karajan-code 4.32.0 → 4.33.0

package/src/privacy/diff-scope.js

@@ -0,0 +1,58 @@
+/**
+ * Which part of a diff the privacy gate reads, and how (KJC-BUG-0203).
+ *
+ * The gate used to concatenate every added line of the diff and scan the lump.
+ * Two consequences: a finding could not name the file it came from, and build
+ * output got judged as if a person had written it. A minified Starlight page
+ * warned twice for `[phone]` over an Astro class hash, which is the kind of
+ * false alarm that teaches people to skip the gate.
+ *
+ * The exemption is by SEVERITY, not by file. Generic heuristics (a shape that
+ * could be a phone, a card, an id) are silenced on generated output, where
+ * nobody typed anything. A denylist hit is NOT: the incident that created this
+ * scanner was personal emails published on a landing, which is exactly a
+ * denylist datum inside a build artifact.
+ *
+ * `kj privacy scan <dir>` is untouched. Scanning an artifact you are about to
+ * publish must keep looking at everything, generated or not.
+ */
+
+/** Paths that are build output in this project's own vocabulary. */
+const GENERATED = [
+  /(^|\/)dist\//,
+  /(^|\/)build\//,
+  /(^|\/)coverage\//,
+  /(^|\/)node_modules\//,
+  /(^|\/)\.astro\//,
+  /(^|\/)public\/docs\//,
+  /\.min\.(js|css)$/,
+  /\.map$/,
+];
+
+/** @param {string} file @returns {boolean} */
+export function isGeneratedPath(file) {
+  if (!file) return false;
+  return GENERATED.some((re) => re.test(file));
+}
+
+/**
+ * Split a unified diff into its added lines, per file.
+ * @param {string} diff
+ * @returns {Array<{file: string, added: string}>} files with at least one added line
+ */
+export function splitAddedByFile(diff) {
+  const out = [];
+  let current = null;
+  for (const line of String(diff || "").split("\n")) {
+    const header = /^diff --git a\/(?:.+) b\/(.+)$/.exec(line);
+    if (header) {
+      current = { file: header[1], lines: [] };
+      out.push(current);
+      continue;
+    }
+    if (!current) continue;
+    // `+++ b/x` is the header, not content; `+` alone is an added blank line.
+    if (line.startsWith("+") && !line.startsWith("+++")) current.lines.push(line.slice(1));
+  }
+  return out.filter((f) => f.lines.length > 0).map((f) => ({ file: f.file, added: f.lines.join("\n") }));
+}

package/src/privacy/scan.js

@@ -73,6 +73,24 @@ const FIREBASE_KEY_HINT = "si es la clave web de Firebase (publica por diseno):
 const CONTEXT_DISCARDS = [
   { type: "git-sha", re: /\b(?:[0-9a-f]{64}|[0-9a-f]{40})\b/g },
   { type: "doc-domain-email", re: /\b[A-Za-z0-9._%+-]+@(?:[A-Za-z0-9-]+\.)*(?:example\.(?:com|org|net)|test|invalid|localhost|example)\b/g },
+  // KJC-BUG-0202: an HU Board id is `HU-<Date.now()>-<n>`, and Date.now() is
+  // 13 digits — exactly a card's length, so every project using the default
+  // board got a credit-card warning over its own card ids. The rule covers
+  // the family (an alphabetic prefix, a dash, a long digit run: HU-…, KJC-…,
+  // any tracker's) and NOTHING else.
+  //
+  // It deliberately does not go further, and it took three rejections to get
+  // this narrow:
+  //   1. discarding every card-shaped run that fails Luhn — wrong, a
+  //      truncated or mistyped card also fails Luhn and is still sensitive;
+  //   2. any alphabetic prefix — `card-4111111111111111` swallowed;
+  //   3. any uppercase prefix with any digits — `CARD-4111111111111111-1`
+  //      swallowed.
+  // So the middle segment must be an actual millisecond timestamp: exactly 13
+  // digits starting 16-19 (years 2022-2033). No card range begins with a 1
+  // (Visa 4, Mastercard 2/5, Amex 3, Discover 6), so a card number cannot
+  // occupy that slot at any length.
+  { type: "tracker-id", re: /\b[A-Z]{2,6}-1[6-9]\d{11}-\d{1,4}\b/g },
 ];
 
 /**

package/src/prompts/card-context.js

@@ -0,0 +1,57 @@
+/**
+ * The coder gets the CARD, not just a sentence (KJC-TSK-0864).
+ *
+ * `kj code` handed the agent a bare task string: no card, no acceptance
+ * criteria, not even the project boundary the pipeline always passed. That is
+ * the gap the user hit, because when the host orchestrates instead of
+ * `kj run`, `kj code` IS the way the declared coder gets invoked, and a coder
+ * without the card writes to a sentence instead of to a contract.
+ *
+ * A local HU is read from the board. A reference kj cannot read (an external
+ * board lives in the host's own MCP, not here) travels as the reference it is
+ * and says so: the coder learns the card exists and where to ask for it,
+ * instead of receiving a silently empty context.
+ */
+import { getHu } from "../hu/store.js";
+
+/** Ids minted by the HU Board; anything else belongs to an external board. */
+const LOCAL_HU = /^HU-/i;
+
+const externalSection = (ref) =>
+  [
+    `## Card ${ref}`,
+    "",
+    `This work is tracked as ${ref} on the project's own board, which kj cannot read from here.`,
+    "Treat the task below as the card's statement, and if something the card should answer is missing, ASK instead of guessing.",
+  ].join("\n");
+
+const localSection = (hu) => {
+  const lines = [`## Card ${hu.id} — ${hu.title}`, ""];
+  if (hu.description?.trim()) lines.push(hu.description.trim(), "");
+  lines.push(`Status on the board: ${hu.status}. The card is the contract: done means its statement is literally true.`);
+  return lines.join("\n");
+};
+
+/**
+ * @param {{projectDir: string, ref: string|null, deps?: {getHu?: Function}}} args
+ * @returns {Promise<null|{huId: string, title: string|null, section: string,
+ *   acceptanceTests: Array|null, external: boolean}>}
+ */
+export async function resolveCardContext({ projectDir, ref, deps = {} }) {
+  if (!ref?.trim()) return null;
+  const id = ref.trim();
+  if (!LOCAL_HU.test(id)) {
+    return { huId: id, title: null, section: externalSection(id), acceptanceTests: null, external: true };
+  }
+  // A missing local HU is an error, never an empty context: the caller asked
+  // for a card by id and kj either delivers it or says it does not exist.
+  const hu = await (deps.getHu || getHu)(projectDir, id);
+  const criteria = hu.acceptanceCriteria?.trim();
+  return {
+    huId: hu.id,
+    title: hu.title,
+    section: localSection(hu),
+    acceptanceTests: criteria ? [{ type: "gherkin", content: criteria }] : null,
+    external: false,
+  };
+}

package/src/prompts/session-context.js

@@ -0,0 +1,68 @@
+/**
+ * What the coder knows before it writes (KJC-TSK-0864).
+ *
+ * The method's first invariant is "the RAG answers before you assume", and
+ * `kj run` honours it through the researcher stage. `kj code` did not: the
+ * declared coder started from a sentence and guessed the codebase. So the
+ * session asks the index on the coder's behalf and hands it what came back.
+ *
+ * Retrieval is best-effort and LOUD: an empty or unreachable index warns and
+ * the coder works without project context, because blocking here would stop
+ * work in a repo that simply has no index yet. What it never does is stay
+ * quiet about it.
+ */
+import { ragQueryCommand } from "../commands/rag.js";
+
+/** Hits to carry and how much of each: the prompt pays for every line. */
+const TOP_K = 5;
+const EXCERPT = 400;
+
+const label = (hit) =>
+  hit.metadata?.symbol || hit.metadata?.hu_id || hit.metadata?.headingPath?.join(" > ") || hit.kind || "block";
+
+/** @returns {string|null} the agent-facing section, or null when there is nothing to say. */
+export function ragSection(hits) {
+  if (!Array.isArray(hits) || hits.length === 0) return null;
+  const lines = [
+    "## What the project's RAG index answers about this task",
+    "",
+    "Retrieved for you, so you do not guess what the codebase does. These are excerpts: open the file before changing it.",
+    "",
+  ];
+  for (const hit of hits) {
+    const text = hit.text || "";
+    lines.push(`### ${hit.source} · ${label(hit)}`);
+    lines.push("```", text.length > EXCERPT ? `${text.slice(0, EXCERPT)}…` : text, "```", "");
+  }
+  return lines.join("\n");
+}
+
+/**
+ * @returns {Promise<null|{section: string|null, sources: string[]}>}
+ */
+export async function resolveRagContext({ task, config, logger, deps = {} }) {
+  const run = deps.ragQueryCommand || ragQueryCommand;
+  // The index warns on stdout in CLI mode; here the hits are the product, so
+  // its narration is swallowed and only OUR verdict reaches the user.
+  const quiet = { info: () => {}, warn: () => {}, error: () => {} };
+  let hits;
+  try {
+    hits = await run({ text: task, config, logger: quiet, flags: { topK: TOP_K } });
+  } catch (err) {
+    logger?.warn?.(`rag context unavailable (${err.message}) — the coder writes without project context`);
+    return null;
+  }
+  if (!hits?.length) {
+    logger?.warn?.("the RAG index returned nothing for this task — the coder writes without project context");
+    return null;
+  }
+  const sources = [...new Set(hits.map((h) => h.source))];
+  logger?.info?.(`RAG context: ${sources.length} file(s) — ${sources.join(", ")}`);
+  return { section: ragSection(hits), sources };
+}
+
+/** The task the coder reads: everything it was given, then its own statement. */
+export function composeTask(task, sections = []) {
+  const kept = sections.filter(Boolean);
+  return kept.length ? `${kept.join("\n\n")}\n\n## Task\n\n${task}` : task;
+}

package/src/roles/agent-role.js

@@ -16,6 +16,7 @@
 import { BaseRole } from "./base-role.js";
 import { createAgent as defaultCreateAgent } from "../agents/index.js";
 import { withBrainRecovery } from "../brain/with-brain-recovery.js";
+import { buildRoleFallbackChain } from "../brain/role-fallback-chain.js";
 
 /**
  * Silence timeout (ms) for an agent subprocess, from
@@ -154,10 +155,18 @@ export class AgentRole extends BaseRole {
     // reviewer usa reviewTask) también funcionan: el wrapper sólo necesita
     // un objeto con la firma `runTask(args) → { ok, output, error, exitCode }`.
     const result = await withBrainRecovery({
-      agent: { runTask: (args) => agent[this.agentMethod](args), provider },
+      agent: { runTask: (args) => agent[this.agentMethod](args), provider, model: this.config?.roles?.[this.name]?.model ?? null },
       taskArgs: runArgs,
       role: this.name,
       provider,
+      // KJC-TSK-0859: the chain the user declared under roles.<role>.fallback.
+      // The schema and the walker existed since KJC-TSK-0415; nobody built it,
+      // so every declared chain was dead config. This is the single point that
+      // covers every role inheriting from AgentRole.
+      fallback: buildRoleFallbackChain({
+        config: this.config, role: this.name, agentMethod: this.agentMethod,
+        createAgentFn: this._createAgent, logger: this.logger,
+      }),
       emitter: this.emitter,
       logger: this.logger,
       // KJC: sessionState lets withBrainRecovery persist a hibernating run
@@ -171,7 +180,7 @@ export class AgentRole extends BaseRole {
       const recoveryNote = result.recovery?.class ? ` [${result.recovery.class}]` : "";
       return {
         ok: false,
-        result: { error: result.error || result.output || `${this.name} failed${recoveryNote}`, provider, recovery: result.recovery, action: result.action, standbyFile: result.standbyFile || null },
+        result: { error: result.error || result.output || `${this.name} failed${recoveryNote}`, provider, recovery: result.recovery, action: result.action, standbyFile: result.standbyFile || null, tried: result.tried || null },
         summary: `${this.name} failed${recoveryNote}: ${result.recovery?.message || result.error || "unknown error"}`,
         usage: result.usage
       };