karajan-code 4.41.0 → 4.43.0

package/src/orchestrator/drivers/iteration-phases/reviewer-gate.js

@@ -29,9 +29,11 @@ export async function runReviewerGateStage({ pipelineFlags, reviewerRole, config
   };
   const reviewerResult = await runStage(stageRegistry.get("reviewer"), reviewerCtx);
   if (reviewerResult === null) {
+    // KJC-BUG-0297 (#1993): `reviewed: false` so the pipeline never stamps a
+    // verdict nobody gave nor commits on it (finalizeGitAutomation).
     return {
       action: "ok",
-      review: { approved: true, blocking_issues: [], non_blocking_suggestions: [], summary: "Reviewer disabled by pipeline", confidence: 1 }
+      review: { approved: true, reviewed: false, blocking_issues: [], non_blocking_suggestions: [], summary: "Reviewer disabled by pipeline: nothing was reviewed", confidence: 0 }
     };
   }
   if (reviewerResult.action === "pause") return { action: "return", result: reviewerResult.result };

package/src/orchestrator/drivers/post-loop.js

@@ -107,7 +107,7 @@ export async function handlePostLoopStages({ config, session, emitter, eventBase
 }
 
 export async function finalizeApprovedSession({ config, gitCtx, task, logger, session, stageResults, emitter, eventBase, budgetSummary, pgCard, pgProject, review, i, rtkTracker }) {
-  const gitResult = await finalizeGitAutomation({ config, gitCtx, task, logger, session, stageResults });
+  const gitResult = await finalizeGitAutomation({ config, gitCtx, task, logger, session, stageResults, review });
 
   // Accumulate final commits for PG card lifecycle tracking
   if (gitResult?.commits?.length) {

package/src/orchestrator/preflight-checks.js

@@ -409,8 +409,8 @@ export async function runPreflightChecks({ config, logger, emitter, eventBase, r
 /**
  * Run the doctor-style complementary checks and merge their outcomes into
  * the existing preflight result shape. Runs with yes:true (non-interactive)
- * and auto-remediation enabled. FAIL/TIMEOUT are appended to errors (blocking),
- * WARN are appended to warnings (non-blocking), FIXED status is recorded as a
+ * and auto-remediation enabled. FAIL is appended to errors (blocking), WARN and
+ * TIMEOUT to warnings (non-blocking: a timeout is "not checked"), FIXED status is recorded as a
  * remediation, and runtime overrides from auto-fixes are merged into
  * configOverrides.
  */
@@ -437,11 +437,12 @@ async function runExtendedPreflight({ config, result, emitter, eventBase, logger
 
   for (const c of report.checks) {
     result.checks.push({ name: c.name, ok: c.status === STATUS.OK || c.status === STATUS.FIXED || c.status === STATUS.SKIPPED, detail: c.detail });
-    const eventStatus = c.status === STATUS.FAIL || c.status === STATUS.TIMEOUT
-      ? "fail"
-      : c.status === STATUS.WARN
-        ? "warn"
-        : "ok";
+    // KJC-BUG-0287 (#1982): a timeout is "not checked", never "broken". GitHub
+    // unreachable for the SHA-pinned actions blocked a docs-only run that needed
+    // no network at all; the runner itself calls TIMEOUT warn-level.
+    let eventStatus = "ok";
+    if (c.status === STATUS.FAIL) eventStatus = "fail";
+    else if (c.status === STATUS.WARN || c.status === STATUS.TIMEOUT) eventStatus = "warn";
     emitProgress(emitter, makeEvent("preflight:check", { ...eventBase, stage: "preflight" }, {
       status: eventStatus,
       message: `${c.label}: ${c.detail}`,
@@ -449,9 +450,11 @@ async function runExtendedPreflight({ config, result, emitter, eventBase, logger
     }));
     if (c.status === STATUS.FIXED) {
       result.remediations.push(`${c.label}: ${c.detail}`);
-    } else if (c.status === STATUS.FAIL || c.status === STATUS.TIMEOUT) {
+    } else if (c.status === STATUS.FAIL) {
       result.ok = false;
       result.errors.push({ check: c.name, message: `${c.label}: ${c.detail}`, fix: c.fix });
+    } else if (c.status === STATUS.TIMEOUT) {
+      result.warnings.push(`${c.label}: not checked, it did not answer in time (${c.detail}); the run goes on`);
     } else if (c.status === STATUS.WARN) {
       result.warnings.push(`${c.label}: ${c.detail}`);
     }

package/src/orchestrator/stages/coder-stage.js

@@ -17,6 +17,7 @@ import { emitProgress, makeEvent, emitAgentOutput } from "../../utils/events.js"
 import { runCoderWithFallback } from "../agent-fallback.js";
 import { invokeSolomon } from "../solomon-escalation.js";
 import { detectRateLimit } from "../../utils/rate-limit-detector.js";
+import { headSha, undoCommitsSince } from "../../git/coder-commit-guard.js";
 import { createStallDetector } from "../../utils/stall-detector.js";
 import { buildStandbyState } from "../../brain/standby-store.js";
 import { applyQuotaSimulation } from "../../utils/quota-simulator.js";
@@ -54,6 +55,10 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   // Claude run `cd /home/manu/assistant && pnpm init …` and 36 MB
   // of code landed outside projectDir, outside any git repo.
   const homeSnapshotBeforeCoder = snapshotHomeTopLevel();
+  // KJC-BUG-0285 (#1982): where HEAD stands before the coder runs. The coder
+  // commits nothing; the pipeline does, once the review approves.
+  const stageDir = config?.projectDir || process.cwd();
+  const headBefore = headSha(stageDir);
   let coderExecResult;
   try {
     coderExecResult = await coderRoleInstance.execute({
@@ -84,6 +89,17 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   }
   trackBudget({ role: "coder", provider: coderRole.provider, model: coderRole.model, result: coderExecResult.result, duration_ms: Date.now() - coderStart });
   applyQuotaSimulation(coderExecResult, { iteration, agent: coderRole.provider });
+  // KJC-BUG-0285 (#1982): a commit the coder made on its own carried the error the
+  // reviewer then rejected, and stayed on the branch. Undone softly: the changes
+  // stay in the tree for the review; the pipeline commits what it approves.
+  if (headBefore) {
+    const undone = undoCommitsSince(headBefore, stageDir);
+    if (undone.undone > 0) {
+      const message = `Coder committed on its own (${undone.undone} commit(s)); undone softly, the changes stay in the tree: the pipeline commits once the review approves`;
+      logger.warn(message);
+      emitProgress(emitter, makeEvent("coder:commit-undone", { ...eventBase, stage: "coder" }, { message, detail: { commits: undone.undone, headBefore } }));
+    }
+  }
 
   if (!coderExecResult.ok) {
     const details = coderExecResult.result?.error || coderExecResult.summary || "unknown error";

package/src/orchestrator/stages/reviewer-stage.js

@@ -335,18 +335,20 @@ export async function runReviewerStage({ reviewerRole, config, logger, emitter,
       confidence: reviewResult.confidence ?? 0
     });
   } catch (error_) {
+    // KJC-BUG-0284 (#1982): a verdict kj cannot read is the reviewer's failure,
+    // never a PARSE_ERROR defect handed to the coder (it sent one run in circles).
+    const details = `the verdict could not be read: ${error_.message}`;
     logger.warn(`Reviewer output validation failed: ${error_.message}`);
-    review = {
-      approved: false,
-      blocking_issues: [{
-        id: "PARSE_ERROR",
-        severity: "high",
-        description: `Reviewer output could not be parsed: ${error_.message}`
-      }],
-      non_blocking_suggestions: [],
-      summary: `Parse error: ${error_.message}`,
-      confidence: 0
-    };
+    await markSessionStatus(session, "failed");
+    emitProgress(
+      emitter,
+      makeEvent("reviewer:end", { ...eventBase, stage: "reviewer" }, {
+        status: "fail",
+        message: `Reviewer failed: ${details}`,
+        detail: { provider: reviewerRole.provider, executorType: "agent" }
+      })
+    );
+    throw new Error(`Reviewer failed: ${details}`, { cause: error_ });
   }
   // --- Scope filter: auto-defer out-of-scope blocking issues ---
   const { review: filteredReview, demoted, deferred, allDemoted } = filterReviewScope(review, diff);

package/src/orchestrator/stages/suite-green-stage.js

@@ -0,0 +1,55 @@
+/**
+ * KJC-BUG-0298 (#1993): with TDD, a red suite never reaches the reviewer. A
+ * step whose test was added without its implementation was approved with one
+ * failing file, because nothing in the iteration RAN the tests: the
+ * verification gate counts changed lines, the TDD check asks that tests changed
+ * alongside sources, and the red-then-green discipline is opt-in. This stage
+ * runs the project's own test command (the one kj harden resolves: npm test, a
+ * known framework, pytest, go test) and hands a red suite back to the coder.
+ * Opt-out: `development.require_green_suite: false`.
+ */
+import { addCheckpoint, saveSession } from "../../session/store.js";
+import { setReviewerFeedback } from "../../session/mutators.js";
+import { emitProgress, makeEvent } from "../../utils/events.js";
+import { runCommand } from "../../utils/process.js";
+import { resolveCmds } from "../../commands/harden.js";
+
+const TAIL_CHARS = 2000;
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+
+/** @returns {Promise<{action: "ok"|"continue", result: object}>} */
+export async function runSuiteGreenStage({ config, logger, emitter, eventBase, session, iteration, resolveCmdsImpl = resolveCmds, runTestsImpl = null }) {
+  const projectDir = config?.projectDir || process.cwd();
+  let command = null;
+  try {
+    command = (await resolveCmdsImpl(projectDir))?.test || null;
+  } catch (err) {
+    logger?.warn?.(`suite-green: could not resolve the test command (${err.message})`);
+  }
+  if (!command) {
+    const message = "suite-green: no test command for this project (package.json scripts.test or a known framework): the suite was NOT run";
+    logger?.warn?.(message);
+    emitProgress(emitter, makeEvent("tests:result", { ...eventBase, stage: "tests" }, { status: "warn", message, detail: { ran: false } }));
+    return { action: "ok", result: { ran: false } };
+  }
+  const timeout = Number(config?.development?.test_timeout_ms) > 0 ? Number(config.development.test_timeout_ms) : DEFAULT_TIMEOUT_MS;
+  const run = runTestsImpl || (async () => {
+    const res = await runCommand("bash", ["-lc", command], { cwd: projectDir, timeout });
+    return { exitCode: res.exitCode ?? 1, output: `${res.stdout || ""}\n${res.stderr || ""}` };
+  });
+  const res = await run(command);
+  const ok = res.exitCode === 0;
+  const verdict = ok ? "green" : `red (exit ${res.exitCode})`;
+  emitProgress(emitter, makeEvent("tests:result", { ...eventBase, stage: "tests" }, {
+    status: ok ? "ok" : "fail",
+    message: `${command}: ${verdict}`,
+    detail: { ran: true, ok, command, exitCode: res.exitCode, executorType: "local" },
+  }));
+  await addCheckpoint(session, { stage: "suite-green", iteration, ok, command });
+  if (ok) return { action: "ok", result: { ran: true, ok: true, command } };
+  const tail = String(res.output || "").trim().slice(-TAIL_CHARS);
+  setReviewerFeedback(session, `The test suite is RED (${command}, exit ${res.exitCode}). Make it green before anything else:\n${tail}`);
+  await saveSession(session);
+  logger?.warn?.(`suite-green: ${command} exited ${res.exitCode}; back to the coder`);
+  return { action: "continue", result: { ran: true, ok: false, command, exitCode: res.exitCode } };
+}

package/src/prompts/coder.js

@@ -251,7 +251,9 @@ export async function buildCoderPromptLayout({ task, reviewerFeedback = null, so
     // .gitignore, a rogue verify worktree). Anchor the scope hard.
     section("SCOPE: this is an EXISTING project. Implement ONLY the current HU against the code already here. NEVER scaffold, bootstrap or initialize project structure, never add a generic multi-stack .gitignore, and never create git worktrees (`git worktree add`) — your workspace is already prepared. If a step ever reads like 'set up the project', treat it as a misread of an existing repo: re-read the HU and make the real change.", STABLE),
     section("Follow SOLID principles. Write small, focused functions (< 30 lines).", STABLE),
-    section("Make atomic commits: 1 logical change = 1 commit. Keep PRs small and reviewable.", STABLE),
+    // KJC-BUG-0285 (#1982): "atomic commits" read as "commit": the coder committed
+    // before the review and the rejected commit stayed on the branch.
+    section("One logical change per task; keep it small and reviewable. NEVER run git commit, git push or open a PR: the pipeline commits once the cross-AI review approves.", STABLE),
     section("Security: validate all input, parameterize queries, never expose secrets. Use the auth pattern that matches the stack (e.g. httpOnly cookies for web sessions).", STABLE),
     section("Use the project's standard logger and type system (no console.log when a structured logger exists; use the project's type idiom — TS types, JSDoc, Python type hints, Go interfaces…).", STABLE),
     section(SUBPROCESS_CONSTRAINTS, STABLE),

package/src/rag/indexer.js

@@ -11,7 +11,7 @@ import { createHash } from "node:crypto";
 import { execa } from "execa";
 
 import { chunkMarkdown, chunkPlan, chunkSource } from "./chunker.js";
-import { insertChunk, deleteChunksBySource, findChunkByHash } from "./vec-store.js";
+import { insertChunk, deleteChunksBySource, findChunkByHash, getEmbeddingsByIds } from "./vec-store.js";
 import { detectAdaptersForProject, getAllCodeExtensions } from "../lang/registry.js";
 import { indexableReason, listProjectFiles } from "./indexable.js";
 
@@ -71,15 +71,17 @@ export async function indexFile(path, { db, embedder, logger = console, project
   let skipped = 0;
   for (const ch of chunks) {
     // KJC-TSK-0484 — Skip re-embedding identical bodies for the same project.
-    // The chunks row is still rewritten under the new source so deletions of
-    // an alias don't orphan a row whose owner was the dedup target.
+    // KJC-BUG-0281 (#1980): the row is STILL written under the new source, with
+    // the stored vector: a file whose every chunk duplicates another (CLAUDE.md
+    // next to the AGENTS.md kj harden writes) was left with no rows at all, and
+    // the coverage check reported it missing after every reindex.
     const contentHash = createHash("sha256").update(ch.text).digest("hex");
     try {
       const dup = findChunkByHash(db, contentHash, project);
-      if (dup) { skipped += 1; continue; }
-      const embedding = await embedder.embed(ch.text);
+      const stored = dup ? getEmbeddingsByIds(db, [dup.id]).get(Number(dup.id)) : null;
+      const embedding = stored ?? await embedder.embed(ch.text);
       insertChunk(db, { source: path, kind: ch.metadata.kind || kind, text: ch.text, metadata: ch.metadata, embedding, project, contentHash });
-      indexed += 1;
+      if (stored) skipped += 1; else indexed += 1;
     } catch (err) {
       failed += 1;
       logger.warn?.(`[rag-indexer] embed failed for ${path} (${chunkLabel(ch)}): ${err.message}`);

package/src/review/gate-gitignore.js

@@ -18,6 +18,8 @@ import { runCommand } from "../utils/process.js";
 // init and the orchestrator's autoInit write this same block instead of a
 // bare `.karajan/` exclude (which git cannot re-include children of).
 export const CONTRACT_BLOCK = [
+  // KJC-BUG-0296 (#1989): the host agent's runtime locks never travel.
+  ".claude/*.lock",
   ".karajan/*",
   "# …except the v4 environment contract, which the whole team inherits:",
   "!.karajan/review-gate",

package/src/review/verdict-store.js

@@ -98,14 +98,16 @@ export async function loadVerdict(projectDir, hash) {
  * (KJC-BUG-0115).
  * @returns {Promise<{stamped: boolean}>}
  */
-export async function stampStagedVerdict({ projectDir, reviewer, summary = "", sonar = null }) {
+export async function stampStagedVerdict({ projectDir, reviewer, summary = "", sonar = null, paths = null }) {
   const dir = projectDir || process.cwd();
   try {
     await fs.access(path.join(dir, ".karajan", "review-gate"));
   } catch {
     return { stamped: false };
   }
-  const res = await runCommand("git", ["diff", "--cached"], { cwd: dir });
+  // KJC-BUG-0294: the pipeline commits by path (`--only`); the verdict must bind
+  // to that diff, not to other files the person had staged.
+  const res = await runCommand("git", ["diff", "--cached", ...(paths?.length ? ["--", ...paths] : [])], { cwd: dir });
   if (res.exitCode !== 0 || !res.stdout?.trim()) return { stamped: false };
   await saveVerdict(dir, res.stdout, {
     verdict: "approved", reviewer, host: "kj-pipeline", issues: [], summary,

package/src/roles/domain-curator-role.js

@@ -42,20 +42,13 @@ export class DomainCuratorRole {
     // 3. Deduplicate (file domains take precedence over registry entries)
     const allDomains = deduplicateDomains(fileDomains, registryDomains);
 
-    // 4. No domains found
+    // 4. No domains found. KJC-BUG-0295 (#1992): this used to ASK the user
+    // ("do you have domain documents?") and then do nothing with the answer:
+    // a cryptic, English-only question with no consequence, raised even when
+    // the card already carried the acceptance criteria. A question that changes
+    // nothing is not asked; what kj uses instead is said.
     if (allDomains.length === 0) {
-      if (askQuestion?.interactive) {
-        const answer = await askQuestion({
-          message: "No domain knowledge found for this task.\nDo you have domain documents to provide, or should the pipeline continue without domain context?",
-          type: "confirm"
-        });
-        // For now, just log. Future: support document ingestion.
-        if (answer === true) {
-          this.logger.info("Domain Curator: user indicated domain documents available — future feature");
-        }
-      } else {
-        this.logger.warn("Domain Curator: no domain knowledge found, continuing without domain context");
-      }
+      this.logger.info("Domain Curator: no domain documents in .karajan/domains/ nor the registry; the task's own text, the card's acceptance criteria and the repo are the context");
 
       return {
         ok: true,

package/src/roles/reviewer-role.js

@@ -1,6 +1,9 @@
+import { createHash } from "node:crypto";
+
 import { AgentRole } from "./agent-role.js";
 import { buildRtkInstructions } from "../prompts/rtk-snippet.js";
 import { extractFirstJson } from "../utils/json-extract.js";
+import { reportUnparseableVerdict } from "../review/unparseable-verdict.js";
 import { section, buildPromptLayout, joinLayout, STABLE, VOLATILE } from "../prompts/prompt-layout.js";
 import { clipDiff } from "../prompts/diff-clip.js";
 import { buildSplitSignal } from "../prompts/split-signal.js";
@@ -66,7 +69,13 @@ export class ReviewerRole extends AgentRole {
   parseOutput(raw) {
     const parsed = extractFirstJson(raw);
     if (!parsed) throw new Error("Failed to parse reviewer output: no JSON found");
-    return parsed;
+    // KJC-BUG-0284 (#1982): a reviewer wrapped its verdict in the role envelope
+    // {ok, result: {approved…}, summary}; the envelope is not the verdict.
+    const verdict = typeof parsed.approved !== "boolean" && typeof parsed.result?.approved === "boolean"
+      ? { ...parsed.result, summary: parsed.result.summary ?? parsed.summary }
+      : parsed;
+    if (typeof verdict.approved !== "boolean") throw new Error("Failed to parse reviewer output: no boolean approved");
+    return verdict;
   }
 
   buildSuccessResult(parsed, provider, agentResult) {
@@ -87,18 +96,20 @@ export class ReviewerRole extends AgentRole {
       : `Rejected: ${blockingIssues.length} blocking issue(s) — ${parsed.summary || ""}`;
   }
 
-  handleParseError(err, agentResult, _provider) {
+  // KJC-BUG-0284 (#1982): an unreadable answer is the reviewer's failure, not
+  // the coder's. Returned as ok=false so the retry and the fallback reviewer
+  // engage (reviewer-fallback.js); the raw answer is saved for inspection.
+  // Before, it came back as a PARSE_ERROR rejection: the coder read it as a
+  // defect of its code and one run went in circles for twenty minutes.
+  async handleParseError(err, agentResult, provider) {
+    const output = agentResult?.output;
+    const hash = createHash("sha256").update(String(output ?? "")).digest("hex").slice(0, 12);
+    const error = await reportUnparseableVerdict({ projectDir: this.config?.projectDir ?? process.cwd(), reviewer: provider, output, hash });
     return {
-      ok: true,
-      result: {
-        ...agentResult,
-        approved: false,
-        blocking_issues: [{ id: "PARSE_ERROR", severity: "high", description: `Reviewer output could not be parsed: ${err.message}` }],
-        non_blocking_suggestions: [],
-        confidence: 0,
-        raw_summary: `Parse error: ${err.message}`
-      },
-      summary: `Reviewer output parse error: ${err.message}`
+      ok: false,
+      result: { ...agentResult, error: `${err.message}\n${error}`, provider },
+      summary: `Reviewer output parse error: ${err.message}`,
+      usage: agentResult?.usage
     };
   }
 }

package/src/sonar/scanner.js

@@ -240,7 +240,12 @@ export function respectRepoProperties(scanner = {}, props = {}) {
   return kept;
 }
 
-/** @returns {Promise<{existed: boolean, declaredKey: string|null}>} */
+// KJC-BUG-0280 (#1979): the scanner aborts, with a stack trace, on a declared
+// folder that does not exist. Only the folders the repo HAS are declared.
+const SOURCE_DIRS = ["src", "lib", "app"];
+const TEST_DIRS = ["tests", "test"];
+
+/** @returns {Promise<{existed: boolean, declaredKey: string|null, written?: boolean, note?: string, nothingToScan?: string}>} */
 export async function ensureSonarProjectProperties(cwd = process.cwd()) {
   const propsPath = path.join(cwd, "sonar-project.properties");
   try {
@@ -257,17 +262,26 @@ export async function ensureSonarProjectProperties(cwd = process.cwd()) {
     } catch {
       // no package.json or invalid JSON — use defaults
     }
+    const existing = (dirs) => dirs.filter((d) => fs.existsSync(path.join(cwd, d)));
+    const sources = existing(SOURCE_DIRS);
+    const tests = existing(TEST_DIRS);
+    if (sources.length === 0) {
+      const wanted = SOURCE_DIRS.map((d) => `${d}/`).join(", ");
+      return { existed: false, declaredKey: null, written: false, nothingToScan: `no ${wanted} folder to analyse: write a sonar-project.properties declaring sonar.sources when the code arrives` };
+    }
     const projectKey = (pkg.name || path.basename(cwd)).replaceAll(/[^a-zA-Z0-9_.-]/g, "_");
+    const layout = [`sonar.sources=${sources.join(",")}`, ...(tests.length ? [`sonar.tests=${tests.join(",")}`] : [])];
     const props = [
       `sonar.projectKey=${projectKey}`,
       `sonar.projectName=${pkg.name || path.basename(cwd)}`,
-      `sonar.sources=src`,
-      `sonar.tests=tests`,
+      ...layout,
       `sonar.javascript.lcov.reportPaths=coverage/lcov.info`,
       `sonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/coverage/**`,
     ].join("\n");
     await fsPromises.writeFile(propsPath, props + "\n", "utf8");
-    return { existed: false, declaredKey: null };
+    // Said out loud: the file is new in the working tree and the team should see it.
+    const note = `sonar: wrote sonar-project.properties (${layout.join(", ")}): review it and commit it`;
+    return { existed: false, declaredKey: null, written: true, note };
   }
 }
 
@@ -277,6 +291,9 @@ export async function runSonarScan(config, projectKey = null, { verbose = false,
   // directory under the key its properties declare — so the proof of
   // coverage is about that package, not the root's `sonar.sources`.
   const repoProps = await ensureSonarProjectProperties(scanCwd);
+  if (repoProps.nothingToScan) {
+    return { ok: false, skipped: true, projectKey: null, stdout: "", stderr: `sonar: ${repoProps.nothingToScan}`, exitCode: 0 };
+  }
   let effectiveProjectKey;
   if (cwd && !projectKey && repoProps.declaredKey) {
     effectiveProjectKey = repoProps.declaredKey;
@@ -403,7 +420,7 @@ export async function runSonarScan(config, projectKey = null, { verbose = false,
     projectKey: effectiveProjectKey,
     cwd: scanCwd,
     scanner: pick.type,
-    note: [note, analysisNote].filter(Boolean).join("; ") || null,
+    note: [repoProps.note, note, analysisNote].filter(Boolean).join("; ") || null,
     stdout: result.stdout,
     // A scan that failed on the server's side says so, not with the scanner's own log.
     stderr: !ok && result.exitCode === 0 ? analysisNote : result.stderr,

package/src/utils/git.js

@@ -189,25 +189,32 @@ export async function hasChanges(cwd = null) {
  * is structural here — without it the slice(3) below would crop one
  * character off the first path.
  */
-export async function listPendingPaths() {
-  const res = await run("git", ["status", "--porcelain"]);
+/**
+ * KJC-BUG-0294: the pending entries as `git status --porcelain -z` reports them,
+ * NUL-separated so a path with blanks or quotes arrives whole. A rename is one
+ * entry "R  new\0old": `path` is the new name, `oldPath` the one that goes away.
+ * @returns {Promise<{path: string, oldPath?: string}[]>}
+ */
+export async function listPendingEntries(cwd = null) {
+  const res = await run("git", ["status", "--porcelain", "-z"], cwd ? { cwd } : {});
   if (res.exitCode !== 0) {
     throw new Error(`git status --porcelain failed: ${res.stderr || res.stdout}`);
   }
-  const stdout = res.stdout;
-  if (!stdout) return [];
-  const lines = stdout.split("\n").map((l) => l.replace(/\r$/, "")).filter(Boolean);
+  const tokens = String(res.stdout || "").split("\0").filter(Boolean);
   const out = [];
-  for (const line of lines) {
-    // Each line is "XY <path>" (XY = 2-char status, space, path).
-    // Renames look like "R  old -> new"; we want the new path.
-    const after = line.slice(3);
-    const arrow = after.indexOf(" -> ");
-    out.push(arrow !== -1 ? after.slice(arrow + 4) : after);
+  for (let i = 0; i < tokens.length; i += 1) {
+    const entry = { path: tokens[i].slice(3) };
+    if (/^[RC]/.test(tokens[i]) || /^.[RC]/.test(tokens[i])) entry.oldPath = tokens[++i];
+    out.push(entry);
   }
   return out;
 }
 
+/** The pending paths; a rename contributes both its names (the old one is a pending deletion). */
+export async function listPendingPaths(cwd = null) {
+  return (await listPendingEntries(cwd)).flatMap((e) => (e.oldPath ? [e.oldPath, e.path] : [e.path]));
+}
+
 // Locale-tolerant detection of "git commit refused because the working
 // tree was already clean by the time we ran it". Observed in N4
 // dogfooding (2026-05-07) — `hasChanges()` reported true after `add -A`
@@ -229,17 +236,36 @@ function isNothingToCommit(message) {
   return NOTHING_TO_COMMIT_PATTERNS.some((re) => re.test(m));
 }
 
-export async function commitAll(message, cwd = null, { beforeCommit = null } = {}) {
+/**
+ * KJC-BUG-0294 (#1993): the pipeline commits what the run changed, never what
+ * was already dirty or untracked before it (`exclude`: the paths pending when
+ * the run started, the harness kj generates among them). `git add -A` staged
+ * 22 untracked files and 960 lines of contract into one step's commit.
+ */
+export async function commitAll(message, cwd = null, { beforeCommit = null, exclude = [] } = {}) {
   const opts = cwd ? { cwd } : {};
-  await runGit(["add", "-A"], opts);
-  const changed = await hasChanges(cwd);
-  if (!changed) return { committed: false };
+  const skip = new Set(exclude);
+  const pending = await listPendingEntries(cwd);
+  const names = (e) => (e.oldPath ? [e.oldPath, e.path] : [e.path]);
+  // A rename of a file that was dirty before the run is that file under a new name.
+  const theirs = (e) => names(e).some((p) => skip.has(p));
+  // A rename stages its old name too (the deletion), or git keeps the old file.
+  const paths = pending.filter((e) => !theirs(e)).flatMap(names);
+  // A path dirty before the run may hold the run's edits too; they cannot be told
+  // apart, so the path stays out and is NAMED (`leftOut`) for the person to commit.
+  const leftOut = pending.filter(theirs).flatMap(names);
+  const said = leftOut.length > 0 ? { leftOut } : {};
+  if (paths.length === 0) return { committed: false, ...said };
+  await runGit(["add", "--", ...paths], opts);
   // ENV-F1 (KJC-TSK-0643): runs between staging and committing — the only
   // window where the staged diff is exactly what the commit will contain
   // (used to stamp the pipeline's review verdict for the v4 gate).
-  if (beforeCommit) await beforeCommit();
+  // The callback learns the exact paths, so a verdict stamped there binds to the
+  // diff this commit will contain and not to whatever else the index holds.
+  if (beforeCommit) await beforeCommit({ paths });
   try {
-    await runGit(["commit", "-m", message], opts);
+    // --only: these paths and nothing else; what the person had staged stays staged.
+    await runGit(["commit", "-m", message, "--only", "--", ...paths], opts);
   } catch (err) {
     // `git status --porcelain` and `git commit` disagreed about whether
     // there was anything to commit. Don't escalate — the only outcome
@@ -252,7 +278,7 @@ export async function commitAll(message, cwd = null, { beforeCommit = null } = {
   }
   const raw = await runGit(["log", "-1", "--pretty=format:%H%x1f%s"], opts);
   const [hash, commitMessage] = raw.split("\x1f");
-  return { committed: true, commit: { hash, message: commitMessage } };
+  return { committed: true, commit: { hash, message: commitMessage }, ...said };
 }
 
 /**

package/src/utils/run-log.js

@@ -267,6 +267,14 @@ export function readRunLog(projectDir, maxLines = 50) {
     const total = lines.length;
     const shown = lines.slice(-maxLines);
     const status = parseRunStatus(lines);
+    // KJC-BUG-0288 (#1982): a run that died with its host session never logs
+    // "finished", so the log said "running" forever. The lock names the run's
+    // process (KJC-BUG-0250): no live holder, no run.
+    if (status.isRunning && !isPidAlive(readLock(path.join(resolveLogDir(projectDir), LOCK_FILENAME))?.pid)) {
+      status.isRunning = false;
+      status.died = true;
+      status.note = "the run's process is gone (it died with its host session, or was killed): kj resume continues it";
+    }
     const MAX_LINE_CHARS = 2000;
     const truncated = shown.map(l => l.length > MAX_LINE_CHARS ? l.slice(0, MAX_LINE_CHARS) + "… [truncated]" : l);
     return {

package/templates/coder-rules.md

@@ -5,7 +5,7 @@
 - NEVER overwrite existing files entirely. Always make targeted, minimal edits.
 - When adding new code to an existing file, insert only the new lines at the correct location.
 - After each edit, verify with `git diff` that ONLY the intended lines changed.
-- If unintended changes are detected, revert immediately with `git checkout -- <file>`.
+- If unintended changes are detected, undo ONLY those hunks with a targeted edit. Never revert the whole file: it may hold edits that are not yours.
 - Pay special attention to CSS, HTML, and config files where full rewrites destroy prior work (brand colors, layouts, styles).
 
 ## Multi-agent / multi-developer environment

package/templates/roles/coder/anthropic.md

@@ -44,13 +44,13 @@ An incomplete implementation is worse than an error — never report success if
 <file_safety>
 - NEVER overwrite a file wholesale. Make targeted edits only.
 - After each edit, inspect `git diff` to confirm only the intended lines changed.
-- If unintended changes appear, revert immediately with `git checkout -- <file>`.
+- If unintended changes appear, undo ONLY those hunks with a targeted edit. Never revert the whole file: it may hold edits that are not yours.
 - CSS, HTML, config files are especially high-risk for full-rewrite damage.
 </file_safety>
 
 <quality>
 - SOLID principles. Functions < 30 lines, single responsibility.
-- Atomic commits: 1 logical change = 1 commit.
+- One logical change per task. NEVER run git commit or git push: the pipeline commits once the review approves.
 - No `console.log` in production — use a structured logger.
 - No `any` types — use JSDoc `@typedef` / `@param` / `@returns`.
 </quality>

package/templates/roles/coder/default.md

@@ -42,13 +42,13 @@ Before reporting done, verify that ALL parts of the task are addressed:
 - NEVER overwrite existing files entirely. Always make targeted, minimal edits.
 - When adding new code to an existing file, insert only the new lines at the correct location.
 - After each edit, verify with `git diff` that ONLY the intended lines changed.
-- If unintended changes are detected, revert immediately with `git checkout -- <file>`.
+- If unintended changes are detected, undo ONLY those hunks with a targeted edit. Never revert the whole file: it may hold edits that are not yours.
 - Pay special attention to CSS, HTML, and config files where full rewrites destroy prior work.
 
 ## Code Quality Rules
 
 - Follow SOLID principles. Write small, focused functions (< 30 lines).
-- Make atomic commits: 1 logical change = 1 commit. Keep PRs small and reviewable.
+- One logical change per task; keep it small and reviewable. NEVER run git commit or git push: the pipeline commits once the review approves.
 - Security: use httpOnly cookies for auth tokens, validate all input, parameterize queries, never expose secrets.
 - No console.log in production code -- use a structured logger. No 'any' types -- use JSDoc annotations.
 

package/templates/roles/coder/google.md

@@ -56,11 +56,11 @@ An incomplete implementation is worse than an error — don't claim success if p
 ## File safety
 
 - NEVER overwrite a file entirely. Targeted edits only.
-- Verify each edit with `git diff`. Unintended lines → revert with `git checkout -- <file>`.
+- Verify each edit with `git diff`. Unintended lines → undo only those hunks, never the whole file (it may hold edits that are not yours).
 
 ## Quality
 
-- SOLID. Small functions (< 30 lines). Atomic commits. No `console.log` in production, no `any` types (JSDoc instead).
+- SOLID. Small functions (< 30 lines). Never commit or push (the pipeline commits after review). No `console.log` in production, no `any` types (JSDoc instead).
 
 ## Output
 

package/templates/roles/coder/openai.md

@@ -32,13 +32,13 @@ An incomplete implementation is worse than an error. Do NOT claim success if any
 
 - NEVER overwrite a file wholesale. Make targeted edits.
 - Verify after each edit with `git diff` that ONLY intended lines changed.
-- If unintended changes appear, revert with `git checkout -- <file>`.
+- If unintended changes appear, undo ONLY those hunks with a targeted edit. Never revert the whole file: it may hold edits that are not yours.
 - CSS/HTML/config files are high-risk for destructive rewrites.
 
 ## QUALITY
 
 - SOLID. Small focused functions (< 30 lines).
-- Atomic commits (1 logical change = 1 commit).
+- One logical change per task. NEVER run git commit or git push: the pipeline commits once the review approves.
 - No `console.log` in production. Use a structured logger.
 - No `any` types. Use JSDoc annotations.
 

package/templates/roles/coder/opencode.md

@@ -12,7 +12,7 @@ Role: write code and tests for the given task.
 6. Code must compile. Tests must pass.
 7. Never hardcode secrets. Use environment variables (`process.env` in Node, `os.environ` in Python).
 8. Never overwrite a file entirely. Make targeted edits only.
-9. Small functions (< 30 lines). Atomic commits. No `console.log` in production. No `any` types.
+9. Small functions (< 30 lines). Never commit or push (the pipeline commits after review). No `console.log` in production. No `any` types.
 
 ## Before reporting done