karajan-code 4.57.0 → 4.57.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.57.0",
+  "version": "4.57.2",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/harden/hook-templates.js

@@ -245,8 +245,21 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
     case "post-merge":
       return [
         "# Refresh the local RAG index so retrieval never serves stale code.",
+        "# KJC-BUG-0381: detached, so the merge never waits for it (one took 15 minutes),",
+        "# and one at a time: a lock in the git dir holding the run's pid, freed only when",
+        "# that process is gone (a lock with no pid, after an hour).",
         "if command -v kj >/dev/null 2>&1; then",
-        "  kj rag index --since auto >/dev/null 2>&1 || true",
+        "  kj_git_dir=$(git rev-parse --git-dir 2>/dev/null) || kj_git_dir=.git",
+        '  kj_lock="$kj_git_dir/kj-rag-index.lock"',
+        '  if [ -d "$kj_lock" ]; then',
+        '    kj_pid=$(cat "$kj_lock/pid" 2>/dev/null)',
+        '    if [ -n "$kj_pid" ]; then kill -0 "$kj_pid" 2>/dev/null || rm -rf "$kj_lock"',
+        '    else find "$kj_lock" -maxdepth 0 -mmin +60 -exec rm -rf {} \\; 2>/dev/null; fi',
+        "  fi",
+        '  if mkdir "$kj_lock" 2>/dev/null; then',
+        '    ( kj rag index --since auto >"$kj_git_dir/kj-rag-index.log" 2>&1; rm -rf "$kj_lock" ) </dev/null >/dev/null 2>&1 &',
+        '    echo $! >"$kj_lock/pid" 2>/dev/null',
+        "  fi",
         "fi",
         ...chain,
       ].join("\n");

package/src/privacy/scan.js

@@ -81,6 +81,11 @@ const SEMVER_OP = String.raw`(?:[\^~]|[<>]=?|=)`;
 const SEMVER_JOIN = String.raw`\s*(?:(?:\|\||-)\s*${SEMVER_OP}?|${SEMVER_OP})\s*`;
 const SEMVER_VALUE = new RegExp(String.raw`^\s*${SEMVER_OP}?\s*${SEMVER_TOKEN}(?:${SEMVER_JOIN}${SEMVER_TOKEN})*\s*$`);
 
+/** KJC-BUG-0380: a pair is discarded only when it is a real latitude, longitude. */
+function inGpsRange(_match, lat, lng) {
+  return Math.abs(Number(lat)) <= 90 && Math.abs(Number(lng)) <= 180;
+}
+
 const CONTEXT_DISCARDS = [
   { type: "git-sha", re: /\b(?:[0-9a-f]{64}|[0-9a-f]{40})\b/g },
   { type: "doc-domain-email", re: /\b[A-Za-z0-9._%+-]+@(?:[A-Za-z0-9-]+\.)*(?:example\.(?:com|org|net)|test|invalid|localhost|example)\b/g },
@@ -114,7 +119,12 @@ const CONTEXT_DISCARDS = [
   // lookarounds instead of \b). Only that WHOLE shape with a real 20xx date and
   // time: no card of 14 digits starts with 20 (Diners is 30/36/38), and a
   // 16-digit card does not fit the slot.
-  { type: "plan-id", re: /(?<![A-Za-z0-9])plan-20\d\d(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d[0-5]\d-[a-z0-9]{4}(?![A-Za-z0-9])/g },
+  // KJC-BUG-0380 (#2263): a latitude, longitude pair in test data read as a phone.
+  // Only the WHOLE pair: both with a decimal point and four or more decimals, in
+  // range (latitude up to 90, longitude up to 180), joined by a comma. A lone
+  // number or a pair out of range still warns.
+  { type: "gps-pair", re: /(?<![\d.])(-?\d{1,3}\.\d{4,})\s*,\s*(-?\d{1,3}\.\d{4,})(?![\d.])/g, keep: inGpsRange },
+  { type: "plan-id", re:/(?<![A-Za-z0-9])plan-20\d\d(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d[0-5]\d-[a-z0-9]{4}(?![A-Za-z0-9])/g },
 ];
 
 /**
@@ -160,9 +170,13 @@ export function scanText(text, { list = loadPrivacyList(), source = "<text>" } =
         re.lastIndex = m.index + m[0].length;
       }
     }
-    for (const { re } of CONTEXT_DISCARDS) {
+    for (const { re, keep } of CONTEXT_DISCARDS) {
       re.lastIndex = 0;
-      probe = probe.replace(re, (m) => { discarded += 1; return " ".repeat(m.length); });
+      probe = probe.replace(re, (m, ...groups) => {
+        if (keep && !keep(m, ...groups)) return m;
+        discarded += 1;
+        return " ".repeat(m.length);
+      });
     }
     const red = redactPII(probe);
     if (red.total > 0) {

package/src/review/diff-batches.js

@@ -0,0 +1,90 @@
+/**
+ * diff-batches (KJC-BUG-0378, #2263): a third-party PR can be far larger than
+ * what one reviewer prompt holds (the reviewer clips at DIFF_CLIP_CHARS). The
+ * diff is cut at each file and whole files are packed into batches that fit, so
+ * every batch is reviewed complete. A file larger than the limit, or files past
+ * the batch cap, are not reviewed and are named in the coverage, never hidden.
+ */
+
+const FILE_HEAD = /^diff --git a\/(.+?) b\//;
+
+/** The diff cut at each file, with the number of changed lines in each. */
+export function splitByFile(diff) {
+  const parts = [];
+  for (const line of String(diff).split("\n")) {
+    const head = FILE_HEAD.exec(line);
+    if (head) parts.push({ file: head[1], lines: [] });
+    if (parts.length === 0) continue;
+    parts.at(-1).lines.push(line);
+  }
+  return parts.map(({ file, lines }) => ({ file, text: lines.join("\n"), changed: changedLines(lines) }));
+}
+
+const changedLines = (lines) => lines.filter((l) => /^[+-]/.test(l) && !/^(\+\+\+|---) /.test(l)).length;
+
+/**
+ * Whole files packed into batches of at most `limit` characters, at most
+ * `maxBatches` of them, and the coverage that leaves.
+ */
+export function batchDiff(diff, { limit, maxBatches }) {
+  const parts = splitByFile(diff);
+  const batches = [];
+  const left = [];
+  for (const piece of parts.flatMap((part) => piecesOf(part, limit))) {
+    const last = batches.at(-1);
+    if (piece.text.length > limit) left.push(piece);
+    else if (last && last.text.length + 1 + piece.text.length <= limit) last.add(piece);
+    else if (batches.length < maxBatches) batches.push(newBatch(piece));
+    else left.push(piece);
+  }
+  // A file counts as reviewed only when every piece of it was.
+  const missing = new Set(left.map((p) => p.file));
+  const sum = (ps) => ps.reduce((n, p) => n + p.changed, 0);
+  const reviewedLines = sum(batches.flatMap((b) => b.parts));
+  return {
+    batches: batches.map((b) => ({ files: [...new Set(b.parts.map((p) => p.file))], text: b.text })),
+    coverage: {
+      files: { reviewed: parts.length - missing.size, total: parts.length },
+      lines: { reviewed: reviewedLines, total: reviewedLines + sum(left) },
+      truncated: missing.size > 0,
+      unreviewed: [...missing],
+    },
+  };
+}
+
+/**
+ * KJC-BUG-0382 (#2263): a file too large for one batch is cut into pieces of whole
+ * hunks, each with the file's header, so it is reviewed whole. A single hunk larger
+ * than the limit stays one piece and is left out (named in the coverage).
+ */
+function piecesOf(part, limit) {
+  if (part.text.length <= limit) return [part];
+  const lines = part.text.split("\n");
+  const firstHunk = lines.findIndex((l) => l.startsWith("@@"));
+  if (firstHunk === -1) return [part];
+  const header = lines.slice(0, firstHunk).join("\n");
+  const hunks = [];
+  for (const line of lines.slice(firstHunk)) {
+    if (line.startsWith("@@")) hunks.push([]);
+    hunks.at(-1).push(line);
+  }
+  const pieces = [];
+  for (const hunk of hunks.map((h) => h.join("\n"))) {
+    const last = pieces.at(-1);
+    if (last && last.text.length + 1 + hunk.length <= limit) last.text = `${last.text}\n${hunk}`;
+    else pieces.push({ file: part.file, text: `${header}\n${hunk}` });
+  }
+  return pieces.map((p) => ({ ...p, changed: changedLines(p.text.split("\n")) }));
+}
+
+function newBatch(first) {
+  const batch = {
+    parts: [first],
+    text: first.text,
+    add(part) {
+      batch.parts.push(part);
+      batch.text = `${batch.text}\n${part.text}`;
+    },
+  };
+  return batch;
+}

package/src/review/split-advice.js

@@ -0,0 +1,102 @@
+/**
+ * split-advice (KJC-TSK-1101, #2263): how to split a large third-party PR. Zero
+ * tokens and reproducible: files are grouped by the project's real structure (the
+ * Java/Kotlin package under the common prefix, the folder under src/ in JS/TS,
+ * tests and resources apart), a group still too large is split by its next level,
+ * and chunks are ordered by layer so each one builds on the ones before it. It is
+ * advice: it never counts as a finding and never changes the verdict.
+ */
+
+const LAYERS = [
+  { rank: 0, names: ["config"], purpose: "build and project configuration" },
+  { rank: 1, names: ["resources"], purpose: "configuration and data files the code reads" },
+  { rank: 2, names: ["model", "models", "domain", "entity", "entities", "dto", "types"], purpose: "the data types the rest builds on" },
+  { rank: 3, names: ["utils", "util", "common", "helpers", "core", "support", "shared"], purpose: "shared helpers used by the layers above" },
+  { rank: 4, names: ["api", "client", "clients", "services", "service", "repository", "data"], purpose: "access to services and APIs" },
+  { rank: 5, names: ["pages", "page", "components", "ui", "views", "screens"], purpose: "what the user sees: pages and components" },
+  { rank: 6, names: ["flows", "flow", "steps", "scenarios", "features", "workflows"], purpose: "flows that combine pages and services" },
+  { rank: 8, names: ["tests"], purpose: "the tests that exercise the chunks above" },
+];
+const OTHER_RANK = 7;
+
+const isTest = (f) => /(^|\/)src\/test\/|(^|\/)(tests?|__tests__|e2e|spec)\/|\.(test|spec)\.[a-z]+$/.test(f);
+const dirsOf = (path) => path.split("/").slice(0, -1);
+
+function commonPrefix(lists) {
+  if (lists.length === 0) return [];
+  let n = Math.min(...lists.map((l) => l.length));
+  for (let i = 0; i < n; i++) if (!lists.every((l) => l[i] === lists[0][i])) n = i;
+  return lists[0].slice(0, n);
+}
+
+/** The structural path of each file: the segments that tell its responsibility. */
+function keysOf(files) {
+  const javaMain = /(^|\/)src\/main\/(java|kotlin)\/(.+)$/;
+  const javaDirs = files.map((f) => javaMain.exec(f.file)).filter(Boolean).map((m) => dirsOf(m[3]));
+  // The root package (com/acme/app), never a layer: a PR that only touches pages/ keeps "pages".
+  const common = commonPrefix(javaDirs);
+  const layerAt = common.findIndex((seg) => layerOf(seg));
+  const prefix = layerAt === -1 ? common : common.slice(0, layerAt);
+  return files.map(({ file }) => {
+    if (/(^|\/)src\/(main|test)\/resources\//.test(file)) return ["resources"];
+    if (isTest(file)) return ["tests"];
+    const java = javaMain.exec(file);
+    if (java) {
+      const rest = dirsOf(java[3]).slice(prefix.length);
+      return rest.length > 0 ? rest : ["main"];
+    }
+    const src = /(^|\/)src\/(.+)$/.exec(file);
+    if (src && dirsOf(src[2]).length > 0) return dirsOf(src[2]);
+    const dirs = dirsOf(file);
+    return dirs.length === 0 || dirs[0].startsWith(".") ? ["config"] : dirs;
+  });
+}
+
+function group(entries, depth) {
+  const groups = new Map();
+  for (const e of entries) {
+    const name = e.key.slice(0, depth).join("/");
+    groups.set(name, [...(groups.get(name) ?? []), e]);
+  }
+  return [...groups].map(([name, items]) => ({ name, items, lines: items.reduce((n, i) => n + i.changed, 0), depth }));
+}
+
+/** Groups by the first segment, then splits any group over `limit` by its next level. */
+function chunksOf(entries, limit) {
+  const out = [];
+  const pending = group(entries, 1);
+  while (pending.length > 0) {
+    const g = pending.shift();
+    const deeper = g.items.some((i) => i.key.length > g.depth);
+    if (g.lines > limit && deeper) pending.push(...group(g.items, g.depth + 1));
+    else out.push(g);
+  }
+  return out;
+}
+
+const layerOf = (name) => LAYERS.find((l) => l.names.includes(name.split("/")[0])) ?? null;
+
+/**
+ * @param {{file: string, changed: number}[]} files the PR's files and changed lines
+ * @param {{limit: number}} opts the size one chunk should stay under
+ */
+export function splitAdvice(files, { limit }) {
+  const keys = keysOf(files);
+  const entries = files.map((f, i) => ({ ...f, key: keys[i] }));
+  const total = files.reduce((n, f) => n + f.changed, 0);
+  const chunks = chunksOf(entries, limit)
+    .map((g) => ({ ...g, rank: layerOf(g.name)?.rank ?? OTHER_RANK }))
+    .sort((a, b) => a.rank - b.rank || a.name.localeCompare(b.name))
+    .map((g, i) => ({
+      order: i + 1,
+      name: g.name,
+      purpose: layerOf(g.name)?.purpose ?? `changes under ${g.name}`,
+      files: g.items.map((e) => e.file),
+      lines: g.lines,
+    }));
+  return {
+    why: `This PR changes ${files.length} files and ${total} lines. Past a few hundred lines a reviewer misses more and the review takes longer; PRs with one purpose each get a better review and merge sooner.`,
+    order: "Each chunk builds on the ones before it (configuration, data types, helpers, services, pages, flows, tests), so it can compile and pass its tests on its own.",
+    chunks,
+  };
+}

package/src/review/third-party-review.js

@@ -8,9 +8,16 @@
 import { runCommand } from "../utils/process.js";
 import { resolveRole } from "../config/role-resolver.js";
 import { runOneShotReview } from "./one-shot-review.js";
-import { prRequirementChecks } from "./pr-requirements.js";
+import { prRequirementChecks, prSizeLimit } from "./pr-requirements.js";
+import { splitAdvice } from "./split-advice.js";
+import { isGenerated } from "./loc-budget.js";
 import { prSecurityChecks } from "./pr-security.js";
 import { sonarCheck } from "./pr-sonar.js";
+import { batchDiff, splitByFile } from "./diff-batches.js";
+import { DIFF_CLIP_CHARS } from "../prompts/diff-clip.js";
+
+// KJC-BUG-0378: a reviewer call per batch; past this many, files are left out and named.
+const MAX_REVIEW_BATCHES = 10;
 
 const gitDiffOf = async (projectDir, range) => {
   const res = await runCommand("git", ["diff", range], { cwd: projectDir });
@@ -23,27 +30,53 @@ const finding = (i) => ({
   description: i.description ?? "", suggested_fix: i.suggested_fix ?? null,
 });
 
-/** The review as data: verdict, findings, suggestions and the PR-requirement checks. */
-export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck }) {
+/** The review as data: verdict, findings, suggestions, security checks and, apart, the house requirements. */
+export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck, limit = DIFF_CLIP_CHARS, maxBatches = MAX_REVIEW_BATCHES, sizeLimit = null }) {
   const diff = await gitDiff(projectDir, range);
   // KJC-TSK-1076/1077: the PR's requirements and its security, with no tokens; they never stop the review.
-  const checks = [...await requirements({ range, projectDir, config }), ...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
-  const record = await run({
-    diff, task, config, logger, projectDir,
-    reviewerOverride: resolveRole(config, "reviewer").provider || null,
-    persist: false,
-  });
+  // KJC-BUG-0379 (#2263): the house requirements (size, commits, attribution, tests) travel apart:
+  // on another repo with other conventions they must not read as findings next to security.
+  const policyChecks = await requirements({ range, projectDir, config });
+  const checks = [...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
+  // KJC-BUG-0378 (#2263): the whole diff, in batches of whole files that fit the reviewer's
+  // prompt; what does not fit is named in the coverage and the verdict cannot be approved.
+  const provider = resolveRole(config, "reviewer").provider || null;
+  const { batches, coverage } = batchDiff(diff, { limit, maxBatches });
+  if (coverage.files.total === 0) throw new Error(`nothing to review — ${range} has no file changes`);
+  const records = [];
+  for (const batch of batches) {
+    records.push(await run({ diff: batch.text, task, config, logger, projectDir, reviewerOverride: provider, persist: false }));
+  }
   return {
     mode: "third-party",
     range,
-    reviewer: record.reviewer,
-    verdict: { approved: record.verdict === "approved", summary: record.summary ?? "" },
-    findings: (record.issues ?? []).map(finding),
-    suggestions: record.suggestions ?? [],
+    reviewer: records[0]?.reviewer ?? provider,
+    verdict: verdictOf(records, coverage),
+    coverage,
+    findings: records.flatMap((r) => (r.issues ?? []).map(finding)),
+    suggestions: records.flatMap((r) => r.suggestions ?? []),
     checks,
+    policyChecks,
+    advice: adviceFor(diff, sizeLimit ?? prSizeLimit({ projectDir, config }).limit),
   };
 }
 
+/** KJC-TSK-1101: over the size budget, how to split the PR; advice only, never a finding. */
+function adviceFor(diff, budget) {
+  const files = splitByFile(diff).filter((f) => !isGenerated(f.file));
+  const total = files.reduce((n, f) => n + f.changed, 0);
+  return total > budget ? { split: splitAdvice(files, { limit: budget }) } : {};
+}
+
+/** Rejected if any batch was; approved only when every file was reviewed; partial otherwise. */
+function verdictOf(records, coverage) {
+  let status = "approved";
+  if (records.some((r) => r.verdict !== "approved")) status = "rejected";
+  else if (coverage.truncated) status = "partial";
+  const summary = records.map((r) => r.summary).filter(Boolean).join("\n");
+  return { status, approved: status === "approved", summary };
+}
+
 /**
  * The CLI side: stdout carries exactly one JSON document, logs go to stderr.
  * Exit 0 whatever the PR's verdict (the agent decides what to post); non-zero