karajan-code 4.58.0 → 4.59.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.58.0",
+  "version": "4.59.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/register-pipeline.js

@@ -262,6 +262,7 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--verify-pr <n>", "CI check: every commit of the PR is listed, with its diff hash, in the kj review a member published")
     .option("--third-party", "Review someone else's PR (--range base...head): reviewer only, no own-work gates, no verdict stored")
     .option("--json", "With --third-party: print the review as one JSON document on stdout")
+    .option("--lens <lens>", "With --third-party: what the reviewer looks at; qa = test coverage, weak assertions, flakiness, test data")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "review", flags, async ({ config, logger }) => {
         // KJC-TSK-1075 (#2227): a third-party PR, for reviewer agents; own work keeps every gate.

package/src/privacy/scan.js

@@ -82,6 +82,16 @@ const SEMVER_JOIN = String.raw`\s*(?:(?:\|\||-)\s*${SEMVER_OP}?|${SEMVER_OP})\s*
 const SEMVER_VALUE = new RegExp(String.raw`^\s*${SEMVER_OP}?\s*${SEMVER_TOKEN}(?:${SEMVER_JOIN}${SEMVER_TOKEN})*\s*$`);
 
 /** KJC-BUG-0380: a pair is discarded only when it is a real latitude, longitude. */
+// KJC-TSK-1118: the test card numbers payment providers publish (Stripe, Braintree,
+// Adyen, PayPal docs). Only these exact numbers; a card one digit away still warns.
+const TEST_CARDS = new Set([
+  "4242424242424242", "4000056655665556", "4111111111111111", "4012888888881881", "4000000000000002",
+  "5555555555554444", "5105105105105100", "2223003122003222", "5200828282828210",
+  "378282246310005", "371449635398431", "6011111111111117", "6011000990139424",
+  "3056930009020004", "36227206271667", "3530111333300000", "3566002020360505",
+]);
+const isTestCard = (match) => TEST_CARDS.has(match.replaceAll(/[\s-]/g, ""));
+
 function inGpsRange(_match, lat, lng) {
   return Math.abs(Number(lat)) <= 90 && Math.abs(Number(lng)) <= 180;
 }
@@ -124,6 +134,14 @@ const CONTEXT_DISCARDS = [
   // range (latitude up to 90, longitude up to 180), joined by a comma. A lone
   // number or a pair out of range still warns.
   { type: "gps-pair", re: /(?<![\d.])(-?\d{1,3}\.\d{4,})\s*,\s*(-?\d{1,3}\.\d{4,})(?![\d.])/g, keep: inGpsRange },
+  // KJC-TSK-1118: numbers reserved for fiction and tests, the good practice for test data.
+  // NANP 555-0100..0199 (with an optional +1 and area code); Ofcom's drama ranges:
+  // 07700 900xxx, 020 7946 0xxx and 01632 960xxx (0 or +44). Nothing around them.
+  { type: "fictional-phone", re: /(?<![\d+])(?:\+?1[\s.-]?)?\(?\d{3}\)?[\s.-]?555[\s.-]?01\d{2}(?!\d)/g },
+  { type: "fictional-phone-uk", re: /(?<![\d+])(?:\+44\s?|0)7700\s?900\d{3}(?!\d)/g },
+  { type: "fictional-phone-uk", re: /(?<![\d+])(?:\+44\s?|0)20\s?7946\s?0\d{3}(?!\d)/g },
+  { type: "fictional-phone-uk", re: /(?<![\d+])(?:\+44\s?|0)1632\s?960\d{3}(?!\d)/g },
+  { type: "test-card", re: /(?<!\d)\d(?:[\s-]?\d){13,18}(?!\d)/g, keep: isTestCard },
   { type: "plan-id", re:/(?<![A-Za-z0-9])plan-20\d\d(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d[0-5]\d-[a-z0-9]{4}(?![A-Za-z0-9])/g },
 ];
 

package/src/review/review-lens.js

@@ -0,0 +1,19 @@
+/**
+ * KJC-TSK-1117: a review lens changes what the reviewer looks at, not how strict
+ * it is (that is review_mode). The qa lens puts a QA rubric before the task, so a
+ * PR of test automation is judged on whether its tests would catch bugs.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getTemplatesRoot } from "../utils/templates-root.js";
+
+const RUBRICS = { qa: "reviewer-qa.md" };
+export const LENSES = Object.keys(RUBRICS);
+
+/** The reviewer's task under a lens; no lens leaves it as it is. */
+export async function lensTask(lens, task) {
+  if (!lens) return task;
+  if (!Object.hasOwn(RUBRICS, lens)) throw new Error(`unknown review lens "${lens}": use ${LENSES.join(", ")}`);
+  const rubric = (await readFile(join(getTemplatesRoot(), "roles", RUBRICS[lens]), "utf8")).trim();
+  return task ? `${rubric}\n\n## Task\n\n${task}` : rubric;
+}

package/src/review/third-party-review.js

@@ -14,6 +14,7 @@ import { isGenerated } from "./loc-budget.js";
 import { prSecurityChecks } from "./pr-security.js";
 import { sonarCheck } from "./pr-sonar.js";
 import { batchDiff, splitByFile } from "./diff-batches.js";
+import { lensTask } from "./review-lens.js";
 import { DIFF_CLIP_CHARS } from "../prompts/diff-clip.js";
 
 // KJC-BUG-0378: a reviewer call per batch; past this many, files are left out and named.
@@ -91,7 +92,9 @@ export async function thirdPartyReviewCommand({ flags, config, out = process.std
   const log = (msg) => err.write(`${msg}\n`);
   const logger = { info: log, warn: log, error: log, debug: () => {} };
   try {
-    print(await review({ range: flags.range, config, projectDir: config.projectDir || process.cwd(), logger, task: flags.task ?? null }));
+    // KJC-TSK-1117: a lens (qa) puts its rubric before the task.
+    const task = await lensTask(flags.lens ?? null, flags.task ?? null);
+    print(await review({ range: flags.range, config, projectDir: config.projectDir || process.cwd(), logger, task }));
     return 0;
   } catch (e) {
     print({ error: e.message });

package/templates/roles/reviewer-qa.md

@@ -0,0 +1,18 @@
+# Review lens: QA
+
+Review this PR as a QA engineer, not only as a developer. Most of it may be test code: judge whether the tests would catch the bugs they exist for.
+
+## Blocking (in the diff only)
+
+- **No test for new behavior**: the change adds or changes behavior and no test exercises it.
+- **Tests that cannot fail**: no assertion, assertions only on mocks, `toBeTruthy`/`assert True` on values that are always truthy, a caught exception that swallows the failure.
+- **Flaky by construction**: fixed sleeps or timeouts instead of waiting on a condition, order dependence between tests, shared mutable state, real clock, randomness or network without control, retries that hide a failure.
+- **Real personal data or production credentials in test data.**
+
+## Suggestions (non-blocking)
+
+- **Missing scenarios**: name the edge and error cases the new tests skip (empty, boundary, invalid input, permissions, concurrency).
+- **Weak assertions**: only a status code, only "element exists", snapshots standing in for a precise check.
+- **Fragile selectors**: CSS chains, XPath by index or text that changes; prefer roles, labels or `data-testid`.
+- **Test data**: prefer values reserved for testing (emails on `example.com`/`example.org`/`.test`, fictional phone ranges such as 555-01xx or 07700 900xxx, the test card numbers each payment provider publishes) or generated data (factories, faker), created and cleaned up by each test.
+- **Structure**: one behavior per test, names that say the scenario and the expected result, page objects and flows that keep selectors out of the test body, no duplicated setup.