karajan-code 4.55.0 → 4.57.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.55.0",
+  "version": "4.57.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/scripts/osv-gate.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * osv-gate (KJC-TSK-1097): CI fails on any advisory osv-scanner scores 9 or more
+ * (critical), naming the lockfile, package, version and advisory. Output it cannot
+ * read fails too: a scanner that broke is not a clean scan.
+ *
+ * Usage: osv-scanner --format=json -r . > osv.json; node scripts/osv-gate.mjs osv.json
+ */
+import { readFileSync } from "node:fs";
+import { relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseOsvOutput } from "../src/audit/osv-findings.js";
+
+const CRITICAL = 9;
+
+/** One line per critical package and advisory, paths relative to the repo root. */
+export function criticalAdvisories(raw, root) {
+  const lines = parseOsvOutput(raw).vulnerabilities
+    .filter((v) => v.score !== null && v.score >= CRITICAL)
+    .map((v) => `${relative(root, v.source)}: ${v.package}@${v.version} ${v.id} (${v.score})`);
+  return [...new Set(lines)];
+}
+
+/** The gate's verdict for the scanner's raw output. */
+export function gateReport(text, root) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    raw = null;
+  }
+  if (!Array.isArray(raw?.results)) return { ok: false, message: "osv-gate: could not read the osv-scanner output (no results list)" };
+  const found = criticalAdvisories(raw, root);
+  if (found.length === 0) return { ok: true, message: "osv-gate: no critical advisories" };
+  const details = found.map((line) => "- " + line).join("\n");
+  return { ok: false, message: `osv-gate: ${found.length} critical advisory(ies):\n${details}` };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const file = process.argv[2];
+  if (!file) throw new Error("osv-gate: pass the osv-scanner JSON file");
+  const { ok, message } = gateReport(readFileSync(file, "utf8"), process.cwd());
+  console.log(message);
+  process.exitCode = ok ? 0 : 1;
+}

package/src/audit/osv-findings.js

@@ -103,6 +103,7 @@ export function parseOsvOutput(raw) {
           id: vuln.id || vuln.aliases?.[0] || "UNKNOWN",
           aliases: vuln.aliases || [],
           severity: extractSeverity(vuln, groups),
+          score: groupScore(vuln, groups),
           summary: vuln.summary || vuln.details?.split("\n")[0] || "",
           publishedAt: vuln.published || null, // the ADVISORY's date — the Steward ages by it (KJC-TSK-0789 AC6)
           package: name,
@@ -141,6 +142,13 @@ function extractSeverity(vuln, groups) {
   return "UNKNOWN";
 }
 
+/** KJC-TSK-1097: the numeric CVSS score of the vuln's group (9 or more is critical), or null. */
+function groupScore(vuln, groups) {
+  const group = groups.find((g) => g.ids?.includes(vuln.id) && g.max_severity);
+  const score = group ? Number.parseFloat(group.max_severity) : Number.NaN;
+  return Number.isNaN(score) ? null : score;
+}
+
 function extractFixedVersion(vuln) {
   const ranges = vuln.affected?.[0]?.ranges || [];
   for (const range of ranges) {

package/src/checks/release-check.js

@@ -70,7 +70,13 @@ async function policyRangeCheck(projectDir) {
     const skipped = prScoped.size > 0 ? `; ${prScoped.size} diff-threshold invariant(s) skipped (PR-scoped)` : "";
     if (hard.length > 0) {
       const list = hard.map((v) => `[${v.rule_id}]${v.file ? ` ${v.file}` : ""}`).join(", ");
-      return { name: "policy", ok: false, detail: `${hard.length} deny violation(s) in ${scope} against the current policy: ${list}` };
+      // KJC-BUG-0374: supervisor files the seal does not back (an older kj's seal, or an
+      // unsealed edit) are fixed by regenerating and resealing, never by a tag or a grant.
+      const why = sup.note ? ` (${sup.note})` : "";
+      const reseal = hard.some((v) => v.rule_id === "defaults.supervisor.write")
+        ? ` — the supervisor seal does not back these files${why}: run kj harden, then ask your user for kj harden --commit`
+        : "";
+      return { name: "policy", ok: false, detail: `${hard.length} deny violation(s) in ${scope} against the current policy: ${list}${reseal}` };
     }
     return { name: "policy", ok: true, detail: `${scope} clean against the current policy (${violations.length} warning(s))${skipped}` };
   } catch (err) {

package/src/cli/register-meta.js

@@ -1048,6 +1048,7 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--no-config", "Skip lint/format/commit config files (hooks only)")
     .option("--no-ci", "Skip CI quality workflows")
     .option("--no-guidelines", "Skip AI-agent guideline files (AGENTS.md/CLAUDE.md)")
+    .option("--no-sandbox", "Leave the host Bash sandbox alone (by default it is turned on where it can start)")
     .option("--mutation", "Also seed an opt-in nightly/manual mutation CI job (never a PR gate)")
     .option("--only <dirs...>", "Harden only these language roots (e.g. frontend backend)")
     .option("--exclude <globs...>", "Skip language roots matching these globs (e.g. wrappers)")
@@ -1065,6 +1066,7 @@ export function registerMeta(program, { pkgVersion }) {
           config: flags.config !== false,
           ci: flags.ci !== false,
           guidelines: flags.guidelines !== false,
+          sandbox: flags.sandbox !== false,
           mutation: Boolean(flags.mutation),
           only: flags.only ?? [],
           exclude: flags.exclude ?? [],

package/src/cli/register-pipeline.js

@@ -15,6 +15,7 @@ import { statusCommand } from "../commands/status.js";
 import { loadPlan } from "../plan/plan-store.js";
 import { withConfig } from "./_shared.js";
 import { publishPrReview } from "../review/publish-pr.js";
+import { thirdPartyReviewCommand } from "../review/third-party-review.js";
 
 /**
  * Register the "core pipeline" commands: everything the user runs day-to-day
@@ -257,8 +258,15 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--walked <route>", "Recorrido comprobado como lo haría una persona (repetible) — queda en el veredicto", (v, prev) => [...(prev || []), v], [])
     .option("--walked-with <tool>", "Con qué se comprobó el recorrido (por ejemplo chrome-devtools)")
     .option("--publish-pr <n>", "Publish the cross-AI verdicts of a PR's commits on it as one GitHub review")
+    .option("--third-party", "Review someone else's PR (--range base...head): reviewer only, no own-work gates, no verdict stored")
+    .option("--json", "With --third-party: print the review as one JSON document on stdout")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "review", flags, async ({ config, logger }) => {
+        // KJC-TSK-1075 (#2227): a third-party PR, for reviewer agents; own work keeps every gate.
+        if (flags.thirdParty) {
+          process.exitCode = await thirdPartyReviewCommand({ flags: { ...flags, task: task ?? null }, config });
+          return;
+        }
         // KJC-TSK-0913: the verdicts kj already holds, published on the PR as one review.
         if (flags.publishPr) {
           const r = await publishPrReview({ projectDir: config.projectDir || process.cwd(), pr: flags.publishPr });

package/src/commands/harden.js

@@ -16,12 +16,14 @@ import { interactiveHarden } from "../harden/interactive.js";
 import { createWizard, isTTY } from "../utils/wizard.js";
 import { commitSupervisorRegeneration } from "../harden/supervisor-commit.js";
 import { installConfigsForRoots } from "../harden/config-engine.js";
+import { readHardenConfig } from "../harden/harden-scope.js";
 import { installGuidelines } from "../harden/guidelines-engine.js";
 import { maybeRulesyncGenerate } from "../utils/rulesync.js";
 import { commandsForLanguage } from "../harden/hook-commands.js";
 import { installHooks } from "../harden/harden-engine.js";
 import { installHarnessHooks } from "../harden/harness-hooks.js";
 import { installSentinelHooks } from "../harden/sentinel-hooks.js";
+import { installSandbox } from "../harden/sandbox.js";
 import { detectStackRoots } from "../harden/stack-roots.js";
 import { installWorkflows } from "../harden/workflow-engine.js";
 import { adviseBranchProtection } from "../harden/branch-protection.js";
@@ -35,21 +37,6 @@ const JS_TEST_CMD = {
   mocha: "npx mocha",
 };
 
-/**
- * Per-repo harden scope, persisted in package.json `kj.harden` so a repo with
- * sub-tools (e.g. a python wrapper) excludes them once instead of on every
- * invocation (KJC-TSK-0564). CLI flags are merged on top.
- */
-function readHardenConfig(projectDir) {
-  const pkgPath = join(projectDir, "package.json");
-  if (!existsSync(pkgPath)) return {};
-  try {
-    return JSON.parse(readFileSync(pkgPath, "utf8")).kj?.harden ?? {};
-  } catch {
-    return {};
-  }
-}
-
 /**
  * Resolve the hook's lint/format/test commands for the primary language.
  * Non-JS stacks use their native toolchain (go/ruff/…); JS/TS is built from
@@ -105,6 +92,7 @@ export async function hardenCommand({
   only = [],
   exclude = [],
   commitSupervisor = false,
+  sandbox = true,
   kjVersion = null,
   // KJC-BUG-0289: the contract files already dirty before anything was generated
   // (kj init captures them before writing its own). What is dirty NOW is the person's.
@@ -174,6 +162,8 @@ export async function hardenCommand({
       // sin sello, que es como una sesión se dejaba sin herramientas.
       const sh = installSentinelHooks({ projectDir, logger, human: commitSupervisor });
       result.sentinelHooks = sh.wired ? "wired" : "script-only";
+      // KJC-TSK-1092: the host sandbox, on by default wherever it can start here.
+      if (sandbox) result.sandbox = installSandbox({ projectDir, logger }).state;
     }
   } catch (err) {
     if (json) logger.info?.(JSON.stringify({ ok: false, error: err.message }));

package/src/commands/rag.js

@@ -38,7 +38,7 @@ async function indexFiles({ files, projectDir, db, embedder, slug, logger, json,
       logger.warn?.(`[rag] ${out}: not indexed`);
       continue;
     }
-    const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind(abs) });
+    const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind() });
     totals.indexed += r.indexed; totals.failed += r.failed; totals.files += 1;
   }
   const deleted = totals.deleted ? `, ${totals.deleted} chunks deleted` : "";

package/src/commands/review-gate.js

@@ -26,6 +26,8 @@ import { loadPrivacyList, scanText } from "../privacy/scan.js";
 import { isGeneratedPath, splitAddedByFile } from "../privacy/diff-scope.js";
 import { budgetedAdded, budgetedNet } from "../review/loc-budget.js";
 import { checkStagedDiff, loadPolicy } from "../policy/engine.js";
+import { prSizeLimit } from "../review/pr-requirements.js";
+import { stewardBlocking } from "../steward/gate.js";
 import { loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
 import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
 import { evaluatePolicyGate } from "../review/policy-gate.js";
@@ -227,6 +229,14 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   const card = await enforceCardFirst({ config, projectDir });
   if (!card.ok) return { verdict: "rejected", reviewer: "card-first", issues: [{ severity: "high", description: card.reason }] };
 
+  // KJC-TSK-1086: the Steward's block at commit too, not only where Edit starts work.
+  const steward = stewardBlocking({ projectDir, config });
+  if (steward) {
+    console.log(`✗ ${steward.reason}`);
+    process.exitCode = 1;
+    return { verdict: "rejected", reviewer: "steward", issues: [{ severity: "high", description: steward.reason }] };
+  }
+
   // KJC-TSK-0687 (MG-B): the verifiable half of TDD — sources without a
   // single test change warn (block via method_gates.tests_with_code).
   const changedFiles = (await rawDiff(flags.range, ["--name-only"])).split("\n").map((f) => f.trim()).filter(Boolean);
@@ -246,16 +256,12 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   // PL-C (KJC-TSK-0735), fuente única de umbrales: si la policy declara el
   // invariante net_lines_added, SU max es el umbral — el mismo número que
   // aplican kj policy check y el tier C de CI; method_gates queda de fallback.
-  const pol = loadPolicy({ projectDir });
-  const locInv = pol.errors.length === 0
-    ? (pol.policy.invariants || []).find((i) => i.kind === "diff-threshold" && i.metric === "net_lines_added")
-    : null;
   // KJC-BUG-0326 (#2085): two tiers. ~150 is the ideal (method_gates.pr_size_warn);
   // up to the limit (the policy's net_lines_added max, else method_gates.pr_size_max,
-  // 200) is allowed without asking; above the limit, partition.
-  const sizeIdeal = config?.method_gates?.pr_size_warn ?? 150;
-  const sizeWarn = locInv?.max ?? config?.method_gates?.pr_size_max ?? 200;
-  const sizeSource = locInv ? `policy [${locInv.id}]` : "method_gates";
+  // 200) is allowed without asking; above the limit, partition. KJC-TSK-1076: one
+  // source, shared with the third-party PR checks.
+  const pol = loadPolicy({ projectDir });
+  const { ideal: sizeIdeal, limit: sizeWarn, source: sizeSource } = prSizeLimit({ projectDir, config });
   if (sizeWarn > 0) {
     const numstat = await rawDiff(flags.range, ["--numstat"]);
     // KJC-BUG-0205: the budget caps CODE growth, so generated output and human

package/src/commands/worktree.js

@@ -34,7 +34,8 @@ export async function worktreeCommand({ config = null, action, args = [], flags
       throw new Error(`lane "${slug}" already exists — cd ${wtPath}, or finish it with: kj worktree done ${slug}`);
     }
     const branch = `feat/${slug}`;
-    await git(["worktree", "add", "-b", branch, wtPath]);
+    // KJC-TSK-1093: --no-track, so no upstream lands in .git/config (read-only in the host sandbox).
+    await git(["worktree", "add", "--no-track", "-b", branch, wtPath]);
     const boot = await bootstrapWorktree({ worktreePath: wtPath, setupCommand: config?.session?.worktree_setup || null });
     console.log(`✓ lane ready: ${branch}`);
     console.log(`  cd ${wtPath}`);

package/src/git/hu-automation.js

@@ -150,9 +150,9 @@ export async function prepareHuBranch({ story, huBranches, config, logger, cardI
  */
 export function pushRemedy(message, branch) {
   if (/workflow/i.test(message) && /scope/i.test(message)) {
-    return `the token lacks the workflow scope: run gh auth refresh -h github.com -s workflow, then git push -u origin ${branch}`;
+    return `the token lacks the workflow scope: run gh auth refresh -h github.com -s workflow, then git push origin ${branch}`;
   }
-  return `push the branch yourself: git push -u origin ${branch}`;
+  return `push the branch yourself: git push origin ${branch}`;
 }
 
 /** The warnings a run reports when the push or the PR of any HU failed. */

package/src/harden/check.js

@@ -11,8 +11,9 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import { runCommand } from "../utils/process.js";
-import { artifactIdForConfig, findAlternative } from "./alternatives.js";
+import { configLeftAlone } from "./config-engine.js";
 import { CONFIGS_BY_LANGUAGE, UNIVERSAL_CONFIGS } from "./config-templates.js";
+import { readHardenConfig } from "./harden-scope.js";
 import { PROFILE_HOOKS } from "./hook-templates.js";
 import { detectStackRoots } from "./stack-roots.js";
 import { qualityWorkflowFor, WORKFLOWS } from "./workflow-templates.js";
@@ -49,24 +50,24 @@ export async function checkHarden({ projectDir = process.cwd(), profile = "stand
   // Config + workflows ship with standard+ — and surface the greenfield gap:
   // a language now present but never hardened ⇒ its config shows as missing.
   if (profile !== "minimal") {
-    const roots = detectStackRoots(projectDir);
+    // KJC-BUG-0370: the same scope (package.json kj.harden) and the same verdict on a
+    // missing config as kj harden, so check never calls drift what harden leaves alone.
+    const { only = [], exclude = [] } = readHardenConfig(projectDir);
+    const roots = detectStackRoots(projectDir, { only, exclude });
+    const configCheck = (cfg, rel, altDirs, missing) => {
+      const leftAlone = existsSync(join(projectDir, rel)) ? null : configLeftAlone(cfg, altDirs);
+      if (!leftAlone) return presence(projectDir, rel, `config:${rel}`, missing);
+      const detail = leftAlone.action === "covered" ? `covered by ${leftAlone.by}` : `omitted: ${leftAlone.note}`;
+      return { id: `config:${rel}`, ok: true, detail };
+    };
     for (const cfg of UNIVERSAL_CONFIGS) {
-      checks.push(presence(projectDir, cfg.file, `config:${cfg.file}`, "missing — run kj harden"));
+      checks.push(configCheck(cfg, cfg.file, [projectDir], "missing — run kj harden"));
     }
     for (const { dir, language } of roots) {
       const rootDir = dir === "." ? projectDir : join(projectDir, dir);
       for (const cfg of CONFIGS_BY_LANGUAGE[language] ?? []) {
         const rel = dir === "." ? cfg.file : join(dir, cfg.file);
-        // A config covered by the user's own tool (biome.json ⇒ eslint+prettier)
-        // is not drift — kj must not demand a second linter/formatter (KJC-TSK-0614).
-        if (!existsSync(join(projectDir, rel))) {
-          const alt = findAlternative([rootDir, projectDir], artifactIdForConfig(cfg));
-          if (alt) {
-            checks.push({ id: `config:${rel}`, ok: true, detail: `covered by ${alt.foundAt} (${alt.tool})` });
-            continue;
-          }
-        }
-        checks.push(presence(projectDir, rel, `config:${rel}`, `missing for ${language} — run kj harden`));
+        checks.push(configCheck(cfg, rel, [rootDir, projectDir], `missing for ${language} — run kj harden`));
       }
     }
     const expectedWf = [...WORKFLOWS];

package/src/harden/config-engine.js

@@ -33,6 +33,30 @@ function hasTool(dirs, tool) {
   return false;
 }
 
+/**
+ * Why kj leaves a missing config alone, or null when it seeds it. KJC-BUG-0370:
+ * kj check reads the same answer, so it never calls drift what harden skips.
+ */
+export function configLeftAlone(cfg, altDirs) {
+  const id = artifactIdForConfig(cfg);
+  const alt = findAlternative(altDirs, id);
+  if (alt) return { action: "covered", by: alt.foundAt };
+  // KJC-BUG-0119: a same-tool variant (eslint.config.mjs, .eslintrc.json,
+  // package.json#eslintConfig…) means the config already EXISTS — seeding
+  // kj's default filename next to it would silently ECLIPSE the user's
+  // real config (eslint resolves eslint.config.js before .mjs).
+  const variant = findEquivalentIn(altDirs, id);
+  if (variant) return { action: "covered", by: variant };
+  // KJC-BUG-0137: no tool ⇒ no config — report the actionable gap instead.
+  return missingToolGap(cfg, altDirs);
+}
+
+/** KJC-BUG-0376: the first tool the config needs and the project lacks, as a report entry. */
+function missingToolGap(cfg, dirs) {
+  const missing = [cfg.requires ?? []].flat().find((tool) => !hasTool(dirs, tool));
+  return missing ? { action: "omitted", note: `${missing} is not installed — npm i -D ${missing}, then re-run kj harden` } : null;
+}
+
 function writeFile(target, content) {
   mkdirSync(dirname(target), { recursive: true });
   writeFileSync(target, content);
@@ -50,30 +74,10 @@ function seedInto(targetDir, configs, dryRun, prefix, results, altDirs = [target
     const exists = existsSync(target);
     const file = prefix === "." ? cfg.file : join(prefix, cfg.file);
 
-    if (!exists) {
-      const alt = findAlternative(altDirs, artifactIdForConfig(cfg));
-      if (alt) {
-        results.push({ file, action: "covered", by: alt.foundAt });
-        continue;
-      }
-      // KJC-BUG-0119: a same-tool variant (eslint.config.mjs, .eslintrc.json,
-      // package.json#eslintConfig…) means the config already EXISTS — seeding
-      // kj's default filename next to it would silently ECLIPSE the user's
-      // real config (eslint resolves eslint.config.js before .mjs).
-      const variant = findEquivalentIn(altDirs, artifactIdForConfig(cfg));
-      if (variant) {
-        results.push({ file, action: "covered", by: variant });
-        continue;
-      }
-      // KJC-BUG-0137: no tool ⇒ no config — report the actionable gap instead.
-      if (cfg.requires && !hasTool(altDirs, cfg.requires)) {
-        results.push({
-          file,
-          action: "omitted",
-          note: `${cfg.requires} is not installed — npm i -D ${cfg.requires}, then re-run kj harden`,
-        });
-        continue;
-      }
+    const leftAlone = exists ? null : configLeftAlone(cfg, altDirs);
+    if (leftAlone) {
+      results.push({ file, ...leftAlone });
+      continue;
     }
 
     if (cfg.json) {
@@ -88,6 +92,12 @@ function seedInto(targetDir, configs, dryRun, prefix, results, altDirs = [target
       results.push({ file, action: "skipped" });
       continue;
     }
+    // KJC-BUG-0376: never rewrite a managed block into one the project cannot load.
+    const gap = exists ? missingToolGap(cfg, altDirs) : null;
+    if (gap) {
+      results.push({ file, ...gap });
+      continue;
+    }
     const { content, action } = upsertManagedBlock({
       source,
       blockId: cfg.blockId,

package/src/harden/config-templates.js

@@ -72,6 +72,19 @@ export const ESLINT_BODY = [
   "];",
 ].join("\n");
 
+// KJC-BUG-0376: a TypeScript root gets the same rules with the TypeScript parser;
+// without it ESLint 9 fails every .ts/.tsx file with "Parsing error".
+const JS_LANGUAGE_OPTIONS = 'languageOptions: { ecmaVersion: 2025, sourceType: "module" }';
+if (!ESLINT_BODY.includes(JS_LANGUAGE_OPTIONS)) throw new Error("config-templates: ESLINT_BODY lost its languageOptions line");
+export const ESLINT_TS_BODY = [
+  'import tsParser from "@typescript-eslint/parser";',
+  "",
+  ESLINT_BODY.replace(
+    JS_LANGUAGE_OPTIONS,
+    'languageOptions: { parser: tsParser, ecmaVersion: 2025, sourceType: "module", parserOptions: { ecmaFeatures: { jsx: true } } }',
+  ),
+].join("\n");
+
 // Ruff covers lint + format for Python; `UP` (pyupgrade) is the analogue of
 // the ES2025 deprecated-API ban — it rewrites legacy idioms to modern Python.
 export const RUFF_BODY = [
@@ -114,6 +127,9 @@ export const JS_CONFIGS = [
   { file: "eslint.config.js", blockId: "eslint", style: "slash", body: ESLINT_BODY, requires: "eslint" },
   { file: ".prettierrc.json", json: true, body: PRETTIER_BODY, requires: "prettier" },
 ];
+export const TS_CONFIGS = JS_CONFIGS.map((cfg) => (cfg.file === "eslint.config.js"
+  ? { ...cfg, body: ESLINT_TS_BODY, requires: ["eslint", "@typescript-eslint/parser"] }
+  : cfg));
 export const PY_CONFIGS = [{ file: "ruff.toml", blockId: "ruff", style: "hash", body: RUFF_BODY }];
 export const GO_CONFIGS = [{ file: ".golangci.yml", blockId: "golangci", style: "hash", body: GOLANGCI_BODY }];
 
@@ -135,7 +151,7 @@ export const GENERATED_CONFIG_FILES = new Set(
 /** Lint/format configs by detected language. Unknown ⇒ universal only. */
 export const CONFIGS_BY_LANGUAGE = {
   javascript: JS_CONFIGS,
-  typescript: JS_CONFIGS,
+  typescript: TS_CONFIGS,
   python: PY_CONFIGS,
   go: GO_CONFIGS,
   php: PHP_CONFIGS,

package/src/harden/harden-scope.js

@@ -0,0 +1,18 @@
+/**
+ * Per-repo harden scope, persisted in package.json `kj.harden` so a repo with
+ * sub-tools (e.g. a python wrapper) excludes them once instead of on every
+ * invocation (KJC-TSK-0564). KJC-BUG-0370: kj harden and kj check read it from
+ * here, so check never asks for configs harden was told to leave out.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export function readHardenConfig(projectDir) {
+  const pkgPath = join(projectDir, "package.json");
+  if (!existsSync(pkgPath)) return {};
+  try {
+    return JSON.parse(readFileSync(pkgPath, "utf8")).kj?.harden ?? {};
+  } catch {
+    return {};
+  }
+}

package/src/harden/hook-templates.js

@@ -10,8 +10,9 @@
 
 import { homedir } from "node:os";
 
-const CONVENTIONAL_TYPES = "feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert";
-const AI_ATTRIBUTION = "co-authored-by:.*(claude|gpt|copilot|gemini)|(generated|written) (by|with) .*(claude|gpt|copilot)";
+// KJC-TSK-1076: exported so the third-party PR checks apply the same rules.
+export const CONVENTIONAL_TYPES = "feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert";
+export const AI_ATTRIBUTION = "co-authored-by:.*(claude|gpt|copilot|gemini)|(generated|written) (by|with) .*(claude|gpt|copilot)";
 
 export const SHEBANG = "#!/usr/bin/env sh";
 
@@ -45,10 +46,12 @@ export function toPortableHooksDir(dir, home = homedir()) {
 function chainToGlobal(hook, globalHooksDir) {
   if (!globalHooksDir) return [];
   const dir = toPortableHooksDir(globalHooksDir);
+  // KJC-TSK-1085: pre-push already read the refs from stdin; the chained hook gets them back.
+  const call = hook === "pre-push" ? `printf '%s\\n' "$kj_push_refs" | "${dir}/${hook}" "$@"; rc=$?` : `"${dir}/${hook}" "$@"; rc=$?`;
   return [
     "# Chain the machine's previous global hook (kj harden keeps it active).",
     `if [ -x "${dir}/${hook}" ]; then`,
-    `  "${dir}/${hook}" "$@"; rc=$?`,
+    `  ${call}`,
     '  [ "$rc" -eq 0 ] || exit "$rc"',
     "fi",
   ];
@@ -100,6 +103,22 @@ function identityGuard(hook) {
   }
   return [
     ...head,
+    // KJC-TSK-1085: every commit the push brings carries the declared identity
+    // (a rebase, cherry-pick, merge or tag never ran pre-commit).
+    "  kj_declared_email=$(sed -n 's/^git_email:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
+    '  if [ -n "$kj_declared_email" ]; then',
+    '    printf "%s\\n" "$kj_push_refs" | while read -r kj_lref kj_lsha kj_rref kj_rsha; do',
+    '      case "$kj_lsha" in *[!0]*) ;; *) continue ;; esac',
+    // A new ref: what the PUSH TARGET ($1, the remote git hands the hook) does not have yet.
+    '      case "$kj_rsha" in *[!0]*) kj_new=$(git rev-list "$kj_rsha..$kj_lsha") ;; *) kj_new=$(git rev-list "$kj_lsha" --not --remotes="${1:-origin}") ;; esac',
+    "      for kj_c in $kj_new; do",
+    '        kj_who=$(git log -1 --format="%ae %ce" "$kj_c")',
+    '        if [ "$kj_who" != "$kj_declared_email $kj_declared_email" ]; then',
+    '          echo "kj harden: identity lock — commit $(git log -1 --format=%h "$kj_c") is authored/committed as $kj_who but this clone is declared as $kj_declared_email"; exit 1',
+    "        fi",
+    "      done",
+    "    done || exit 1",
+    "  fi",
     "  kj_declared_gh=$(sed -n 's/^gh_user:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
     '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
     "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
@@ -178,6 +197,8 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
       ].join("\n");
     case "pre-push": {
       const lines = [
+        // KJC-TSK-1085: git hands the pushed refs on stdin; kept for the identity check and the chained hook.
+        "[ -t 0 ] || kj_push_refs=$(cat)",
         "# Identity guard — never push without a configured git identity.",
         'if [ -z "$(git config user.email)" ] || [ -z "$(git config user.name)" ]; then',
         "  echo 'kj harden: git user.name/user.email not set — refusing to push'; exit 1",

package/src/harden/human-act.js

@@ -8,18 +8,36 @@
  *  4.   a random nonce typed back, read from the real controlling terminal.
  */
 import { randomBytes } from "node:crypto";
-import { closeSync, openSync, readFileSync, readSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { closeSync, existsSync, openSync, readFileSync, readSync } from "node:fs";
 
 const AGENT_PROC = /claude|codex|copilot|gemini|opencode|\bagy\b/i;
 
-export function agentAncestry({ pid = process.pid, readProc = null, maxDepth = 40 } = {}) {
-  const read = readProc || ((p) => {
-    const stat = readFileSync(`/proc/${p}/stat`, "utf8");
-    const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-    let cmd = "";
-    try { cmd = readFileSync(`/proc/${p}/cmdline`).toString("utf8").replaceAll("\0", " "); } catch { /* gone */ }
-    return { ppid, cmd };
-  });
+const procRead = (p) => {
+  const stat = readFileSync(`/proc/${p}/stat`, "utf8");
+  const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+  let cmd = "";
+  try { cmd = readFileSync(`/proc/${p}/cmdline`).toString("utf8").replaceAll("\0", " "); } catch { /* gone */ }
+  return { ppid, cmd };
+};
+
+// KJC-TSK-1084: without /proc (macOS) the chain comes from ps, so a human
+// there is not refused for an ancestry nobody could read.
+// The system binary by absolute path: a ps resolved through PATH could be the
+// agent's own forgery prepended to it.
+const PS_BIN = ["/bin/ps", "/usr/bin/ps"].find((p) => existsSync(p)) ?? null;
+const psOutput = (p) => {
+  if (!PS_BIN) throw new Error("no system ps (/bin/ps, /usr/bin/ps)");
+  return execFileSync(PS_BIN, ["-o", "ppid=", "-o", "command=", "-p", String(p)], { encoding: "utf8", env: {} });
+};
+const psRead = (ps) => (p) => {
+  const m = /^\s*(\d+)\s+(.*)$/s.exec(String(ps(p) ?? ""));
+  if (!m) throw new Error(`ps gave nothing for pid ${p}`);
+  return { ppid: Number(m[1]), cmd: m[2].trim() };
+};
+
+export function agentAncestry({ pid = process.pid, readProc = null, maxDepth = 40, hasProc = existsSync("/proc/self/stat"), ps = psOutput } = {}) {
+  const read = readProc || (hasProc ? procRead : psRead(ps));
   let cur = pid;
   for (let i = 0; i < maxDepth && cur > 1; i += 1) {
     let info;
@@ -37,6 +55,11 @@ export function refuseAgentSession(what, { env = process.env, tty = process.stdo
     throw new Error(`${what} es un acto humano: córrelo desde TU terminal, fuera de una sesión de agente (ADR 0009)`);
   }
   const anc = agentAncestry(ancestry);
+  // KJC-TSK-1084: fail closed. Nothing else stops a human act any more (the
+  // Sentinel does not read its text), so an ancestry that cannot be read is no pass.
+  if (anc.unknown) {
+    throw new Error(`${what} es un acto humano y no se pudo comprobar la ascendencia de procesos — córrelo desde TU terminal (ADR 0009)`);
+  }
   if (anc.agent) {
     throw new Error(`${what} es un acto humano y este proceso desciende de un agente (${anc.match}) — ni con pty falso ni con el entorno limpio (ADR 0009)`);
   }