karajan-code 4.6.2 → 4.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.6.2",
+  "version": "4.7.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/base-agent.js

@@ -11,6 +11,7 @@
  */
 
 import { defaultEnvironment } from "../infrastructure/environment.js";
+import { buildAgentEnv } from "../utils/role-env.js";
 
 const MODEL_NOT_SUPPORTED_PATTERNS = [
   /model.{0,30}is not supported/i,
@@ -49,6 +50,25 @@ export class BaseAgent {
    * @returns {Promise<CommandRunResult>}
    */
   async runCommand(command, args = [], options = {}) {
+    // KJC-TSK-0693: the subprocess gets an env allowlist, never the user's
+    // whole environment. security.env_allowlist:false opts out.
+    if (this.config?.security?.env_allowlist !== false) {
+      // Solomon-arbitrated contract (KJC-TSK-0693): an explicit env WITH a
+      // PATH is a COMPLETE child env (agents build those from process.env and
+      // deliberately strip vars — cleanExecaOpts drops CLAUDECODE, qwen
+      // unsets gemini's trust var) and is filtered AS GIVEN. An env WITHOUT
+      // a PATH is a partial overlay and merges over the inherited env first,
+      // so an overlay caller can never cost the child PATH/HOME.
+      const complete = options.env && ("PATH" in options.env || "Path" in options.env);
+      const base = complete ? options.env : { ...process.env, ...(options.env || {}) };
+      options = {
+        ...options,
+        env: buildAgentEnv(base, {
+          agent: this.name,
+          passthrough: this.config?.security?.env_passthrough || [],
+        }),
+      };
+    }
     return this.environment.runner.run(command, args, options);
   }
 

package/src/checks/ai-surface.js

@@ -0,0 +1,76 @@
+/**
+ * ai-surface — MCP inventory with drift detection (KJC-TSK-0694).
+ *
+ * Every new tool an agent gains is one more access. An inventory nobody
+ * reconciles is "the feeling of control without the control", so kj check
+ * flags what APPEARED since the last run and asks the user to own it.
+ * A nudge, never a gate. ~/.claude.json is scoped to its global block plus
+ * THIS project's entry — other projects' MCPs are not reachable here.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const sources = (projectDir, home) => [
+  { file: path.join(projectDir, ".mcp.json"), format: "json" },
+  { file: path.join(home, ".claude.json"), format: "json" },
+  { file: path.join(home, ".codex", "config.toml"), format: "toml" },
+  { file: path.join(home, ".gemini", "settings.json"), format: "json" },
+];
+
+function jsonServerNames(text, projectDir) {
+  try {
+    const parsed = JSON.parse(text);
+    const names = new Set(Object.keys(parsed.mcpServers || {}));
+    for (const name of Object.keys(parsed.projects?.[projectDir]?.mcpServers || {})) names.add(name);
+    return names;
+  } catch {
+    return new Set();
+  }
+}
+
+const tomlServerNames = (text) =>
+  new Set([...text.matchAll(/^\s*\[mcp_servers\.["']?([^\]"']+)["']?\]/gm)].map((m) => m[1]));
+
+/** Sorted `name (config-file)` entries for every MCP reachable in this project. */
+export function collectAiSurface({ projectDir = process.cwd(), home = os.homedir() } = {}) {
+  const surface = new Set();
+  for (const { file, format } of sources(projectDir, home)) {
+    if (!existsSync(file)) continue;
+    let text;
+    try { text = readFileSync(file, "utf8"); } catch { continue; }
+    const names = format === "toml" ? tomlServerNames(text) : jsonServerNames(text, projectDir);
+    for (const name of names) surface.add(`${name} (${path.basename(file)})`);
+  }
+  return [...surface].sort();
+}
+
+/**
+ * Diff the current surface against the last-seen snapshot and persist the
+ * new state. First run records the baseline silently.
+ */
+export function checkAiSurface({ projectDir = process.cwd(), home = os.homedir(), statePath = path.join(os.homedir(), ".karajan", "ai-surface.json") } = {}) {
+  const surface = collectAiSurface({ projectDir, home });
+  let state = {};
+  try { state = JSON.parse(readFileSync(statePath, "utf8")); } catch { /* first run or corrupt → baseline */ }
+  const prev = Array.isArray(state[projectDir]) ? state[projectDir] : null;
+  const added = prev ? surface.filter((e) => !prev.includes(e)) : [];
+  const removed = prev ? prev.filter((e) => !surface.includes(e)) : [];
+  state[projectDir] = surface;
+  try {
+    mkdirSync(path.dirname(statePath), { recursive: true });
+    writeFileSync(statePath, JSON.stringify(state, null, 2));
+  } catch { /* read-only FS — inventory still reports, just cannot remember */ }
+  return { surface, added, removed, first: !prev };
+}
+
+/** One line for kj check output. */
+export function formatAiSurface({ surface, added, removed, first }) {
+  const head = `ai surface: ${surface.length} MCP(s)`;
+  if (first) return `${head} — baseline recorded`;
+  const parts = [head];
+  if (added.length) parts.push(`NEW since last check: ${added.join(", ")} — approved by you?`);
+  if (removed.length) parts.push(`gone: ${removed.join(", ")}`);
+  return parts.join(" · ");
+}

package/src/commands/check.js

@@ -6,21 +6,26 @@
 
 import { checkHarden } from "../harden/check.js";
 import { collectMethodStats, formatMethodStats } from "../checks/method.js";
+import { checkAiSurface, formatAiSurface } from "../checks/ai-surface.js";
 
 export async function checkCommand({ projectDir = process.cwd(), profile = "standard", json = false, logger = console } = {}) {
   const result = await checkHarden({ projectDir, profile });
   // KJC-TSK-0689 (MG-D): method adherence is VISIBILITY, not a gate — it
   // rides along in check output but never affects the exit code.
   const method = await collectMethodStats({ projectDir }).catch(() => null);
+  // KJC-TSK-0694: same deal for the MCP inventory — a nudge, never a gate.
+  let aiSurface = null;
+  try { aiSurface = checkAiSurface({ projectDir }); } catch { /* inventory is best-effort */ }
 
   if (json) {
-    logger.info?.(JSON.stringify({ ...result, method }));
+    logger.info?.(JSON.stringify({ ...result, method, aiSurface }));
     return result.ok ? 0 : 1;
   }
 
   logger.info?.(`kj check (${profile})`);
   for (const c of result.checks) logger.info?.(`  ${c.ok ? "✓" : "✗"} ${c.id}: ${c.detail}`);
   if (method) logger.info?.(`  method: ${formatMethodStats(method)}`);
+  if (aiSurface) logger.info?.(`  ${formatAiSurface(aiSurface)}`);
   if (!result.ok) logger.info?.("Harness drift detected — run `kj harden` to repair.");
   else logger.info?.("Harness OK.");
   return result.ok ? 0 : 1;

package/src/harden/workflow-engine.js

@@ -27,6 +27,13 @@ export function isPublishableNpm(projectDir) {
   }
 }
 
+/** Lockfile-detected package manager (KJC-BUG-0131): npm ci kills pnpm/yarn CI. */
+export function detectPackageManager(projectDir) {
+  if (existsSync(join(projectDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join(projectDir, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+
 export function installWorkflows({
   projectDir = process.cwd(),
   language = null,
@@ -35,9 +42,10 @@ export function installWorkflows({
   dryRun = false,
 } = {}) {
   const dir = join(projectDir, WORKFLOWS_DIR);
-  const quality = qualityWorkflowFor(language);
-  const extras = extraWorkflowsFor({ profile, publishable: isPublishableNpm(projectDir) });
-  const mut = mutation ? mutationWorkflowFor(language) : null;
+  const pm = detectPackageManager(projectDir);
+  const quality = qualityWorkflowFor(language, pm);
+  const extras = extraWorkflowsFor({ profile, publishable: isPublishableNpm(projectDir), pm });
+  const mut = mutation ? mutationWorkflowFor(language, pm) : null;
   const all = [...WORKFLOWS, ...(quality ? [quality] : []), ...extras, ...(mut ? [mut] : [])];
   const results = [];
   for (const wf of all) {

package/src/harden/workflow-templates.js

@@ -54,15 +54,37 @@ const header = (steps) =>
     ...steps,
   ].join("\n");
 
+// Per-package-manager commands (KJC-BUG-0131, issue #1330): `npm ci` in a
+// pnpm/yarn repo dies with EUSAGE (no package-lock.json). corepack ships with
+// Node 22 and resolves the right pnpm/yarn from `packageManager` — no
+// third-party action. pnpm passes flags AFTER the script name to the script
+// itself, so --if-present must go BEFORE it; yarn has no --if-present at all,
+// so lint runs through `npm run` (scripts don't touch the lockfile).
+const PM_COMMANDS = {
+  npm: { setup: [], install: "npm ci", lint: "npm run -s lint --if-present", test: "npm test" },
+  pnpm: {
+    setup: ["      - run: corepack enable"],
+    install: "pnpm install --frozen-lockfile",
+    lint: "pnpm run --if-present -s lint",
+    test: "pnpm test",
+  },
+  yarn: {
+    setup: ["      - run: corepack enable"],
+    install: "yarn install --frozen-lockfile",
+    lint: "npm run -s lint --if-present",
+    test: "yarn test",
+  },
+};
+
+const nodeSetupSteps = (pm) => [
+  "      - uses: actions/setup-node@v4",
+  "        with:",
+  "          node-version: 22",
+  ...(PM_COMMANDS[pm] || PM_COMMANDS.npm).setup,
+  `      - run: ${(PM_COMMANDS[pm] || PM_COMMANDS.npm).install}`,
+];
+
 const QUALITY_BY_LANGUAGE = {
-  javascript: header([
-    "      - uses: actions/setup-node@v4",
-    "        with:",
-    "          node-version: 22",
-    "      - run: npm ci",
-    "      - run: npm run -s lint --if-present",
-    "      - run: npm test",
-  ]),
   python: header([
     "      - uses: actions/setup-python@v5",
     "        with:",
@@ -87,11 +109,13 @@ const QUALITY_BY_LANGUAGE = {
     "      - run: vendor/bin/phpunit",
   ]),
 };
-QUALITY_BY_LANGUAGE.typescript = QUALITY_BY_LANGUAGE.javascript;
-
 /** Stack-aware Quality workflow entry, or null for an unknown language. */
-export function qualityWorkflowFor(language) {
-  const body = QUALITY_BY_LANGUAGE[language];
+export function qualityWorkflowFor(language, pm = "npm") {
+  const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
+  const body =
+    language === "javascript" || language === "typescript"
+      ? header([...nodeSetupSteps(pm), `      - run: ${c.lint}`, `      - run: ${c.test}`])
+      : QUALITY_BY_LANGUAGE[language];
   return body ? { file: "kj-quality.yml", blockId: "wf-quality", body } : null;
 }
 
@@ -123,29 +147,29 @@ export const SHRINK_BUDGET_WORKFLOW = [
 ].join("\n");
 
 // Packs the tarball and installs it clean — only for publishable npm packages.
-export const PACK_SMOKE_WORKFLOW = [
-  "name: Pack smoke",
-  "on:",
-  "  pull_request:",
-  "    branches: [main]",
-  "permissions:",
-  "  contents: read",
-  "jobs:",
-  "  pack-smoke:",
-  "    runs-on: ubuntu-latest",
-  "    steps:",
-  "      - uses: actions/checkout@v4",
-  "      - uses: actions/setup-node@v4",
-  "        with:",
-  "          node-version: 22",
-  "      - run: npm ci",
-  "      - name: Pack and install the tarball clean",
-  "        run: |",
-  "          tgz=$(npm pack --silent)",
-  "          dir=$(mktemp -d)",
-  '          npm install --prefix "$dir" "$PWD/$tgz" --no-audit --no-fund',
-  '          echo "Tarball installs clean: $tgz"',
-].join("\n");
+// `npm pack`/`npm install <tarball>` need no lockfile, so only the dependency
+// install step is package-manager-aware.
+export const packSmokeWorkflow = (pm = "npm") =>
+  [
+    "name: Pack smoke",
+    "on:",
+    "  pull_request:",
+    "    branches: [main]",
+    "permissions:",
+    "  contents: read",
+    "jobs:",
+    "  pack-smoke:",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    ...nodeSetupSteps(pm),
+    "      - name: Pack and install the tarball clean",
+    "        run: |",
+    "          tgz=$(npm pack --silent)",
+    "          dir=$(mktemp -d)",
+    '          npm install --prefix "$dir" "$PWD/$tgz" --no-audit --no-fund',
+    '          echo "Tarball installs clean: $tgz"',
+  ].join("\n");
 
 // Opt-in nightly/manual mutation audit (KJC-TSK-0589). NEVER a PR gate: it runs
 // on a weekly schedule + manual dispatch, and the mutate step is non-blocking
@@ -153,7 +177,7 @@ export const PACK_SMOKE_WORKFLOW = [
 // yields a JSON report (stryker/mutmut/infection) get a workflow — no silent
 // scaffold for tools that can't report yet.
 const MUTATION_TOOLCHAIN = {
-  javascript: ["      - run: npm ci"],
+  javascript: "node", // resolved per package manager in mutationWorkflowFor
   python: [
     "      - uses: actions/setup-python@v5",
     "        with:",
@@ -170,9 +194,11 @@ const MUTATION_TOOLCHAIN = {
 MUTATION_TOOLCHAIN.typescript = MUTATION_TOOLCHAIN.javascript;
 
 /** Opt-in mutation workflow entry, or null for a stack without a JSON report. */
-export function mutationWorkflowFor(language) {
-  const toolchain = MUTATION_TOOLCHAIN[language];
-  if (!toolchain) return null;
+export function mutationWorkflowFor(language, pm = "npm") {
+  const entry = MUTATION_TOOLCHAIN[language];
+  if (!entry) return null;
+  const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
+  const toolchain = entry === "node" ? [...c.setup, `      - run: ${c.install}`] : entry;
   const body = [
     "name: Mutation (nightly)",
     "on:",
@@ -200,13 +226,13 @@ export function mutationWorkflowFor(language) {
 }
 
 /** Conditional workflows: shrink-budget on strict, pack-smoke when publishable. */
-export function extraWorkflowsFor({ profile = "standard", publishable = false } = {}) {
+export function extraWorkflowsFor({ profile = "standard", publishable = false, pm = "npm" } = {}) {
   const extras = [];
   if (profile === "strict") {
     extras.push({ file: "kj-shrink-budget.yml", blockId: "wf-shrink", body: SHRINK_BUDGET_WORKFLOW });
   }
   if (publishable) {
-    extras.push({ file: "kj-pack-smoke.yml", blockId: "wf-pack-smoke", body: PACK_SMOKE_WORKFLOW });
+    extras.push({ file: "kj-pack-smoke.yml", blockId: "wf-pack-smoke", body: packSmokeWorkflow(pm) });
   }
   return extras;
 }

package/src/roles/coder-role.js

@@ -17,9 +17,17 @@ export class CoderRole extends AgentRole {
   }
 
   createAgentInstance(provider) {
+    // KJC-BUG-0129 (issues #1301/#1303): running INSIDE an agent does not
+    // make it "the host executor" — delegating sent the full instruction
+    // prompt through elicitInput as a hanging board "question". A CLI
+    // provider spawns as a subprocess ALWAYS; host delegation is explicit
+    // opt-in (roles.coder.host_delegation: true) for MCP-only setups.
     if (this._askHost && isHostAgent(provider)) {
-      this.logger.info(`Host-as-coder: delegating to host AI (skipping ${provider} subprocess)`);
-      return new HostAgent(this.config, this.logger, { askHost: this._askHost });
+      if (this.config?.roles?.coder?.host_delegation === true) {
+        this.logger.info(`Host-as-coder: delegating to host AI (roles.coder.host_delegation, skipping ${provider} subprocess)`);
+        return new HostAgent(this.config, this.logger, { askHost: this._askHost });
+      }
+      this.logger.info(`Running inside ${provider} — spawning it as a subprocess anyway (set roles.coder.host_delegation: true to delegate to the host)`);
     }
     return this._createAgent(provider, this.config, this.logger);
   }

package/src/utils/role-env.js

@@ -0,0 +1,57 @@
+/**
+ * role-env — env allowlist for agent subprocesses (KJC-TSK-0693).
+ *
+ * Agents inherit only what their function requires: system essentials, the
+ * spawned CLI's own auth/config vars, and KJ_* lane vars. Long-lived secrets
+ * that no agent needs (cloud keys, registry tokens, DB URLs) never reach the
+ * child, so a compromised agent or an injected prompt cannot exfiltrate them.
+ * Escapes: `security.env_passthrough` (exact names or trailing-* globs) and
+ * `security.env_allowlist: false` to disable filtering entirely.
+ */
+
+const EXACT = new Set([
+  "PATH", "Path", "HOME", "USER", "LOGNAME", "SHELL", "TERM", "COLORTERM", "LANG",
+  "TZ", "TMPDIR", "TMP", "TEMP", "EDITOR", "CI", "OLLAMA_HOST",
+  // Windows child-process essentials: executable resolution and profile dirs.
+  "SystemRoot", "SYSTEMROOT", "windir", "COMSPEC", "ComSpec", "PATHEXT",
+  "USERPROFILE", "HOMEDRIVE", "HOMEPATH", "APPDATA", "LOCALAPPDATA", "PROGRAMDATA",
+  // SSH agent socket: local-only handle, needed for git fetch/pull over SSH
+  // inside worktrees. Unusable off-machine, unlike a long-lived token.
+  "SSH_AUTH_SOCK", "SSH_AGENT_PID",
+  "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "http_proxy", "https_proxy", "no_proxy",
+]);
+
+// Per-CLI auth/config families. GOOGLE_ covers GOOGLE_APPLICATION_CREDENTIALS
+// (gemini via Vertex); npm_ covers npm_config_* that Node tooling reads.
+const PREFIXES = [
+  "LC_", "XDG_", "KJ_", "NODE_", "npm_",
+  "ANTHROPIC_", "CLAUDE", "OPENAI_", "CODEX", "GEMINI", "GOOGLE_",
+  "QWEN", "DASHSCOPE_", "OPENCODE", "AIDER_", "OPENROUTER_",
+];
+
+// Vars only ONE agent authenticates with — granting them globally would
+// defeat the point (the coder does not need your GitHub token; copilot does).
+const AGENT_EXTRAS = {
+  copilot: ["GITHUB_", "GH_"],
+};
+
+const matches = (pattern, key) =>
+  pattern.endsWith("*") ? key.startsWith(pattern.slice(0, -1)) : key === pattern;
+
+/**
+ * Filter an environment down to what the given agent's subprocess needs.
+ * @param {Record<string,string|undefined>} base - env to filter
+ * @param {{agent?: string|null, passthrough?: string[]}} [opts]
+ * @returns {Record<string,string|undefined>}
+ */
+export function buildAgentEnv(base = process.env, { agent = null, passthrough = [] } = {}) {
+  const prefixes = [...PREFIXES, ...(AGENT_EXTRAS[agent] || [])];
+  const out = {};
+  for (const [key, value] of Object.entries(base)) {
+    if (EXACT.has(key) || prefixes.some((p) => key.startsWith(p)) || passthrough.some((p) => matches(p, key))) {
+      out[key] = value;
+    }
+  }
+  return out;
+}