karajan-code 4.0.0 → 4.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/commands/harden.js

@@ -9,6 +9,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { loadConfig } from "../config.js";
 import { compareHarden, formatAdvisoryReport } from "../harden/advisory.js";
 import { interactiveHarden } from "../harden/interactive.js";
 import { createWizard, isTTY } from "../utils/wizard.js";
@@ -120,9 +121,16 @@ export async function hardenCommand({
 
   const roots = detectStackRoots(projectDir, { only: onlyDirs, exclude: excludeDirs });
   const cmds = await resolveCmds(projectDir, roots[0]?.language ?? null);
+  // KJC-TSK-0648: branch-first guard — the base branch only moves via PR.
+  // Resolved from the project's kj config (default "main"); best-effort so
+  // harden keeps working on repos that never ran kj init.
+  let baseBranch = "main";
+  try {
+    baseBranch = (await loadConfig(projectDir))?.base_branch || "main";
+  } catch { /* no kj config — default stands */ }
   let result;
   try {
-    result = await installHooks({ projectDir, profile, cmds, dryRun });
+    result = await installHooks({ projectDir, profile, cmds, dryRun, baseBranch });
   } catch (err) {
     if (json) logger.info?.(JSON.stringify({ ok: false, error: err.message }));
     else logger.error?.(`kj harden: ${err.message}`);

package/src/environment/playbook.js

@@ -41,7 +41,9 @@ You are the orchestrator; Karajan governs the method. Follow this on every task:
 5. **Security checklist** (you absorb the security role): validate all inputs,
    never commit secrets or keys, no deprecated APIs, parameterized queries,
    sanitize anything user-controlled before it reaches HTML/shell/SQL.
-6. **Ship small**: Conventional Commits, atomic PRs (~150 net lines), each PR
+6. **Branch first**: never commit on the base branch — create a branch per
+   task/bug and every change reaches the base only through a PR.
+7. **Ship small**: Conventional Commits, atomic PRs (~150 net lines), each PR
    compiles and passes tests on its own.
 
 Useful commands: \`kj rag query\` · \`kj review --staged\` · \`kj review --check\` ·

package/src/harden/harden-engine.js

@@ -33,11 +33,25 @@ export async function installHooks({
   profile = "standard",
   cmds = {},
   dryRun = false,
+  baseBranch = null,
 } = {}) {
   if (!isGitRepo(projectDir)) throw new Error(`Not a git repository: ${projectDir}`);
   const hooks = PROFILE_HOOKS[profile];
   if (!hooks) throw new Error(`Unknown harden profile: ${profile}`);
 
+  // KJC-TSK-0645: setting a repo-local hooksPath ECLIPSES the machine's
+  // global hooks dir — personal guards (AI-attribution commit-msg, protected
+  // branch pre-push) would silently stop applying here. Detect the previous
+  // global dir and have every generated hook chain to it. `~` is emitted as
+  // `$HOME` so the committed hook stays portable across machines (the -x
+  // guard silences it where the dir doesn't exist).
+  let globalHooksDir = null;
+  const globalCfg = await runCommand("git", ["config", "--global", "core.hooksPath"], { cwd: projectDir });
+  const rawGlobal = globalCfg.exitCode === 0 ? globalCfg.stdout.trim() : "";
+  if (rawGlobal && rawGlobal !== HOOKS_DIR) {
+    globalHooksDir = rawGlobal.startsWith("~") ? `$HOME${rawGlobal.slice(1)}` : rawGlobal;
+  }
+
   const absHooksDir = join(projectDir, HOOKS_DIR);
   const results = [];
   for (const hook of hooks) {
@@ -47,7 +61,7 @@ export async function installHooks({
       source,
       blockId: `hook:${hook}`,
       version: BLOCK_VERSION,
-      body: hookBody(hook, cmds),
+      body: hookBody(hook, cmds, { globalHooksDir, baseBranch }),
       style: "hash",
     });
     results.push({ hook, target, action });

package/src/harden/hook-templates.js

@@ -21,10 +21,42 @@ export const PROFILE_HOOKS = {
 };
 
 /** Build the managed body for a single hook. */
-export function hookBody(hook, cmds = {}) {
+// KJC-TSK-0645: `core.hooksPath .karajan/hooks` eclipses the user's global
+// hooks dir, silently disabling personal guards. When a previous global dir
+// is known, every generated hook ends by chaining its namesake there —
+// guarded, so machines without it are unaffected.
+function chainToGlobal(hook, globalHooksDir) {
+  if (!globalHooksDir) return [];
+  return [
+    "# Chain the machine's previous global hook (kj harden keeps it active).",
+    `if [ -x "${globalHooksDir}/${hook}" ]; then`,
+    `  "${globalHooksDir}/${hook}" "$@"; rc=$?`,
+    '  [ "$rc" -eq 0 ] || exit "$rc"',
+    "fi",
+  ];
+}
+
+// KJC-TSK-0648: branch-first, enforced. The first external session of the
+// v4 environment committed on local main following literal instructions —
+// the playbook now orders "branch first" and this guard backs it up.
+function baseBranchGuard(baseBranch) {
+  if (!baseBranch) return [];
+  return [
+    "# Branch-first guard — the base branch only moves via PR.",
+    'if [ "$KJ_ALLOW_BASE_COMMIT" != "1" ]; then',
+    '  current_branch=$(git symbolic-ref --short HEAD 2>/dev/null || echo "")',
+    `  if [ "$current_branch" = "${baseBranch}" ]; then`,
+    `    echo 'kj harden: direct commits on ${baseBranch} are not allowed — create a branch and open a PR (KJ_ALLOW_BASE_COMMIT=1 to override)'; exit 1`,
+    "  fi",
+    "fi",
+  ];
+}
+
+export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch = null } = {}) {
+  const chain = chainToGlobal(hook, globalHooksDir);
   switch (hook) {
     case "pre-commit": {
-      const lines = ["# Lint + format the working tree with the project's native tools."];
+      const lines = [...baseBranchGuard(baseBranch), "# Lint + format the working tree with the project's native tools."];
       if (cmds.lint) lines.push(`${cmds.lint} || { echo 'kj harden: lint failed'; exit 1; }`);
       if (cmds.format) lines.push(`${cmds.format} || { echo 'kj harden: format check failed'; exit 1; }`);
       if (!cmds.lint && !cmds.format) lines.push("# (no lint/format command detected for this stack)");
@@ -38,7 +70,7 @@ export function hookBody(hook, cmds = {}) {
         "  kj review --check || { echo 'kj: no approved cross-AI verdict for the staged diff — run `kj review --staged`'; exit 1; }",
         "fi"
       );
-      return lines.join("\n");
+      return [...lines, ...chain].join("\n");
     }
     case "commit-msg":
       // Pure POSIX — Conventional Commits header, length cap, AI-attribution.
@@ -52,6 +84,7 @@ export function hookBody(hook, cmds = {}) {
         `if grep -qiE '${AI_ATTRIBUTION}' "$msg_file"; then`,
         "  echo 'kj harden: AI attribution is not allowed in commit messages'; exit 1",
         "fi",
+        ...chain,
       ].join("\n");
     case "pre-push": {
       const lines = [
@@ -64,7 +97,7 @@ export function hookBody(hook, cmds = {}) {
       ];
       if (cmds.test) lines.push(`${cmds.test} || { echo 'kj harden: tests failed'; exit 1; }`);
       else lines.push("# (no test command detected for this stack)");
-      return lines.join("\n");
+      return [...lines, ...chain].join("\n");
     }
     case "post-merge":
       return [
@@ -72,6 +105,7 @@ export function hookBody(hook, cmds = {}) {
         "if command -v kj >/dev/null 2>&1; then",
         "  kj rag index --since auto >/dev/null 2>&1 || true",
         "fi",
+        ...chain,
       ].join("\n");
     default:
       throw new Error(`Unknown hook: ${hook}`);