karajan-code 4.53.0 → 4.53.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.53.0",
+  "version": "4.53.1",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/harden/sentinel/sentinel-shell.mjs

@@ -155,6 +155,65 @@ export const stripTextOptionValues = (cmd) => cmd
   .replace(KJ_TITLE, (m, pre, head, val) => `${pre}${head}${val[0]}${val[0]}`)
   .replace(QUOTED_OPTION_VALUE, (m, pre, opt, sep, val) => (TEXT_OPTIONS.has(opt) ? `${pre}${opt}${sep}${val[0]}${val[0]}` : m));
 
+// KJC-BUG-0354: commands that only STORE their text: there, a quoted text value
+// is never run. Anywhere else it may be (flock --command '...'), so it stays.
+// git's global options that only pick where and how it runs may precede commit.
+const GIT_GLOBAL_WITH_VALUE = new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace"]);
+const GIT_GLOBAL_FLAG = /^(?:--no-pager|--(?:git-dir|work-tree|namespace)=\S+)$/;
+
+const isGitCommit = (words) => {
+  let i = 1;
+  while (i < words.length) {
+    if (GIT_GLOBAL_WITH_VALUE.has(words[i])) i += 2;
+    else if (GIT_GLOBAL_FLAG.test(words[i])) i += 1;
+    else break;
+  }
+  return words[0] === "git" && words[i] === "commit";
+};
+
+const isTextOnlyHead = (seg) => /^kj\s+(?:hu|adr)\s+add\b/.test(seg) || isGitCommit(seg.split(/\s+/));
+
+/**
+ * KJC-BUG-0354: blank the quoted text values (stripTextOptionValues) only when the
+ * whole input is a text-only command, so the human-act guards stop reading a
+ * title or a commit message that merely mentions a guarded command.
+ * @param {string} cmd
+ */
+export const stripTextOnlyCommandValues = (cmd) => {
+  // Only a whole input that is ONE simple text-storage command: a chained
+  // segment could follow a shell function that turns the stored text into code.
+  const bare = stripInertQuotes(cmd);
+  if (splitOutsideQuotes(cmd).length !== 1 || /[(){}<>`$\n]/.test(bare) || !isTextOnlyHead(cmd.trim())) return cmd;
+  return stripTextOptionValues(cmd);
+};
+
+/** Segments and the ; && || | between them, cut only outside quotes (the pieces join back to cmd). */
+function splitOutsideQuotes(cmd) {
+  const parts = [];
+  let start = 0;
+  let quote = null;
+  let i = 0;
+  while (i < cmd.length) {
+    const c = cmd[i];
+    const op = quote ? null : /^(?:&&|\|\||;|\|)/.exec(cmd.slice(i))?.[0];
+    if (quote) {
+      // inside double quotes a backslash escapes the next character
+      if (c === "\\" && quote === '"') i += 1;
+      else if (c === quote) quote = null;
+    } else if (c === "'" || c === '"') {
+      quote = c;
+    } else if (op) {
+      parts.push(cmd.slice(start, i), op);
+      start = i + op.length;
+      i = start;
+      continue;
+    }
+    i += 1;
+  }
+  parts.push(cmd.slice(start));
+  return parts;
+}
+
 /**
  * KJC-BUG-0245: the values of the named options, read by the shell reader, so a
  * `;`, `&&` or `|` right after a path ends the word instead of joining it.

package/src/harden/sentinel-hooks.js

@@ -88,7 +88,7 @@ export const boardGate = (sid, pend) => {
   if (!pend.length) return { blocking: [], carried: [] };
   const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
   if (!bg.error && (bg.status === 0 || bg.status === 2)) {
-    try { const d = JSON.parse(bg.stdout); return { blocking: d.blocking || [], carried: d.carried || [] }; } catch { /* unreadable: as always */ }
+    try { const d = JSON.parse(bg.stdout); return { blocking: d.blocking || [], carried: d.carried || [], reason: d.reason || "" }; } catch { /* unreadable: as always */ }
   }
   return { blocking: pend, carried: [] };
 };
@@ -473,7 +473,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
+import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
 import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
 import { shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
@@ -606,7 +606,8 @@ process.stdin.on("end", () => {
     // — si un agente pudiera enrolar una clave SUYA, contestaria la capa 5 el
     // solo. Ni el comando ni el fichero de enrolamiento desde la sesion.
     {
-      const enrollCmd = String(input.command || "");
+      // KJC-BUG-0354: un titulo o un mensaje de commit que solo lo MENCIONA no es enrolar.
+      const enrollCmd = stripTextOnlyCommandValues(String(input.command || ""));
       const namesEnroll = (enrollCmd.includes("identity") && enrollCmd.includes("enroll-phone")) || enrollCmd.includes("supervisor-phone.json");
       const writesEnroll = EDIT_TOOLS.includes(tool) && String(input.file_path || "").includes("supervisor-phone.json");
       if ((tool === "Bash" && namesEnroll) || writesEnroll) {
@@ -618,11 +619,13 @@ process.stdin.on("end", () => {
     // sesion ni lo intenta. Sin escape (superficie de supervisor). includes()
     // a proposito: cero ambiguedad de escapes en plantilla, y fail-closed
     // (mencionarlo en un argumento tambien bloquea: preferible a un hueco).
+    // KJC-BUG-0354: salvo en el texto entrecomillado de kj hu add, kj adr add y
+    // git commit, que solo guardan texto (decision del usuario, 16-oct).
     // ANTES de KJ_SENTINEL_OFF a proposito, como el guard PROTECTED de
     // arriba: un env var lo pone tambien un agente — el supervisor no se
     // apaga con interruptores al alcance del supervisado.
     {
-      const kjCmd = String(input.command || "");
+      const kjCmd = stripTextOnlyCommandValues(String(input.command || ""));
       if (tool === "Bash" && kjCmd.includes("harden") && kjCmd.includes("--commit")) {
         console.error("karajan sentinel: kj harden --commit es un acto humano (ADR 0009) — pideselo a tu usuario; ninguna sesion de agente lo ejecuta." + doc("supervisor"));
         process.exit(2);
@@ -1171,15 +1174,20 @@ process.stdin.on("end", () => {
       const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
       const mergeM = cmd.match(MERGE);
       const pend = pendingMoves(load().sessions?.[sid]);
+      // KJC-BUG-0364: one board-gate decision per command; the push gate below
+      // reuses it, so a second slow gh cannot contradict the first answer.
+      let boardDecision = null;
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
         // por su primera mitad (boardGate, en la lib).
-        const { blocking, carried } = boardGate(sid, pend);
+        boardDecision = boardGate(sid, pend);
+        const { blocking, carried, reason } = boardDecision;
         for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
         // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
         // are already decided above (KJC-BUG-0230, 0198).
+        // KJC-BUG-0363: when kj could not check, its reason travels with the block.
         if (blocking.length > 0) {
-          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + doc("board-sync"));
+          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + (reason ? "\\n(" + reason + ")" : "") + doc("board-sync"));
           process.exit(2);
         }
       }
@@ -1225,9 +1233,10 @@ process.stdin.on("end", () => {
         // ADR 0015 (KJC-TSK-0925): with no escape.
         // KJC-BUG-0262: a carried card does not block the push the commit let through.
         const sess = load().sessions?.[sid];
-        const v = violations(sess, branchOf(), boardGate(sid, pendingMoves(sess)).blocking);
+        const decision = boardDecision || boardGate(sid, pendingMoves(sess));
+        const v = violations(sess, branchOf(), decision.blocking);
         if (v.length) {
-          console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
+          console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + (decision.reason ? "\\n(" + decision.reason + ")" : "") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
           process.exit(2);
         }
       }

package/src/review/board-pending.js

@@ -11,7 +11,9 @@
  * One verifiable fact carries a pending, never a promise in prose: the same card
  * has another OPEN pull request. A branch named after the card is not enough,
  * because the merged branch carries that name too, so accepting it would forgive
- * every merge made from its own lane.
+ * every merge made from its own lane. KJC-BUG-0362 narrows that, never widens
+ * it: the current branch carries only with unmerged commits and when it is not
+ * the merged PR's head.
  */
 
 import { execFileSync } from "node:child_process";
@@ -31,9 +33,24 @@ const cardOf = (text) => {
  *
  * @returns {{blocking: Array<object>, carried: Array<{card: string, why: string}>, reason?: string}}
  */
-export function blockingMoves({ pendings = [], openPrHeads = null, openPrNumbers = [] }) {
+/**
+ * KJC-BUG-0362 (#2199): the next PR of a split card may not exist yet (committed,
+ * not pushed). The branch the session stands on carries the card when it names
+ * that card, holds commits the base does not have, and is NOT the merged PR's
+ * head: the merged lane stays unforgiven, as above.
+ */
+function carriedByLocalBranch(pending, card, localBranch, mergedHeads) {
+  if (!localBranch?.name || !(localBranch.unique > 0)) return null;
+  const mergedHead = mergedHeads[Number(pending.pr)];
+  if (!mergedHead || mergedHead === localBranch.name || cardOf(localBranch.name) !== card) return null;
+  return { card, why: `sigue entregándose en la rama ${localBranch.name}, con ${localBranch.unique} commit(s) sin mergear` };
+}
+
+export function blockingMoves({ pendings = [], openPrHeads = null, openPrNumbers = [], localBranch = null, mergedHeads = {} }) {
   if (pendings.length === 0) return { blocking: [], carried: [] };
-  if (openPrHeads === null) return { blocking: [...pendings], carried: [], reason: "no se pudo comprobar si la card sigue viva en otra PR abierta (gh no respondió) — se bloquea" };
+  // KJC-BUG-0363 (#2201): the guard runs BEFORE the command, so a gh auth switch
+  // inside it has not happened yet, and other sessions move the active account.
+  if (openPrHeads === null) return { blocking: [...pendings], carried: [], reason: "no se pudo comprobar si la card sigue viva en otra PR abierta: gh no pudo listar las PR con la cuenta activa. Si el repo es de otra cuenta, cambiala en un comando aparte (gh auth switch --user <cuenta>) y repite: el guard corre antes que el comando" };
   const openCards = new Set();
   for (const [i, head] of openPrHeads.entries()) {
     // A pending must never forgive itself: the PR it came from is merged, and if
@@ -46,7 +63,9 @@ export function blockingMoves({ pendings = [], openPrHeads = null, openPrNumbers
   for (const p of pendings) {
     const card = p.card ? String(p.card).toUpperCase() : null;
     if (!card) { blocking.push(p); continue; } // nothing to check against
-    if (openCards.has(card)) carried.push({ card, why: "sigue entregándose en una PR abierta" });
+    if (openCards.has(card)) { carried.push({ card, why: "sigue entregándose en una PR abierta" }); continue; }
+    const byBranch = carriedByLocalBranch(p, card, localBranch, mergedHeads);
+    if (byBranch) carried.push(byBranch);
     else blocking.push(p);
   }
   return { blocking, carried };
@@ -60,9 +79,26 @@ export function boardGate({ projectDir = process.cwd(), sessionId = "default", d
   const state = deps.readState?.() ?? readJson(join(projectDir, ".karajan", "harness", "sentinel-state.json"));
   const pendings = state?.sessions?.[sessionId]?.pending_moves;
   if (!Array.isArray(pendings) || pendings.length === 0) return { blocking: [], carried: [] };
-  const run = deps.run ?? ((cmd, args) => execFileSync(cmd, args, { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }));
+  // KJC-BUG-0364: gh can take several seconds; a timeout reads as "could not check" and blocks.
+  const run = deps.run ?? ((cmd, args) => execFileSync(cmd, args, { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15000 }));
   let open = null;
   try { open = JSON.parse(run("gh", ["pr", "list", "--state", "open", "--limit", "100", "--json", "number,headRefName"])); } catch { /* fail closed */ }
   const listed = Array.isArray(open) ? open : null;
-  return blockingMoves({ pendings, openPrHeads: listed?.map((p) => p.headRefName) ?? null, openPrNumbers: listed?.map((p) => Number(p.number)) ?? [] });
+  return blockingMoves({ pendings, openPrHeads: listed?.map((p) => p.headRefName) ?? null, openPrNumbers: listed?.map((p) => Number(p.number)) ?? [], ...localFacts(run, pendings) });
+}
+
+/** The current branch, its commits outside the base, and each merged PR's head; unreadable facts forgive nothing. */
+function localFacts(run, pendings) {
+  const facts = { localBranch: null, mergedHeads: {} };
+  try {
+    const name = run("git", ["rev-parse", "--abbrev-ref", "HEAD"]).trim();
+    let base = "origin/main"; // a clone without origin/HEAD measures against origin/main
+    try { base = run("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]).trim() || base; } catch { /* keep origin/main */ }
+    const unique = Number(run("git", ["rev-list", "--count", `${base}..HEAD`]).trim());
+    if (name && name !== "HEAD" && Number.isInteger(unique)) facts.localBranch = { name, unique };
+  } catch { return facts; }
+  for (const p of pendings) {
+    try { facts.mergedHeads[Number(p.pr)] = JSON.parse(run("gh", ["pr", "view", String(p.pr), "--json", "headRefName"])).headRefName; } catch { /* unknown head: not forgiven */ }
+  }
+  return facts;
 }