karajan-code 4.1.3 → 4.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.1.3",
+  "version": "4.1.4",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/utils/binary-sources.js

@@ -44,6 +44,12 @@ export function osvScannerSource(platform = process.platform, arch = process.arc
  */
 export function semgrepFallback(available = {}) {
   if (available.docker) return { via: "docker", command: "docker pull semgrep/semgrep" };
+  // KJC-BUG-0120 (issue #1256): on Debian/Ubuntu-like systems the system
+  // Python is externally managed (PEP 668) and often ships without pip at
+  // all — `python3 -m pip install --user` is guaranteed to fail there.
+  // pipx must come from the distro's own package manager.
+  if (available.apt) return { via: "apt", command: "sudo apt update && sudo apt install -y pipx && pipx install semgrep" };
+  if (available.dnf) return { via: "dnf", command: "sudo dnf install -y pipx && pipx install semgrep" };
   return { via: "pipx", command: "python3 -m pip install --user pipx && pipx install semgrep" };
 }
 

package/src/utils/display/header.js

@@ -4,7 +4,6 @@ import { fileURLToPath } from "node:url";
 import { printBanner } from "../banner.js";
 import { ANSI } from "./formatters.js";
 
-// TODO: i18n display messages
 const DISPLAY_PKG_PATH = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../package.json");
 const DISPLAY_VERSION = JSON.parse(readFileSync(DISPLAY_PKG_PATH, "utf8")).version;
 

package/src/utils/install-hints.js

@@ -80,8 +80,13 @@ export async function getInstallHint(tool, available = null) {
   for (const { manager, command } of candidates) {
     if (avail[manager]) return { command, manager, manualUrl: MANUAL_URLS[tool] };
   }
-  // Nothing matched — fall back to the first candidate's command as a
-  // suggestion, so the user at least sees a working recipe.
+  // Nothing matched — suggest a recipe that actually works on this system.
+  // KJC-BUG-0120 (issue #1256): distro-aware fallbacks first (PEP 668 makes
+  // the generic pip bootstrap fail on Debian/Ubuntu); these are display-only
+  // (manager: null), never auto-run — sudo stays in the user's hands.
+  for (const { when, command } of DISTRO_FALLBACKS[tool] || []) {
+    if (avail[when]) return { command, manager: null, manualUrl: MANUAL_URLS[tool] };
+  }
   const first = candidates[0];
   return {
     command: first ? first.command : null,
@@ -90,6 +95,13 @@ export async function getInstallHint(tool, available = null) {
   };
 }
 
+const DISTRO_FALLBACKS = {
+  semgrep: [
+    { when: "apt", command: "sudo apt update && sudo apt install -y pipx && pipx install semgrep" },
+    { when: "dnf", command: "sudo dnf install -y pipx && pipx install semgrep" },
+  ],
+};
+
 const INSTALL_CANDIDATES = {
   semgrep: [
     { manager: "pipx", command: "pipx install semgrep" },

package/src/utils/pending-user-action.js

@@ -25,7 +25,9 @@ const OS_COMMANDS = {
     win32: ["winget install Git.Git"],
   },
   semgrep: {
-    linux: ["python3 -m pip install --user semgrep   # or: pipx install semgrep"],
+    // PEP 668 (#1256): system Python is externally managed on modern
+    // distros — pipx comes from the distro package manager, never from pip.
+    linux: ["sudo apt update && sudo apt install -y pipx && pipx install semgrep   # Debian/Ubuntu", "sudo dnf install -y pipx && pipx install semgrep   # Fedora/RHEL"],
     darwin: ["brew install semgrep"],
     win32: ["python -m pip install --user semgrep"],
   },
@@ -75,10 +77,11 @@ export function renderPendingBlock(pending, { platform = process.platform, retry
   for (const r of pending) {
     const why = r.error ? `install failed: ${r.error}` : r.reason || "no automatic route on this machine";
     lines.push(`  ▸ ${r.tool}  (${why})`);
-    const commands = r.commands
-      ?? (r.command ? [r.command] : null)
-      ?? (r.suggested ? [r.suggested] : null)
-      ?? (osCommandsFor(r.tool, platform).length > 0 ? osCommandsFor(r.tool, platform) : null)
+    const os = osCommandsFor(r.tool, platform);
+    const own = r.commands ?? (r.command ? [r.command] : null) ?? (r.suggested ? [r.suggested] : null);
+    // A FAILED install must not be re-suggested verbatim (#1256: the pip
+    // route that just broke) — the curated per-OS route goes first there.
+    const commands = (r.action === "failed" ? (os.length > 0 ? os : own) : (own ?? (os.length > 0 ? os : null)))
       ?? [`see ${r.manualUrl || "the tool's install docs"}`];
     for (const c of commands) lines.push(`      ${c}`);
     lines.push("");