karajan-code 4.27.0 → 4.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.27.0",
+  "version": "4.28.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -116,6 +116,7 @@
     "karajan-rag": "^1.2.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",
+    "qrcode-terminal": "0.12.0",
     "sqlite-vec": "^0.1.9",
     "valibot": "^1.4.1",
     "web-tree-sitter": "^0.26.9",

package/src/cli/register-meta.js

@@ -148,6 +148,15 @@ export function registerMeta(program, { pkgVersion }) {
         process.exitCode = await identityCommand({ action: "set", config, flags });
       });
     });
+  identityCmd
+    .command("enroll-phone")
+    .description("Enroll the phone's PUBLIC signing key (base64 of the raw 32-byte ed25519 key) for the supervisor seal")
+    .argument("<publicKeyBase64>", "raw ed25519 public key, base64 (shown by the phone app)")
+    .action(async (publicKeyBase64, flags) => {
+      await withConfig(pkgVersion, "identity-enroll-phone", flags, async ({ config }) => {
+        process.exitCode = await identityCommand({ action: "enroll-phone", config, flags: { ...flags, publicKeyBase64 } });
+      });
+    });
 
   // MGL-A (KJC-TSK-0808): the muggle launcher — one command, at most one
   // question, and the person lands inside a governed conversation.

package/src/commands/harden.js

@@ -207,7 +207,7 @@ export async function hardenCommand({
   // commitSupervisorRegeneration y rechaza sesiones de agente.
   if (commitSupervisor && !dryRun) {
     try {
-      out.supervisorCommit = commitSupervisorRegeneration({
+      out.supervisorCommit = await commitSupervisorRegeneration({
         projectDir,
         kjVersion: kjVersion ?? "unknown",
         generation: result.generation ?? { profile },

package/src/commands/identity.js

@@ -8,6 +8,7 @@
  *           no session and no flags → exit 1.
  */
 
+import { enrollPhone } from "../harden/phone-sign.js";
 import { readIdentity, writeIdentity } from "../identity/store.js";
 import { activeGhUser, effectiveGitEmail } from "../identity/detect.js";
 import { compareIdentity } from "../identity/compare.js";
@@ -23,6 +24,18 @@ export async function identityCommand({ action = "show", config, flags = {}, dep
     git_email: effectiveGitEmail(projectDir, detectOpts.gitFn ? { gitFn: detectOpts.gitFn } : {}),
   };
 
+  // KJC-TSK-0822: enrola la clave PÚBLICA del móvil (la privada nunca toca esta máquina).
+  if (action === "enroll-phone") {
+    try {
+      enrollPhone(flags.publicKeyBase64, { home: deps.home });
+    } catch (err) {
+      log(`kj identity enroll-phone: ${err.message}`);
+      return 1;
+    }
+    log("Móvil enrolado: la clave pública quedó en ~/.karajan/supervisor-phone.json. A partir de ahora, sellar el supervisor pedirá la firma de tu móvil.");
+    return 0;
+  }
+
   if (action === "set") {
     const candidate = { gh_user: flags.gh || effective.gh_user, git_email: flags.email || effective.git_email };
     if (!candidate.gh_user || !candidate.git_email) {

package/src/harden/hook-templates.js

@@ -109,6 +109,14 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
       if (cmds.format) lines.push(`${cmds.format} || { echo 'kj harden: format check failed'; exit 1; }`);
       if (!cmds.lint && !cmds.format) lines.push("# (no lint/format command detected for this stack)");
       lines.push(
+        "# KJC-BUG-0164: attribution is surface EVERYWHERE — the staged diff's",
+        "# ADDED lines (changelog, docs, code comments) are scanned too, with",
+        "# the same precise pattern (tool MENTIONS stay legal; attribution not).",
+        "# The guard's own definition files are excluded by literal path — they",
+        "# CONTAIN the pattern; excluding a path that does not exist is harmless.",
+        `if git diff --cached -- . ':(exclude).github/workflows/kj-no-ai-attribution.yml' ':(exclude)src/harden/hook-templates.js' ':(exclude)src/harden/workflow-templates.js' ':(exclude)src/harden/sentinel-hooks.js' ':(exclude)scripts/ai-attribution-guard.yml' ':(exclude)tests/harden/attribution-guard.test.js' ':(exclude)tests/harden/sentinel-hooks.test.js' | grep '^+' | grep -qiE '${AI_ATTRIBUTION}|generated with \\[?claude'; then`,
+        "  echo 'kj harden: AI attribution is not allowed in committed content'; exit 1",
+        "fi",
         "# v4 review gate (ENV-C1, opt-in via `kj review --install-gate`):",
         "# a staged diff only enters with a recorded cross-AI approved verdict.",
         "if [ -f .karajan/review-gate ]; then",

package/src/harden/phone-sign.js

@@ -0,0 +1,119 @@
+/**
+ * KJC-TSK-0822 (PRP-0023) — capa 5 del sello del supervisor: firma asimétrica
+ * desde el móvil. La clave privada vive SOLO en el teléfono; aquí se enrola su
+ * clave PÚBLICA (~/.karajan/supervisor-phone.json) y se verifica ed25519
+ * contra ella — el transporte (Firestore, PR siguiente) nunca es la verdad.
+ */
+import { createHash, createPublicKey, randomBytes, verify } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import qrcode from "qrcode-terminal";
+
+const SPKI_ED25519_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+// La config del relé (apiKey de cliente Firestore — pública por diseño, la
+// misma que la página firmante lleva incrustada) NO viaja en el tarball: el
+// escáner de privacidad del pack deniega claves google con razón general, y
+// servirla desde la landing la hace además rotable sin release.
+const RELAY_CONFIG_URL = "https://karajancode.com/sign/relay.json";
+let relayCache = null;
+async function relayConfig(fetchFn) {
+  if (relayCache) return relayCache;
+  const res = await fetchFn(RELAY_CONFIG_URL);
+  if (!res.ok) throw new Error(`phone-sign: no pude cargar la config del relé (${res.status}) — revisa la red`);
+  const cfg = await res.json();
+  if (!cfg?.apiKey || !cfg?.projectId || !cfg?.collection) throw new Error("phone-sign: config del relé incompleta");
+  relayCache = {
+    apiKey: cfg.apiKey,
+    url: `https://firestore.googleapis.com/v1/projects/${cfg.projectId}/databases/(default)/documents/${cfg.collection}`,
+  };
+  return relayCache;
+}
+const SIGN_PAGE = "https://karajancode.com/sign";
+const POLL_INTERVAL_MS = 2000;
+const TTL_MS = 120000;
+
+const phoneKeyPath = (home) => join(home ?? homedir(), ".karajan", "supervisor-phone.json");
+
+export const isPhoneEnrolled = ({ home } = {}) => existsSync(phoneKeyPath(home));
+
+export const readEnrolledKey = ({ home } = {}) =>
+  JSON.parse(readFileSync(phoneKeyPath(home), "utf8")).publicKey;
+
+/** Valida y persiste la clave pública del móvil (base64 del raw de 32 bytes). */
+export function enrollPhone(publicKeyBase64, { home } = {}) {
+  const raw = Buffer.from(publicKeyBase64 ?? "", "base64");
+  if (raw.length !== 32 || raw.toString("base64") !== publicKeyBase64) {
+    throw new Error("la clave debe ser base64 canónico de EXACTAMENTE 32 bytes (ed25519 raw)");
+  }
+  mkdirSync(join(phoneKeyPath(home), ".."), { recursive: true });
+  const record = { publicKey: publicKeyBase64, enrolledAt: new Date().toISOString() };
+  writeFileSync(phoneKeyPath(home), `${JSON.stringify(record, null, 2)}\n`, "utf8");
+}
+
+/** Payload canónico firmado: files EXACTAMENTE como se enviaron, JSON sin espacios. */
+export function canonicalPayload({ cid, nonce, project, files }) {
+  const filesHash = createHash("sha256").update(JSON.stringify(files)).digest("hex");
+  return `kj-supervisor-sign:v1:${cid}:${nonce}:${project}:${filesHash}`;
+}
+
+/** Verifica la firma (base64) del payload contra la clave pública raw (base64). */
+export function verifyPhoneSignature({ payload, signature, publicKey }) {
+  const der = Buffer.concat([SPKI_ED25519_PREFIX, Buffer.from(publicKey, "base64")]);
+  const key = createPublicKey({ key: der, format: "der", type: "spki" });
+  return verify(null, Buffer.from(payload, "utf8"), key, Buffer.from(signature, "base64"));
+}
+
+/**
+ * Publica la petición en Firestore, enseña QR + URL, pollea el doc y verifica
+ * la firma. Sin fallbacks silenciosos: red caída o HTTP no-ok ⇒ throw. Firma
+ * mala / clave ajena / TTL vencido ⇒ {ok:false, reason}.
+ * @returns {Promise<{ok: boolean, reason?: string}>}
+ */
+export async function requestPhoneSignature({ project, files, kjVersion, logger = console, deps = {} }) {
+  const fetchFn = deps.fetch ?? fetch;
+  const now = deps.now ?? Date.now;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const drawQr = deps.qr ?? ((url) => qrcode.generate(url, { small: true }));
+  const cid = randomBytes(16).toString("hex");
+  const nonce = randomBytes(16).toString("hex");
+  const body = {
+    fields: {
+      nonce: { stringValue: nonce },
+      project: { stringValue: project },
+      kj_version: { stringValue: kjVersion },
+      state: { stringValue: "pending" },
+      createdAt: { timestampValue: new Date().toISOString() },
+      files: { arrayValue: { values: files.map((f) => ({ mapValue: { fields: { file: { stringValue: f.file }, sha256: { stringValue: f.sha256 ?? "" } } } })) } },
+    },
+  };
+  const relay = await relayConfig(fetchFn);
+  const created = await fetchFn(`${relay.url}?documentId=${cid}&key=${relay.apiKey}`, {
+    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body),
+  });
+  if (!created.ok) {
+    throw new Error(`phone-sign: no se pudo publicar la petición de firma (HTTP ${created.status}) — sin red no hay sello, no se degrada`);
+  }
+  const signUrl = `${SIGN_PAGE}?c=${cid}`;
+  drawQr(signUrl);
+  logger.info?.(`phone-sign: escanea el QR o abre ${signUrl} y firma en el móvil (caduca en ${TTL_MS / 1000}s)`);
+  const deadline = now() + TTL_MS;
+  while (now() < deadline) {
+    const res = await fetchFn(`${relay.url}/${cid}?key=${relay.apiKey}`);
+    if (!res.ok) throw new Error(`phone-sign: fallo consultando la petición de firma (HTTP ${res.status})`);
+    const fields = (await res.json()).fields ?? {};
+    if (fields.state?.stringValue === "signed") {
+      const enrolled = readEnrolledKey({ home: deps.home });
+      if (fields.publicKey?.stringValue !== enrolled) {
+        return { ok: false, reason: "la publicKey del doc no coincide con la enrolada — el doc es transporte, la verdad es la enrolada" };
+      }
+      const payload = canonicalPayload({ cid, nonce, project, files });
+      const good = verifyPhoneSignature({ payload, signature: fields.signature?.stringValue ?? "", publicKey: enrolled });
+      return good ? { ok: true } : { ok: false, reason: "firma ed25519 inválida para el payload canónico" };
+    }
+    logger.info?.("phone-sign: esperando la firma del móvil…");
+    await sleep(POLL_INTERVAL_MS);
+  }
+  return { ok: false, reason: "caducado" };
+}

package/src/harden/sentinel-hooks.js

@@ -371,6 +371,44 @@ process.stdin.on("end", () => {
       console.error("karajan sentinel: los ficheros del supervisor no se tocan desde Bash — consultalos con la tool Read/Grep; solo el humano los modifica, fuera de la sesion." + doc("supervisor"));
       process.exit(2);
     }
+    // KJC-BUG-0164: todo gh que PUBLICA texto (pr/issue/release, create/edit/
+    // comment/review) se escanea contra el patron de ATRIBUCION a IA antes de
+    // salir — comando inline Y ficheros --body-file/--notes-file. Regla
+    // determinista del proyecto: prohibido, sin escape. Un fichero ilegible
+    // tampoco publica (fail closed).
+    {
+      // Regex SIN backslashes a proposito (clases de caracteres, emoji
+      // literal): asi la plantilla y el fichero generado son identicos y no
+      // hay doble-escape que leer mal.
+      const ghCmd = String(input.command || "");
+      if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
+        const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
+        let corpus = ghCmd;
+        for (const m of ghCmd.matchAll(/--(?:body-file|notes-file|comment-file)[= ]+("([^"]+)"|'([^']+)'|([^ ]+))/g)) {
+          const bodyPath = m[2] || m[3] || m[4];
+          try { corpus += "\\n" + readFileSync(bodyPath, "utf8"); } catch {
+            console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
+            process.exit(2);
+          }
+        }
+        if (attrib.test(corpus)) {
+          console.error("karajan sentinel: atribucion a IA detectada en contenido a PUBLICAR (PR/issue/release) — prohibida por regla determinista del proyecto: limpia el texto." + doc("attribution"));
+          process.exit(2);
+        }
+      }
+    }
+    // KJC-TSK-0822 v1.1: enrolar (o pisar) la clave del movil es acto humano
+    // — si un agente pudiera enrolar una clave SUYA, contestaria la capa 5 el
+    // solo. Ni el comando ni el fichero de enrolamiento desde la sesion.
+    {
+      const enrollCmd = String(input.command || "");
+      const namesEnroll = (enrollCmd.includes("identity") && enrollCmd.includes("enroll-phone")) || enrollCmd.includes("supervisor-phone.json");
+      const writesEnroll = EDIT_TOOLS.includes(tool) && String(input.file_path || "").includes("supervisor-phone.json");
+      if ((tool === "Bash" && namesEnroll) || writesEnroll) {
+        console.error("karajan sentinel: el enrolamiento del movil (capa 5) es un acto humano — pideselo a tu usuario; supervisor-phone.json no se toca desde la sesion." + doc("supervisor"));
+        process.exit(2);
+      }
+    }
     // ADR 0009 (KJC-BUG-0161): kj harden --commit es un ACTO HUMANO — la
     // sesion ni lo intenta. Sin escape (superficie de supervisor). includes()
     // a proposito: cero ambiguedad de escapes en plantilla, y fail-closed
@@ -578,6 +616,15 @@ process.stdin.on("end", () => {
     }
     if (tool === "Bash") {
       const cmd = String(input.command || "");
+      // KJC-BUG-0166: una sesion intento EN BUCLE retirar el ARBOL PRINCIPAL
+      // con git worktree remove y KJ_ALLOW_CROSS_LANE puesto. Retirar un
+      // worktree es destruccion de la estructura del repo — jamas trabajo de
+      // una sesion, y el escape de cruce NO puede ampararlo. Deny sin escape
+      // (el cauce sancionado es kj worktree done, que corre dentro de kj).
+      if (/(^|[^a-z])git[^a-z]+worktree[^a-z]+(remove|prune)/.test(cmd)) {
+        console.error("karajan sentinel: git worktree remove/prune no se ejecuta desde una sesion — destruccion de estructura del repo, sin escape; usa kj worktree done." + doc("cross-lane"));
+        process.exit(2);
+      }
       // Deny-unless-known-read-only: un allowlist de verbos mutadores era
       // esquivable (dd, interpretes). Solo un comando SIMPLE de lectura (sin
       // encadenar ni redirigir) puede nombrar otro carril; leer carriles es

package/src/harden/supervisor-commit.js

@@ -7,11 +7,12 @@
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { closeSync, existsSync, openSync, readFileSync, readSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
 
 import { recordGateDecision } from "../policy/decisions.js";
 import { readIdentity } from "../identity/store.js";
+import { isPhoneEnrolled, requestPhoneSignature } from "./phone-sign.js";
 
 export const PROVENANCE_FILE = ".karajan/supervisor-provenance.json";
 const HOOKS_PREFIX = ".karajan/hooks/";
@@ -68,9 +69,9 @@ export function supervisorDrift({ projectDir, gitFn }) {
 }
 
 /**
- * @returns {{committed: boolean, reason?: string, files?: object[]}}
+ * @returns {Promise<{committed: boolean, reason?: string, files?: object[]}>}
  */
-export function commitSupervisorRegeneration({
+export async function commitSupervisorRegeneration({
   projectDir,
   kjVersion,
   generation,
@@ -102,16 +103,37 @@ export function commitSupervisorRegeneration({
     throw new Error(`harden --commit: confirmación humana fallida (esperaba "${nonce}") — ADR 0009`);
   }
   const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
-  const files = supervisorDrift({ projectDir, gitFn: run });
-  if (files.length === 0) {
-    logger.info?.("harden --commit: sin drift en el supervisor — nada que versionar");
+  const drift = supervisorDrift({ projectDir, gitFn: run });
+  // La provenance describe SIEMPRE el estado COMPLETO del supervisor (cazado
+  // en el primer estreno real: un sello parcial pisaba al anterior y dejaba
+  // ficheros sin respaldo). Borrados del drift ⇒ deleted (catch de codex).
+  const current = readdirSync(join(projectDir, HOOKS_PREFIX)).map((f) => HOOKS_PREFIX + f).sort();
+  const hashed = [
+    ...current.map((file) => ({ file, sha256: sha256(join(projectDir, file)) })),
+    ...drift.filter((f) => !existsSync(join(projectDir, f))).map((file) => ({ file, deleted: true })),
+  ];
+  let previous = null;
+  try { previous = JSON.parse(readFileSync(join(projectDir, PROVENANCE_FILE), "utf8")); } catch { /* primer sello */ }
+  const covered = JSON.stringify(previous?.files ?? null) === JSON.stringify(hashed);
+  if (drift.length === 0 && covered) {
+    logger.info?.("harden --commit: sin drift y provenance completa — nada que versionar");
     return { committed: false, reason: "sin drift" };
   }
-  // Borrados/renombrados también son drift (catch de codex): ausente ⇒ deleted.
-  const hashed = files.map((file) => {
-    const abs = join(projectDir, file);
-    return existsSync(abs) ? { file, sha256: sha256(abs) } : { file, deleted: true };
-  });
+  // Capa 5 (KJC-TSK-0822 / PRP-0023): con móvil enrolado la firma asimétrica
+  // es OBLIGATORIA — jamás se degrada a solo-nonce. Firma los MISMOS
+  // files/hashes de la provenance (normalizados al par {file, sha256}).
+  const phone = deps.phone ?? { enrolled: isPhoneEnrolled, request: requestPhoneSignature };
+  if (phone.enrolled({})) {
+    const signed = await phone.request({
+      project: basename(projectDir),
+      files: hashed.map(({ file, sha256: hash }) => ({ file, sha256: hash ?? "" })),
+      kjVersion,
+      logger,
+    });
+    if (!signed.ok) {
+      throw new Error(`capa 5: firma del móvil rechazada (${signed.reason}) — con móvil enrolado el sello exige su firma (PRP-0023)`);
+    }
+  }
   const who = readIdentity(projectDir);
   const provenance = {
     kj_version: kjVersion,
@@ -142,6 +164,6 @@ export function commitSupervisorRegeneration({
     PROVENANCE_FILE,
     ".karajan/hooks",
   ]);
-  logger.info?.(`harden --commit: ${files.length} fichero(s) de supervisor versionados con procedencia sellada`);
+  logger.info?.(`harden --commit: ${hashed.length} fichero(s) de supervisor versionados con procedencia sellada`);
   return { committed: true, files: hashed };
 }

package/src/harden/workflow-templates.js

@@ -36,9 +36,14 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   `      - uses: ${PINNED_ACTIONS.checkout}`,
   "        with:",
   "          fetch-depth: 0",
-  "      - name: Scan commit messages for AI attribution",
+  "      - name: Scan commit messages and PR body for AI attribution",
   "        env:",
   "          BASE_REF: ${{ github.base_ref }}",
+  // KJC-BUG-0164: el cuerpo de la PR tambien es superficie — 15 PRs entraron
+  // con pie de atribucion porque solo se escaneaban commits. Via env, jamas
+  // interpolado en el script (el cuerpo es texto no confiable).
+  "          PR_BODY: ${{ github.event.pull_request.body }}",
+  "          PR_TITLE: ${{ github.event.pull_request.title }}",
   "        run: |",
   '          if ! msgs=$(git log --format=%B "origin/${BASE_REF}...HEAD"); then',
   '            echo "::error::cannot resolve origin/${BASE_REF}...HEAD — the scan did not run"; exit 1',
@@ -48,6 +53,9 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   '          if printf "%s" "$msgs" | grep -qiE "$pat"; then',
   '            echo "::error::AI attribution detected in commit messages"; exit 1',
   "          fi",
+  '          if printf "%s\\n%s" "$PR_BODY" "$PR_TITLE" | grep -qiE "$pat|generated with \\[?claude|🤖"; then',
+  '            echo "::error::AI attribution detected in the PR body or title"; exit 1',
+  "          fi",
   '          echo "AI attribution scan: clean"',
 ].join("\n");
 

package/src/review/gate-gitignore.js

@@ -25,7 +25,11 @@ export const CONTRACT_BLOCK = [
   "!.karajan/hooks/commit-msg",
   "!.karajan/hooks/pre-push",
   "!.karajan/hooks/post-merge",
+  "!.karajan/hooks/prepare-commit-msg",
   "!.karajan/adrs/",
+  // ADR 0009 (KJC-BUG-0161): la procedencia del supervisor VIAJA con el
+  // repo — es lo que CI verifica. Cazado en el primer harden --commit real.
+  "!.karajan/supervisor-provenance.json",
 ];
 
 /**