karajan-code 4.31.0 → 4.31.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.31.0",
+  "version": "4.31.1",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/checks/release-check.js

@@ -10,6 +10,7 @@ import { isAbsolute, join } from "node:path";
 import { runCommand } from "../utils/process.js";
 import { loadPrivacyList, scanPaths } from "../privacy/scan.js";
 import { checkStagedDiff, loadPolicy } from "../policy/engine.js";
+import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
 
 // KJC-TSK-0769 — the effect boundary: what ships is re-evaluated against the
 // policy IN FORCE now, not the one each PR was merged under. Artifact rules
@@ -28,7 +29,13 @@ async function policyRangeCheck(projectDir) {
       : ["-C", projectDir, "ls-tree", "-r", "--name-only", "HEAD"]);
     if (listed.exitCode !== 0) throw new Error((listed.stderr || "git failed").trim());
     const files = listed.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
-    const violations = checkStagedDiff(policy, { role: "coder", files, netLinesAdded: null }).filter((v) => !prScoped.has(v.rule_id));
+    const raw = checkStagedDiff(policy, { role: "coder", files, netLinesAdded: null }).filter((v) => !prScoped.has(v.rule_id));
+    // KJC-BUG-0178 (ADR 0009): the supervisor seal trips the very rule that
+    // protects the supervisor. `kj review` and `kj policy check` already lift
+    // what the sealed provenance backs; without this the release check blocked
+    // every version cut after a human `kj harden --commit`, by its own seal.
+    const sup = liftSealedSupervisorViolations({ projectDir, violations: raw });
+    const violations = sup.violations;
     const hard = violations.filter((v) => v.enforcement === "deny");
     const skipped = prScoped.size > 0 ? `; ${prScoped.size} diff-threshold invariant(s) skipped (PR-scoped)` : "";
     if (hard.length > 0) {

package/src/orchestrator/fs-leak-detector.js

@@ -112,6 +112,24 @@ export function detectNewHomeEntries(before, projectDir) {
  * @param {string|null|undefined} transcript — coder's full output text
  * @returns {string[]} filtered leaks (the subset attributable to coder)
  */
+/**
+ * KJC-BUG-0180 — attribution is not severity. `verifyLeaksAgainstTranscript`
+ * stays strict on purpose: with no transcript it returns everything. But
+ * "the snapshot changed and there is NO evidence the coder did it" is a
+ * different fact from "the coder wrote there", and only the second one
+ * should kill the run. The flaky CI failure was exactly this: other test
+ * files writing under $HOME during the iteration window, an empty
+ * transcript from a mocked coder, and the whole flow failing and retrying.
+ *
+ * @returns {{attributed: string[], unattributed: string[]}} — `attributed`
+ *   fails the run; `unattributed` is reported and the work goes on.
+ */
+export function splitLeakEvidence(leaks, transcript) {
+  const hasTranscript = typeof transcript === "string" && transcript.length > 0;
+  const found = verifyLeaksAgainstTranscript(leaks, transcript);
+  return hasTranscript ? { attributed: found, unattributed: [] } : { attributed: [], unattributed: found };
+}
+
 export function verifyLeaksAgainstTranscript(leaks, transcript) {
   if (!Array.isArray(leaks) || leaks.length === 0) return [];
   if (!transcript || typeof transcript !== "string" || transcript.length === 0) {

package/src/orchestrator/stages/coder-stage.js

@@ -20,7 +20,7 @@ import { detectRateLimit } from "../../utils/rate-limit-detector.js";
 import { createStallDetector } from "../../utils/stall-detector.js";
 import { buildStandbyState } from "../../brain/standby-store.js";
 import { applyQuotaSimulation } from "../../utils/quota-simulator.js";
-import { snapshotHomeTopLevel, detectNewHomeEntries, formatLeakMessage, verifyLeaksAgainstTranscript, detectTranscriptCdLeaks } from "../fs-leak-detector.js";
+import { snapshotHomeTopLevel, detectNewHomeEntries, formatLeakMessage, splitLeakEvidence, detectTranscriptCdLeaks } from "../fs-leak-detector.js";
 
 export async function runCoderStage({ coderRoleInstance, coderRole, config, logger, emitter, eventBase, session, plannedTask, trackBudget, iteration, brainCtx, acceptanceTests = null, adrs = null, specSection = null, reviewerFindings = null, huId = null }) {
   logger.setContext({ iteration, stage: "coder" });
@@ -186,9 +186,14 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   // detected entries against the coder's transcript: only flag those
   // the coder demonstrably referenced.
   const coderTranscript = coderExecResult.result?.output || "";
-  const layer1Leaks = verifyLeaksAgainstTranscript(candidateLeaks, coderTranscript);
+  // KJC-BUG-0180: only what the transcript ATTRIBUTES to the coder fails the
+  // run. Without a transcript there is no evidence it wrote anything, so the
+  // finding is reported and the work goes on — a concurrent host-side write
+  // under $HOME used to kill the whole flow.
+  const { attributed: layer1Leaks, unattributed } = splitLeakEvidence(candidateLeaks, coderTranscript);
   if (candidateLeaks.length > 0 && layer1Leaks.length === 0) {
-    logger.warn(`fs-leak-detector: ${candidateLeaks.length} new $HOME entr(y/ies) detected but none referenced in the coder transcript — likely a concurrent host-side write, not flagging (#546).`);
+    const why = unattributed.length > 0 ? "no coder transcript to attribute them" : "none referenced in the coder transcript";
+    logger.warn(`fs-leak-detector: ${candidateLeaks.length} new $HOME entr(y/ies) detected but ${why} — likely a concurrent host-side write, not flagging (#546).`);
   }
   // Layer 2 (BUG-0032): scan the transcript for `cd <abs-out-of-project> && <write-cmd>`
   // patterns the snapshot-diff misses (e.g. when target dir pre-existed).

package/src/privacy/scan.js

@@ -59,6 +59,17 @@ const SECRET_HEURISTICS = [
 // are blanked before redactPII and COUNTED, so a clean result can say
 // "nothing found" or "found and discarded by context" — never the same thing.
 // The personal denylist runs before this: the user's own datum always blocks.
+// KJC-BUG-0195 — a Google key inside a Firebase web config is public by
+// design: it names the project, and what protects the data are the Firestore
+// rules. It still BLOCKS (the shape alone cannot prove which key it is, and a
+// server key next to it would ride along), but the finding stops being a dead
+// end: it names the declared way out, the allowlist, and what actually
+// protects that key. A gate with no exit teaches people to skip the gate.
+// Markers kept unambiguous on purpose (codex caught projectId being generic
+// enough to appear next to a server key): only Firebase-specific ones count.
+const FIREBASE_WEB_MARKERS = /firebaseConfig|authDomain|firebasestorage|firestore\.googleapis\.com|firebaseapp\.com/;
+const FIREBASE_KEY_HINT = "si es la clave web de Firebase (publica por diseno): declarala en el allow de ~/.karajan/privacy.yml y restringela por dominio en la consola de Google";
+
 const CONTEXT_DISCARDS = [
   { type: "git-sha", re: /\b(?:[0-9a-f]{64}|[0-9a-f]{40})\b/g },
   { type: "doc-domain-email", re: /\b[A-Za-z0-9._%+-]+@(?:[A-Za-z0-9-]+\.)*(?:example\.(?:com|org|net)|test|invalid|localhost|example)\b/g },
@@ -71,6 +82,7 @@ const CONTEXT_DISCARDS = [
 export function scanText(text, { list = loadPrivacyList(), source = "<text>" } = {}) {
   const findings = [];
   let discarded = 0;
+  const firebaseWeb = FIREBASE_WEB_MARKERS.test(String(text));
   String(text).split("\n").forEach((line, i) => {
     let probe = line;
     for (const a of list.allow) probe = probe.split(a).join(" ");
@@ -85,7 +97,8 @@ export function scanText(text, { list = loadPrivacyList(), source = "<text>" } =
       re.lastIndex = 0;
       let m;
       while ((m = re.exec(probe)) !== null) {
-        findings.push({ severity: "block", type, source, line: i + 1, masked: maskValue(m[0]) });
+        const hint = type === "google-key" && firebaseWeb ? ` — ${FIREBASE_KEY_HINT}` : "";
+        findings.push({ severity: "block", type, source, line: i + 1, masked: `${maskValue(m[0])}${hint}` });
         probe = probe.slice(0, m.index) + " ".repeat(m[0].length) + probe.slice(m.index + m[0].length);
         re.lastIndex = m.index + m[0].length;
       }