karajan-code 4.52.0 → 4.53.0

package/src/review/verdict-store.js

@@ -14,6 +14,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { runCommand } from "../utils/process.js";
 import { kjStamp, stampDiffers, stampLabel } from "./kj-provenance.js";
+import { sourceFilesOf } from "./tests-with-code.js";
 
 const STORE_DIR = path.join(".karajan", "reviews");
 
@@ -107,13 +108,15 @@ export async function stampStagedVerdict({ projectDir, reviewer, summary = "", s
   }
   // KJC-BUG-0294: the pipeline commits by path (`--only`); the verdict must bind
   // to that diff, not to other files the person had staged.
-  const res = await runCommand("git", ["diff", "--cached", ...(paths?.length ? ["--", ...paths] : [])], { cwd: dir });
+  const pathArgs = paths?.length ? ["--", ...paths] : [];
+  const res = await runCommand("git", ["diff", "--cached", ...pathArgs], { cwd: dir });
   if (res.exitCode !== 0 || !res.stdout?.trim()) return { stamped: false };
+  // A deleted file cannot be indexed, so it never counts as a source to prove.
+  const names = sonar?.indexed ? (await runCommand("git", ["diff", "--cached", "--name-only", "--diff-filter=ACMR", ...pathArgs], { cwd: dir })).stdout.split("\n").filter(Boolean) : [];
   await saveVerdict(dir, res.stdout, {
     verdict: "approved", reviewer, host: "kj-pipeline", issues: [], summary,
-    // KJC-TSK-0838: what the pipeline's sonar stage saw, so --check can tell
-    // a run whose gate ran from one that skipped it.
-    ...(sonar ? { sonar } : {}),
+    // KJC-TSK-0838/0839: what the pipeline's sonar stage saw, proved per staged source.
+    ...(sonar ? { sonar: coverageFor(sonar, names) } : {}),
   });
   return { stamped: true };
 }
@@ -122,8 +125,8 @@ export async function stampStagedVerdict({ projectDir, reviewer, summary = "", s
  * KJC-TSK-0838: the pipeline sonar stage result as a verdict sonar block.
  * SKIPPED (no remote, no key) or absent is `ran:false` WITH the reason — the
  * pre-commit check then refuses code, as it would for any other diff.
- * Coverage lists stay empty: the pipeline scans the whole project, and the
- * per-file proof (verbose index) is not wired into SonarRole yet.
+ * KJC-TSK-0839: a stage that ran carries the files its verbose scan indexed;
+ * stampStagedVerdict turns them into covered/uncovered for the staged sources.
  */
 export function pipelineSonarBlock(stageResult) {
   if (!stageResult) return { ran: false, source: "pipeline", reason: "the pipeline recorded no sonar stage" };
@@ -131,10 +134,19 @@ export function pipelineSonarBlock(stageResult) {
     return { ran: false, source: "pipeline", reason: stageResult.reason || stageResult.error || "the sonar stage did not run" };
   }
   return {
-    ran: true, source: "pipeline", projectKey: stageResult.projectKey || null, gateStatus: stageResult.gateStatus, covered: [], uncovered: [],
+    ran: true, source: "pipeline", projectKey: stageResult.projectKey || null, gateStatus: stageResult.gateStatus, indexed: stageResult.indexedFiles ?? [],
   };
 }
 
+/** KJC-TSK-0839: the per-source proof of a pipeline block, against the files this commit stages. */
+function coverageFor(sonar, stagedNames) {
+  if (!sonar?.ran || !Array.isArray(sonar.indexed)) return sonar;
+  const { indexed, ...block } = sonar;
+  const seen = new Set(indexed);
+  const { sources } = sourceFilesOf({}, stagedNames);
+  return { ...block, covered: sources.filter((f) => seen.has(f)), uncovered: sources.filter((f) => !seen.has(f)) };
+}
+
 /**
  * Is there an APPROVED verdict for exactly this diff?
  * @returns {Promise<{ok: boolean, verdict?: object, reason?: string}>}

package/src/roles/sonar-role.js

@@ -1,5 +1,5 @@
 import { BaseRole } from "./base-role.js";
-import { runSonarScan } from "../sonar/scanner.js";
+import { indexedFilesFrom, runSonarScan } from "../sonar/scanner.js";
 import { getQualityGateStatus, getOpenIssues } from "../sonar/api.js";
 import { shouldBlockByProfile, summarizeIssues } from "../sonar/enforcer.js";
 
@@ -20,7 +20,8 @@ export class SonarRole extends BaseRole {
   }
 
   async execute(_input) {
-    const scan = await runSonarScan(this.config);
+    // KJC-TSK-0839: verbose, so the scanner names every file it indexed.
+    const scan = await runSonarScan(this.config, null, { verbose: true });
 
     if (!scan.ok) {
       return {
@@ -53,6 +54,7 @@ export class SonarRole extends BaseRole {
       ok: !blocking,
       result: {
         projectKey: scan.projectKey,
+        indexedFiles: [...indexedFilesFrom(scan.stdout)],
         gateStatus: gate.status,
         conditions: gate.conditions || [],
         issues,

package/src/sonar/api.js

@@ -124,6 +124,13 @@ export async function getQualityGateStatus(config, projectKey = null) {
   }
 }
 
+/** KJC-TSK-1051 (TEAM-E): the names of the quality profiles the project runs on. */
+export async function getProjectQualityProfiles(config, projectKey = null) {
+  const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey, cwd: queryCwd(config) });
+  const body = await sonarFetch(config, `/api/qualityprofiles/search?project=${encodeURIComponent(effectiveProjectKey)}`);
+  return (JSON.parse(body).profiles ?? []).map((p) => p.name);
+}
+
 export async function getOpenIssues(config, projectKey = null) {
   const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey, cwd: queryCwd(config) });
   // KJC-BUG-0339 (#2099): current SonarQube ignores projectKeys and answered with

package/src/utils/injection-guard.js

@@ -8,52 +8,52 @@
  * @module utils/injection-guard
  */
 
-/** Phrases that attempt to override system/reviewer instructions. */
-const DIRECTIVE_PATTERNS = [
-  /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|rules?|prompts?|guidelines?)/i,
-  /disregard\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|rules?|prompts?)/i,
-  /forget\s+(all\s+)?(previous|prior|your)\s+(instructions?|rules?|context)/i,
-  /override\s+(the\s+)?(system|reviewer|review)\s+(prompt|instructions?|rules?)/i,
-  /do\s+not\s+follow\s+(the\s+)?(above|previous|system)\s+(instructions?|rules?)/i,
-  /new\s+instructions?\s*:/i,
-  /system\s*:\s*you\s+are/i,
-  /\bact\s+as\s+(a\s+)?(different|new|my|an?\s+)/i,
-  /you\s+are\s+now\s+(a\s+)?/i,
-  /from\s+now\s+on\s*(,|\s)?\s*you\s+(will|should|must|are)/i,
-  /pretend\s+(you\s+are|to\s+be)/i,
-  /respond\s+(only\s+)?with\s+["']?approved["']?/i,
-  /always\s+(return|respond|output)\s+.*approved/i,
-  /set\s+approved\s*[=:]\s*true/i,
-  /\bapproved["']?\s*:\s*true\b.*ignore/i,
-  /output\s+the\s+following\s+json/i,
-  /return\s+this\s+exact\s+(json|response|output)/i,
-];
-
-/** Unicode categories that can hide or disguise content. */
-const UNICODE_PATTERNS = [
-  /[\u200B-\u200F]/,   // zero-width spaces, LTR/RTL marks
-  /[\u202A-\u202E]/,   // bidi embedding/override
-  /[\u2066-\u2069]/,   // bidi isolate
-  /[\uFEFF]/,          // BOM mid-text
-  /[\u00AD]{3,}/,      // repeated soft hyphens
-  /[\u2060-\u2064]/,   // invisible operators
-  /[\u{E0000}-\u{E007F}]/u, // tag characters
-];
-
-/** Maximum comment block size (chars) before flagging. */
-const MAX_COMMENT_BLOCK = 2000;
+import { readFileSync } from "node:fs";
 
 /**
- * Comment block patterns for common languages.
- * Each regex captures the full block content.
+ * KJC-TSK-0703: the patterns live in injection-patterns.json, the family's
+ * versioned catalog (karajan-radar reads it from Python). Only constructs both
+ * JavaScript RegExp and Python re understand are accepted.
  */
-const COMMENT_BLOCK_RE = [
-  /\/\*[\s\S]{0,20000}?\*\//g,        // C-style /* ... */
-  /<!--[\s\S]{0,20000}?-->/g,         // HTML <!-- ... -->
-  /"""\s*[\s\S]{0,20000}?\s*"""/g,    // Python docstrings
-  /'''\s*[\s\S]{0,20000}?\s*'''/g,    // Python docstrings (single)
-  /=begin[\s\S]{0,20000}?=end/g,      // Ruby block comments
+const NON_PORTABLE = [
+  [/\\u\{/, "\\u{...} escapes (put the literal character in the JSON instead)"],
+  [/\\[pP]\{/, "\\p{...} property escapes"],
+  [/\(\?<(?![=!])/, "a named group (Python spells it (?P<name>)"],
+  [/\\k</, "a named backreference"],
 ];
+const PORTABLE_FLAGS = new Set(["i", "m", "s", "u"]);
+
+/** Throws, naming the pattern, when an entry would not work outside JavaScript. */
+export function assertPortable({ id, expression, flags = "" }) {
+  for (const flag of flags) {
+    if (!PORTABLE_FLAGS.has(flag)) throw new Error(`${id}: flag "${flag}" is not portable (only i, m, s, u)`);
+  }
+  for (const [construct, what] of NON_PORTABLE) {
+    if (construct.test(expression)) throw new Error(`${id}: ${what} is not portable: ${expression}`);
+  }
+  return new RegExp(expression, flags);
+}
+
+/** The catalog compiled per type; a missing or broken catalog fails loudly, never scans empty. */
+// The SEA bundle has no sibling files: scripts/esbuild-sea.config.mjs inlines this exact read.
+const readCatalog = () => readFileSync(new URL("./injection-patterns.json", import.meta.url), "utf8");
+
+export function loadInjectionCatalog() {
+  const catalog = JSON.parse(readCatalog());
+  const compiled = { directive: [], unicode: [], comment_block: [], maxCommentBlock: catalog.max_comment_block, version: catalog.version };
+  for (const entry of catalog.patterns) {
+    const re = assertPortable(entry);
+    // Comment blocks are walked match by match: the global flag is the engine's, not the catalog's.
+    compiled[entry.type].push(entry.type === "comment_block" ? new RegExp(re.source, `${re.flags}g`) : re);
+  }
+  return compiled;
+}
+
+const CATALOG = loadInjectionCatalog();
+const DIRECTIVE_PATTERNS = CATALOG.directive;
+const UNICODE_PATTERNS = CATALOG.unicode;
+const MAX_COMMENT_BLOCK = CATALOG.maxCommentBlock;
+const COMMENT_BLOCK_RE = CATALOG.comment_block;
 
 /**
  * @typedef {Object} InjectionFinding
@@ -118,7 +118,7 @@ export function scanForInjection(text, opts = {}) {
   for (const re of COMMENT_BLOCK_RE) {
     let m;
     while ((m = re.exec(text)) !== null) {
-      if (m[0].length > maxBlock) {
+      if (proseLength(m[0]) > maxBlock) {
         findings.push({
           type: "comment_block",
           pattern: `block ${m[0].length} chars (max ${maxBlock})`,
@@ -175,6 +175,22 @@ export function scanDiff(diff, opts = {}) {
 
 // --- Helpers ---
 
+/**
+ * KJC-TSK-0743: the size of a comment block that counts against the limit. In a
+ * JSDoc block (`/**`), tag lines (`* @typedef`, `* @property`...) are structure,
+ * not prose: they are left out unless a single one runs past 300 chars. Any
+ * instruction inside a tag line is still caught by the directive patterns.
+ */
+const JSDOC_TAG_LINE = /^\s*\*\s*@[A-Za-z]+/;
+const MAX_TAG_LINE = 300;
+function proseLength(block) {
+  if (!block.startsWith("/**")) return block.length;
+  return block
+    .split("\n")
+    .filter((line) => !(JSDOC_TAG_LINE.test(line) && line.length <= MAX_TAG_LINE))
+    .join("\n").length;
+}
+
 function excerpt(text, index) {
   const start = Math.max(0, index - 20);
   const end = Math.min(text.length, index + 100);

package/src/utils/injection-patterns.json

@@ -0,0 +1,36 @@
+{
+  "$comment": "KJC-TSK-0703: the canonical prompt-injection catalog of the karajan family. Data, not code: each language keeps only its small scanning engine. Expressions must stay portable (JavaScript RegExp and Python re): invisible characters go as literal characters (JSON escapes), never as regex escapes like \\u{...}; flags are only i, m, s, u. Bump version on any change.",
+  "version": "1.0.0",
+  "max_comment_block": 2000,
+  "patterns": [
+    { "id": "directive-ignore-previous", "type": "directive", "expression": "ignore\\s+(all\\s+)?(previous|prior|above|earlier)\\s+(instructions?|rules?|prompts?|guidelines?)", "flags": "i", "severity": "high", "why": "Tells the model to drop the instructions it was given, the classic override." },
+    { "id": "directive-disregard-previous", "type": "directive", "expression": "disregard\\s+(all\\s+)?(previous|prior|above|earlier)\\s+(instructions?|rules?|prompts?)", "flags": "i", "severity": "high", "why": "Same override as ignore-previous, worded to slip past a single keyword." },
+    { "id": "directive-forget-instructions", "type": "directive", "expression": "forget\\s+(all\\s+)?(previous|prior|your)\\s+(instructions?|rules?|context)", "flags": "i", "severity": "high", "why": "Asks the model to wipe its context or rules before obeying new ones." },
+    { "id": "directive-override-system", "type": "directive", "expression": "override\\s+(the\\s+)?(system|reviewer|review)\\s+(prompt|instructions?|rules?)", "flags": "i", "severity": "high", "why": "Names the system or reviewer prompt as something to replace." },
+    { "id": "directive-do-not-follow", "type": "directive", "expression": "do\\s+not\\s+follow\\s+(the\\s+)?(above|previous|system)\\s+(instructions?|rules?)", "flags": "i", "severity": "high", "why": "Negates the instructions above it, steering the model away from its task." },
+    { "id": "directive-new-instructions", "type": "directive", "expression": "new\\s+instructions?\\s*:", "flags": "i", "severity": "medium", "why": "Announces a fresh instruction block inside content that should carry none." },
+    { "id": "directive-system-you-are", "type": "directive", "expression": "system\\s*:\\s*you\\s+are", "flags": "i", "severity": "high", "why": "Forges a system message that redefines who the model is." },
+    { "id": "directive-act-as", "type": "directive", "expression": "\\bact\\s+as\\s+(a\\s+)?(different|new|my|an?\\s+)", "flags": "i", "severity": "medium", "why": "Role reassignment: asks the model to become another persona." },
+    { "id": "directive-you-are-now", "type": "directive", "expression": "you\\s+are\\s+now\\s+(a\\s+)?", "flags": "i", "severity": "medium", "why": "Role reassignment phrased as a fact the model should accept." },
+    { "id": "directive-from-now-on", "type": "directive", "expression": "from\\s+now\\s+on\\s*(,|\\s)?\\s*you\\s+(will|should|must|are)", "flags": "i", "severity": "medium", "why": "Installs a standing behaviour change for the rest of the conversation." },
+    { "id": "directive-pretend", "type": "directive", "expression": "pretend\\s+(you\\s+are|to\\s+be)", "flags": "i", "severity": "medium", "why": "Role-play framing used to step around the model's instructions." },
+    { "id": "directive-respond-approved", "type": "directive", "expression": "respond\\s+(only\\s+)?with\\s+[\"']?approved[\"']?", "flags": "i", "severity": "high", "why": "Dictates the reviewer's verdict instead of letting it judge the change." },
+    { "id": "directive-always-approved", "type": "directive", "expression": "always\\s+(return|respond|output)\\s+.*approved", "flags": "i", "severity": "high", "why": "Fixes the output to approved whatever the content says." },
+    { "id": "directive-set-approved", "type": "directive", "expression": "set\\s+approved\\s*[=:]\\s*true", "flags": "i", "severity": "high", "why": "Tries to write the verdict field directly." },
+    { "id": "directive-approved-true-ignore", "type": "directive", "expression": "\\bapproved[\"']?\\s*:\\s*true\\b.*ignore", "flags": "i", "severity": "high", "why": "A forged approved verdict next to an instruction to ignore something." },
+    { "id": "directive-output-json", "type": "directive", "expression": "output\\s+the\\s+following\\s+json", "flags": "i", "severity": "medium", "why": "Hands the model a ready answer to emit instead of its own." },
+    { "id": "directive-return-exact", "type": "directive", "expression": "return\\s+this\\s+exact\\s+(json|response|output)", "flags": "i", "severity": "medium", "why": "Same as output-json: a scripted response smuggled into the content." },
+    { "id": "unicode-zero-width", "type": "unicode", "expression": "[\u200B-\u200F]", "flags": "", "severity": "high", "why": "Zero-width spaces and LTR/RTL marks hide text a human reviewer cannot see." },
+    { "id": "unicode-bidi-embedding", "type": "unicode", "expression": "[\u202A-\u202E]", "flags": "", "severity": "high", "why": "Bidi embedding and override characters reorder what is displayed (Trojan Source)." },
+    { "id": "unicode-bidi-isolate", "type": "unicode", "expression": "[\u2066-\u2069]", "flags": "", "severity": "high", "why": "Bidi isolates, the other half of the Trojan Source trick." },
+    { "id": "unicode-bom-midtext", "type": "unicode", "expression": "[\uFEFF]", "flags": "", "severity": "medium", "why": "A byte order mark in the middle of text is invisible and has no honest use there." },
+    { "id": "unicode-soft-hyphens", "type": "unicode", "expression": "[\u00AD]{3,}", "flags": "", "severity": "low", "why": "Runs of soft hyphens split words so keyword filters miss them." },
+    { "id": "unicode-invisible-operators", "type": "unicode", "expression": "[\u2060-\u2064]", "flags": "", "severity": "medium", "why": "Word joiner and invisible operators carry no visible glyph." },
+    { "id": "unicode-tag-characters", "type": "unicode", "expression": "[\uDB40\uDC00-\uDB40\uDC7F]", "flags": "u", "severity": "high", "why": "Unicode tag characters (U+E0000 to U+E007F) can encode a whole hidden instruction." },
+    { "id": "comment-block-c", "type": "comment_block", "expression": "/\\*[\\s\\S]{0,20000}?\\*/", "flags": "", "severity": "low", "why": "An oversized C-style comment can hide a payload addressed to the model." },
+    { "id": "comment-block-html", "type": "comment_block", "expression": "<!--[\\s\\S]{0,20000}?-->", "flags": "", "severity": "low", "why": "An oversized HTML comment is invisible when rendered but read by the model." },
+    { "id": "comment-block-docstring-double", "type": "comment_block", "expression": "\"\"\"\\s*[\\s\\S]{0,20000}?\\s*\"\"\"", "flags": "", "severity": "low", "why": "An oversized Python docstring can carry instructions as prose." },
+    { "id": "comment-block-docstring-single", "type": "comment_block", "expression": "'''\\s*[\\s\\S]{0,20000}?\\s*'''", "flags": "", "severity": "low", "why": "Same as the double-quoted docstring, with single quotes." },
+    { "id": "comment-block-ruby", "type": "comment_block", "expression": "=begin[\\s\\S]{0,20000}?=end", "flags": "", "severity": "low", "why": "An oversized Ruby block comment, the same hiding place." }
+  ]
+}

package/src/utils/model-selector.js

@@ -1,8 +1,19 @@
+// KJC-TSK-0699: the ONE table of default models per provider and level (the HU
+// router reads it too). Ids verified 2026-10-16: claude takes its CLI aliases,
+// which follow the current version; codex takes the models its CLI lists
+// (models_cache.json: luna fast, terra balanced, sol the most capable). null
+// leaves the CLI's own default where no id could be verified: aider and
+// opencode run on each user's providers, gemini and qwen no longer serve
+// individuals, copilot publishes no list.
+const NO_MODEL = { trivial: null, simple: null, medium: null, complex: null };
 const DEFAULT_MODEL_TIERS = {
   claude: { trivial: "haiku", simple: "haiku", medium: "sonnet", complex: "opus" },
-  codex: { trivial: "o4-mini", simple: "o4-mini", medium: "o4-mini", complex: "o3" },
-  gemini: { trivial: "gemini-2.0-flash", simple: "gemini-2.0-flash", medium: "gemini-2.5-pro", complex: "gemini-2.5-pro" },
-  aider: { trivial: null, simple: null, medium: null, complex: null }
+  codex: { trivial: "gpt-5.6-luna", simple: "gpt-5.6-luna", medium: "gpt-5.6-terra", complex: "gpt-5.6-sol" },
+  gemini: NO_MODEL,
+  qwen: NO_MODEL,
+  copilot: NO_MODEL,
+  opencode: NO_MODEL,
+  aider: NO_MODEL
 };
 
 const DEFAULT_ROLE_OVERRIDES = {
@@ -12,6 +23,39 @@ const DEFAULT_ROLE_OVERRIDES = {
 
 const VALID_LEVELS = new Set(["trivial", "simple", "medium", "complex"]);
 
+/**
+ * KJC-TSK-0699 (MR-B): named profiles over the levels, so the user talks of
+ * profiles, not model ids. Resolution: flag > roles.<role>.model > profile >
+ * the CLI's own default. The reviewer keeps its floor (never below medium).
+ */
+export const MODEL_PROFILES = { frugal: "trivial", standard: "medium", deep: "complex" };
+const CODER_PROVIDER_ROLES = new Set(["planner", "refactorer", "solomon", "researcher", "tester", "security", "impeccable", "triage", "discover", "architect", "audit"]);
+
+/** Fills the model of every role that has none yet; returns what it set. */
+export function applyModelProfile(config, profile) {
+  const level = MODEL_PROFILES[profile];
+  if (!level) throw new Error(`model profile "${profile}" does not exist: use one of ${Object.keys(MODEL_PROFILES).join(", ")}`);
+  const coderProvider = config.roles?.coder?.provider || config.coder || null;
+  const set = {};
+  for (const [role, entry] of Object.entries(config.roles ?? {})) {
+    if (entry?.model) continue;
+    const provider = entry?.provider || (role === "reviewer" ? config.reviewer : null) || (CODER_PROVIDER_ROLES.has(role) || role === "coder" ? coderProvider : null);
+    const model = resolveModelForRole({ role, provider, level });
+    // A new object: the entry may be shared with the shipped defaults.
+    if (!model) continue;
+    set[role] = model;
+    config.roles[role] = { ...entry, model };
+  }
+  return set;
+}
+
+/** The line kj config prints about the effective profile. */
+export function formatModelProfile(config) {
+  const profile = config?.model_profile;
+  if (!profile) return "Model profile: none (each CLI uses its own default model)";
+  return `Model profile: ${profile} (${MODEL_PROFILES[profile]} models; reviewer never below standard)`;
+}
+
 export function getDefaultModelTiers() {
   return structuredClone(DEFAULT_MODEL_TIERS);
 }