karajan-code 4.48.0 → 4.48.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.48.0",
+  "version": "4.48.3",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -104,6 +104,7 @@
     "@babel/parser": "^7.29.7",
     "@karajan-family/governance": "^0.1.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@xterm/xterm": "^6.0.0",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^5.0.0",
     "commander": "^15.0.0",
@@ -120,8 +121,12 @@
     "sqlite-vec": "^0.1.9",
     "valibot": "^1.4.1",
     "web-tree-sitter": "^0.26.9",
+    "ws": "^8.21.3",
     "yaml": "^2.9.0"
   },
+  "optionalDependencies": {
+    "node-pty": "^1.1.0"
+  },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@vitest/coverage-v8": "^4.1.8",

package/src/commands/harden.js

@@ -186,7 +186,7 @@ export async function hardenCommand({
   const cfg = withConfig ? installConfigsForRoots({ projectDir, roots, dryRun }) : null;
   const withCi = ci && profile !== "minimal";
   const wf = withCi
-    ? installWorkflows({ projectDir, language: roots[0]?.language ?? null, profile, mutation, dryRun })
+    ? installWorkflows({ projectDir, language: roots[0]?.language ?? null, root: roots[0]?.dir ?? ".", profile, mutation, dryRun })
     : null;
   const withGuidelines = guidelines && profile !== "minimal";
   // KJC-BUG-0199 (issue #1773): the same detected language the workflows and

package/src/config/defaults.js

@@ -254,7 +254,8 @@ const DEFAULTS = {
     // delta re-index before every `kj run`; `onCommit` is consulted by
     // `kj rag install-hooks` to decide whether to install the post-merge
     // hook. Both default ON; flip to false to opt out without uninstalling.
-    autoUpdate: { onCommit: true, onRun: true },
+    // maxFiles (KJC-BUG-0304): past this drift the pre-query refresh answers from the index as it is.
+    autoUpdate: { onCommit: true, onRun: true, maxFiles: 25 },
     // KJC-TSK-0682 — sensitivity of the indexed code. Cloud embedders
     // (openai/voyage/cohere/mistral) require an explicit "public"; the
     // safe default blocks them (local ollama/onnx always allowed).

package/src/harden/sentinel-hooks.js

@@ -1049,7 +1049,11 @@ process.stdin.on("end", () => {
         // above rules on it) and the ledger only holds in-repo paths.
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
         // the gate asks for kj rag index instead of denying the impossible.
-        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
+        // KJC-BUG-0308: a barrel only re-exports its folder, so the RAG answers with
+        // what it re-exports and never with the barrel: a hit in its own subtree covers it.
+        const BARRELS = ["index.js", "index.ts", "index.mjs", "index.cjs", "index.jsx", "index.tsx", "__init__.py", "mod.rs"];
+        const barrelCovered = dirOf(rel) !== "" && BARRELS.includes(rel.slice(rel.lastIndexOf("/") + 1)) && hits.some((h) => h.startsWith(dirOf(rel) + "/"));
+        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || barrelCovered || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
         // ADR 0015 (KJC-TSK-0925): no escape. The cases it covered (new file, empty
         // index, not indexable) are decided by the gate itself.
         if (!covered) {

package/src/harden/workflow-engine.js

@@ -73,10 +73,14 @@ export function installWorkflows({
   mutation = false,
   dryRun = false,
   kjVersion = null,
+  root = ".",
 } = {}) {
   const dir = join(projectDir, WORKFLOWS_DIR);
   const pm = detectPackageManager(projectDir);
-  const quality = qualityWorkflowFor(language, pm, hasLintScript(projectDir));
+  // KJC-BUG-0309: the Quality workflow reads the package manager and the lint
+  // script where the language root is, and runs its steps there.
+  const appDir = join(projectDir, root);
+  const quality = qualityWorkflowFor(language, detectPackageManager(appDir), hasLintScript(appDir), root);
   const extras = extraWorkflowsFor({ profile, publishable: isPublishableNpm(projectDir), pm });
   const mut = mutation ? mutationWorkflowFor(language, pm) : null;
   // PL-C: el tier C solo existe donde el proyecto DECLARA policy. Versión a

package/src/harden/workflow-templates.js

@@ -166,13 +166,21 @@ const QUALITY_BY_LANGUAGE = {
  * `lint:false` drops the JS lint step entirely (project has no lint script,
  * KJC-BUG-0137) — mirroring the local hook, which also omits it.
  */
-export function qualityWorkflowFor(language, pm = "npm", lint = true) {
+export function qualityWorkflowFor(language, pm = "npm", lint = true, root = ".") {
   const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
   const body =
     language === "javascript" || language === "typescript"
       ? header([...nodeSetupSteps(pm), ...(lint ? [`      - run: ${c.lint}`] : []), `      - run: ${c.test}`])
       : QUALITY_BY_LANGUAGE[language];
-  return body ? { file: "kj-quality.yml", blockId: "wf-quality", body } : null;
+  return body ? { file: "kj-quality.yml", blockId: "wf-quality", body: inRoot(body, root) } : null;
+}
+
+// KJC-BUG-0309 (#2023): a repo whose app lives in a subdirectory runs every step
+// there. The root goes into YAML, so it is a plain relative path or nothing.
+function inRoot(body, root) {
+  if (root === "." || root === "") return body;
+  if (!/^[\w.-]+(\/[\w.-]+)*$/.test(root) || root.split("/").includes("..")) throw new Error(`kj harden: "${root}" is not a safe directory for the Quality workflow`);
+  return body.replace("    runs-on: ubuntu-latest\n", `    runs-on: ubuntu-latest\n    defaults:\n      run:\n        working-directory: ${root}\n`);
 }
 
 // Caps the net LOC delta of a PR (strict profile only — it is opinionated).

package/src/policy/supervisor-verify.js

@@ -20,6 +20,16 @@ const HARNESS_PREFIX = ".karajan/harness/";
 const SAFE_DIR = /^(\$HOME)?(\/[\w.@%+~-]+)+$/;
 
 const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+// KJC-BUG-0311: the kj judging now, to tell a seal made by another version. Read
+// lazily and never fatal (a bundled binary may not carry package.json): unknown
+// means no seal counts as "older", so the strict re-render rule applies.
+let kjVersionCache;
+const kjVersion = () => {
+  if (kjVersionCache === undefined) {
+    try { kjVersionCache = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version ?? null; } catch { kjVersionCache = null; }
+  }
+  return kjVersionCache;
+};
 
 /**
  * @returns {{files: Set<string>, reason?: string}} rutas repo-relativas de
@@ -41,6 +51,10 @@ export function verifiedSupervisorFiles({ projectDir, trackedOnly = false }) {
   if (!signed.ok) return { files: new Set(), reason: signed.reason };
   const ok = new Set();
   const unjudgeable = new Set();
+  const current = kjVersion();
+  const olderSeal = current && typeof prov?.kj_version === "string" && prov.kj_version !== current ? prov.kj_version : null;
+  let vouched = false;
+  let stale = false;
   // KJC-BUG-0259 (user's decision, option A): history is judged with the kj of
   // when it was committed. The harness guards are machine-local and never in the
   // repo; the review and each PR's CI verify them when the seal is made. A check
@@ -87,13 +101,23 @@ export function verifiedSupervisorFiles({ projectDir, trackedOnly = false }) {
       continue;
     }
     if (canonical != null && sha256(Buffer.from(canonical, "utf8")) === entry.sha256) ok.add(entry.file);
+    // KJC-BUG-0311 (#2052): sealed with another kj whose template this kj cannot
+    // re-render. A phone of the roster signed these very bytes: that vouches for
+    // them. Without that signature recomputation is the only proof, so it stays
+    // denied (an unsigned provenance could claim any version to skip it).
+    else if (olderSeal && signed.required) { ok.add(entry.file); vouched = true; }
+    else if (olderSeal) stale = true;
   }
   // `complete` = ninguna entrada FALLO y alguna verifico. Exigir que todas
   // verifiquen hacia imposible sellar desde cualquier sitio que no fuera la
   // maquina que sello, porque los guardias no viajan con el repo (0212).
   const judged = (e) => ok.has(e.file) || unjudgeable.has(e.file);
   const complete = ok.size > 0 && entries.every((e) => typeof e?.file === "string" && judged(e));
-  return { files: ok, complete, unjudgeable, signed: signed.required };
+  return {
+    files: ok, complete, unjudgeable, signed: signed.required,
+    ...(vouched ? { vouchedOlder: olderSeal } : {}),
+    ...(stale ? { reason: `sellado con kj ${olderSeal} y este kj (${current}) no puede recomputar su plantilla, y sin firma del padrón nada más lo respalda: re-séllalo con kj harden --commit` } : {}),
+  };
 }
 
 /**
@@ -117,6 +141,7 @@ export function liftSealedSupervisorViolations({ projectDir, violations, tracked
     ...(unjudged > 0 ? [`${unjudged} guardia(s) del sello no existen en este checkout y no se han podido comprobar aquí`] : []),
     // KJC-TSK-0964: what the signature did or did not prove is said, never assumed.
     ...(sealed.signed === false ? ["proyecto sin padrón de firmantes: el sello no lleva firma verificable y su garantía es solo local"] : []),
+    ...(sealed.vouchedOlder ? [`sellado con kj ${sealed.vouchedOlder}: este kj no puede recomputar su plantilla y lo respalda la firma del padrón sobre esos bytes`] : []),
     ...(kept.length === violations.length && sealed.reason ? [sealed.reason] : []),
   ];
   return {

package/src/rag/auto-update.js

@@ -12,6 +12,8 @@ import { ragExclude } from "./indexable.js";
 import { makeGovernedEmbedder } from "./governed-embedder.js";
 import { openProjectStore } from "./project-store.js";
 
+// The pre-query refresh reindexes at most this many changed files (config.rag.autoUpdate.maxFiles).
+export const DEFAULT_MAX_DRIFT_FILES = 25;
 const HOOK_SRC = resolve(fileURLToPath(import.meta.url), "../../../scripts/git-hooks/post-merge");
 
 export async function maybeAutoUpdate({ projectDir, config, logger = console, flags = {} } = {}) {
@@ -26,6 +28,16 @@ export async function maybeAutoUpdate({ projectDir, config, logger = console, fl
   try {
     const since = getLastIndexedCommit(db, slug);
     if (!since || since === head) return { skipped: true, head };
+    // KJC-BUG-0304: a drift of hundreds of files (an index weeks old) reindexed the
+    // repo for half an hour before the query answered. Past the bound the query
+    // answers from the index as it is, and says how to bring it up to date.
+    const maxFiles = config?.rag?.autoUpdate?.maxFiles ?? DEFAULT_MAX_DRIFT_FILES;
+    const { stdout } = await execa("git", ["-C", projectDir, "diff", "--name-only", since, "HEAD"]);
+    const changed = stdout.split("\n").filter(Boolean).length;
+    if (changed > maxFiles) {
+      logger.warn?.(`[rag] ${changed} file(s) changed since the last index (more than ${maxFiles}): answering from the index as it is; bring it up to date with kj rag index --since auto`);
+      return { skipped: true, reason: "drift-too-large", changed, head };
+    }
     logger.info?.(`[rag] drift detected (${since.slice(0, 7)} → ${head.slice(0, 7)}); running delta update`);
     const totals = await indexProjectDelta(projectDir, { db, embedder: makeGovernedEmbedder(config), since, logger, exclude: ragExclude(config) });
     if (totals.head) setLastIndexedCommit(db, slug, totals.head);