karajan-code 4.37.0 → 4.39.0

package/src/harden/supervisor-commit.js

@@ -117,6 +117,16 @@ export async function commitSupervisorRegeneration({
       `harden --commit es un acto humano y este proceso desciende de un agente (${anc.match}) — ni con pty falso ni con el entorno limpio (ADR 0009)`,
     );
   }
+  const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
+  // KJC-BUG-0244 (grebla #958): el commit sellado solo lleva el supervisor, pero
+  // un stage ajeno se quedaba en esta rama y el siguiente commit caía aquí con la
+  // card equivocada. Se para ANTES de pedir nada al humano y se nombra.
+  const foreign = run(["diff", "--cached", "--name-only"]).split("\n").filter((f) => f && !f.startsWith(HOOKS_PREFIX) && f !== PROVENANCE_FILE);
+  if (foreign.length > 0) {
+    throw new Error(
+      `harden --commit: hay cambios en el stage que no son del supervisor (${foreign.slice(0, 5).join(", ")}${foreign.length > 5 ? ", …" : ""}): commitéalos en su rama o sácalos del stage (git restore --staged <ficheros>) antes de sellar`,
+    );
+  }
   // Capa 4 (test adversarial 6-sep: un huérfano a init con pty falso y
   // prompts a ciegas llegó hasta aquí): nonce aleatorio tecleado de vuelta.
   // Un alimentador ciego no conoce el código; automatizar su lectura exige
@@ -126,7 +136,6 @@ export async function commitSupervisorRegeneration({
   if (answer !== nonce) {
     throw new Error(`harden --commit: confirmación humana fallida (esperaba "${nonce}") — ADR 0009`);
   }
-  const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
   const drift = supervisorDrift({ projectDir, gitFn: run });
   // La provenance describe SIEMPRE el estado COMPLETO del supervisor (cazado
   // en el primer estreno real: un sello parcial pisaba al anterior y dejaba

package/src/policy/supervisor-verify.js

@@ -24,7 +24,7 @@ const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
  * @returns {{files: Set<string>, reason?: string}} rutas repo-relativas de
  * supervisor cuyo estado actual está respaldado por la provenance sellada.
  */
-export function verifiedSupervisorFiles({ projectDir }) {
+export function verifiedSupervisorFiles({ projectDir, trackedOnly = false }) {
   let prov;
   try {
     prov = JSON.parse(readFileSync(resolve(projectDir, PROVENANCE_FILE), "utf8"));
@@ -37,7 +37,11 @@ export function verifiedSupervisorFiles({ projectDir }) {
   }
   const ok = new Set();
   const unjudgeable = new Set();
-  const entries = Array.isArray(prov?.files) ? prov.files : [];
+  // KJC-BUG-0259 (user's decision, option A): history is judged with the kj of
+  // when it was committed. The harness guards are machine-local and never in the
+  // repo; the review and each PR's CI verify them when the seal is made. A check
+  // over the repo's history (release check) judges only what is versioned.
+  const entries = (Array.isArray(prov?.files) ? prov.files : []).filter((e) => !trackedOnly || !String(e?.file).startsWith(HARNESS_PREFIX));
   // KJC-BUG-0211: desde KJC-BUG-0197 el sello cubre tambien los guardias del
   // supervisor, y aqui solo se sabian verificar los hooks. Como `complete`
   // exige que TODAS las entradas verifiquen, el sello no se podia ni commitear.
@@ -93,10 +97,10 @@ export function verifiedSupervisorFiles({ projectDir }) {
  * `note` dice lo que este sitio NO ha podido juzgar, para que un levantamiento
  * mas laxo de lo que parece no pase por silencio (KJC-BUG-0212).
  */
-export function liftSealedSupervisorViolations({ projectDir, violations }) {
+export function liftSealedSupervisorViolations({ projectDir, violations, trackedOnly = false }) {
   const RULE = "defaults.supervisor.write";
   if (!violations.some((v) => v.rule_id === RULE && v.file)) return { violations, lifted: 0 };
-  const sealed = verifiedSupervisorFiles({ projectDir });
+  const sealed = verifiedSupervisorFiles({ projectDir, trackedOnly });
   // La violación sobre la PROPIA provenance solo se alza si la provenance
   // entera verificó — a medias no describe la verdad y sigue denegada.
   const liftable = (v) =>

package/src/rag/migrate.js

@@ -7,11 +7,22 @@
  * toca: borrarla es decision del usuario, no efecto de una migracion.
  */
 import { existsSync } from "node:fs";
+import { sep } from "node:path";
 
 import { openVecStore, insertChunk, getLastIndexedCommit, setLastIndexedCommit } from "./vec-store.js";
 
 export const countProjectChunks = (db, slug) => db.prepare("SELECT COUNT(*) AS n FROM chunks WHERE project_slug = ?").get(slug).n;
 
+/**
+ * KJC-BUG-0258: chunks of the project's OWN files (sources under projectDir), as
+ * opposed to its plans and briefs. A prefix compare, not LIKE: paths may hold % or _.
+ */
+export const countProjectSources = (db, slug, projectDir) => {
+  // path.sep: sources are stored as native paths (backslashes on Windows).
+  const prefix = projectDir.replace(/[\\/]+$/, "") + sep;
+  return db.prepare("SELECT COUNT(*) AS n FROM chunks WHERE project_slug = ? AND substr(source, 1, ?) = ?").get(slug, prefix.length, prefix).n;
+};
+
 /**
  * KJC-TSK-0882: que decir cuando el indice del proyecto no tiene nada suyo.
  * Si la base global tiene sus chunks, migrar (segundos); si no, indexar.
@@ -29,9 +40,12 @@ export function emptyIndexRemedy({ slug, legacyPath, dim = 768 }) {
 }
 
 /**
- * @returns {{state: "migrated"|"already"|"nothing", migrated: number, reason: string}}
+ * KJC-BUG-0255: `keep(source)` is the indexer's criterion today (generated,
+ * excluded, .ragignore, sensitive, gone). The global index was filled before
+ * those rules, so copying it blind brought vendor/*.min.js along as noise.
+ * @returns {{state: "migrated"|"already"|"nothing", migrated: number, skipped?: number, reason: string}}
  */
-export function migrateProjectIndex({ slug, legacyPath, targetPath, dim = 768 }) {
+export function migrateProjectIndex({ slug, legacyPath, targetPath, dim = 768, keep = () => true }) {
   const nothing = { state: "nothing", migrated: 0, reason: `the global index holds nothing for ${slug}: kj rag index --with-sources` };
   if (!existsSync(legacyPath)) return nothing;
 
@@ -49,8 +63,10 @@ export function migrateProjectIndex({ slug, legacyPath, targetPath, dim = 768 })
       const rows = legacy.prepare("SELECT id, source, kind, text, metadata, content_hash FROM chunks WHERE project_slug = ?").all(slug);
       if (rows.length === 0) return nothing;
       const vecOf = legacy.prepare("SELECT embedding FROM vec_chunks WHERE rowid = ?");
+      let skipped = 0;
       const copy = target.transaction(() => {
         for (const r of rows) {
+          if (!keep(r.source)) { skipped++; continue; }
           const raw = vecOf.get(BigInt(r.id))?.embedding;
           if (!raw) continue; // un chunk sin vector no se puede buscar: no se inventa
           const embedding = new Float32Array(raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength));
@@ -63,7 +79,8 @@ export function migrateProjectIndex({ slug, legacyPath, targetPath, dim = 768 })
       const migrated = countProjectChunks(target, slug);
       const parts = [`${migrated} chunks of ${slug} copied with their embeddings`];
       if (stamp) parts.push(`indexed at ${stamp.slice(0, 9)}`);
-      return { state: "migrated", migrated, reason: parts.join(", ") };
+      if (skipped) parts.push(`${skipped} left out (the indexer would not take them today: generated, excluded or gone)`);
+      return { state: "migrated", migrated, skipped, reason: parts.join(", ") };
     } finally {
       legacy.close();
     }

package/src/review/card-first.js

@@ -4,7 +4,8 @@
  * hu-board → the branch must reference a LIVE card (block by default);
  * planning-game/external → card-shaped reference required (warn default,
  * block via method_gates.card_first). Exemptions explicit and visible:
- * base branch, configured prefixes (releases), KJ_ALLOW_NO_CARD=1.
+ * base branch and configured prefixes (releases). No escape (ADR 0015): a
+ * gate an agent can switch off is a suggestion.
  */
 import { listPlans, loadPlan } from "../plan/plan-store.js";
 import { escapeRegExp } from "../utils/escape-regexp.js";
@@ -48,10 +49,7 @@ async function findLiveCardInBranch(projectDir, branch) {
   return closedHit;
 }
 
-export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, env = process.env, deps = {} }) {
-  if (env.KJ_ALLOW_NO_CARD === "1") {
-    return { ok: true, mode: "exempt", reason: "KJ_ALLOW_NO_CARD=1 (explicit escape hatch)" };
-  }
+export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, deps = {} }) {
   const exempt = config.method_gates?.card_first_exempt_branches || DEFAULT_EXEMPT_PREFIXES;
   if (exempt.some((p) => branch.startsWith(p))) {
     return { ok: true, mode: "exempt", reason: `branch prefix exempt (${branch.split("/")[0]}/…)` };

package/src/review/policy-gate.js

@@ -1,10 +1,9 @@
 /**
  * Adaptador del gate de policy en el flujo de review de karajan-code
  * (GOV-A, KJC-TSK-0745). La decisión warn/deny/inexcepcionable/excepción
- * vive en el kernel (@karajan-family/governance); aquí solo el dominio: la
- * excepción se pide con KJ_ALLOW_POLICY=1 + KJ_POLICY_REASON, y el
- * artefacto de este dominio es el diff staged — por eso el alcance
- * registrado dice "este diff exacto".
+ * vive en el kernel (@karajan-family/governance); aquí solo el dominio: el
+ * artefacto es el diff staged. Sin excepción por diff (ADR 0015,
+ * KJC-TSK-0932): una regla que falla se corrige por PR.
  */
 import { evaluateGate } from "@karajan-family/governance";
 
@@ -13,13 +12,12 @@ import { evaluateGate } from "@karajan-family/governance";
  */
 export function evaluatePolicyGate({
   policy, errors = [], role = "coder", files = [], netLinesAdded = null,
-  diffHashValue = null, env = process.env, recordException = () => {},
+  diffHashValue = null, recordException = () => {},
   standingExceptions = [], now = new Date(),
 }) {
   return evaluateGate({
     policy, errors, role, files, netLinesAdded,
     artifactHash: diffHashValue,
-    exemption: { requested: env.KJ_ALLOW_POLICY === "1", justification: env.KJ_POLICY_REASON, hint: 'KJ_POLICY_REASON="por qué"' },
     recordException: (entry) => recordException({ ...entry, scope: "este diff exacto" }),
     standingExceptions, now,
   });

package/src/review/sonar-pregate.js

@@ -110,9 +110,9 @@ export async function runSonarPregate({ config, stagedFiles = [], touchedLines =
       }
       for (const f of own) indexed.add(`${prefix}${f}`);
       keys.push(scan.projectKey);
-      // The scan above ALWAYS runs before issues are read (single-flight): the
-      // verdict is about the code as it is now, never a stale server analysis
-      // (KJC-TSK-0795 AC2 — that failure mode has no route here, by design).
+      // The scan above ALWAYS runs before issues are read (single-flight), and
+      // it returns once the server has processed it (KJC-BUG-0263: before, the
+      // upload returned first and the issues read were the previous analysis).
       const res = await getOpenIssues(config, scan.projectKey);
       totalProject += res.total ?? (res.issues || []).length;
       // Issue components are package-relative: made repo-relative here.

package/src/review/tests-with-code.js

@@ -5,7 +5,7 @@
  * `method_gates.tests_with_code`. Test-FIRST remains the reviewer's
  * judgment; test-PRESENT belongs to the gate. Patterns come from the
  * project's own `development.*` config (same ones headless enforces).
- * KJ_ALLOW_NO_TESTS=1 is the explicit escape hatch.
+ * No escape (ADR 0015): deletions and comment-only cleanups already pass.
  */
 
 const DEFAULT_TEST_PATTERNS = ["/tests/", "/__tests__/", ".test.", ".spec."];
@@ -28,10 +28,7 @@ export function sourceFilesOf(config = {}, files = []) {
   };
 }
 
-export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = null, env = process.env }) {
-  if (env.KJ_ALLOW_NO_TESTS === "1") {
-    return { ok: true, mode: "exempt", reason: "KJ_ALLOW_NO_TESTS=1 (explicit escape hatch)" };
-  }
+export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = null }) {
   const { sources, hasTests } = sourceFilesOf(config, stagedFiles);
 
   if (sources.length === 0 || hasTests) return { ok: true, mode: "pass" };
@@ -51,7 +48,7 @@ export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = nu
   }
 
   const policy = config.method_gates?.tests_with_code || "warn";
-  const reason = `source changes without any test change (${sources.slice(0, 5).join(", ")}${sources.length > 5 ? "…" : ""}) — the failing test comes first; add one or KJ_ALLOW_NO_TESTS=1 for a deliberate exception`;
+  const reason = `source changes without any test change (${sources.slice(0, 5).join(", ")}${sources.length > 5 ? "…" : ""}) — the failing test comes first: add one`;
   return policy === "block"
     ? { ok: false, mode: "block", sources, reason }
     : { ok: true, mode: "warn", sources, reason };

package/src/sonar/api.js

@@ -82,6 +82,27 @@ async function sonarFetch(config, urlPath) {
   );
 }
 
+const CE_FINAL = new Set(["SUCCESS", "FAILED", "CANCELED"]);
+const sleepMs = (ms) => new Promise((done) => setTimeout(done, ms));
+
+/**
+ * KJC-BUG-0263 — the scanner uploads the analysis and returns; the server
+ * processes it in the background, and issues read before that task ends are
+ * the PREVIOUS analysis. Polls /api/ce/task until it reaches a final status.
+ * @returns {Promise<{ok: boolean, status: string, timedOut?: boolean}>}
+ */
+export async function waitForAnalysis(config, taskId, { timeoutMs = 120_000, intervalMs = 1000, sleep = sleepMs } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let status = "UNKNOWN";
+  while (Date.now() < deadline) {
+    const body = await sonarFetch(config, `/api/ce/task?id=${encodeURIComponent(taskId)}`);
+    try { status = JSON.parse(body).task?.status || "UNKNOWN"; } catch { status = "UNKNOWN"; }
+    if (CE_FINAL.has(status)) return { ok: status === "SUCCESS", status };
+    await sleep(intervalMs);
+  }
+  return { ok: false, status, timedOut: true };
+}
+
 /**
  * KJC-BUG-0226 (issue #1838) — de donde sale la clave que se CONSULTA. El
  * scanner sube el analisis con la que el repo declara en su

package/src/sonar/scanner.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import os from "node:os";
 import { runCommand } from "../utils/process.js";
 import { sonarUp } from "./manager.js";
+import { waitForAnalysis } from "./api.js";
 import { resolveSonarProjectKey } from "./project-key.js";
 import {
   resolveSonarHost,
@@ -380,14 +381,32 @@ export async function runSonarScan(config, projectKey = null, { verbose = false,
   }
 
   const result = await runCommand(cmd, args, { timeout: scannerTimeout, env, cwd: scanCwd });
+  // KJC-BUG-0263: the scan is done when the server has processed it; whoever reads
+  // the issues next would otherwise get the previous analysis. Said out loud when
+  // the log names no task to wait for.
+  let ok = result.exitCode === 0;
+  let analysisNote = null;
+  if (ok) {
+    const taskId = /api\/ce\/task\?id=([\w-]+)/.exec(String(result.stdout || ""))?.[1];
+    if (taskId) {
+      const done = await waitForAnalysis({ ...config, sonarqube: { ...sonarConfig, host: apiHost } }, taskId);
+      if (!done.ok) {
+        ok = false;
+        analysisNote = `sonar: the server did not finish analysis ${taskId} (${done.status}${done.timedOut ? ", timed out" : ""}) — its issues would be the previous analysis`;
+      }
+    } else {
+      analysisNote = "sonar: the scanner log names no analysis task, so kj could not wait for the server — issues may belong to the previous analysis";
+    }
+  }
   return {
-    ok: result.exitCode === 0,
+    ok,
     projectKey: effectiveProjectKey,
     cwd: scanCwd,
     scanner: pick.type,
-    note,
+    note: [note, analysisNote].filter(Boolean).join("; ") || null,
     stdout: result.stdout,
-    stderr: result.stderr,
+    // A scan that failed on the server's side says so, not with the scanner's own log.
+    stderr: !ok && result.exitCode === 0 ? analysisNote : result.stderr,
     exitCode: result.exitCode
   };
 }