karajan-code 4.49.1 → 4.49.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.49.1",
+  "version": "4.49.3",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/claude-agent.js

@@ -289,10 +289,12 @@ export function createStreamJsonFilter(onOutput) {
  *    sessions.  The spawned `claude -p` is a separate non-interactive
  *    invocation, not a true nested session.
  *
- * 2. Detach stdin (stdin: "ignore") — When launched from Node.js (which is
- *    how Claude Code / Karajan MCP runs), the child inherits the parent's
- *    stdin.  `claude -p` then blocks waiting to read from a stdin that the
- *    parent is already consuming.  Ignoring stdin prevents the hang.
+ * 2. Never inherit stdin — When launched from Node.js (which is how Claude
+ *    Code / Karajan MCP runs), an inherited stdin made `claude -p` block
+ *    reading what the parent was consuming. KJC-BUG-0344: the prompt now
+ *    travels ON stdin (input), which also closes it, so there is nothing to
+ *    wait on, and a large prompt no longer hits the kernel's per-argument
+ *    limit (E2BIG).
  *
  * 3. Claude Code 2.x writes all structured output (stream-json, json) to
  *    stderr, NOT stdout.  The agent must read from stderr for the actual
@@ -303,7 +305,7 @@ function cleanExecaOpts(extra = {}) {
   // PAR-H (KJC-TSK-0631): extra.env ADDS to the inherited env (lane slot
   // vars) instead of replacing it wholesale.
   const { env: extraEnv, ...rest } = extra;
-  return { env: extraEnv ? { ...env, ...extraEnv } : env, stdin: "ignore", ...rest };
+  return { env: extraEnv ? { ...env, ...extraEnv } : env, ...rest };
 }
 
 /**
@@ -332,11 +334,12 @@ const ALLOWED_TOOLS = [
  * the volatile block goes in the -p message. Without the split, legacy
  * single-prompt behavior is unchanged.
  */
+// KJC-BUG-0344: the -p message goes on stdin (`input`), never as an argument.
 function buildPromptArgs(task) {
   if (task.stablePrompt && task.volatilePrompt) {
-    return ["-p", task.volatilePrompt, "--append-system-prompt", task.stablePrompt, "--allowedTools", ...ALLOWED_TOOLS];
+    return { args: ["-p", "--append-system-prompt", task.stablePrompt, "--allowedTools", ...ALLOWED_TOOLS], input: task.volatilePrompt };
   }
-  return ["-p", task.prompt, "--allowedTools", ...ALLOWED_TOOLS];
+  return { args: ["-p", "--allowedTools", ...ALLOWED_TOOLS], input: String(task.prompt ?? "") };
 }
 
 export class ClaudeAgent extends BaseAgent {
@@ -353,7 +356,7 @@ export class ClaudeAgent extends BaseAgent {
   }
 
   async _runTaskExec(task, model, _role) {
-    const args = buildPromptArgs(task);
+    const { args, input } = buildPromptArgs(task);
     if (model) args.push("--model", model);
     // PL-C (KJC-TSK-0735): el rol del subproceso viaja en KJ_POLICY_ROLE —
     // si su harness corre hooks (claude -p), el tier A evalúa la policy con
@@ -366,6 +369,7 @@ export class ClaudeAgent extends BaseAgent {
       args.push("--output-format", "stream-json", "--verbose");
       const streamFilter = createStreamJsonFilter(task.onOutput);
       const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({
+        input,
         onOutput: streamFilter,
         silenceTimeoutMs: task.silenceTimeoutMs,
         timeout: task.timeoutMs,
@@ -380,7 +384,7 @@ export class ClaudeAgent extends BaseAgent {
 
     // Without streaming, use json output to get structured response via stderr
     args.push("--output-format", "json");
-    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: roleEnv, cwd: task.cwd }));
+    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ input, env: roleEnv, cwd: task.cwd }));
     const raw = pickOutput(res);
     const output = extractTextFromStreamJson(raw);
     const usage = extractUsageFromStreamJson(raw);
@@ -388,9 +392,11 @@ export class ClaudeAgent extends BaseAgent {
   }
 
   async _reviewTaskExec(task, model) {
-    const args = [...buildPromptArgs(task), "--output-format", "stream-json", "--verbose"];
+    const prompt = buildPromptArgs(task);
+    const args = [...prompt.args, "--output-format", "stream-json", "--verbose"];
     if (model) args.push("--model", model);
     const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({
+      input: prompt.input,
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs,

package/src/brain/agent-error-classifier.js

@@ -26,6 +26,9 @@ export const ERROR_CLASS = Object.freeze({
   // un problema de cuota — es motivo para tomar el siguiente eslabón de la
   // cadena declarada. No tiene cooldown: esperar no lo va a resucitar.
   MODEL_UNAVAILABLE: "MODEL_UNAVAILABLE",
+  // KJC-BUG-0327: the OS refused the invocation (E2BIG: the prompt, passed as an
+  // argument, is too large). The same command will fail again: no waiting.
+  INVOCATION_TOO_LARGE: "INVOCATION_TOO_LARGE",
   API_DOWN: "API_DOWN",
   AUTH_FAILED: "AUTH_FAILED",
   NETWORK_TIMEOUT: "NETWORK_TIMEOUT",
@@ -74,6 +77,12 @@ export function classifyAgentError({ provider = "unknown", stdout = "", stderr =
   const combined = `${stderr}\n${stdout}`;
   const base = { provider, exitCode, retryAfter: null, retryUntil: null };
 
+  // 0. KJC-BUG-0327 (#2087): E2BIG first. The error echoes the command, prompt
+  //    included, so any word the prompt carries (rate limit, 401...) would win.
+  if (/\bE2BIG\b|argument list too long/i.test(combined)) {
+    return { ...base, class: ERROR_CLASS.INVOCATION_TOO_LARGE, message: "the prompt is too large to pass as a command argument (E2BIG)", recoverable: true };
+  }
+
   // 1. AUTH_FAILED tiene prioridad absoluta — no es recuperable, escalar al usuario.
   if (AUTH_PATTERNS.test(combined)) {
     return { ...base, class: ERROR_CLASS.AUTH_FAILED, message: pickMessage(combined, AUTH_PATTERNS), recoverable: false };

package/src/brain/with-brain-recovery.js

@@ -36,6 +36,8 @@ export const DEFAULT_RECOVERY_POLICY = Object.freeze({
     // the next link straight away. Without a chain it aborts, because
     // retrying the same dead model is how a run burns quota saying nothing.
     [ERROR_CLASS.MODEL_UNAVAILABLE]: { mode: "abort", maxRetries: 0, fallbackEligible: true, fallbackImmediate: true },
+    // KJC-BUG-0327: the same oversized invocation fails again; take the next link.
+    [ERROR_CLASS.INVOCATION_TOO_LARGE]: { mode: "abort", maxRetries: 0, fallbackEligible: true, fallbackImmediate: true },
     [ERROR_CLASS.API_DOWN]: { mode: "backoff", maxRetries: 3, baseMs: 5_000, factor: 3, jitterPct: 0.2 },
     [ERROR_CLASS.NETWORK_TIMEOUT]: { mode: "backoff", maxRetries: 3, baseMs: 5_000, factor: 3, jitterPct: 0.2 },
     [ERROR_CLASS.SILENCED]: { mode: "backoff", maxRetries: 2, baseMs: 30_000, factor: 2, jitterPct: 0.15 },
@@ -144,7 +146,8 @@ export async function withBrainRecovery({
     const attempt = attemptsByClass[cls.class];
 
     emit(emitter, "brain:agent-error", eventBase, { role, class: cls.class, attempt, message: cls.message, provider: effectiveProvider });
-    logger?.warn?.(`[brain] ${role} (${effectiveProvider}) → ${cls.class} attempt ${attempt}/${classPolicy.maxRetries}: ${cls.message}`);
+    // KJC-BUG-0327: "attempt 4/3" read as one over budget; it is failure 4 with 3 retries allowed.
+    logger?.warn?.(`[brain] ${role} (${effectiveProvider}) → ${cls.class} failure ${attempt} (retries allowed: ${classPolicy.maxRetries}): ${cls.message}`);
 
     // KJC-TSK-0859: un modelo retirado se resuelve ANTES de abortar. No hay
     // cooldown que esperar, así que la condición de la cadena por cuota

package/src/checks/release-check.js

@@ -16,11 +16,37 @@ import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
 // policy IN FORCE now, not the one each PR was merged under. Artifact rules
 // only: diff-threshold invariants are PR-scoped by definition — skipped, and
 // said — so no line metric is needed (without a tag, the whole tree counts).
+/** The commit that introduced the kj pre-commit hook (kj setup), or null. */
+async function setupCommitOf(projectDir) {
+  const res = await runCommand("git", ["-C", projectDir, "log", "--diff-filter=A", "--format=%H", "--", ".karajan/hooks/pre-commit"]);
+  if (res.exitCode !== 0) return null;
+  return res.stdout.trim().split("\n").filter(Boolean).at(-1) ?? null;
+}
+
+/** Supervisor violations on files the setup commit added and nothing changed since. */
+async function withoutSetupInstalls(projectDir, setup, violations) {
+  const added = await runCommand("git", ["-C", projectDir, "diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "--diff-filter=A", setup]);
+  const installed = new Set(added.exitCode === 0 ? added.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : []);
+  const kept = [];
+  for (const v of violations) {
+    if (v.rule_id === "defaults.supervisor.write" && installed.has(v.file)) {
+      const changed = await runCommand("git", ["-C", projectDir, "diff", "--quiet", setup, "HEAD", "--", v.file]);
+      if (changed.exitCode === 0) continue;
+    }
+    kept.push(v);
+  }
+  return kept;
+}
+
 async function policyRangeCheck(projectDir) {
   const { policy, errors } = loadPolicy({ projectDir });
   if (errors.length > 0) return { name: "policy", ok: false, detail: `policy.yml invalid — ${errors[0]}` };
   const described = await runCommand("git", ["-C", projectDir, "describe", "--tags", "--abbrev=0", "--match", "v[0-9]*"]);
   const tag = described.exitCode === 0 ? described.stdout.trim() : null;
+  // KJC-BUG-0342 (#2105): with no tag the whole tree is judged, and the supervisor
+  // files the human's kj setup commit installed read as writes. Only those, and only
+  // while unchanged since that commit, are the setup and not judged.
+  const setup = tag ? null : await setupCommitOf(projectDir);
   const scope = tag ? `${tag}..HEAD` : "whole history (no previous tag)";
   const prScoped = new Set((policy.invariants ?? []).filter((i) => i.kind === "diff-threshold").map((i) => i.id));
   try {
@@ -37,7 +63,7 @@ async function policyRangeCheck(projectDir) {
     // KJC-BUG-0259: the history is judged on what is versioned (hooks, provenance);
     // the machine-local guards were verified when the seal was reviewed.
     const sup = liftSealedSupervisorViolations({ projectDir, violations: raw, trackedOnly: true });
-    const violations = sup.violations;
+    const violations = setup ? await withoutSetupInstalls(projectDir, setup, sup.violations) : sup.violations;
     const hard = violations.filter((v) => v.enforcement === "deny");
     const skipped = prScoped.size > 0 ? `; ${prScoped.size} diff-threshold invariant(s) skipped (PR-scoped)` : "";
     if (hard.length > 0) {

package/src/environment/contract-commit.js

@@ -32,6 +32,9 @@ export const CONTRACT_PATHS = [
   ".karajan/supervisor-signers.json",
   // KJC-TSK-0995 (HUM-D, ADR 0018): the security level the whole team inherits.
   ".karajan/security-level.json",
+  // KJC-BUG-0346: kj env install wires kj_rag_query as a native tool here; a clone
+  // without it loses the tool. Only committed when kj changed it in this run.
+  ".mcp.json",
 ];
 
 const FRESH_MESSAGE = "chore(bootstrap): el contrato del método, para que quien clone lo herede";

package/src/harden/sentinel/sentinel-shell.mjs

@@ -86,6 +86,38 @@ export const isGhIssueCreate = (cmd) => shellSegments(cmd).some((words) => {
   return subcommand[0] === "issue" && subcommand[1] === "create";
 });
 
+// KJC-BUG-0204: the real command puts flags between the verb's words
+// (firebase --account a@b deploy), so they are read in order, not adjacent.
+const PUBLISH_VERBS = [["npm", "publish"], ["firebase", "deploy"], ["gh", "release", "create"]];
+// Known options that take a separate value: that value is not a subcommand word
+// (npm --tag publish test does not publish). An unknown option is not skipped, so
+// a real publish behind it is still read (a false positive costs less than a miss).
+const VALUE_OPTIONS = {
+  npm: ["--prefix", "--tag", "--registry", "--userconfig", "--workspace", "-w", "--otp", "--access", "--cache", "--loglevel", "-C"],
+  firebase: ["--account", "--project", "-P", "--config", "-c", "--only", "--except", "--token", "--message", "-m"],
+  gh: ["--repo", "-R", "--hostname"],
+};
+
+/**
+ * KJC-BUG-0333 (#2093): a simple command whose head is npm, firebase or gh and
+ * whose own words then say publish/deploy/release create. Words inside a quoted
+ * argument of another command (a kj rag query text, a commit message) are one
+ * word of THAT command, so they never read as a publish.
+ * @param {string} cmd
+ */
+export const isPublishCommand = (cmd) => shellSegments(cmd).some((words) => PUBLISH_VERBS.some(([head, ...rest]) => {
+  const i = headIndex(words, [head]);
+  if (words[i]?.split("/").at(-1) !== head) return false;
+  let k = 0;
+  let skipValue = false;
+  for (const w of words.slice(i + 1)) {
+    if (skipValue) { skipValue = false; continue; }
+    if (VALUE_OPTIONS[head].includes(w)) { skipValue = true; continue; }
+    if (w === rest[k] && ++k === rest.length) return true;
+  }
+  return false;
+}));
+
 // KJC-BUG-0286: a $ expands only when something expandable follows it ($x, ${x},
 // $(cmd), $1, $@...). A lone "$ " in a grep pattern is a literal dollar sign.
 const LIVE_EXPANSION = /\$(?=[A-Za-z0-9_{(@*#?$!-])|`/;

package/src/harden/sentinel-hooks.js

@@ -473,20 +473,14 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { isGhIssueCreate, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
+import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
 import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
 import { shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-// KJC-BUG-0204: el comando real lleva flags EN MEDIO del verbo
-// (firebase --account a@b --project p deploy --only hosting:main), asi que la
-// adyacencia dejaba pasar sin mirar justo el despliegue que el gate vigila.
-// Las palabras del verbo tienen que aparecer en orden, no pegadas.
-const PUBLISH_VERBS = [["npm", "publish"], ["firebase", "deploy"], ["gh", "release", "create"]];
-// Cada palabra se lee por su basename: /usr/bin/npm publish es la misma
-// publicacion que npm publish (catch de la review).
-const wordsOf = (text) => String(text).split(/[^A-Za-z0-9_.@:/-]+/).filter(Boolean).map((w) => w.slice(w.lastIndexOf("/") + 1)).filter(Boolean);
 const inOrder = (want, got) => { let i = 0; for (const w of got) if (w === want[i] && ++i === want.length) return true; return false; };
-const isPublish = (cmd) => { const got = wordsOf(cmd); return PUBLISH_VERBS.some((verb) => inOrder(verb, got)); };
+// KJC-BUG-0333: a publish is read per simple command by the shell reader, so
+// words inside a quoted argument of another command are not a publish.
+const isPublish = isPublishCommand;
 const PUSH = /\\bgit\\s+push\\b/;
 const PROTECTED = /\\.claude\\/settings\\.json\\b|\\.karajan\\/(hooks|harness)\\//;
 let raw = "";
@@ -565,15 +559,22 @@ process.stdin.on("end", () => {
       const ghCmd = String(input.command || "");
       if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
         const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
-        let corpus = ghCmd;
+        // KJC-BUG-0340: a body file's PATH is not published text (a scratch dir
+        // under .../claude-1000/... read as an attribution next to a title saying
+        // "generated by kj"); its content is. Each piece is judged on its own, so a
+        // match never spans from the command into a file.
+        const pieces = [];
+        let cmdText = ghCmd;
         // KJC-BUG-0245: the shell reader ends the path at ; && | (a regex took "pr.md;").
         for (const bodyPath of optionValues(ghCmd, ["--body-file", "--notes-file", "--comment-file"])) {
-          try { corpus += "\\n" + readFileSync(bodyPath, "utf8"); } catch {
+          cmdText = cmdText.split(bodyPath).join(" ");
+          try { pieces.push(readFileSync(bodyPath, "utf8")); } catch {
             console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
             process.exit(2);
           }
         }
-        if (attrib.test(corpus)) {
+        pieces.push(cmdText);
+        if (pieces.some((p) => attrib.test(p))) {
           console.error("karajan sentinel: atribucion a IA detectada en contenido a PUBLICAR (PR/issue/release) — prohibida por regla determinista del proyecto: limpia el texto." + doc("attribution"));
           process.exit(2);
         }
@@ -798,7 +799,9 @@ process.stdin.on("end", () => {
       // puede ejecutar cualquier cosa (reviewer catch: grep foo $(rm ...)).
       // (find fuera: -delete/-exec mutan — reviewer catch; sus tokens de
       // carril los caza el escaner de abajo.)
-      const READONLY = /^[ \\t]*(grep|rg|cat|head|tail|less|ls|wc|diff|stat|file|du|tree|git (log|show|diff|status|blame))\\b[^;|&<>$\`(){}\\n\\r]*$/;
+      // KJC-BUG-0338: kj rag query only reads, and the rag-first gate asks for it
+      // with a quoted question that names the file.
+      const READONLY = /^[ \\t]*(grep|rg|cat|head|tail|less|ls|wc|diff|stat|file|du|tree|git (log|show|diff|status|blame)|kj rag query)\\b[^;|&<>$\`(){}\\n\\r]*$/;
       // KJC-BUG-0286 (#1982): a command whose EVERY segment only reads mutates
       // nothing, however it is chained (grep | grep, git show | grep, cd && git
       // status). A cd with a literal target is one such segment: the paths after

package/src/orchestrator/drivers/iteration-phases/quality-gates.js

@@ -21,7 +21,7 @@ import {
 import { runImpeccableStage } from "../../post-loop-stages.js";
 import { runPerfStage } from "../../stages/perf-stage.js";
 import { runTddDisciplineStage } from "../../stages/tdd-discipline-stage.js";
-import { runSuiteGreenStage } from "../../stages/suite-green-stage.js";
+import { runSuiteGreenStage, suiteGreenRequired } from "../../stages/suite-green-stage.js";
 import { runToolJudgeStage } from "../../stages/tool-judge-stage.js";
 import { tryCiComment } from "../../ci-integration.js";
 
@@ -31,7 +31,7 @@ export async function runQualityGateStages({ config, logger, emitter, eventBase,
   if (tddResult.action === "continue") return { action: "continue" };
 
   // KJC-BUG-0298 (#1993): with TDD, a red suite never reaches the reviewer.
-  if (config.development?.methodology === "tdd" && config.development?.require_green_suite !== false && config?.testHarness?.disableSuiteGreenStage !== true) {
+  if (config.development?.methodology === "tdd" && suiteGreenRequired(config)) {
     const green = await runSuiteGreenStage({ config, logger, emitter, eventBase, session, iteration: i });
     if (green.action === "continue") return { action: "continue" };
   }

package/src/orchestrator/drivers/pre-loop.js

@@ -62,6 +62,23 @@ import {
 import { tryCiComment } from "../ci-integration.js";
 import { getIntegration } from "../integrations.js";
 
+/**
+ * KJC-BUG-0332 (#2092, root of #2090/#2091): a plan run implements the plan's
+ * certified HUs. Triaging the plan's original task auto-generated other HUs
+ * (HU-01..) that ran instead, and could call it analysis-only, skipping the
+ * coder and approving an empty diff. In a plan run there is no triage; each HU
+ * carries its own task type, which the HU batch applies.
+ */
+export async function triageForRun({ flags, runTriage }) {
+  if (flags?.plan) {
+    return {
+      roleOverrides: {}, // applyTriageOverrides reads its keys: no override, never null
+      stageResult: { ok: true, taskType: "sw", level: null, roles: [], shouldDecompose: false, subtasks: [], fromPlan: flags.plan, summary: "plan run: the plan's HUs are the work" },
+    };
+  }
+  return (await runTriage()) ?? { roleOverrides: null, stageResult: null };
+}
+
 export async function runPreLoopStages({ config, logger, emitter, eventBase, session, flags, pipelineFlags, coderRole, trackBudget, task, askQuestion, pgTaskId, pgProject, stageResults, brainCtx }) {
   // KJC-BUG-0058: on `kj resume` `stageResults` is rehydrated from
   // `session.stage_results`. Persist after every successful pre-loop stage
@@ -121,7 +138,8 @@ export async function runPreLoopStages({ config, logger, emitter, eventBase, ses
   // stages it gates (researcher, architect, planner) ARE skipped if
   // already complete.
   const triageCtx = { config, logger, emitter, eventBase, session, coderRole, trackBudget, pipelineFlags };
-  const triageResult = await runStage(stageRegistry.get("triage"), triageCtx) ?? { roleOverrides: null, stageResult: null };
+  const triageResult = await triageForRun({ flags, runTriage: () => runStage(stageRegistry.get("triage"), triageCtx) });
+  if (triageResult.stageResult?.fromPlan) logger.info(`Triage skipped: plan ${flags.plan} runs its own certified HUs`);
   applyTriageOverrides(pipelineFlags, triageResult.roleOverrides);
   await persistStage("triage", triageResult.stageResult);
 

package/src/orchestrator/drivers/run-hu-batch.js

@@ -26,6 +26,7 @@ import { emitProgress, makeEvent } from "../../utils/events.js";
 import { needsSubPipeline, runHuSubPipeline } from "../hu-sub-pipeline.js";
 import { runCoderStage } from "../stages/coder-stage.js";
 import { runSonarStage } from "../stages/sonar-stage.js";
+import { runSuiteGreenStage, suiteGreenRequired } from "../stages/suite-green-stage.js";
 import { runIterationLoop } from "./iteration-loop.js";
 import { classifyFailure, createFailureTracker } from "../repair/repair-detector.js";
 import { runRepair } from "../repair/repair-runner.js";
@@ -235,6 +236,16 @@ export async function runHuBatch({ ctx, task, askQuestion, emitter, logger }) {
             }
           }
 
+          // KJC-BUG-0328 (#2088): a code HU is never approved over a red project
+          // suite; it goes back to the coder, as in the iteration loop.
+          if ((huPolicies.tdd || huPolicies.testsRequired) && suiteGreenRequired(laneConfig)) {
+            const green = await runSuiteGreenStage({ config: laneConfig, logger, emitter, eventBase: ctx.eventBase, session: laneSession, iteration: attempt });
+            if (green.action === "continue") {
+              lanePlannedTask = `${huTask}\n\n--- TEST SUITE RED ---\n${laneSession.last_reviewer_feedback}`;
+              continue;
+            }
+          }
+
           // Brain runs acceptance tests
           logger.info(`HU ${story.id}: running ${story.acceptance_tests.length} acceptance tests`);
           emitProgress(emitter, makeEvent("hu:acceptance-start", { ...ctx.eventBase, stage: "acceptance" }, {

package/src/orchestrator/stages/suite-green-stage.js

@@ -17,6 +17,11 @@ import { resolveCmds } from "../../commands/harden.js";
 const TAIL_CHARS = 2000;
 const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
 
+/** Whether the project asks for a green suite (opt-out, and off in the test harness). */
+export function suiteGreenRequired(config) {
+  return config?.development?.require_green_suite !== false && config?.testHarness?.disableSuiteGreenStage !== true;
+}
+
 /** @returns {Promise<{action: "ok"|"continue", result: object}>} */
 export async function runSuiteGreenStage({ config, logger, emitter, eventBase, session, iteration, resolveCmdsImpl = resolveCmds, runTestsImpl = null }) {
   const projectDir = config?.projectDir || process.cwd();

package/src/policy/engine.js

@@ -9,6 +9,7 @@
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { stripTextOptionValues } from "../harden/sentinel/sentinel-shell.mjs";
 import {
   ALLOW_VERDICT,
   checkArtifacts,
@@ -72,7 +73,10 @@ export function loadPolicy({ projectDir = process.cwd(), deps = {} } = {}) {
  *  es no-verificable ⇒ deny (roles sin declarar quedan como hoy). */
 export function evalToolCall(policy, { role = "coder", tool, input = {}, root = null }) {
   if (WRITE_TOOLS.has(tool)) return evalWrite(policy, role, input.file_path || input.notebook_path, root);
-  if (tool === "Bash") return evalShell(policy, role, input.command);
+  // KJC-BUG-0343: the inert prose of a text option (--title, --error, -m...) is
+  // not a target: a report naming a supervisor path is not a write to it. A path
+  // anywhere else, or a value that can expand, is still judged.
+  if (tool === "Bash") return evalShell(policy, role, stripTextOptionValues(String(input.command ?? "")));
   if (READONLY_TOOLS.has(tool) || !policy.roles?.[role]) return ALLOW_VERDICT;
   return denyVerdict(`roles.${role}.tools`, `tool "${tool}" fuera del registro de la policy — no verificable para el rol declarado ${role}`);
 }

package/src/privacy/scan.js

@@ -70,6 +70,17 @@ const SECRET_HEURISTICS = [
 const FIREBASE_WEB_MARKERS = /firebaseConfig|authDomain|firebasestorage|firestore\.googleapis\.com|firebaseapp\.com/;
 const FIREBASE_KEY_HINT = "si es la clave web de Firebase (publica por diseno): declarala en el allow de ~/.karajan/privacy.yml y restringela por dominio en la consola de Google";
 
+// KJC-BUG-0329 (#2089): a lockfile dependency named *-token/*-auth/*-secret has a
+// version for value. Only a WHOLE value made of versions (digits.x[.y], optional
+// prerelease) joined by range operators is discarded (and counted); digits with
+// no dot, or a version glued to text, are still a secret assignment.
+// Prerelease and build metadata with the full SemVer charset (1.2.3-beta-1+build.5).
+const SEMVER_TOKEN = String.raw`\d+\.(?:\d+|x|\*)(?:\.(?:\d+|x|\*))?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?`;
+const SEMVER_OP = String.raw`(?:[\^~]|[<>]=?|=)`;
+// Between two versions there is always an operator (||, a hyphen range, or a comparator).
+const SEMVER_JOIN = String.raw`\s*(?:(?:\|\||-)\s*${SEMVER_OP}?|${SEMVER_OP})\s*`;
+const SEMVER_VALUE = new RegExp(String.raw`^\s*${SEMVER_OP}?\s*${SEMVER_TOKEN}(?:${SEMVER_JOIN}${SEMVER_TOKEN})*\s*$`);
+
 const CONTEXT_DISCARDS = [
   { type: "git-sha", re: /\b(?:[0-9a-f]{64}|[0-9a-f]{40})\b/g },
   { type: "doc-domain-email", re: /\b[A-Za-z0-9._%+-]+@(?:[A-Za-z0-9-]+\.)*(?:example\.(?:com|org|net)|test|invalid|localhost|example)\b/g },
@@ -138,6 +149,12 @@ export function scanText(text, { list = loadPrivacyList(), source = "<text>" } =
       re.lastIndex = 0;
       let m;
       while ((m = re.exec(probe)) !== null) {
+        if (type === "secret-assignment" && SEMVER_VALUE.test(m[1])) {
+          discarded += 1;
+          probe = probe.slice(0, m.index) + " ".repeat(m[0].length) + probe.slice(m.index + m[0].length);
+          re.lastIndex = m.index + m[0].length;
+          continue;
+        }
         findings.push({ severity: "warn", type, source, line: i + 1, masked: `${maskValue(m[1])} — move it to .env or a secret manager` });
         probe = probe.slice(0, m.index) + " ".repeat(m[0].length) + probe.slice(m.index + m[0].length);
         re.lastIndex = m.index + m[0].length;

package/src/review/loc-budget.js

@@ -19,8 +19,9 @@
  * unbounded growth there dilutes the signal the agent receives.
  */
 
-const EXEMPT = [
-  // Generated or vendored: nobody typed it.
+// Generated or vendored: nobody typed it. KJC-BUG-0347: also what the review and
+// Solomon prompts summarize instead of pasting whole.
+const GENERATED = [
   /(^|\/)dist\//,
   /(^|\/)build\//,
   /(^|\/)coverage\//,
@@ -35,6 +36,10 @@ const EXEMPT = [
   /(^|\/)tests\/_diet\//,
   // KJC-BUG-0318: the plan `kj plan share` writes, at the project root only.
   /^\.karajan-shared\/plans\/[^/]+\.json$/,
+];
+
+const EXEMPT = [
+  ...GENERATED,
   // Human documentation, wherever the project keeps it. The landing's docs
   // moved into the monorepo (MONO-3) and the old root-anchored `docs/` rule
   // stopped matching them, which is how documenting started costing budget.
@@ -46,6 +51,11 @@ const EXEMPT = [
 // The exceptions to the exception: these ARE the agent's context.
 const AI_RULES = [/^CLAUDE\.md$/, /^AGENTS\.md$/, /^GEMINI\.md$/, /(^|\/)templates\//];
 
+/** Whether nobody typed this file (lockfile, build output, snapshot...). */
+export function isGenerated(file) {
+  return Boolean(file) && GENERATED.some((re) => re.test(file));
+}
+
 /** @param {string} file @returns {boolean} */
 export function countsTowardBudget(file) {
   if (!file) return false;

package/src/review/one-shot-review.js

@@ -15,6 +15,7 @@ import { resolveReviewProfile } from "./profiles.js";
 import { parseMaybeJsonString, normalizeReviewPayload } from "./parser.js";
 import { detectAvailableAgents, detectHostAgent } from "../utils/agent-detect.js";
 import { saveVerdict, diffHash } from "./verdict-store.js";
+import { summarizeGeneratedFiles } from "./prompt-diff.js";
 import { reportUnparseableVerdict } from "./unparseable-verdict.js";
 import { detectWorkspace } from "./workspace.js";
 import { isQuotaExhausted, candidateStatus, pickQuotaFallback, formatCandidateMenu } from "./reviewer-fallback.js";
@@ -69,7 +70,8 @@ export async function runOneShotReview({
   const attempt = async (who, cfg = config) => {
     const prompt = await buildReviewerPrompt({
       task: task || "Review the following diff for correctness, security and maintainability.",
-      diff, reviewRules: rules, mode: "standard", provider: who, projectDir,
+      // KJC-BUG-0347: generated files summarized; the verdict still binds to the full diff.
+      diff: summarizeGeneratedFiles(diff), reviewRules: rules, mode: "standard", provider: who, projectDir,
     });
     logger?.info?.(`kj review: host=${hostAgent || "none"} → reviewer=${who} (cross-AI)`);
     return createAgentFn(who, cfg, logger).reviewTask({ prompt, role: "reviewer" });

package/src/review/prompt-diff.js

@@ -0,0 +1,26 @@
+/**
+ * KJC-BUG-0347 (#2101): the diff a reviewer or Solomon READS. A generated file
+ * (lockfile, build output, snapshot) enters as one summary line instead of its
+ * thousands of lines: the reviewer kept losing the real hunks behind a 4800-line
+ * package-lock.json, and Solomon's prompt blew the argument limit (E2BIG).
+ * The verdict still binds to the full diff; this only shapes the prompt.
+ */
+import { isGenerated } from "./loc-budget.js";
+
+const HEADER = /^diff --git a\/(.+?) b\/(.+)$/;
+
+/** @param {string} diff unified diff @returns {string} */
+export function summarizeGeneratedFiles(diff) {
+  const sections = String(diff).split(/(?=^diff --git )/m);
+  let changed = false;
+  const out = sections.map((sec) => {
+    const file = sec.split("\n", 1)[0].match(HEADER)?.[2];
+    if (!file || !isGenerated(file)) return sec;
+    changed = true;
+    const lines = sec.split("\n");
+    const added = lines.filter((l) => l.startsWith("+") && !l.startsWith("+++")).length;
+    const removed = lines.filter((l) => l.startsWith("-") && !l.startsWith("---")).length;
+    return `diff --git a/${file} b/${file}\n# ${file}: generated file, +${added} -${removed} lines, contents left out of this prompt\n`;
+  });
+  return changed ? out.join("") : diff;
+}

package/src/review/solomon-arbitration.js

@@ -16,6 +16,7 @@ import { createAgent } from "../agents/index.js";
 import { parseMaybeJsonString } from "./parser.js";
 import { detectAvailableAgents, detectHostAgent } from "../utils/agent-detect.js";
 import { diffHash, loadVerdict, saveVerdict } from "./verdict-store.js";
+import { summarizeGeneratedFiles } from "./prompt-diff.js";
 
 const SECURITY_PATTERN = /injection|xss|csrf|secret|credential|password|token leak|auth(entication|orization)?|crypt|session|sanitiz|traversal|rce\b/i;
 
@@ -75,7 +76,8 @@ export async function runSolomonArbitration({
     "", "## Reviewer's blocking issues",
     JSON.stringify(verdict.issues || [], null, 2),
     "", "## Brain's position", position,
-    "", "## The diff under dispute", diff,
+    // KJC-BUG-0347: generated files summarized; the ruling still binds to the full diff.
+    "", "## The diff under dispute", summarizeGeneratedFiles(diff),
   ].join("\n");
 
   logger?.info?.(`kj solomon: brain=${hostAgent || "?"} vs reviewer=${verdict.reviewer} → arbiter=${solomon}`);

package/src/sonar/api.js

@@ -126,13 +126,20 @@ export async function getQualityGateStatus(config, projectKey = null) {
 
 export async function getOpenIssues(config, projectKey = null) {
   const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey, cwd: queryCwd(config) });
-  const body = await sonarFetch(config, `/api/issues/search?projectKeys=${effectiveProjectKey}&statuses=OPEN`);
+  // KJC-BUG-0339 (#2099): current SonarQube ignores projectKeys and answered with
+  // every project's issues, so the audit of one repo listed others' paths. The
+  // project goes in `components` (and projectKeys stays for old servers), and the
+  // answer is filtered by the key too: an issue of another project never leaves.
+  const key = encodeURIComponent(effectiveProjectKey);
+  const body = await sonarFetch(config, `/api/issues/search?components=${key}&projectKeys=${key}&statuses=OPEN`);
 
   let parsedIssues = [];
   let parsedRaw = body;
   try {
     const parsed = JSON.parse(body);
-    parsedIssues = parsed.issues || [];
+    // A project key may hold colons (Maven-style): match the whole key as a prefix.
+    const ownComponent = (c) => c === effectiveProjectKey || String(c ?? "").startsWith(`${effectiveProjectKey}:`);
+    parsedIssues = (parsed.issues || []).filter((i) => (i.project != null ? i.project === effectiveProjectKey : ownComponent(i.component)));
     parsedRaw = parsed;
   } catch { /* SonarQube response is not valid JSON */ }