karajan-code 4.36.0 → 4.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.36.0",
+  "version": "4.37.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/advanced-commands.js

@@ -34,7 +34,7 @@ export const ADVANCED_GROUPS = [
   { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan", "tournament"] },
   { title: "Análisis pre-run", commands: ["discover", "triage", "researcher", "architect", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch"] },
-  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy", "claims", "steward"] },
+  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy", "claims", "steward", "pr-size"] },
   { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel", "identity"] },
   { title: "Infra / setup", commands: ["install-tools", "ollama", "skills", "roles", "agents", "env"] },
   { title: "Mantenimiento", commands: ["clean", "sync", "telemetry", "report-issue"] },

package/src/cli/register-meta.js

@@ -522,6 +522,17 @@ export function registerMeta(program, { pkgVersion }) {
       await privacyScanCommand({ paths, flags });
     });
 
+  // KJC-TSK-0910: the branch's size while it is written, same budget as CI.
+  program.command("pr-size")
+    .description("Lines this branch adds against its base, with the CI budget (committed, uncommitted and new files)")
+    .option("--json", "Machine-readable result")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "pr-size", flags, async ({ config, logger }) => {
+        const { prSizeCommand } = await import("../commands/pr-size.js");
+        await prSizeCommand({ config, logger, flags });
+      });
+    });
+
   const rag = program.command("rag").description("Retrieval-augmented search over Karajan plans, onboarding briefs and project code");
   rag.command("index")
     .description("Index plans + onboarding (and optionally project sources) into the local vector store")

package/src/commands/pr-size.js

@@ -0,0 +1,45 @@
+/**
+ * KJC-TSK-0910 — `kj pr-size`: the branch's size while it is being written,
+ * with the SAME budget the CI gate applies (loc-budget.js). It counts what is
+ * committed, what is not yet, and new files not yet added, against the merge
+ * base with the base branch, so the Sentinel can warn before the gate blocks.
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { budgetedAdded } from "../review/loc-budget.js";
+
+const git = (projectDir, args) =>
+  execFileSync("git", ["-C", projectDir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+
+function mergeBase(projectDir, base) {
+  for (const ref of [`origin/${base}`, base]) {
+    try { return git(projectDir, ["merge-base", "HEAD", ref]).trim(); } catch { /* try the next ref */ }
+  }
+  throw new Error(`pr-size: no merge base with ${base} (nor origin/${base})`);
+}
+
+/** @returns {Promise<{added: number, exempt: number, testAdded: number, base: string}>} */
+export async function branchSize({ projectDir = process.cwd(), base = "main" } = {}) {
+  const from = mergeBase(projectDir, base);
+  // Working tree against the merge base: committed and uncommitted together.
+  let numstat = git(projectDir, ["diff", "--numstat", from]);
+  // New files not yet added are where a branch grows while it is written.
+  for (const file of git(projectDir, ["ls-files", "--others", "--exclude-standard"]).split("\n").filter(Boolean)) {
+    let text;
+    try { text = readFileSync(join(projectDir, file), "utf8"); } catch { continue; }
+    if (text.includes("\0")) continue; // binary
+    // Lines as git counts them: an empty file adds none.
+    const n = text === "" ? 0 : text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+    numstat += `${n}\t0\t${file}\n`;
+  }
+  return { ...budgetedAdded(numstat), base };
+}
+
+export async function prSizeCommand({ config, logger = console, flags = {} }) {
+  const s = await branchSize({ projectDir: config?.projectDir || process.cwd(), base: config?.base_branch || "main" });
+  if (flags.json) process.stdout.write(`${JSON.stringify(s)}\n`);
+  else logger.info(`pr-size: ${s.added} line(s) added against ${s.base} (${s.testAdded} in tests, ${s.exempt} exempt)`);
+  return s;
+}

package/src/commands/review-gate.js

@@ -5,7 +5,7 @@
  * verdict tied to the exact diff (verdict-store), so the pre-commit hook
  * (ENV-C) can verify it. Exit code 0 = approved, 1 = rejected/stale.
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { runCommand } from "../utils/process.js";
 import { checkVerdict, diffHash, pruneVerdicts } from "../review/verdict-store.js";
@@ -13,6 +13,7 @@ import { runOneShotReview } from "../review/one-shot-review.js";
 import { runSolomonArbitration } from "../review/solomon-arbitration.js";
 import { ensureGateTrackable } from "../review/gate-gitignore.js";
 import { runSonarPregate, formatSonarFinding, addedLinesByFile } from "../review/sonar-pregate.js";
+import { addedAreCommentsOnly } from "../review/comment-only.js";
 import { checkSonarRequirement, SONAR_RULE_ID } from "../review/sonar-requirement.js";
 import { checkRagRequirement, checkRagVerdict, ragBlock, RAG_RULE_ID } from "../review/rag-requirement.js";
 import { checkUiEvidence, uiBlock } from "../review/ui-evidence.js";
@@ -59,6 +60,36 @@ async function rawDiff(range, extraArgs = []) {
   return res.stdout;
 }
 
+/** The file as the reviewed diff leaves it. */
+async function resultingContent(range, file, projectDir) {
+  const show = async (spec) => {
+    const res = await runCommand("git", ["show", spec]);
+    return res.exitCode === 0 ? res.stdout : null;
+  };
+  // Staged review: the INDEX, never the working tree (unstaged edits are not reviewed).
+  if (!range) return show(`:${file}`);
+  // `a..b` / `a...b`: the right side (HEAD when omitted).
+  if (/\.\./.test(range)) return show(`${range.split(/\.\.\.?/)[1] || "HEAD"}:${file}`);
+  // `git diff <ref>` compares the ref with the working tree, so that is the result.
+  try { return readFileSync(join(projectDir, file), "utf8"); } catch { return null; }
+}
+
+/**
+ * KJC-BUG-0235: mark the files whose added lines are all comments, so a
+ * cleanup that corrects the comments it left lying is not taken for new code.
+ * Anything unreadable or of unknown syntax stays unmarked (counts as code).
+ */
+export async function markCommentOnlyAdditions(numstat, { range, projectDir }) {
+  const touched = numstat.filter((n) => n.added > 0);
+  if (touched.length === 0) return;
+  const added = addedLinesByFile(await rawDiff(range, ["--unified=0"]));
+  for (const n of touched) {
+    const lines = added.get(n.file);
+    const content = lines ? await resultingContent(range, n.file, projectDir) : null;
+    n.commentOnly = content !== null && addedAreCommentsOnly(content, lines, n.file);
+  }
+}
+
 // KJC-TSK-0838: a grant is the ONLY way past the sonar requirement, so it is
 // said with who gave it, its scope and until when.
 const formatSonarGrant = (g) => {
@@ -286,6 +317,7 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   // exempt — deleting code adds no behavior to test.
   const numstat = (await rawDiff(flags.range, ["--numstat"])).split("\n").map((l) => l.trim()).filter(Boolean)
     .map((l) => { const [a, r, ...f] = l.split(/\s+/); return { file: f.join(" "), added: a === "-" ? 1 : Number(a) || 0, removed: r === "-" ? 0 : Number(r) || 0 }; });
+  await markCommentOnlyAdditions(numstat, { range: flags.range, projectDir });
   const tests = checkTestsWithCode({ config, stagedFiles: changedFiles, numstat });
   if (tests.mode === "delete-only") console.log(`⚠ tests-with-code: exempt — ${tests.reason}`);
   if (tests.mode === "warn") console.log(`⚠ tests-with-code: ${tests.reason}`);

package/src/harden/hook-templates.js

@@ -156,6 +156,13 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
         "  echo 'kj harden: commit header must follow Conventional Commits (type: subject)'; exit 1",
         "fi",
         'if [ "${#header}" -gt 100 ]; then echo \'kj harden: commit header exceeds 100 chars\'; exit 1; fi',
+        "# KJC-TSK-0909: the rest of what CI's commitlint rejects, caught here.",
+        "if ! awk 'NR > 2 && !/^#/ && length($0) > 100 { exit 1 }' \"$msg_file\"; then",
+        "  echo 'kj harden: a commit body line exceeds 100 chars (CI commitlint rejects it)'; exit 1",
+        "fi",
+        'if [ -x node_modules/.bin/commitlint ]; then',
+        '  node_modules/.bin/commitlint --edit "$msg_file" || exit 1',
+        "fi",
         `if grep -qiE '${AI_ATTRIBUTION}' "$msg_file"; then`,
         "  echo 'kj harden: AI attribution is not allowed in commit messages'; exit 1",
         "fi",

package/src/harden/phone-sign.js

@@ -17,18 +17,22 @@ const SPKI_ED25519_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
 // escáner de privacidad del pack deniega claves google con razón general, y
 // servirla desde la landing la hace además rotable sin release.
 const RELAY_CONFIG_URL = "https://karajancode.com/sign/relay.json";
-let relayCache = null;
+// Cacheada por fetch: en produccion es siempre la misma; en tests, cada relé falso es otro.
+const relayCache = new WeakMap();
 async function relayConfig(fetchFn) {
-  if (relayCache) return relayCache;
+  if (relayCache.has(fetchFn)) return relayCache.get(fetchFn);
   const res = await fetchFn(RELAY_CONFIG_URL);
   if (!res.ok) throw new Error(`phone-sign: no pude cargar la config del relé (${res.status}) — revisa la red`);
   const cfg = await res.json();
   if (!cfg?.apiKey || !cfg?.projectId || !cfg?.collection) throw new Error("phone-sign: config del relé incompleta");
-  relayCache = {
+  const relay = {
     apiKey: cfg.apiKey,
     url: `https://firestore.googleapis.com/v1/projects/${cfg.projectId}/databases/(default)/documents/${cfg.collection}`,
+    // KJC-TSK-0901: v2 solo cuando la landing (pagina + reglas) ya lo entiende.
+    payloadVersion: cfg.payloadVersion === 2 ? 2 : 1,
   };
-  return relayCache;
+  relayCache.set(fetchFn, relay);
+  return relay;
 }
 const SIGN_PAGE = "https://karajancode.com/sign";
 const POLL_INTERVAL_MS = 2000;
@@ -109,9 +113,15 @@ export function enrollPhone(publicKeyBase64, { home } = {}) {
   writeFileSync(phoneKeyPath(home), `${JSON.stringify(record, null, 2)}\n`, "utf8");
 }
 
-/** Payload canónico firmado: files EXACTAMENTE como se enviaron, JSON sin espacios. */
-export function canonicalPayload({ cid, nonce, project, files }) {
+/**
+ * Payload canónico firmado: files EXACTAMENTE como se enviaron, JSON sin espacios.
+ * KJC-TSK-0901/0902: v2 firma también lo demás que el móvil enseña (versión de
+ * kj) y la propia vigencia (emisión y caducidad, en ms), para que nada mostrado
+ * quede sin firmar y la caducidad sea de lo que el humano aprobó.
+ */
+export function canonicalPayload({ cid, nonce, project, files, v = 1, kjVersion, issuedMs, expiresMs }) {
   const filesHash = createHash("sha256").update(JSON.stringify(files)).digest("hex");
+  if (v === 2) return `kj-supervisor-sign:v2:${cid}:${nonce}:${project}:${kjVersion}:${issuedMs}:${expiresMs}:${filesHash}`;
   return `kj-supervisor-sign:v1:${cid}:${nonce}:${project}:${filesHash}`;
 }
 
@@ -135,17 +145,21 @@ export async function requestPhoneSignature({ project, files, kjVersion, logger
   const drawQr = deps.qr ?? ((url) => qrcode.generate(url, { small: true }));
   const cid = randomBytes(16).toString("hex");
   const nonce = randomBytes(16).toString("hex");
+  const relay = await relayConfig(fetchFn);
+  const v = relay.payloadVersion;
+  const issuedMs = now();
+  const expiresMs = issuedMs + TTL_MS;
   const body = {
     fields: {
       nonce: { stringValue: nonce },
       project: { stringValue: project },
       kj_version: { stringValue: kjVersion },
       state: { stringValue: "pending" },
-      createdAt: { timestampValue: new Date().toISOString() },
+      createdAt: { timestampValue: new Date(issuedMs).toISOString() },
       files: { arrayValue: { values: files.map((f) => ({ mapValue: { fields: { file: { stringValue: f.file }, sha256: { stringValue: f.sha256 ?? "" } } } })) } },
+      ...(v === 2 ? { v: { integerValue: "2" }, expires_at: { timestampValue: new Date(expiresMs).toISOString() } } : {}),
     },
   };
-  const relay = await relayConfig(fetchFn);
   const created = await fetchFn(`${relay.url}?documentId=${cid}&key=${relay.apiKey}`, {
     method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body),
   });
@@ -157,7 +171,7 @@ export async function requestPhoneSignature({ project, files, kjVersion, logger
   logger.info?.(`phone-sign: escanea el QR o abre ${signUrl} y firma en el móvil (caduca en ${TTL_MS / 1000}s)`);
   logger.info?.("phone-sign: esperando la firma del móvil…");
   const spinner = deps.spinner ?? makeSpinner();
-  const deadline = now() + TTL_MS;
+  const deadline = expiresMs;
   while (now() < deadline) {
     const res = await fetchFn(`${relay.url}/${cid}?key=${relay.apiKey}`);
     if (!res.ok) { spinner.stop(); throw new Error(`phone-sign: fallo consultando la petición de firma (HTTP ${res.status})`); }
@@ -171,14 +185,17 @@ export async function requestPhoneSignature({ project, files, kjVersion, logger
       if (!signerKey || !authorized.has(signerKey)) {
         return { ok: false, reason: "la publicKey que firma no está en el padrón autorizado — el doc es transporte, la verdad es el padrón" };
       }
-      const payload = canonicalPayload({ cid, nonce, project, files });
+      const signed2 = v === 2 ? { v, kjVersion, issuedMs, expiresMs } : {};
+      const payload = canonicalPayload({ cid, nonce, project, files, ...signed2 });
       const signature = fields.signature?.stringValue ?? "";
       const good = verifyPhoneSignature({ payload, signature, publicKey: signerKey });
       if (!good) return { ok: false, reason: "firma ed25519 inválida para el payload canónico" };
+      // KJC-TSK-0901: una firma válida fuera de la vigencia que ella misma firma no vale.
+      if (v === 2 && now() > expiresMs) return { ok: false, reason: "la firma llegó fuera de su vigencia firmada" };
       // KJC-TSK-0823: devuelve el desafío + firma para que el sello los GRABE en
       // la provenance y CI pueda re-verificar server-side (clave del padrón).
       const filesHash = createHash("sha256").update(JSON.stringify(files)).digest("hex");
-      return { ok: true, signer: signerKey, signature, challenge: { cid, nonce, project, filesHash } };
+      return { ok: true, signer: signerKey, signature, challenge: { cid, nonce, project, filesHash, ...signed2 } };
     }
     spinner.tick();
     await sleep(POLL_INTERVAL_MS);

package/src/harden/sentinel-hooks.js

@@ -288,9 +288,23 @@ process.stdin.on("end", () => {
         s.escapes.push(e);
         (state.escape_events ||= []).push({ escape: e, tool, sid, ts: Date.now() });
       }
+    // KJC-TSK-0910: the branch size while it is written, with the CI budget
+    // (kj pr-size), said once per threshold crossed. Context, never a block.
+    let sizeNote = null;
+    if (bucket) {
+      const ps = spawnSync("kj", ["pr-size", "--json"], { cwd: ROOT, encoding: "utf8", timeout: 5000 });
+      let size = null;
+      try { size = JSON.parse(String(ps.stdout || "").trim().split(String.fromCharCode(10)).pop()); } catch { size = null; }
+      const crossed = size ? [200, 150].find((t) => size.added > t) : undefined;
+      if (crossed && (s.size_warned || 0) < crossed) {
+        s.size_warned = crossed;
+        sizeNote = "karajan sentinel: la rama ya suma " + size.added + " lineas contables (" + size.testAdded + " de tests); " + (crossed >= 200 ? "pasa el limite de 200 del CI: parte antes de seguir" : "pasa de 150: planea la particion ahora, no en el stage");
+      }
+    }
     const ids = Object.keys(state.sessions);
     if (ids.length > 5) delete state.sessions[ids.sort((a, b) => (state.sessions[a].at || 0) - (state.sessions[b].at || 0))[0]];
     save(state);
+    if (sizeNote) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: sizeNote } }));
   } catch { /* fail open — the sentinel never breaks a tool call */ }
   process.exit(0);
 });

package/src/rag/indexable.js

@@ -8,7 +8,8 @@
  * text windows (chunkSource already does).
  */
 import { execFileSync } from "node:child_process";
-import { closeSync, lstatSync, openSync, readSync } from "node:fs";
+import { closeSync, lstatSync, openSync, readFileSync, readSync, statSync } from "node:fs";
+import { join } from "node:path";
 
 import { matchesAny } from "@karajan-family/governance";
 
@@ -40,6 +41,35 @@ const skipsFor = (projectDir) => {
   return skipCache.get(key);
 };
 
+/**
+ * KJC-TSK-0900: `.ragignore` at the project root, gitignore syntax, versioned so
+ * the whole team inherits it. `dir/` is a folder anywhere, `*.csv` an extension
+ * anywhere, `/data` anchored to the root, a path with a slash is from the root.
+ * `!` negation is not supported (said in the docs). Re-read when it changes.
+ */
+const ragignoreCache = new Map();
+export function ragignoreGlobs(projectDir) {
+  if (!projectDir) return [];
+  const file = join(projectDir, ".ragignore");
+  let mtime;
+  try { mtime = statSync(file).mtimeMs; } catch { return []; }
+  const hit = ragignoreCache.get(file);
+  if (hit?.mtime === mtime) return hit.globs;
+  const globs = [];
+  for (const raw of readFileSync(file, "utf8").split("\n")) {
+    let p = raw.trim();
+    if (!p || p.startsWith("#") || p.startsWith("!")) continue;
+    const dirOnly = p.endsWith("/");
+    p = p.replace(/^\/+|\/+$/g, "");
+    if (!p) continue;
+    const base = raw.trim().startsWith("/") || p.includes("/") ? p : `**/${p}`;
+    globs.push(`${base}/**`);
+    if (!dirOnly) globs.push(base);
+  }
+  ragignoreCache.set(file, { mtime, globs });
+  return globs;
+}
+
 /** What the project keeps out of its index: `rag.exclude`, repo-relative globs. */
 export const ragExclude = (config) => (Array.isArray(config?.rag?.exclude) ? config.rag.exclude : []);
 
@@ -63,6 +93,7 @@ function looksBinary(abs) {
 export function indexableReason(rel, abs, { exclude = [], projectDir = null, skip = skipsFor(projectDir) } = {}) {
   if (skip(rel)) return `${rel} lives under a path the indexer always skips`;
   if (matchesAny(rel, exclude)) return `${rel} is excluded by the project's rag.exclude`;
+  if (matchesAny(rel, ragignoreGlobs(projectDir))) return `${rel} is excluded by the project's .ragignore`;
   if (SENSITIVE.some((re) => re.test(rel))) return `${rel} may hold secrets, and the embedder can be a remote service`;
   if (GENERATED.some((re) => re.test(rel))) return `${rel} is a generated file (lockfile, minified, sourcemap or snapshot)`;
   let st;

package/src/review/comment-only.js

@@ -0,0 +1,93 @@
+/**
+ * KJC-BUG-0235 — are the lines a diff ADDS only comments? A cleanup deletes
+ * code and corrects the comments that were left lying about it; those added
+ * lines carry no behavior to test. Decided by scanning the resulting file, not
+ * by a line's first characters: " * factor" can continue a product. Strings are
+ * kept as code, so a docstring or a `//` inside a string is never a comment.
+ * An unknown syntax is not judged: everything counts as code (conservative).
+ */
+import { extname } from "node:path";
+
+// JSX/TSX and PHP are out: a `//` in a JSX text child or outside `<?php` is
+// rendered content. JSX inside a .js/.ts file is detected below.
+const C_STYLE = new Set([".js", ".mjs", ".cjs", ".ts", ".java", ".cs", ".go", ".kt", ".swift", ".c", ".cc", ".cpp", ".h", ".hpp", ".rs", ".scala"]);
+// Shell and Ruby are left out on purpose: a `#` line inside a heredoc is
+// content, not a comment, and this scanner does not parse heredocs.
+const HASH_STYLE = new Set([".py"]);
+const OPENER_AFTER = new Set([";", "{", "}", "(", ")", ",", "=", ":", "?", "!", "&", "|"]);
+
+/** @returns {Set<number>|null} 1-based lines holding code, or null for an unknown syntax */
+export function codeLines(content, file) {
+  const ext = extname(file).toLowerCase();
+  const cStyle = C_STYLE.has(ext);
+  if (!cStyle && !HASH_STYLE.has(ext)) return null;
+  const lines = new Set();
+  let line = 1;
+  let state = "code"; // code | line | block | string
+  let quote = "";
+  const s = String(content);
+  let step; // characters consumed by the current iteration (set in the body)
+  let prev = ""; // last non-space character seen in code on this line
+  let word = ""; // identifier being read in code
+  let lastWord = ""; // last complete identifier in code
+  for (let i = 0; i < s.length; i += step) {
+    const c = s[i];
+    const next = s[i + 1];
+    step = 1;
+    if (c === "\n") prev = "";
+    if (c === "\n") {
+      line++;
+      if (state === "line") state = "code";
+      // A line inside a multi-line string is part of its value, even if blank.
+      if (state === "string") lines.add(line);
+    } else if (state === "block") {
+      if (c === "*" && next === "/") { state = "code"; step = 2; }
+    } else if (state === "string") {
+      lines.add(line);
+      if (c === "\\") {
+        // An escaped newline continues the string on the next physical line: count it.
+        if (next === "\n") { line++; lines.add(line); }
+        step = 2;
+      } else if (c === quote) {
+        state = "code";
+      }
+    } else if (state === "code") {
+      // A comment opens only where one can: line start or after a separator.
+      // After `\`, `[` or an identifier a slash may belong to a regex literal
+      // (/a\/*b/, /[/*]/), so it is taken as code: in doubt, code.
+      const canOpen = prev === "" || OPENER_AFTER.has(prev);
+      if (/[\w$]/.test(c)) word += c;
+      else if (word) { lastWord = word; word = ""; }
+      // A tag where an expression starts (`= <div>`, `return <App />`) is JSX:
+      // its text children are rendered, so this file is not judged.
+      if (cStyle && c === "<" && /[A-Za-z/>]/.test(next ?? "") && (canOpen || lastWord === "return")) return null;
+      if (cStyle && canOpen && c === "/" && next === "/") state = "line";
+      else if (cStyle && canOpen && c === "/" && next === "*") { state = "block"; step = 2; }
+      else if (!cStyle && c === "#") state = "line";
+      else if (c === '"' || c === "'" || c === "`") { state = "string"; quote = c; lines.add(line); }
+      else if (!/\s/.test(c)) lines.add(line);
+      if (state === "code" && !/\s/.test(c)) prev = c;
+    }
+  }
+  return lines;
+}
+
+const COMMENT_START = /^(\/\/|\/\*|\*|#)/;
+
+/**
+ * Every added line (1-based, in the resulting file) is a comment or blank.
+ * Two checks must agree: the scanner says no code on the line AND the line
+ * itself starts like a comment (or is blank). The second one is a net against
+ * a scanner mistake, and it costs a knowingly accepted false negative: a block
+ * comment continuation without a leading `*` counts as code. Agreed criterion
+ * (KJC-BUG-0235): better a cleanup that still asks for tests than code let through.
+ */
+export function addedAreCommentsOnly(content, addedLines, file) {
+  const code = codeLines(content, file);
+  if (!code) return false;
+  const text = String(content).split("\n");
+  return [...addedLines].every((n) => {
+    const t = (text[n - 1] ?? "").trim();
+    return !code.has(n) && (t === "" || COMMENT_START.test(t));
+  });
+}

package/src/review/tests-with-code.js

@@ -42,8 +42,11 @@ export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = nu
   // cleanup PRs). Callers that only know names keep the old behavior.
   if (Array.isArray(numstat)) {
     const bySource = numstat.filter((n) => sources.includes(n.file));
-    if (bySource.length === sources.length && bySource.every((n) => (n.added || 0) === 0)) {
-      return { ok: true, mode: "delete-only", sources, reason: "every touched source only removes lines — deleting is not new behavior" };
+    // KJC-BUG-0235: a cleanup also corrects the comments the deletion left
+    // lying; lines the caller PROVED to be comments carry no behavior either.
+    const cleanup = (n) => (n.added || 0) === 0 || n.commentOnly === true;
+    if (bySource.length === sources.length && bySource.every(cleanup)) {
+      return { ok: true, mode: "delete-only", sources, reason: "every touched source only removes lines or corrects comments — deleting is not new behavior" };
     }
   }