal(session, { journalDir, logger });
+    const treeResult = await writeTreeJournal(journalDir, session.session_start_sha, { logger });
+
+    const journalFiles = [...(session._journalFiles || [])];
+    if (session._journalIterations?.length) journalFiles.push("iterations.md");
+    if (decisionsResult.written) journalFiles.push("decisions.md");
+    if (treeResult.written) journalFiles.push("tree.txt");
+
+    // Commit range from session start so the summary shows every commit
+    // the run produced, not just the post-loop scaffold (2026-05-07
+    // dogfooding). try/catch tolerates promise rejection AND a sync
+    // undefined return from a resetAllMocks-stripped test mock.
+    let summaryCommits = Array.isArray(commits) ? commits : null;
+    if (!summaryCommits) {
+      try { summaryCommits = (await listCommitsBetween(session.head_at_start || session.session_start_sha)) || []; }
+      catch { summaryCommits = []; }
+    }
+
+    const startedAt = session._startedAt ? new Date(session._startedAt).toISOString() : undefined;
+    await writeSummaryJournal(journalDir, {
+      task: session.task,
+      result,
+      sessionId: session.id,
+      iterations,
+      durationMs: Date.now() - (session._startedAt || Date.now()),
+      budget,
+      stages,
+      commits: summaryCommits,
+      files: journalFiles,
+      startedAt,
+      finishedAt: new Date().toISOString(),
+      brainDecisions: Array.isArray(session.brainDecisions) ? session.brainDecisions.length : 0,
+      solomonInvocations: Array.isArray(session.solomonRulings) ? session.solomonRulings.length : 0,
+      skills: {
+        addyosmani: session.addyosmaniSkills,
+        installed: session.autoInstalledSkills,
+        recommended: session.skillsRecommended,
+      },
+      planAdherence,
+    }, { logger });
+    session._journalWritten = true;
+    logger?.info?.(`Session journal written to ${journalDir}`);
+    return { written: true };
+  } catch (err) {
+    logger?.warn?.(`Journal write failed (non-blocking): ${err.message}`);
+    return { written: false, reason: err.message };
+  }
+}

package/src/sonar/discovery.js

@@ -21,6 +21,7 @@
 
 import { runCommand } from "../utils/process.js";
 import { isSonarReachable } from "./manager.js";
+import { escapeRegExp } from "../utils/escape-regexp.js";
 
 /**
  * @typedef {Object} DiscoveredSonar
@@ -48,7 +49,7 @@ import { isSonarReachable } from "./manager.js";
 export function extractHostPort(portsStr, internalPort = 9000) {
   if (!portsStr) return null;
   const re = new RegExp(
-    `(?:0\\.0\\.0\\.0|127\\.0\\.0\\.1|::|\\[::\\]):(\\d+)\\s*->\\s*${internalPort}\\/tcp`,
+    `(?:0\\.0\\.0\\.0|127\\.0\\.0\\.1|::|\\[::\\]):(\\d+)\\s*->\\s*${escapeRegExp(internalPort)}\\/tcp`,
     "g"
   );
   const matches = [...portsStr.matchAll(re)];

package/src/sonar/scanner.js

@@ -11,7 +11,7 @@ import {
   resolveSonarCredentials,
 } from "./config-resolver.js";
 
-export async function findNativeSonarScanner() {
+async function findNativeSonarScanner() {
   const which = await runCommand("sh", ["-c", "command -v sonar-scanner"]);
   if (which.exitCode === 0) {
     const bin = String(which.stdout || "").trim();

package/src/utils/cli-progress.js

@@ -157,8 +157,10 @@ export function createCliProgressReporter(opts = {}) {
   //   - `  "foo": 123`           propiedad numérica
   //   - `  "foo": {`             apertura de objeto en valor
   //   - `  },` / `  ],` / `  }` / `  ]`  cierre con o sin coma
-  const JSON_SCRAP_RE =
-    /^\s*(?:"[^"\\]*(?:\\.[^"\\]*)*"\s*:\s*.+|[}\]][,]?)\s*$/;
+  // Split in two named patterns (S5843): property line vs closer line.
+  const JSON_PROP_LINE_RE = /^\s*"[^"\\]*(?:\\.[^"\\]*)*"\s*:\s*.+$/;
+  const JSON_CLOSER_LINE_RE = /^\s*[}\]],?\s*$/;
+  const JSON_SCRAP_RE = { test: (l) => JSON_PROP_LINE_RE.test(l) || JSON_CLOSER_LINE_RE.test(l) };
   const onOutput = (event) => {
     if (!event || typeof event !== "object") return;
     const raw = typeof event.line === "string" ? event.line : "";