karajan-code 4.6.3 → 4.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.6.3",
+  "version": "4.7.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/base-agent.js

@@ -11,6 +11,7 @@
  */
 
 import { defaultEnvironment } from "../infrastructure/environment.js";
+import { buildAgentEnv } from "../utils/role-env.js";
 
 const MODEL_NOT_SUPPORTED_PATTERNS = [
   /model.{0,30}is not supported/i,
@@ -49,6 +50,25 @@ export class BaseAgent {
    * @returns {Promise<CommandRunResult>}
    */
   async runCommand(command, args = [], options = {}) {
+    // KJC-TSK-0693: the subprocess gets an env allowlist, never the user's
+    // whole environment. security.env_allowlist:false opts out.
+    if (this.config?.security?.env_allowlist !== false) {
+      // Solomon-arbitrated contract (KJC-TSK-0693): an explicit env WITH a
+      // PATH is a COMPLETE child env (agents build those from process.env and
+      // deliberately strip vars — cleanExecaOpts drops CLAUDECODE, qwen
+      // unsets gemini's trust var) and is filtered AS GIVEN. An env WITHOUT
+      // a PATH is a partial overlay and merges over the inherited env first,
+      // so an overlay caller can never cost the child PATH/HOME.
+      const complete = options.env && ("PATH" in options.env || "Path" in options.env);
+      const base = complete ? options.env : { ...process.env, ...(options.env || {}) };
+      options = {
+        ...options,
+        env: buildAgentEnv(base, {
+          agent: this.name,
+          passthrough: this.config?.security?.env_passthrough || [],
+        }),
+      };
+    }
     return this.environment.runner.run(command, args, options);
   }
 

package/src/checks/ai-surface.js

@@ -0,0 +1,76 @@
+/**
+ * ai-surface — MCP inventory with drift detection (KJC-TSK-0694).
+ *
+ * Every new tool an agent gains is one more access. An inventory nobody
+ * reconciles is "the feeling of control without the control", so kj check
+ * flags what APPEARED since the last run and asks the user to own it.
+ * A nudge, never a gate. ~/.claude.json is scoped to its global block plus
+ * THIS project's entry — other projects' MCPs are not reachable here.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const sources = (projectDir, home) => [
+  { file: path.join(projectDir, ".mcp.json"), format: "json" },
+  { file: path.join(home, ".claude.json"), format: "json" },
+  { file: path.join(home, ".codex", "config.toml"), format: "toml" },
+  { file: path.join(home, ".gemini", "settings.json"), format: "json" },
+];
+
+function jsonServerNames(text, projectDir) {
+  try {
+    const parsed = JSON.parse(text);
+    const names = new Set(Object.keys(parsed.mcpServers || {}));
+    for (const name of Object.keys(parsed.projects?.[projectDir]?.mcpServers || {})) names.add(name);
+    return names;
+  } catch {
+    return new Set();
+  }
+}
+
+const tomlServerNames = (text) =>
+  new Set([...text.matchAll(/^\s*\[mcp_servers\.["']?([^\]"']+)["']?\]/gm)].map((m) => m[1]));
+
+/** Sorted `name (config-file)` entries for every MCP reachable in this project. */
+export function collectAiSurface({ projectDir = process.cwd(), home = os.homedir() } = {}) {
+  const surface = new Set();
+  for (const { file, format } of sources(projectDir, home)) {
+    if (!existsSync(file)) continue;
+    let text;
+    try { text = readFileSync(file, "utf8"); } catch { continue; }
+    const names = format === "toml" ? tomlServerNames(text) : jsonServerNames(text, projectDir);
+    for (const name of names) surface.add(`${name} (${path.basename(file)})`);
+  }
+  return [...surface].sort();
+}
+
+/**
+ * Diff the current surface against the last-seen snapshot and persist the
+ * new state. First run records the baseline silently.
+ */
+export function checkAiSurface({ projectDir = process.cwd(), home = os.homedir(), statePath = path.join(os.homedir(), ".karajan", "ai-surface.json") } = {}) {
+  const surface = collectAiSurface({ projectDir, home });
+  let state = {};
+  try { state = JSON.parse(readFileSync(statePath, "utf8")); } catch { /* first run or corrupt → baseline */ }
+  const prev = Array.isArray(state[projectDir]) ? state[projectDir] : null;
+  const added = prev ? surface.filter((e) => !prev.includes(e)) : [];
+  const removed = prev ? prev.filter((e) => !surface.includes(e)) : [];
+  state[projectDir] = surface;
+  try {
+    mkdirSync(path.dirname(statePath), { recursive: true });
+    writeFileSync(statePath, JSON.stringify(state, null, 2));
+  } catch { /* read-only FS — inventory still reports, just cannot remember */ }
+  return { surface, added, removed, first: !prev };
+}
+
+/** One line for kj check output. */
+export function formatAiSurface({ surface, added, removed, first }) {
+  const head = `ai surface: ${surface.length} MCP(s)`;
+  if (first) return `${head} — baseline recorded`;
+  const parts = [head];
+  if (added.length) parts.push(`NEW since last check: ${added.join(", ")} — approved by you?`);
+  if (removed.length) parts.push(`gone: ${removed.join(", ")}`);
+  return parts.join(" · ");
+}

package/src/commands/check.js

@@ -6,21 +6,26 @@
 
 import { checkHarden } from "../harden/check.js";
 import { collectMethodStats, formatMethodStats } from "../checks/method.js";
+import { checkAiSurface, formatAiSurface } from "../checks/ai-surface.js";
 
 export async function checkCommand({ projectDir = process.cwd(), profile = "standard", json = false, logger = console } = {}) {
   const result = await checkHarden({ projectDir, profile });
   // KJC-TSK-0689 (MG-D): method adherence is VISIBILITY, not a gate — it
   // rides along in check output but never affects the exit code.
   const method = await collectMethodStats({ projectDir }).catch(() => null);
+  // KJC-TSK-0694: same deal for the MCP inventory — a nudge, never a gate.
+  let aiSurface = null;
+  try { aiSurface = checkAiSurface({ projectDir }); } catch { /* inventory is best-effort */ }
 
   if (json) {
-    logger.info?.(JSON.stringify({ ...result, method }));
+    logger.info?.(JSON.stringify({ ...result, method, aiSurface }));
     return result.ok ? 0 : 1;
   }
 
   logger.info?.(`kj check (${profile})`);
   for (const c of result.checks) logger.info?.(`  ${c.ok ? "✓" : "✗"} ${c.id}: ${c.detail}`);
   if (method) logger.info?.(`  method: ${formatMethodStats(method)}`);
+  if (aiSurface) logger.info?.(`  ${formatAiSurface(aiSurface)}`);
   if (!result.ok) logger.info?.("Harness drift detected — run `kj harden` to repair.");
   else logger.info?.("Harness OK.");
   return result.ok ? 0 : 1;

package/src/utils/role-env.js

@@ -0,0 +1,57 @@
+/**
+ * role-env — env allowlist for agent subprocesses (KJC-TSK-0693).
+ *
+ * Agents inherit only what their function requires: system essentials, the
+ * spawned CLI's own auth/config vars, and KJ_* lane vars. Long-lived secrets
+ * that no agent needs (cloud keys, registry tokens, DB URLs) never reach the
+ * child, so a compromised agent or an injected prompt cannot exfiltrate them.
+ * Escapes: `security.env_passthrough` (exact names or trailing-* globs) and
+ * `security.env_allowlist: false` to disable filtering entirely.
+ */
+
+const EXACT = new Set([
+  "PATH", "Path", "HOME", "USER", "LOGNAME", "SHELL", "TERM", "COLORTERM", "LANG",
+  "TZ", "TMPDIR", "TMP", "TEMP", "EDITOR", "CI", "OLLAMA_HOST",
+  // Windows child-process essentials: executable resolution and profile dirs.
+  "SystemRoot", "SYSTEMROOT", "windir", "COMSPEC", "ComSpec", "PATHEXT",
+  "USERPROFILE", "HOMEDRIVE", "HOMEPATH", "APPDATA", "LOCALAPPDATA", "PROGRAMDATA",
+  // SSH agent socket: local-only handle, needed for git fetch/pull over SSH
+  // inside worktrees. Unusable off-machine, unlike a long-lived token.
+  "SSH_AUTH_SOCK", "SSH_AGENT_PID",
+  "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "http_proxy", "https_proxy", "no_proxy",
+]);
+
+// Per-CLI auth/config families. GOOGLE_ covers GOOGLE_APPLICATION_CREDENTIALS
+// (gemini via Vertex); npm_ covers npm_config_* that Node tooling reads.
+const PREFIXES = [
+  "LC_", "XDG_", "KJ_", "NODE_", "npm_",
+  "ANTHROPIC_", "CLAUDE", "OPENAI_", "CODEX", "GEMINI", "GOOGLE_",
+  "QWEN", "DASHSCOPE_", "OPENCODE", "AIDER_", "OPENROUTER_",
+];
+
+// Vars only ONE agent authenticates with — granting them globally would
+// defeat the point (the coder does not need your GitHub token; copilot does).
+const AGENT_EXTRAS = {
+  copilot: ["GITHUB_", "GH_"],
+};
+
+const matches = (pattern, key) =>
+  pattern.endsWith("*") ? key.startsWith(pattern.slice(0, -1)) : key === pattern;
+
+/**
+ * Filter an environment down to what the given agent's subprocess needs.
+ * @param {Record<string,string|undefined>} base - env to filter
+ * @param {{agent?: string|null, passthrough?: string[]}} [opts]
+ * @returns {Record<string,string|undefined>}
+ */
+export function buildAgentEnv(base = process.env, { agent = null, passthrough = [] } = {}) {
+  const prefixes = [...PREFIXES, ...(AGENT_EXTRAS[agent] || [])];
+  const out = {};
+  for (const [key, value] of Object.entries(base)) {
+    if (EXACT.has(key) || prefixes.some((p) => key.startsWith(p)) || passthrough.some((p) => matches(p, key))) {
+      out[key] = value;
+    }
+  }
+  return out;
+}