karajan-code 4.6.1 → 4.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.6.1",
+  "version": "4.6.3",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/commands/review-gate.js

@@ -113,14 +113,26 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   // single test change warn (block via method_gates.tests_with_code).
   const changedFiles = (await rawDiff(flags.range, ["--name-only"])).split("\n").map((f) => f.trim()).filter(Boolean);
 
-  // KJC-TSK-0688 (MG-C): oversized-diff nudge — informative only; the
-  // project's CI owns any hard budget. Sums additions from --numstat.
+  // KJC-TSK-0688 (MG-C) + KJC-TSK-0691 (MG-E): oversized-diff policy.
+  // Field case: a 522-line PR sailed past the warning with a
+  // rationalization — where the project wants teeth, pr_size: "block"
+  // rejects deterministically with a NAMED escape. Default stays warn.
   const sizeWarn = config?.method_gates?.pr_size_warn ?? 150;
   if (sizeWarn > 0) {
     const numstat = await rawDiff(flags.range, ["--numstat"]);
     const added = numstat.split("\n").reduce((acc, l) => acc + (Number(l.split("\t")[0]) || 0), 0);
     if (added > sizeWarn) {
-      console.log(`⚠ pr-size: ${added} lines added (guideline ~${sizeWarn}) — atomic PRs review better; consider splitting (method_gates.pr_size_warn to tune)`);
+      const sizePolicy = config?.method_gates?.pr_size || "warn";
+      if (process.env.KJ_ALLOW_LARGE_PR === "1") {
+        console.log(`⚠ pr-size exempt: ${added} lines added — KJ_ALLOW_LARGE_PR=1 (explicit escape hatch)`);
+      } else if (sizePolicy === "block") {
+        const reason = `${added} lines added exceeds the ${sizeWarn}-line budget (method_gates.pr_size: block) — partition the work, or get your user's explicit OK and re-run with KJ_ALLOW_LARGE_PR=1`;
+        console.log(`✗ pr-size gate: ${reason}`);
+        process.exitCode = 1;
+        return { verdict: "rejected", reviewer: "pr-size", issues: [{ severity: "high", description: reason }] };
+      } else {
+        console.log(`⚠ pr-size: ${added} lines added (guideline ~${sizeWarn}) — an oversized warning is not an opinion: partition, or ask your user (method_gates.pr_size: block to harden)`);
+      }
     }
   }
   const tests = checkTestsWithCode({ config, stagedFiles: changedFiles });

package/src/environment/playbook.js

@@ -66,6 +66,10 @@ Invariants (the git gates enforce these — they are not suggestions):
   and it must be reviewed again. Disagree with a rejection? \`kj solomon\`.
 - Security findings are never overridable — not even by arbitration. You
   absorb the security role: \`kj brief security\` states what must be true.
+- A design decision the card's AC don't cover belongs to the USER: record
+  it as a proposed ADR (\`kj adr add\`) and ask — never bury it in a PR
+  bullet. An oversized-diff warning is not an opinion either: partition,
+  or get an explicit OK.
 - Branch first: never commit on the base branch — every change reaches it
   through an atomic PR (~150 net lines, Conventional Commits). More than one
   task, or the base tree must stay untouched? \`kj worktree start <slug>\`

package/src/harden/hook-templates.js

@@ -16,8 +16,8 @@ export const SHEBANG = "#!/usr/bin/env sh";
 /** Hooks enabled per profile. */
 export const PROFILE_HOOKS = {
   minimal: ["commit-msg"],
-  standard: ["pre-commit", "commit-msg", "pre-push", "post-merge"],
-  strict: ["pre-commit", "commit-msg", "pre-push", "post-merge"],
+  standard: ["pre-commit", "prepare-commit-msg", "commit-msg", "pre-push", "post-merge"],
+  strict: ["pre-commit", "prepare-commit-msg", "commit-msg", "pre-push", "post-merge"],
 };
 
 /** Build the managed body for a single hook. */
@@ -99,6 +99,37 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
       else lines.push("# (no test command detected for this stack)");
       return [...lines, ...chain].join("\n");
     }
+    case "prepare-commit-msg":
+      // KJC-TSK-0692 (MG-F): the branch already carries the card ref
+      // (validated by the card-first gate) — the subject inherits it
+      // automatically. A convention that enforces itself needs no adoption.
+      return [
+        'msg_file="$1"',
+        'branch=$(git symbolic-ref --short HEAD 2>/dev/null || echo "")',
+        "# POSIX-safe extraction (no grep -o): the ref is the leading",
+        "# card-shaped token of the branch's last segment (feat/REF-desc).",
+        "seg=$(printf '%s' \"$branch\" | tr '[:upper:]' '[:lower:]'); seg=\"${seg##*/}\"",
+        "ref=$(printf '%s' \"$seg\" | sed -nE 's/^([a-z][a-z0-9]{1,9}(-[a-z][a-z0-9]{1,9})*-[0-9]{1,6})(-.*)?$/\\1/p')",
+        'header=$(head -n1 "$msg_file")',
+        'if [ -n "$ref" ] && [ -n "$header" ]; then',
+        '  case "$header" in',
+        "    Merge*|fixup!*|squash!*) ;;",
+        "    *)",
+        "      # Boundary match — a header mentioning KJW-TSK-00011 must not",
+        "      # suppress the KJW-TSK-0001 stamp. $ref is [a-z0-9-] only by",
+        "      # construction (sed extraction above), safe inside the ERE.",
+        '      if ! printf \'%s\' "$header" | grep -qiE "(^|[^a-zA-Z0-9-])$ref([^a-zA-Z0-9-]|$)"; then',
+        "        stamp=$(printf '%s' \"$ref\" | tr '[:lower:]' '[:upper:]')",
+        '        new_header="$header ($stamp)"',
+        '        if [ "${#new_header}" -le 100 ]; then',
+        "          { printf '%s\\n' \"$new_header\"; tail -n +2 \"$msg_file\"; } > \"$msg_file.kjtmp\" && mv \"$msg_file.kjtmp\" \"$msg_file\"",
+        "        fi",
+        "      fi",
+        "      ;;",
+        "  esac",
+        "fi",
+        ...chain,
+      ].join("\n");
     case "post-merge":
       return [
         "# Refresh the local RAG index so retrieval never serves stale code.",

package/src/harden/workflow-engine.js

@@ -27,6 +27,13 @@ export function isPublishableNpm(projectDir) {
   }
 }
 
+/** Lockfile-detected package manager (KJC-BUG-0131): npm ci kills pnpm/yarn CI. */
+export function detectPackageManager(projectDir) {
+  if (existsSync(join(projectDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join(projectDir, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+
 export function installWorkflows({
   projectDir = process.cwd(),
   language = null,
@@ -35,9 +42,10 @@ export function installWorkflows({
   dryRun = false,
 } = {}) {
   const dir = join(projectDir, WORKFLOWS_DIR);
-  const quality = qualityWorkflowFor(language);
-  const extras = extraWorkflowsFor({ profile, publishable: isPublishableNpm(projectDir) });
-  const mut = mutation ? mutationWorkflowFor(language) : null;
+  const pm = detectPackageManager(projectDir);
+  const quality = qualityWorkflowFor(language, pm);
+  const extras = extraWorkflowsFor({ profile, publishable: isPublishableNpm(projectDir), pm });
+  const mut = mutation ? mutationWorkflowFor(language, pm) : null;
   const all = [...WORKFLOWS, ...(quality ? [quality] : []), ...extras, ...(mut ? [mut] : [])];
   const results = [];
   for (const wf of all) {

package/src/harden/workflow-templates.js

@@ -54,15 +54,37 @@ const header = (steps) =>
     ...steps,
   ].join("\n");
 
+// Per-package-manager commands (KJC-BUG-0131, issue #1330): `npm ci` in a
+// pnpm/yarn repo dies with EUSAGE (no package-lock.json). corepack ships with
+// Node 22 and resolves the right pnpm/yarn from `packageManager` — no
+// third-party action. pnpm passes flags AFTER the script name to the script
+// itself, so --if-present must go BEFORE it; yarn has no --if-present at all,
+// so lint runs through `npm run` (scripts don't touch the lockfile).
+const PM_COMMANDS = {
+  npm: { setup: [], install: "npm ci", lint: "npm run -s lint --if-present", test: "npm test" },
+  pnpm: {
+    setup: ["      - run: corepack enable"],
+    install: "pnpm install --frozen-lockfile",
+    lint: "pnpm run --if-present -s lint",
+    test: "pnpm test",
+  },
+  yarn: {
+    setup: ["      - run: corepack enable"],
+    install: "yarn install --frozen-lockfile",
+    lint: "npm run -s lint --if-present",
+    test: "yarn test",
+  },
+};
+
+const nodeSetupSteps = (pm) => [
+  "      - uses: actions/setup-node@v4",
+  "        with:",
+  "          node-version: 22",
+  ...(PM_COMMANDS[pm] || PM_COMMANDS.npm).setup,
+  `      - run: ${(PM_COMMANDS[pm] || PM_COMMANDS.npm).install}`,
+];
+
 const QUALITY_BY_LANGUAGE = {
-  javascript: header([
-    "      - uses: actions/setup-node@v4",
-    "        with:",
-    "          node-version: 22",
-    "      - run: npm ci",
-    "      - run: npm run -s lint --if-present",
-    "      - run: npm test",
-  ]),
   python: header([
     "      - uses: actions/setup-python@v5",
     "        with:",
@@ -87,11 +109,13 @@ const QUALITY_BY_LANGUAGE = {
     "      - run: vendor/bin/phpunit",
   ]),
 };
-QUALITY_BY_LANGUAGE.typescript = QUALITY_BY_LANGUAGE.javascript;
-
 /** Stack-aware Quality workflow entry, or null for an unknown language. */
-export function qualityWorkflowFor(language) {
-  const body = QUALITY_BY_LANGUAGE[language];
+export function qualityWorkflowFor(language, pm = "npm") {
+  const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
+  const body =
+    language === "javascript" || language === "typescript"
+      ? header([...nodeSetupSteps(pm), `      - run: ${c.lint}`, `      - run: ${c.test}`])
+      : QUALITY_BY_LANGUAGE[language];
   return body ? { file: "kj-quality.yml", blockId: "wf-quality", body } : null;
 }
 
@@ -123,29 +147,29 @@ export const SHRINK_BUDGET_WORKFLOW = [
 ].join("\n");
 
 // Packs the tarball and installs it clean — only for publishable npm packages.
-export const PACK_SMOKE_WORKFLOW = [
-  "name: Pack smoke",
-  "on:",
-  "  pull_request:",
-  "    branches: [main]",
-  "permissions:",
-  "  contents: read",
-  "jobs:",
-  "  pack-smoke:",
-  "    runs-on: ubuntu-latest",
-  "    steps:",
-  "      - uses: actions/checkout@v4",
-  "      - uses: actions/setup-node@v4",
-  "        with:",
-  "          node-version: 22",
-  "      - run: npm ci",
-  "      - name: Pack and install the tarball clean",
-  "        run: |",
-  "          tgz=$(npm pack --silent)",
-  "          dir=$(mktemp -d)",
-  '          npm install --prefix "$dir" "$PWD/$tgz" --no-audit --no-fund',
-  '          echo "Tarball installs clean: $tgz"',
-].join("\n");
+// `npm pack`/`npm install <tarball>` need no lockfile, so only the dependency
+// install step is package-manager-aware.
+export const packSmokeWorkflow = (pm = "npm") =>
+  [
+    "name: Pack smoke",
+    "on:",
+    "  pull_request:",
+    "    branches: [main]",
+    "permissions:",
+    "  contents: read",
+    "jobs:",
+    "  pack-smoke:",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    ...nodeSetupSteps(pm),
+    "      - name: Pack and install the tarball clean",
+    "        run: |",
+    "          tgz=$(npm pack --silent)",
+    "          dir=$(mktemp -d)",
+    '          npm install --prefix "$dir" "$PWD/$tgz" --no-audit --no-fund',
+    '          echo "Tarball installs clean: $tgz"',
+  ].join("\n");
 
 // Opt-in nightly/manual mutation audit (KJC-TSK-0589). NEVER a PR gate: it runs
 // on a weekly schedule + manual dispatch, and the mutate step is non-blocking
@@ -153,7 +177,7 @@ export const PACK_SMOKE_WORKFLOW = [
 // yields a JSON report (stryker/mutmut/infection) get a workflow — no silent
 // scaffold for tools that can't report yet.
 const MUTATION_TOOLCHAIN = {
-  javascript: ["      - run: npm ci"],
+  javascript: "node", // resolved per package manager in mutationWorkflowFor
   python: [
     "      - uses: actions/setup-python@v5",
     "        with:",
@@ -170,9 +194,11 @@ const MUTATION_TOOLCHAIN = {
 MUTATION_TOOLCHAIN.typescript = MUTATION_TOOLCHAIN.javascript;
 
 /** Opt-in mutation workflow entry, or null for a stack without a JSON report. */
-export function mutationWorkflowFor(language) {
-  const toolchain = MUTATION_TOOLCHAIN[language];
-  if (!toolchain) return null;
+export function mutationWorkflowFor(language, pm = "npm") {
+  const entry = MUTATION_TOOLCHAIN[language];
+  if (!entry) return null;
+  const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
+  const toolchain = entry === "node" ? [...c.setup, `      - run: ${c.install}`] : entry;
   const body = [
     "name: Mutation (nightly)",
     "on:",
@@ -200,13 +226,13 @@ export function mutationWorkflowFor(language) {
 }
 
 /** Conditional workflows: shrink-budget on strict, pack-smoke when publishable. */
-export function extraWorkflowsFor({ profile = "standard", publishable = false } = {}) {
+export function extraWorkflowsFor({ profile = "standard", publishable = false, pm = "npm" } = {}) {
   const extras = [];
   if (profile === "strict") {
     extras.push({ file: "kj-shrink-budget.yml", blockId: "wf-shrink", body: SHRINK_BUDGET_WORKFLOW });
   }
   if (publishable) {
-    extras.push({ file: "kj-pack-smoke.yml", blockId: "wf-pack-smoke", body: PACK_SMOKE_WORKFLOW });
+    extras.push({ file: "kj-pack-smoke.yml", blockId: "wf-pack-smoke", body: packSmokeWorkflow(pm) });
   }
   return extras;
 }

package/src/roles/coder-role.js

@@ -17,9 +17,17 @@ export class CoderRole extends AgentRole {
   }
 
   createAgentInstance(provider) {
+    // KJC-BUG-0129 (issues #1301/#1303): running INSIDE an agent does not
+    // make it "the host executor" — delegating sent the full instruction
+    // prompt through elicitInput as a hanging board "question". A CLI
+    // provider spawns as a subprocess ALWAYS; host delegation is explicit
+    // opt-in (roles.coder.host_delegation: true) for MCP-only setups.
     if (this._askHost && isHostAgent(provider)) {
-      this.logger.info(`Host-as-coder: delegating to host AI (skipping ${provider} subprocess)`);
-      return new HostAgent(this.config, this.logger, { askHost: this._askHost });
+      if (this.config?.roles?.coder?.host_delegation === true) {
+        this.logger.info(`Host-as-coder: delegating to host AI (roles.coder.host_delegation, skipping ${provider} subprocess)`);
+        return new HostAgent(this.config, this.logger, { askHost: this._askHost });
+      }
+      this.logger.info(`Running inside ${provider} — spawning it as a subprocess anyway (set roles.coder.host_delegation: true to delegate to the host)`);
     }
     return this._createAgent(provider, this.config, this.logger);
   }