karajan-code 4.57.0 → 4.57.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.57.0",
+  "version": "4.57.1",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/privacy/scan.js

@@ -81,6 +81,11 @@ const SEMVER_OP = String.raw`(?:[\^~]|[<>]=?|=)`;
 const SEMVER_JOIN = String.raw`\s*(?:(?:\|\||-)\s*${SEMVER_OP}?|${SEMVER_OP})\s*`;
 const SEMVER_VALUE = new RegExp(String.raw`^\s*${SEMVER_OP}?\s*${SEMVER_TOKEN}(?:${SEMVER_JOIN}${SEMVER_TOKEN})*\s*$`);
 
+/** KJC-BUG-0380: a pair is discarded only when it is a real latitude, longitude. */
+function inGpsRange(_match, lat, lng) {
+  return Math.abs(Number(lat)) <= 90 && Math.abs(Number(lng)) <= 180;
+}
+
 const CONTEXT_DISCARDS = [
   { type: "git-sha", re: /\b(?:[0-9a-f]{64}|[0-9a-f]{40})\b/g },
   { type: "doc-domain-email", re: /\b[A-Za-z0-9._%+-]+@(?:[A-Za-z0-9-]+\.)*(?:example\.(?:com|org|net)|test|invalid|localhost|example)\b/g },
@@ -114,7 +119,12 @@ const CONTEXT_DISCARDS = [
   // lookarounds instead of \b). Only that WHOLE shape with a real 20xx date and
   // time: no card of 14 digits starts with 20 (Diners is 30/36/38), and a
   // 16-digit card does not fit the slot.
-  { type: "plan-id", re: /(?<![A-Za-z0-9])plan-20\d\d(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d[0-5]\d-[a-z0-9]{4}(?![A-Za-z0-9])/g },
+  // KJC-BUG-0380 (#2263): a latitude, longitude pair in test data read as a phone.
+  // Only the WHOLE pair: both with a decimal point and four or more decimals, in
+  // range (latitude up to 90, longitude up to 180), joined by a comma. A lone
+  // number or a pair out of range still warns.
+  { type: "gps-pair", re: /(?<![\d.])(-?\d{1,3}\.\d{4,})\s*,\s*(-?\d{1,3}\.\d{4,})(?![\d.])/g, keep: inGpsRange },
+  { type: "plan-id", re:/(?<![A-Za-z0-9])plan-20\d\d(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d[0-5]\d-[a-z0-9]{4}(?![A-Za-z0-9])/g },
 ];
 
 /**
@@ -160,9 +170,13 @@ export function scanText(text, { list = loadPrivacyList(), source = "<text>" } =
         re.lastIndex = m.index + m[0].length;
       }
     }
-    for (const { re } of CONTEXT_DISCARDS) {
+    for (const { re, keep } of CONTEXT_DISCARDS) {
       re.lastIndex = 0;
-      probe = probe.replace(re, (m) => { discarded += 1; return " ".repeat(m.length); });
+      probe = probe.replace(re, (m, ...groups) => {
+        if (keep && !keep(m, ...groups)) return m;
+        discarded += 1;
+        return " ".repeat(m.length);
+      });
     }
     const red = redactPII(probe);
     if (red.total > 0) {

package/src/review/diff-batches.js

@@ -0,0 +1,64 @@
+/**
+ * diff-batches (KJC-BUG-0378, #2263): a third-party PR can be far larger than
+ * what one reviewer prompt holds (the reviewer clips at DIFF_CLIP_CHARS). The
+ * diff is cut at each file and whole files are packed into batches that fit, so
+ * every batch is reviewed complete. A file larger than the limit, or files past
+ * the batch cap, are not reviewed and are named in the coverage, never hidden.
+ */
+
+const FILE_HEAD = /^diff --git a\/(.+?) b\//;
+
+/** The diff cut at each file, with the number of changed lines in each. */
+export function splitByFile(diff) {
+  const parts = [];
+  for (const line of String(diff).split("\n")) {
+    const head = FILE_HEAD.exec(line);
+    if (head) parts.push({ file: head[1], lines: [] });
+    if (parts.length === 0) continue;
+    parts.at(-1).lines.push(line);
+  }
+  return parts.map(({ file, lines }) => ({
+    file,
+    text: lines.join("\n"),
+    changed: lines.filter((l) => /^[+-]/.test(l) && !/^(\+\+\+|---) /.test(l)).length,
+  }));
+}
+
+/**
+ * Whole files packed into batches of at most `limit` characters, at most
+ * `maxBatches` of them, and the coverage that leaves.
+ */
+export function batchDiff(diff, { limit, maxBatches }) {
+  const batches = [];
+  const unreviewed = [];
+  for (const part of splitByFile(diff)) {
+    const last = batches.at(-1);
+    if (part.text.length > limit) unreviewed.push(part);
+    else if (last && last.text.length + 1 + part.text.length <= limit) last.add(part);
+    else if (batches.length < maxBatches) batches.push(newBatch(part));
+    else unreviewed.push(part);
+  }
+  const reviewed = batches.flatMap((b) => b.parts);
+  const sum = (ps) => ps.reduce((n, p) => n + p.changed, 0);
+  return {
+    batches: batches.map((b) => ({ files: b.parts.map((p) => p.file), text: b.text })),
+    coverage: {
+      files: { reviewed: reviewed.length, total: reviewed.length + unreviewed.length },
+      lines: { reviewed: sum(reviewed), total: sum(reviewed) + sum(unreviewed) },
+      truncated: unreviewed.length > 0,
+      unreviewed: unreviewed.map((p) => p.file),
+    },
+  };
+}
+
+function newBatch(first) {
+  const batch = {
+    parts: [first],
+    text: first.text,
+    add(part) {
+      batch.parts.push(part);
+      batch.text = `${batch.text}\n${part.text}`;
+    },
+  };
+  return batch;
+}

package/src/review/third-party-review.js

@@ -11,6 +11,11 @@ import { runOneShotReview } from "./one-shot-review.js";
 import { prRequirementChecks } from "./pr-requirements.js";
 import { prSecurityChecks } from "./pr-security.js";
 import { sonarCheck } from "./pr-sonar.js";
+import { batchDiff } from "./diff-batches.js";
+import { DIFF_CLIP_CHARS } from "../prompts/diff-clip.js";
+
+// KJC-BUG-0378: a reviewer call per batch; past this many, files are left out and named.
+const MAX_REVIEW_BATCHES = 10;
 
 const gitDiffOf = async (projectDir, range) => {
   const res = await runCommand("git", ["diff", range], { cwd: projectDir });
@@ -23,27 +28,45 @@ const finding = (i) => ({
   description: i.description ?? "", suggested_fix: i.suggested_fix ?? null,
 });
 
-/** The review as data: verdict, findings, suggestions and the PR-requirement checks. */
-export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck }) {
+/** The review as data: verdict, findings, suggestions, security checks and, apart, the house requirements. */
+export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck, limit = DIFF_CLIP_CHARS, maxBatches = MAX_REVIEW_BATCHES }) {
   const diff = await gitDiff(projectDir, range);
   // KJC-TSK-1076/1077: the PR's requirements and its security, with no tokens; they never stop the review.
-  const checks = [...await requirements({ range, projectDir, config }), ...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
-  const record = await run({
-    diff, task, config, logger, projectDir,
-    reviewerOverride: resolveRole(config, "reviewer").provider || null,
-    persist: false,
-  });
+  // KJC-BUG-0379 (#2263): the house requirements (size, commits, attribution, tests) travel apart:
+  // on another repo with other conventions they must not read as findings next to security.
+  const policyChecks = await requirements({ range, projectDir, config });
+  const checks = [...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
+  // KJC-BUG-0378 (#2263): the whole diff, in batches of whole files that fit the reviewer's
+  // prompt; what does not fit is named in the coverage and the verdict cannot be approved.
+  const provider = resolveRole(config, "reviewer").provider || null;
+  const { batches, coverage } = batchDiff(diff, { limit, maxBatches });
+  if (coverage.files.total === 0) throw new Error(`nothing to review — ${range} has no file changes`);
+  const records = [];
+  for (const batch of batches) {
+    records.push(await run({ diff: batch.text, task, config, logger, projectDir, reviewerOverride: provider, persist: false }));
+  }
   return {
     mode: "third-party",
     range,
-    reviewer: record.reviewer,
-    verdict: { approved: record.verdict === "approved", summary: record.summary ?? "" },
-    findings: (record.issues ?? []).map(finding),
-    suggestions: record.suggestions ?? [],
+    reviewer: records[0]?.reviewer ?? provider,
+    verdict: verdictOf(records, coverage),
+    coverage,
+    findings: records.flatMap((r) => (r.issues ?? []).map(finding)),
+    suggestions: records.flatMap((r) => r.suggestions ?? []),
     checks,
+    policyChecks,
   };
 }
 
+/** Rejected if any batch was; approved only when every file was reviewed; partial otherwise. */
+function verdictOf(records, coverage) {
+  let status = "approved";
+  if (records.some((r) => r.verdict !== "approved")) status = "rejected";
+  else if (coverage.truncated) status = "partial";
+  const summary = records.map((r) => r.summary).filter(Boolean).join("\n");
+  return { status, approved: status === "approved", summary };
+}
+
 /**
  * The CLI side: stdout carries exactly one JSON document, logs go to stderr.
  * Exit 0 whatever the PR's verdict (the agent decides what to post); non-zero