karajan-code 4.54.0 → 4.56.0

package/src/review/pr-sonar.js

@@ -0,0 +1,22 @@
+/**
+ * KJC-TSK-1078: Sonar on a third-party PR, when SonarQube is reachable. The
+ * own-work pre-gate scans the PR's files and only issues on the lines the PR
+ * adds can fail the check; without Sonar the check says "not available" and
+ * passes (decision of the user: Sonar if available, never demanded).
+ */
+import { addedLinesByFile, issueFile, runSonarPregate } from "./sonar-pregate.js";
+
+export async function sonarCheck({ diff, config, projectDir = process.cwd(), pregate = runSonarPregate }) {
+  const touchedLines = addedLinesByFile(diff);
+  let res;
+  try {
+    res = await pregate({ config, stagedFiles: [...touchedLines.keys()], touchedLines, projectDir });
+  } catch (err) {
+    res = { available: false, reason: err.message };
+  }
+  if (!res.available) return { id: "sonar", ok: true, detail: `not available: ${res.reason}` };
+  const blocking = res.blocking ?? [];
+  return blocking.length
+    ? { id: "sonar", ok: false, detail: blocking.map((i) => `${issueFile(i)}:${i.line} ${i.rule} ${i.severity}`).join("; ") }
+    : { id: "sonar", ok: true, detail: `no blocking Sonar issue on the added lines (${(res.advisory ?? []).length} advisory)` };
+}

package/src/review/sonar-pregate.js

@@ -14,6 +14,8 @@ import { dirname, join } from "node:path";
 import { indexedFilesFrom, runSonarScan } from "../sonar/scanner.js";
 import { getOpenIssues } from "../sonar/api.js";
 import { acquireToolLock } from "../utils/tool-governor.js";
+
+const DEFAULT_SCAN_SLOTS = 2;
 import { sourceFilesOf } from "./tests-with-code.js";
 
 const BLOCKING_SEVERITIES = new Set(["BLOCKER", "CRITICAL"]);
@@ -80,14 +82,22 @@ export function groupByScanRoot(files, { root = process.cwd(), exists = existsSy
   return groups;
 }
 
-export async function runSonarPregate({ config, stagedFiles = [], touchedLines = null, logger = null, exists = existsSync }) {
+// KJC-TSK-1078: projectDir is where the files live (a third-party PR's clone may not be the cwd).
+export async function runSonarPregate({ config, stagedFiles = [], touchedLines = null, logger = null, exists = existsSync, projectDir = process.cwd() }) {
   if (config?.review_gate?.sonar === false) {
     return { available: false, reason: "disabled in config (review_gate.sonar: false)" };
   }
+  // KJC-BUG-0368 (#2216): concurrent reviews on one machine share the scanner slots.
+  const slots = config?.sonarqube?.max_parallel_scans ?? DEFAULT_SCAN_SLOTS;
+  if (!Number.isInteger(slots) || slots < 1) {
+    return { available: false, reason: `sonarqube.max_parallel_scans must be a positive integer (got ${JSON.stringify(slots)})` };
+  }
   let lock = null;
   try {
-    lock = await acquireToolLock("sonar-scanner", { timeoutMs: 300_000 });
-    const groups = groupByScanRoot(stagedFiles, { exists });
+    lock = await acquireToolLock("sonar-scanner", { timeoutMs: 300_000, slots });
+    const groups = groupByScanRoot(stagedFiles, { root: projectDir, exists });
+    // The root keeps the scanner's own default (cwd) unless the project lives elsewhere.
+    const rootCwd = projectDir === process.cwd() ? null : projectDir;
     if (groups.size === 0) groups.set("", []);
     const indexed = new Set();
     const issues = [];
@@ -96,7 +106,8 @@ export async function runSonarPregate({ config, stagedFiles = [], touchedLines =
     for (const dir of groups.keys()) {
       const prefix = dir ? `${dir}/` : "";
       // KJC-TSK-0838: verbose, so the scanner names every file it indexed.
-      const scan = await runSonarScan(config, null, { verbose: true, ...(dir ? { cwd: join(process.cwd(), dir) } : {}) });
+      const scanCwd = dir ? join(projectDir, dir) : rootCwd;
+      const scan = await runSonarScan(config, null, { verbose: true, ...(scanCwd ? { cwd: scanCwd } : {}) });
       if (scan.note) logger?.warn?.(scan.note); // KJC-BUG-0156: precedence is said, never silent
       if (!scan.ok) {
         return { available: false, reason: (scan.stderr || scan.stdout || "sonar scan failed").trim() };

package/src/review/third-party-review.js

@@ -0,0 +1,67 @@
+/**
+ * KJC-TSK-1075 (#2227): review someone else's PR. kj's reviewer, the target
+ * repo's rules (.karajan) and the provider the agent picks run over
+ * base...head; no own-work gate applies (card, tests, policy, session RAG) and
+ * no verdict is stored, so this mode never unlocks a commit (ADR 0015). The
+ * own-work gate, reviewGateCommand, stays untouched.
+ */
+import { runCommand } from "../utils/process.js";
+import { resolveRole } from "../config/role-resolver.js";
+import { runOneShotReview } from "./one-shot-review.js";
+import { prRequirementChecks } from "./pr-requirements.js";
+import { prSecurityChecks } from "./pr-security.js";
+import { sonarCheck } from "./pr-sonar.js";
+
+const gitDiffOf = async (projectDir, range) => {
+  const res = await runCommand("git", ["diff", range], { cwd: projectDir });
+  if (res.exitCode !== 0) throw new Error(`git diff ${range} failed: ${(res.stderr || "").trim()}`);
+  return res.stdout;
+};
+
+const finding = (i) => ({
+  file: i.file ?? null, line: i.line ?? null, severity: i.severity ?? null,
+  description: i.description ?? "", suggested_fix: i.suggested_fix ?? null,
+});
+
+/** The review as data: verdict, findings, suggestions and the PR-requirement checks. */
+export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck }) {
+  const diff = await gitDiff(projectDir, range);
+  // KJC-TSK-1076/1077: the PR's requirements and its security, with no tokens; they never stop the review.
+  const checks = [...await requirements({ range, projectDir, config }), ...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
+  const record = await run({
+    diff, task, config, logger, projectDir,
+    reviewerOverride: resolveRole(config, "reviewer").provider || null,
+    persist: false,
+  });
+  return {
+    mode: "third-party",
+    range,
+    reviewer: record.reviewer,
+    verdict: { approved: record.verdict === "approved", summary: record.summary ?? "" },
+    findings: (record.issues ?? []).map(finding),
+    suggestions: record.suggestions ?? [],
+    checks,
+  };
+}
+
+/**
+ * The CLI side: stdout carries exactly one JSON document, logs go to stderr.
+ * Exit 0 whatever the PR's verdict (the agent decides what to post); non-zero
+ * only when kj itself fails.
+ */
+export async function thirdPartyReviewCommand({ flags, config, out = process.stdout, err = process.stderr, review = thirdPartyReview }) {
+  const print = (doc) => out.write(`${JSON.stringify(doc)}\n`);
+  if (!flags.range) {
+    print({ error: "--third-party reviews a range: pass --range <base>...<head>" });
+    return 1;
+  }
+  const log = (msg) => err.write(`${msg}\n`);
+  const logger = { info: log, warn: log, error: log, debug: () => {} };
+  try {
+    print(await review({ range: flags.range, config, projectDir: config.projectDir || process.cwd(), logger, task: flags.task ?? null }));
+    return 0;
+  } catch (e) {
+    print({ error: e.message });
+    return 1;
+  }
+}

package/src/roles/agent-role.js

@@ -121,7 +121,7 @@ export class AgentRole extends BaseRole {
   async execute(input) {
     const extracted = this.extractInput(input);
     const provider = this.resolveProvider();
-    const agent = this.createAgentInstance(provider);
+    const agent = this.createAgentInstance(provider, extracted);
 
     const promptResult = await this.buildPrompt(extracted);
     const { prompt, onOutput, stablePrompt, volatilePrompt } = typeof promptResult === "string"

package/src/roles/coder-role.js

@@ -16,7 +16,11 @@ export class CoderRole extends AgentRole {
     return this.config?.roles?.coder?.provider || this.config?.coder || "claude";
   }
 
-  createAgentInstance(provider) {
+  createAgentInstance(provider, input = {}) {
+    // KJC-TSK-1070 (MR-D2): the HU's route rides on this call only; the shared
+    // role keeps its own config (lanes run in parallel).
+    const route = input?.route;
+    const config = route ? { ...this.config, roles: { ...this.config?.roles, coder: { ...this.config?.roles?.coder, model: route.model, effort: route.effort } } } : this.config;
     // KJC-BUG-0129 (issues #1301/#1303): running INSIDE an agent does not
     // make it "the host executor" — delegating sent the full instruction
     // prompt through elicitInput as a hanging board "question". A CLI
@@ -29,7 +33,7 @@ export class CoderRole extends AgentRole {
       }
       this.logger.info(`Running inside ${provider} — spawning it as a subprocess anyway (set roles.coder.host_delegation: true to delegate to the host)`);
     }
-    return this._createAgent(provider, this.config, this.logger);
+    return this._createAgent(provider, config, this.logger);
   }
 
   extractInput(input) {
@@ -66,6 +70,8 @@ export class CoderRole extends AgentRole {
       projectDir: input?.projectDir || null,
       // PAR-H (KJC-TSK-0631): per-call subprocess env (lane slot vars).
       env: input?.env || null,
+      // KJC-TSK-1070: the model and effort this HU's coder runs on.
+      route: input?.route || null,
       onOutput: input?.onOutput || null
     };
   }

package/src/steward/gate.js

@@ -0,0 +1,31 @@
+/**
+ * KJC-TSK-1086: the Steward's block (STW-C, KJC-TSK-0791) at commit too. Only
+ * where the project adopted it (method_gates.steward: block), only the hard
+ * invariants (vulnerable dependencies, a persistently red main), and never on
+ * an invariant whose verdict is unknown. Having declared block, a missing or
+ * unreadable report blocks too: the sweep has to run.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const HARD = new Set(["vulnerable-deps", "main-ci"]);
+
+/** @returns {{ sweptAt: string, hard: object[], reason: string } | null} */
+export function stewardBlocking({ projectDir, config }) {
+  if (config?.method_gates?.steward !== "block") return null;
+  const file = join(projectDir, ".karajan", "steward", "report.json");
+  let rep;
+  try {
+    rep = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    // block was adopted explicitly: a missing or unreadable report is never a silent pass.
+    return { sweptAt: null, hard: [], reason: `steward cannot read ${file} (${err.message}) — rerun kj steward sweep; while it is unreadable the block stands` };
+  }
+  if (!Array.isArray(rep?.invariants)) {
+    return { sweptAt: rep?.sweptAt ?? null, hard: [], reason: `steward report ${file} has no invariants list — rerun kj steward sweep; while it is malformed the block stands` };
+  }
+  const hard = rep.invariants.filter((r) => r?.verdict === "broken" && HARD.has(r.id));
+  if (hard.length === 0) return null;
+  const lines = hard.map((r) => `${r.id}: ${r.evidence || ""} -> ${r.remedy || r.renew || "kj steward sweep"}`);
+  return { sweptAt: rep.sweptAt, hard, reason: `steward (sweep ${rep.sweptAt}) blocks: ${lines.join("; ")} — if the work goes on, your user sets method_gates.steward to inform` };
+}

package/src/utils/tool-governor.js

@@ -28,35 +28,50 @@ function isPidAlive(pid) {
   }
 }
 
-/** Machine-wide lock for `tool` → {release}; ELOCKTIMEOUT if the live holder outlasts `timeoutMs`. */
-export async function acquireToolLock(tool, { locksDir = DEFAULT_LOCKS_DIR, timeoutMs = 180_000, pollMs = 500 } = {}) {
-  fs.mkdirSync(locksDir, { recursive: true });
-  const lockPath = path.join(locksDir, `${tool}.lock`);
-  const deadline = Date.now() + timeoutMs;
+/** One slot: {release} when taken, else the live holder; a dead or unreadable holder is stolen. */
+function tryTakeSlot(lockPath) {
   for (;;) {
     try {
       // wx = atomic create-or-fail: the filesystem is the arbiter.
       const fd = fs.openSync(lockPath, "wx");
       fs.writeSync(fd, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
       fs.closeSync(fd);
-      return { release: () => fs.rmSync(lockPath, { force: true }) };
+      return { lock: { release: () => fs.rmSync(lockPath, { force: true }) } };
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       let holder = null;
       try {
         holder = JSON.parse(fs.readFileSync(lockPath, "utf8"));
       } catch { /* unreadable → stale */ }
-      if (!holder || !Number.isInteger(holder.pid) || !isPidAlive(holder.pid)) {
-        fs.rmSync(lockPath, { force: true });
-        continue;
-      }
-      if (Date.now() >= deadline) {
-        const e = new Error(`${tool} is already running (pid ${holder.pid}, since ${holder.startedAt}) — gave up waiting after ${timeoutMs}ms`);
-        e.code = "ELOCKTIMEOUT";
-        throw e;
-      }
-      await new Promise((r) => setTimeout(r, pollMs));
+      if (holder && Number.isInteger(holder.pid) && isPidAlive(holder.pid)) return { holder };
+      fs.rmSync(lockPath, { force: true });
+    }
+  }
+}
+
+/**
+ * Machine-wide lock for `tool` → {release}; ELOCKTIMEOUT if every live holder
+ * outlasts `timeoutMs`. KJC-BUG-0368 (#2216): `slots` lets that many run at
+ * once (slot 0 keeps the single-lock path `<tool>.lock`).
+ */
+export async function acquireToolLock(tool, { locksDir = DEFAULT_LOCKS_DIR, timeoutMs = 180_000, pollMs = 500, slots = 1 } = {}) {
+  fs.mkdirSync(locksDir, { recursive: true });
+  const paths = Array.from({ length: Math.max(1, slots) }, (_, n) => path.join(locksDir, n === 0 ? `${tool}.lock` : `${tool}.${n}.lock`));
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    let holder = null;
+    for (const lockPath of paths) {
+      const slot = tryTakeSlot(lockPath);
+      if (slot.lock) return slot.lock;
+      holder ??= slot.holder;
+    }
+    if (Date.now() >= deadline) {
+      const busy = paths.length > 1 ? `, all ${paths.length} slots busy` : "";
+      const e = new Error(`${tool} is already running (pid ${holder.pid}, since ${holder.startedAt}${busy}) — gave up waiting after ${timeoutMs}ms`);
+      e.code = "ELOCKTIMEOUT";
+      throw e;
     }
+    await new Promise((r) => setTimeout(r, pollMs));
   }
 }