karajan-code 4.37.0 → 4.39.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.37.0",
+  "version": "4.39.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/packages/ai-trash/src/destructive-parser.js

@@ -35,14 +35,43 @@ function classifyMv(tokens) {
   return { destructive: true, kind: "mv-overwrite", paths: positional.slice(-1), reason: "mv may overwrite destination" };
 }
 
+// KJC-BUG-0240 (#1886): checkout and restore drop uncommitted work file by file,
+// and a bundle keeps commits only, so the named files are kept as files and a
+// discard of the whole tree marks it (worktree) for the hook to keep every dirty file.
+function classifyDiscard(tokens, sub) {
+  const args = tokens.slice(2);
+  const has = (...flags) => flags.some((f) => args.includes(f));
+  const SAFE = { destructive: false, kind: "git-safe", paths: [] };
+  if (sub === "restore" && has("--staged", "-S") && !has("--worktree", "-W")) return { ...SAFE, reason: "restore --staged only unstages" };
+  // -B resets an existing branch: its commits need the bundle.
+  if (sub === "checkout" && has("-B")) return { destructive: true, kind: "git-checkout-reset-branch", bundle: true, paths: [], reason: "git checkout -B resets an existing branch" };
+  if (sub === "checkout" && has("-b", "--orphan")) return { ...SAFE, reason: "checkout -b creates a branch" };
+  const dd = args.indexOf("--");
+  const named = [];
+  let sourceValue = false;
+  args.forEach((a, i) => {
+    if (sourceValue) sourceValue = false;
+    else if (a === "-s" || a === "--source") sourceValue = true;
+    else if ((dd >= 0 && i > dd) || !a.startsWith("-")) named.push(a);
+  });
+  if (!named.length && !has("-f", "--force")) return { ...SAFE, reason: `${sub} with nothing to discard` };
+  const whole = has("-f", "--force") || named.includes(".") || named.includes(":/");
+  return { destructive: true, kind: `git-${sub}-discard`, paths: named.filter((p) => p !== "." && p !== ":/"), ...(whole ? { worktree: "tracked" } : {}), reason: `git ${sub} discards local edits` };
+}
+
 function classifyGit(tokens) {
   const sub = tokens[1];
   const has = (...flags) => flags.some((f) => tokens.includes(f));
-  if (sub === "reset" && has("--hard")) return { destructive: true, kind: "git-reset-hard", paths: [], reason: "git reset --hard drops working tree" };
-  if (sub === "clean" && has("-f", "-fd", "-xdf")) return { destructive: true, kind: "git-clean", paths: [], reason: "git clean -f removes untracked files" };
-  if (sub === "branch" && has("-D")) return { destructive: true, kind: "git-branch-D", paths: [], reason: "git branch -D drops unmerged branch" };
-  if (sub === "push" && has("--force", "-f", "--force-with-lease")) return { destructive: true, kind: "git-push-force", paths: [], reason: "git push --force rewrites remote history" };
-  if (sub === "checkout" && has("--", ".")) return { destructive: true, kind: "git-checkout-discard", paths: [], reason: "git checkout -- discards local edits" };
+  if (sub === "reset" && has("--hard")) return { destructive: true, kind: "git-reset-hard", bundle: true, worktree: "tracked", paths: [], reason: "git reset --hard drops working tree" };
+  if (sub === "clean" && tokens.some((t) => t === "--force" || /^-[a-zA-Z]*f/.test(t))) {
+    // -x / -X also remove ignored files.
+    const ignored = tokens.some((t) => /^-[a-zA-Z]*[xX]/.test(t));
+    return { destructive: true, kind: "git-clean", bundle: true, worktree: ignored ? "untracked+ignored" : "untracked", paths: [], reason: "git clean -f removes untracked files" };
+  }
+  if (sub === "branch" && has("-D")) return { destructive: true, kind: "git-branch-D", bundle: true, paths: [], reason: "git branch -D drops unmerged branch" };
+  if (sub === "push" && has("--force", "-f", "--force-with-lease")) return { destructive: true, kind: "git-push-force", bundle: true, paths: [], reason: "git push --force rewrites remote history" };
+  if (sub === "checkout" || sub === "restore") return classifyDiscard(tokens, sub);
+  if (sub === "switch" && has("-f", "--force", "--discard-changes")) return { destructive: true, kind: "git-switch-discard", worktree: "tracked", paths: [], reason: "git switch --discard-changes drops local edits" };
   return { destructive: false, kind: "git-safe", paths: [], reason: "git op without destructive flags" };
 }
 

package/packages/ai-trash/src/hook.js

@@ -4,6 +4,7 @@
 // throws, deny the op so Claude never destroys without a recovery copy.
 
 import { promises as fs } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { isAbsolute, resolve } from "node:path";
 import process from "node:process";
 import { classifyCommand } from "./destructive-parser.js";
@@ -47,6 +48,29 @@ async function snapshotExistingPaths(root, paths, cwd, command) {
   return snapshots;
 }
 
+// KJC-BUG-0240 (#1886): the dirty files a whole-tree discard would drop, kept as
+// files (a bundle keeps commits only). `which`: "tracked" changes, "untracked"
+// files, or "untracked+ignored" (git clean -x/-X removes ignored files too).
+async function snapshotDirtyFiles(root, cwd, command, which) {
+  if (!cwd) return [];
+  const top = spawnSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  if (top.status !== 0) return [];
+  const withIgnored = which === "untracked+ignored";
+  // traditional + all: every file inside an ignored directory is listed one by one.
+  const st = spawnSync("git", ["-C", cwd, "status", "--porcelain", "-z", "--untracked-files=all", ...(withIgnored ? ["--ignored=traditional"] : [])], { encoding: "utf8" });
+  if (st.status !== 0) throw new Error(`git status failed: ${st.stderr.trim()}`);
+  const wanted = (rec) => (which === "tracked" ? !rec.startsWith("??") && !rec.startsWith("!!") : rec.startsWith("??") || (withIgnored && rec.startsWith("!!")));
+  const files = [];
+  let renameSource = false; // a rename or copy record is followed by its source path
+  for (const rec of st.stdout.split("\0")) {
+    if (renameSource) { renameSource = false; continue; }
+    if (rec.length < 4) continue;
+    if (wanted(rec)) files.push(rec.slice(3));
+    renameSource = "RC".includes(rec[0]);
+  }
+  return snapshotExistingPaths(root, files, top.stdout.trim(), command);
+}
+
 async function snapshotGitRepo(root, cwd, command, kind) {
   if (!cwd) return { snapshots: [], skipped: "no cwd" };
   try {
@@ -86,11 +110,9 @@ export async function handleHookPayload(payload, { root, stdin }) {
     await assertOwnedByCurrentUser(root);
     let snapshots = [];
     let skipped = null;
-    if (verdict.kind.startsWith("git-")) {
-      ({ snapshots, skipped } = await snapshotGitRepo(root, data.cwd, command, verdict.kind));
-    } else {
-      snapshots = await snapshotExistingPaths(root, verdict.paths, data.cwd, command);
-    }
+    if (verdict.bundle) ({ snapshots, skipped } = await snapshotGitRepo(root, data.cwd, command, verdict.kind));
+    snapshots.push(...(await snapshotExistingPaths(root, verdict.paths, data.cwd, command)));
+    if (verdict.worktree) snapshots.push(...(await snapshotDirtyFiles(root, data.cwd, command, verdict.worktree)));
     if (snapshots.length) {
       const m = await loadManifest(root);
       for (const s of snapshots) m.entries.push(s);
@@ -106,7 +128,7 @@ export async function handleHookPayload(payload, { root, stdin }) {
     if (snapshots.length) {
       return reply(
         "allow",
-        `ai-trash: snapshotted ${snapshots.length} ${verdict.kind.startsWith("git-") ? "git bundle" : "path(s)"} before ${verdict.kind}`
+        `ai-trash: snapshotted ${snapshots.length} ${snapshots.some((s) => s.type === "git-bundle") ? "item(s), git bundle included," : "path(s)"} before ${verdict.kind}`
       );
     }
     return reply(

package/scripts/esbuild-sea.config.mjs

@@ -26,6 +26,15 @@ const seaTransformPlugin = {
       let contents = await fs.readFile(args.path, "utf8");
       let modified = false;
 
+      // KJC-TSK-0915 (ADR 0014): the Sentinel's guard modules are read as TEXT at
+      // load time, to be copied into a project's harness. A single-file bundle has
+      // no sibling files, so the text is inlined here, before import.meta.url goes.
+      const SENTINEL_READ = /readFileSync\(new URL\("(\.\/sentinel\/[\w-]+\.mjs)", import\.meta\.url\), "utf8"\)/g;
+      if (SENTINEL_READ.test(contents)) {
+        contents = contents.replace(SENTINEL_READ, (_m, rel) => JSON.stringify(readFileSync(path.resolve(path.dirname(args.path), rel), "utf8")));
+        modified = true;
+      }
+
       // Replace import.meta.dirname with __dirname
       if (contents.includes("import.meta.dirname")) {
         contents = contents.replaceAll("import.meta.dirname", "__dirname");

package/src/checks/method.js

@@ -36,7 +36,7 @@ export async function collectMethodStats({ projectDir, run = runCommand, sample
   const blocks = blocksRes.exitCode === 0
     ? blocksRes.stdout.split(/^@.*$/m).map((b) => b.split("\n").map((l) => l.trim()).filter(Boolean)).filter((b) => b.length > 0)
     : [];
-  const offenders = blocks.filter((files) => checkTestsWithCode({ config: {}, stagedFiles: files, env: {} }).mode !== "pass").length;
+  const offenders = blocks.filter((files) => checkTestsWithCode({ config: {}, stagedFiles: files }).mode !== "pass").length;
 
   const verdicts = recentVerdicts(projectDir, sample);
   const stamped = verdicts.filter((v) => v.workspace);

package/src/checks/release-check.js

@@ -34,7 +34,9 @@ async function policyRangeCheck(projectDir) {
     // protects the supervisor. `kj review` and `kj policy check` already lift
     // what the sealed provenance backs; without this the release check blocked
     // every version cut after a human `kj harden --commit`, by its own seal.
-    const sup = liftSealedSupervisorViolations({ projectDir, violations: raw });
+    // KJC-BUG-0259: the history is judged on what is versioned (hooks, provenance);
+    // the machine-local guards were verified when the seal was reviewed.
+    const sup = liftSealedSupervisorViolations({ projectDir, violations: raw, trackedOnly: true });
     const violations = sup.violations;
     const hard = violations.filter((v) => v.enforcement === "deny");
     const skipped = prScoped.size > 0 ? `; ${prScoped.size} diff-threshold invariant(s) skipped (PR-scoped)` : "";

package/src/cli/register-meta.js

@@ -30,7 +30,7 @@ import { envInstallCommand, briefCommand } from "../commands/env.js";
 import { runReleaseCheck } from "../checks/release-check.js";
 import { agentRunCommand } from "../commands/agent-run.js";
 import { reportIssueCommand } from "../commands/report-issue.js";
-import { huCommand } from "../commands/hu.js";
+import { huCommand, HU_STATUSES } from "../commands/hu.js";
 import { worktreeCommand } from "../commands/worktree.js";
 import { addAdr, listAdrs } from "../environment/adr.js";
 import { formatAdvancedIndex } from "../commands/advanced.js";
@@ -271,6 +271,8 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
   hu.command("move <id> <status>")
+    // KJC-BUG-0257: the valid states, said before the call fails.
+    .description(`Move a card; <status> is one of: ${HU_STATUSES.join(", ")}`)
     .option("--json", "Machine-readable output")
     .action(async (id, status, flags) => {
       await withConfig(pkgVersion, "hu", flags, async ({ config }) => {

package/src/cli/register-pipeline.js

@@ -201,7 +201,8 @@ export function registerPipeline(program, { pkgVersion }) {
   program
     .command("solomon")
     .description("Ask a third AI to arbitrate a rejected review verdict (brain ≠ reviewer ≠ solomon)")
-    .requiredOption("--position <text>", "Why the brain disagrees with the reviewer")
+    .option("--position <text>", "Why the brain disagrees with the reviewer")
+    .option("--position-file <path>", "Read the position from a file (no quoting to get right)")
     .option("--range <range>", "Arbitrate a git range instead of the staged diff")
     .action(async (flags) => {
       await withConfig(pkgVersion, "solomon", flags, async ({ config, logger }) => {

package/src/commands/rag.js

@@ -14,7 +14,7 @@ import { installPostMergeHook, maybeAutoUpdate } from "../rag/auto-update.js";
 import { indexLibrary, LIBRARY_PROJECT } from "../rag/library.js";
 import { loadGoldenQueries, runEval } from "../rag/eval.js";
 import { getKarajanHome } from "../utils/paths.js";
-import { countProjectChunks, emptyIndexRemedy, migrateProjectIndex } from "../rag/migrate.js";
+import { countProjectChunks, countProjectSources, emptyIndexRemedy, migrateProjectIndex } from "../rag/migrate.js";
 import { openLibraryStore, openProjectStore, projectDbPath } from "../rag/project-store.js";
 
 // KJC-TSK-0882 (ADR 0011): el indice es del proyecto, no de la maquina.
@@ -153,6 +153,11 @@ export async function ragQueryCommand({ text, config, logger, flags = {} }) {
       if (flags.json) process.stdout.write(`${JSON.stringify({ hits: [], empty: true, topK, scope, remedy })}\n`);
       return [];
     }
+    // KJC-BUG-0258: chunks of plans and briefs but none of the project's own files
+    // answer nothing about the code; said now, not when kj review --staged blocks.
+    if (!library && project && countProjectSources(db, project, config?.projectDir || process.cwd()) === 0) {
+      logger.warn("[rag] this project's index holds none of its own files (only plans or briefs): run kj rag index --with-sources");
+    }
     const mode = flags.mode || "hybrid";
     const alpha = Math.max(0, Math.min(1, Number(flags.alpha) || 0.6));
     // Safe by grammar: parseWhere (core where-parser.js) accepts ONLY
@@ -234,6 +239,19 @@ export async function ragCoversCommand({ file, config, flags = {} }) {
   }
 }
 
+/**
+ * KJC-BUG-0255: what `kj rag migrate` keeps. The project's own files pass the
+ * indexer's criterion of today; sources outside the tree (plans, onboarding)
+ * are kept as they are.
+ */
+export function migrateKeep(projectDir, config) {
+  const exclude = ragExclude(config);
+  return (source) => {
+    const rel = relative(projectDir, source);
+    return rel.startsWith("..") || isAbsolute(rel) || indexableReason(rel, source, { exclude, projectDir }) === null;
+  };
+}
+
 /**
  * KJC-TSK-0888 (RAG-P1a, ADR 0011) — `kj rag migrate`: copia los chunks de este
  * proyecto desde la base global a su propio indice, con sus embeddings, sin
@@ -241,11 +259,13 @@ export async function ragCoversCommand({ file, config, flags = {} }) {
  */
 export async function ragMigrateCommand({ config, flags = {} }) {
   const projectDir = config?.projectDir || process.cwd();
+  const keep = migrateKeep(projectDir, config);
   const res = migrateProjectIndex({
     slug: projectSlug(projectDir),
     legacyPath: join(getKarajanHome(), "rag.db"),
     targetPath: projectDbPath(projectDir),
     dim: config?.rag?.embedder?.dim || 768,
+    keep,
   });
   if (flags.json) process.stdout.write(`${JSON.stringify(res)}\n`);
   else process.stdout.write(`rag migrate: ${res.state} — ${res.reason}\n`);

package/src/commands/review-gate.js

@@ -42,7 +42,6 @@ async function enforceCardFirst({ config, projectDir }) {
   // KJC-TSK-0732: the verification LEVEL is part of the verdict — a pass on
   // branch-ref alone must never read as a tracker-verified pass.
   if (card.note) console.log(`⚠ card-first: ${card.note}`);
-  if (card.mode === "exempt" && card.reason.includes("KJ_ALLOW_NO_CARD")) console.log(`⚠ card-first exempt: ${card.reason}`);
   if (!card.ok) {
     console.log(`✗ card-first gate: ${card.reason}`);
     process.exitCode = 1;
@@ -139,6 +138,14 @@ function printVerdict(record) {
  */
 export async function solomonCommand({ config, logger = null, flags = {} }) {
   const projectDir = config?.projectDir || process.cwd();
+  // KJC-BUG-0260: a position is prose with blanks and slashes; from a file it
+  // needs no quoting the lane guard has to tell apart from a path.
+  const position = flags.positionFile ? readFileSync(flags.positionFile, "utf8").trim() : flags.position;
+  if (!position) {
+    console.log("✗ kj solomon: give the brain's position with --position <text> or --position-file <path>");
+    process.exitCode = 1;
+    return { ruling: "reject", reasoning: "no position given" };
+  }
   const diff = await rawDiff(flags.range);
   // KJC-TSK-0734 (PL-B): un hallazgo de policy de clase seguridad no es
   // arbitrable — solomon se niega antes de gastar un token. Y una policy
@@ -162,7 +169,7 @@ export async function solomonCommand({ config, logger = null, flags = {} }) {
     process.exitCode = 1;
     return { ruling: "reject", reasoning: "security-class policy denial — not arbitrable" };
   }
-  const res = await runSolomonArbitration({ diff, position: flags.position, config, logger, projectDir });
+  const res = await runSolomonArbitration({ diff, position, config, logger, projectDir });
   if (res.ruling === "approve") {
     console.log(`⚖ Solomon (${res.solomon}) rules for the brain — verdict recorded, the gate is open.`);
   } else {
@@ -256,10 +263,9 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
       // partitioning is a decision, and it must never split code from its tests.
       const split = testAdded > 0 ? ` (${added - testAdded} source + ${testAdded} accompanying tests — partition by feature, never code from its tests)` : "";
       const sizePolicy = config?.method_gates?.pr_size || "warn";
-      if (process.env.KJ_ALLOW_LARGE_PR === "1") {
-        console.log(`⚠ pr-size exempt: ${added} lines added — KJ_ALLOW_LARGE_PR=1 (explicit escape hatch)`);
-      } else if (sizePolicy === "block") {
-        const reason = `${added} lines added${split} exceeds the ${sizeWarn}-line budget (${sizeSource}; method_gates.pr_size: block) — partition the work, or get your user's explicit OK and re-run with KJ_ALLOW_LARGE_PR=1`;
+      // ADR 0015: no env escape — an exception is the user's label on the PR, judged in CI.
+      if (sizePolicy === "block") {
+        const reason = `${added} lines added${split} exceeds the ${sizeWarn}-line budget (${sizeSource}; method_gates.pr_size: block) — partition the work; an exception is your user's large-pr-justified label on the PR`;
         console.log(`✗ pr-size gate: ${reason}`);
         process.exitCode = 1;
         return { verdict: "rejected", reviewer: "pr-size", issues: [{ severity: "high", description: reason }] };
@@ -269,7 +275,7 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     }
   }
   // KJC-TSK-0705 (PV-B): the outbound privacy boundary at commit time.
-  // Denylist data rejects (KJ_ALLOW_PII=1 is the named escape); generic PII
+  // Denylist data rejects with no escape (ADR 0015: false positives go in the allow list); generic PII
   // warns (privacy.generic: "block" hardens). Added lines only — deletions
   // don't publish. In the SEA binary the privacy module is stubbed and
   // throws: the gate degrades with a note instead of crashing.
@@ -288,25 +294,19 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     for (const f of warns) console.log(`⚠ privacy: [${f.type}] ${f.source}:${f.line} → ${f.masked} — personal data? move it out before it ships`);
     const hardened = config?.privacy?.generic === "block" && warns.length > 0;
     if (blocks.length > 0 || hardened) {
-      if (process.env.KJ_ALLOW_PII === "1") {
-        console.log(`⚠ privacy exempt: ${blocks.length} denylist hit(s) — KJ_ALLOW_PII=1 (explicit escape hatch)`);
-      } else {
-        for (const f of blocks) console.log(`✗ privacy: [${f.type}] ${f.source}:${f.line} → ${f.masked}`);
-        const reason = `${blocks.length || warns.length} personal-data finding(s) in the staged diff — this must not reach the repo (KJ_ALLOW_PII=1 to override consciously)`;
-        console.log(`✗ privacy gate: ${reason}`);
-        process.exitCode = 1;
-        return { verdict: "rejected", reviewer: "privacy", issues: [{ severity: "high", description: reason }] };
-      }
+      for (const f of blocks) console.log(`✗ privacy: [${f.type}] ${f.source}:${f.line} → ${f.masked}`);
+      const reason = `${blocks.length || warns.length} personal-data finding(s) in the staged diff — this must not reach the repo (a confirmed false positive goes in the allow list of ~/.karajan/privacy.yml)`;
+      console.log(`✗ privacy gate: ${reason}`);
+      process.exitCode = 1;
+      return { verdict: "rejected", reviewer: "privacy", issues: [{ severity: "high", description: reason }] };
     }
   } catch (err) {
     // Known degradation: the SEA stub throws its install-from-npm message.
     // Anything else fails CLOSED — a silent skip would defeat the guarantee.
     if (/standalone binary/i.test(err?.message || "")) {
       console.log("⚠ privacy gate unavailable in this build — skipping");
-    } else if (process.env.KJ_ALLOW_PII === "1") {
-      console.log(`⚠ privacy gate errored (${err.message}) — KJ_ALLOW_PII=1 (explicit escape hatch)`);
     } else {
-      const reason = `privacy gate error: ${err.message} — refusing to pass the boundary unchecked (KJ_ALLOW_PII=1 to override consciously)`;
+      const reason = `privacy gate error: ${err.message} — refusing to pass the boundary unchecked`;
       console.log(`✗ ${reason}`);
       process.exitCode = 1;
       return { verdict: "rejected", reviewer: "privacy", issues: [{ severity: "high", description: reason }] };
@@ -330,9 +330,8 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
 
   // KJC-TSK-0734 (PL-B): la policy declarativa como gate determinista, en
   // --staged Y en --check — el pre-commit hereda los dientes sin regenerar
-  // hooks. enforcement=warn avisa; deny cierra salvo excepción probatoria
-  // (KJ_ALLOW_POLICY=1 + KJ_POLICY_REASON, registrada con identidad y hash
-  // del diff); class=security cierra sin escape y sin arbitraje.
+  // hooks. enforcement=warn avisa; deny cierra sin excepción por diff (ADR
+  // 0015); class=security cierra además sin arbitraje.
   // KJC-BUG-0208: el mismo modulo que decide el presupuesto decide el metrico
   // del invariante. Sumar aqui el numstat entero daba dos cifras para la misma
   // regla en dos lineas seguidas del mismo comando.

package/src/harden/harness-hooks.js

@@ -3,8 +3,9 @@
  * Field case 2026-08-02: text rules were not enough — the environment must
  * impose them AT TOOL TIME. `kj harden` writes a PreToolUse script and wires
  * it into the project's `.claude/settings.json` (merged, never clobbered):
- * Write over an existing file blocks ("use Edit", KJ_ALLOW_WRITE=1 escapes);
- * Bash that reserializes whole JSON files blocks (KJ_ALLOW_REWRITE=1).
+ * Write over an existing file blocks ("use Edit"), with no escape (ADR 0015).
+ * Writes through Bash are the Sentinel's bash-write guard (KJC-BUG-0237), which
+ * replaced the JSON-reserialization guard that lived here.
  * Claude-only v1 — the abstraction arrives with the second host that
  * supports tool hooks.
  */
@@ -19,94 +20,15 @@ const SCRIPT_BODY = `#!/usr/bin/env node
 // so a gate bug never bricks the session.
 import console from "node:console";
 import process from "node:process";
-import { existsSync, realpathSync } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-// El guard vive en <repo>/.karajan/harness/, asi que el arbol es dos arriba.
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+import { existsSync } from "node:fs";
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
     const { tool_name: tool, tool_input: input = {} } = JSON.parse(raw);
-    if (tool === "Write" && process.env.KJ_ALLOW_WRITE !== "1") {
-      if (input.file_path && existsSync(input.file_path)) {
-        console.error("kj tool gate: Write over an EXISTING file destroys unseen changes — use Edit for targeted changes (KJ_ALLOW_WRITE=1 to override consciously).");
-        process.exit(2);
-      }
-    }
-    if (tool === "Bash") {
-      const cmd = String(input.command || "");
-      // KJC-BUG-0227: el escape tambien viaja en el PROPIO comando, como en el
-      // resto de guardias. Mirando solo process.env el agente no tenia salida:
-      // un export dentro del comando jamas llega a este proceso.
-      // Solo cuentan las asignaciones DEL PRINCIPIO, que son las que el shell
-      // aplica al comando. Buscarla en cualquier parte del texto dejaba pasar
-      // un "echo KJ_ALLOW_REWRITE=1; python3 ..." (catch de la review).
-      const toks = cmd.trim().split(/\\s+/);
-      let i = 0;
-      let named = false;
-      while (i < toks.length && /^[A-Z][A-Z0-9_]*=/.test(toks[i])) {
-        if (toks[i] === "KJ_ALLOW_REWRITE=1") named = true;
-        i += 1;
-      }
-      // Una asignacion delante solo alcanza a SU comando, asi que el escape del
-      // comando vale unicamente en un comando SIMPLE: en "VAR=1 true && python"
-      // o "VAR=1 && python" el python nunca la recibe (catch de la review). Lo
-      // que va entre comillas no encadena nada, asi que no cuenta.
-      // Tampoco es simple si hay sustitucion: el proceso de dentro de $( ) no
-      // hereda la asignacion (catch de la review). Mismo criterio que el resto
-      // de guardias del Sentinel.
-      // Dentro de comillas SIMPLES todo es literal; dentro de dobles, un ; no
-      // encadena pero $( ) si ejecuta. Por eso se miran dos cosas distintas.
-      const noSingle = cmd.replaceAll(/'[^']*'/g, "");
-      const substitutes = noSingle.includes("$(") || noSingle.includes("\\u0060");
-      const bare = noSingle.replaceAll(/"[^"]*"/g, "");
-      const simple = !substitutes && !/[;&|]/.test(bare) && !bare.includes("\\n");
-      const cmdEscape = named && simple && i < toks.length;
-      const escaped = process.env.KJ_ALLOW_REWRITE === "1" || cmdEscape;
-      // Un escape ignorado EN SILENCIO era el bug: si esta puesto y no vale, se dice.
-      if (named && !cmdEscape) console.error("kj tool gate: KJ_ALLOW_REWRITE=1 presente pero IGNORADO — solo vale delante del comando y en uno simple (sin ; | & fuera de comillas).");
-      const writes = /open\\s*\\([^)]*["'][wa]["']|>\\s*\\S+\\.json\\b/.test(cmd);
-      // KJC-BUG-0227: y solo se vigila lo que esta DENTRO del arbol. Un fichero
-      // temporal del scratchpad no es asunto de este guard, y bloquearlo
-      // ensenaba a rodearlo. Sin ruta reconocible se vigila: el lado seguro.
-      const targets = cmd.match(/[\\w./-]+\\.json\\b/g) || [];
-      // Solo se exime lo que se puede establecer CON CERTEZA: una ruta absoluta
-      // fuera del arbol. Una relativa depende del cwd del shell, que este hook
-      // no conoce — "cd packages && ... open(\\"../package.json\\")" escribe
-      // dentro del repo (catch de la review), asi que se sigue vigilando.
-      // Un enlace puede apuntar dentro: /tmp/link.json escribiria en el repo
-      // (catch de la review). Se resuelve el padre real antes de clasificar, y
-      // si no se puede resolver, se vigila.
-      // Fuera del arbol es SALIR de el, no que el nombre empiece por dos puntos:
-      // <repo>/..config.json esta dentro (catch de la review).
-      const escapesRoot = (rel) => rel === ".." || rel.startsWith("../");
-      const outsideForSure = (t) => {
-        if (!t.startsWith("/")) return false;
-        const abs = resolve(t);
-        try {
-          const root = realpathSync(ROOT);
-          // El propio fichero puede SER el enlace (/tmp/link.json -> repo/cfg.json),
-          // asi que se resuelve entero cuando existe; si aun no existe, manda su
-          // directorio real.
-          if (existsSync(abs)) return escapesRoot(relative(root, realpathSync(abs)));
-          const parts = abs.split("/");
-          const name = parts.pop();
-          return escapesRoot(relative(root, realpathSync(parts.join("/") || "/") + "/" + name));
-        } catch {
-          return false;
-        }
-      };
-      // Con expansion del shell no se sabe a donde apunta nada: "$PWD/cfg.json"
-      // deja el trozo "/cfg.json", que parece absoluto y ajeno sin serlo (catch
-      // de la review). Ante la duda se vigila.
-      const expands = /[$~]/.test(cmd) || cmd.includes("\\u0060");
-      const mine = expands || targets.length === 0 || !targets.every(outsideForSure);
-      if (!escaped && mine && /json\\.dumps?\\s*\\(/.test(cmd) && writes) {
-        console.error("kj tool gate: reserializing a whole JSON file makes the diff unreviewable — make targeted edits instead (KJ_ALLOW_REWRITE=1 to override consciously).");
-        process.exit(2);
-      }
+    if (tool === "Write" && input.file_path && existsSync(input.file_path)) {
+      console.error("kj tool gate: Write over an EXISTING file destroys unseen changes — use Edit for targeted changes.");
+      process.exit(2);
     }
   } catch { /* fail open */ }
   process.exit(0);

package/src/harden/hook-templates.js

@@ -62,10 +62,11 @@ function baseBranchGuard(baseBranch) {
   return [
     "# Branch-first guard — the base branch only moves via PR. KJC-BUG-0186:",
     "# the bootstrap commit is exempt, there is no commit to branch from yet.",
-    'if [ "$KJ_ALLOW_BASE_COMMIT" != "1" ] && git rev-parse --verify HEAD >/dev/null 2>&1; then',
+    "# No escape (ADR 0015): an env prefix on git commit was one the agent could raise.",
+    "if git rev-parse --verify HEAD >/dev/null 2>&1; then",
     '  current_branch=$(git symbolic-ref --short HEAD 2>/dev/null || echo "")',
     `  if [ "$current_branch" = "${baseBranch}" ]; then`,
-    `    echo 'kj harden: direct commits on ${baseBranch} are not allowed — create a branch and open a PR (KJ_ALLOW_BASE_COMMIT=1 to override)'; exit 1`,
+    `    echo 'kj harden: direct commits on ${baseBranch} are not allowed — create a branch and open a PR'; exit 1`,
     "  fi",
     "fi",
   ];
@@ -78,7 +79,7 @@ function baseBranchGuard(baseBranch) {
 function identityGuard(hook) {
   const head = [
     "# Identity lock (IDN-C, ADR 0005) — this clone's declared identity governs.",
-    'if [ "$KJ_ALLOW_IDENTITY" != "1" ] && [ -f .karajan/identity.local.yml ]; then',
+    "if [ -f .karajan/identity.local.yml ]; then",
   ];
   const tail = [
     "elif [ ! -f .karajan/identity.local.yml ]; then",
@@ -92,7 +93,7 @@ function identityGuard(hook) {
       "  kj_author=$(git var GIT_AUTHOR_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
       "  kj_committer=$(git var GIT_COMMITTER_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
       '  if [ -n "$kj_declared_email" ] && { [ "$kj_author" != "$kj_declared_email" ] || [ "$kj_committer" != "$kj_declared_email" ]; }; then',
-      '    echo "kj harden: identity lock — committing as $kj_author / $kj_committer but this clone is declared as $kj_declared_email (kj identity show; KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+      '    echo "kj harden: identity lock — committing as $kj_author / $kj_committer but this clone is declared as $kj_declared_email (kj identity show)"; exit 1',
       "  fi",
       ...tail,
     ];
@@ -103,7 +104,7 @@ function identityGuard(hook) {
     '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
     "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
     '  if [ -n "$kj_declared_gh" ] && [ "$kj_active_gh" != "$kj_declared_gh" ]; then',
-    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh (KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh"; exit 1',
     "  fi",
     ...tail,
   ];

package/src/harden/sentinel/sentinel-bash-write.mjs

@@ -0,0 +1,106 @@
+// The Sentinel's bash-write guard (KJC-BUG-0237, moved here by KJC-TSK-0919,
+// ADR 0014). Inside the repo, files are written through Edit/Write only, the path
+// every gate guards. Copied byte for byte into .karajan/harness; `root` injected.
+// The stated limit: a program you run can write files; only a sandbox stops that.
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
+import { headIndex, shellSegments } from "./sentinel-shell.mjs";
+
+const WRITES = ["tee", "touch", "truncate", "cp", "mv", "install", "ln", "sed", "perl", "dd", "sh", "bash", "zsh", "dash", "eval"];
+const RUNNERS = ["xargs", "find", "node", "python3", "python", "ruby", "php", "deno", "bun"];
+// touch/truncate -s SIZE, -r REF, -d DATE, -t STAMP: the value is not a file it writes.
+const VALUED = ["-s", "--size", "-r", "--reference", "-d", "--date", "-t"];
+
+/** Redirection targets: >&N and >&- duplicate or close a descriptor; >& FILE and >&FILE write FILE. */
+const redirections = (words) => {
+  const out = [];
+  words.forEach((w, k) => {
+    const m = /^\d*(>>|>[|]|>)(.*)$/.exec(w);
+    if (!m) return;
+    const dup = m[2].startsWith("&") ? m[2].slice(1) : null;
+    if (dup === null) out.push(m[2] || words[k + 1]);
+    else if (dup === "") out.push(words[k + 1]);
+    else if (!/^\d*-?$/.test(dup)) out.push(dup);
+  });
+  return out;
+};
+
+/** Destination of cp/mv/install/ln: -t DIR / --target-directory[=]DIR, else the last plain word. */
+const destination = (rest, plain) => {
+  const t = rest.findIndex((w) => w === "-t" || w === "--target-directory");
+  const tEq = rest.find((w) => w.startsWith("--target-directory="));
+  if (t >= 0) return [rest[t + 1]];
+  if (tEq) return [tEq.slice(19)];
+  return plain.length >= 2 ? [plain.at(-1)] : [];
+};
+
+/** Files sed/perl -i edit: the script is the word after -e/-f, else the first plain word; a lone plain word is the file. */
+const inPlace = (rest, plain) => {
+  if (!rest.some((w) => w.startsWith("--in-place") || /^-[a-zA-Z0-9]*i/.test(w))) return [];
+  const script = rest.findIndex((w) => ["-e", "-f", "--expression"].includes(w));
+  if (script >= 0) return plain.filter((w) => w !== rest[script + 1]);
+  return plain.length === 1 ? plain : plain.slice(1);
+};
+
+/**
+ * The files a simple command (a word list) writes from the shell. "$(...)"
+ * marks a target that only exists at run time: unknowable, so writesRepo denies it.
+ * @param {string[]} words
+ * @returns {string[]}
+ */
+export const shellWrites = (words) => {
+  const out = redirections(words);
+  const i = headIndex(words, [...WRITES, ...RUNNERS]);
+  const head = (words[i] || "").split("/").at(-1);
+  // xargs / find -exec run a writer on targets that arrive at run time.
+  if (["xargs", "find"].includes(head) && words.slice(i + 1).some((w) => WRITES.includes(w.split("/").at(-1)))) out.push(`$(${head})`);
+  // Arguments without redirections (< << <<< > >> and a detached operand).
+  const rest = [];
+  for (let k = i + 1; k < words.length; k++) {
+    if (!/^\d*[<>]/.test(words[k])) rest.push(words[k]);
+    else if (/^\d*(<{1,3}|>>?|>[|&])$/.test(words[k])) k++;
+  }
+  // Operands: words that are not options, and EVERY word after "--" (touch -- -file).
+  const cut = rest.includes("--") ? rest.indexOf("--") : rest.length;
+  const plain = [...rest.slice(0, cut).filter((w) => !w.startsWith("-")), ...rest.slice(cut + 1)];
+  if (head === "tee") out.push(...plain);
+  if (head === "dd") out.push(...rest.filter((w) => w.startsWith("of=")).map((w) => w.slice(3)));
+  // By position, not value (touch -d today today writes "today").
+  if (head === "touch" || head === "truncate") out.push(...rest.filter((w, k) => k > cut || (k < cut && !w.startsWith("-") && !VALUED.includes(rest[k - 1]))));
+  // sh -c / eval run a script of their own: its writes are this command's writes.
+  if (["sh", "bash", "zsh", "dash"].includes(head) && rest.includes("-c")) for (const seg of shellSegments(rest[rest.indexOf("-c") + 1] || "")) out.push(...shellWrites(seg));
+  if (head === "eval") for (const seg of shellSegments(rest.join(" "))) out.push(...shellWrites(seg));
+  // An inline script (node -e, python -c...) that names a write API.
+  const inline = rest[rest.findIndex((w) => ["-e", "-c", "--eval", "-p", "-r"].includes(w)) + 1] || "";
+  if (/^(node|deno|bun|python[\d.]*|ruby|perl|php)$/.test(head) && /write|append|open|copy|rename|truncate|unlink|mkdir|symlink/i.test(inline)) out.push(`$(${head})`);
+  if (["cp", "mv", "install", "ln"].includes(head)) out.push(...destination(rest, plain));
+  if (head === "sed" || head === "perl") out.push(...inPlace(rest, plain));
+  return out.filter(Boolean);
+};
+
+/**
+ * Inside the repo, or unknowable ($VAR, backtick, ~user): both deny. /dev/* and
+ * descriptor duplication (&1) are outside; ~/ is the home, where the repo may live.
+ * Real paths: a link outside (/tmp/link -> repo) points in.
+ * @param {string} t
+ * @param {string} root
+ */
+export const writesRepo = (t, root) => {
+  if (t.includes("$") || t.includes("`")) return true;
+  if (t.startsWith("&") || t.startsWith("/dev/")) return false;
+  if (t.startsWith("~") && t !== "~" && !t.startsWith("~/")) return true;
+  let a = resolve(root, t.startsWith("~") ? homedir() + t.slice(1) : t);
+  let tail = "";
+  while (!existsSync(a) && dirname(a) !== a) {
+    tail = join(a.slice(dirname(a).length + 1), tail);
+    a = dirname(a);
+  }
+  let rel;
+  try {
+    rel = relative(realpathSync(root), join(realpathSync(a), tail));
+  } catch {
+    return true;
+  }
+  return !rel.startsWith("..") && !rel.startsWith("/");
+};