karajan-code 4.65.0 → 4.65.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.65.0",
+  "version": "4.65.1",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/packages/hu-board/src/preflight.js

@@ -29,7 +29,8 @@
 
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { getHuBoardPlansDirs } from './db.js';
 
 function runQuiet(cmd, opts = {}) {
@@ -71,10 +72,24 @@ function checkGitRemote(projectDir) {
       blocking: false
     };
   }
-  // Capture first remote URL for display.
-  const firstLine = r.out.split('\n')[0] || '';
-  const remoteUrl = firstLine.split(/\s+/)[1] || '(unknown)';
-  return { id: 'git_remote', label: 'Repositorio remoto', status: 'ok', detail: remoteUrl, blocking: false };
+  // KJC-BUG-0398: origin is the remote that matters, not the first alphabetically; a remote
+  // whose URL is a local path that no longer exists is garbage, named with its removal.
+  // `git remote -v` is "<name>\t<url> (fetch|push)": a URL may hold spaces, and fetch and push may differ.
+  const entries = r.out.split('\n').map((line) => /^(\S+)\t(.+) \((?:fetch|push)\)$/.exec(line)).filter(Boolean).map(([, name, url]) => ({ name, url }));
+  const shown = (entries.find((e) => e.name === 'origin') ?? entries[0])?.url ?? '(unknown)';
+  // A local remote is an absolute or ./ ../ path (resolved from the project) or a file:// URL.
+  const localPath = (url) => {
+    if (url.startsWith('file://')) {
+      try { return fileURLToPath(url); } catch { return null; } // host-qualified or malformed: not judged
+    }
+    return /^(\/|\.\.?\/)/.test(url) ? resolve(projectDir, url) : null;
+  };
+  const dead = [...new Set(entries.filter(({ url }) => localPath(url) && !existsSync(localPath(url))).map((e) => e.name))];
+  if (dead.length === 0) return { id: 'git_remote', label: 'Repositorio remoto', status: 'ok', detail: shown, blocking: false };
+  return {
+    id: 'git_remote', label: 'Repositorio remoto', status: 'warn', detail: shown, blocking: false,
+    consequence: `Remotos que apuntan a carpetas que ya no existen: ${dead.join(', ')}. No sirven y confunden; bórralos con: ${dead.map((n) => `git remote remove -- '${n.replaceAll("'", "'\\''")}'`).join(' && ')}`,
+  };
 }
 
 function checkGitBranch(projectDir) {

package/src/checks/repo-state.js

@@ -19,10 +19,13 @@
 
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const STRATEGY_MANUAL = "manual";
 
+// KJC-BUG-0398: a remote's name is free text; quoted, it can never be read as a command.
+const shellQuote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
 const git = (projectDir, args) => execFileSync("git", ["-C", projectDir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
 const gitOk = (projectDir, args) => { try { git(projectDir, args); return true; } catch { return false; } };
 
@@ -77,6 +80,26 @@ export function createRepoStateCheck({ projectDir }) {
         });
       }
 
+      // KJC-BUG-0398: a remote whose URL is a local folder that no longer exists is garbage
+      // (four /tmp imports lived two months here unnoticed, and the board showed one as the remote).
+      // `git remote -v` is "<name>\t<url> (fetch|push)": a URL may hold spaces, and fetch and push may differ.
+      // A local remote is an absolute or ./ ../ path (resolved from the project) or a file:// URL.
+      const localPath = (url) => {
+        if (url.startsWith("file://")) {
+          try { return fileURLToPath(url); } catch { return null; } // host-qualified or malformed: not judged
+        }
+        return /^(\/|\.\.?\/)/.test(url) ? resolve(dir, url) : null;
+      };
+      const dead = git(dir, ["remote", "-v"]).split("\n").map((l) => /^(\S+)\t(.+) \((?:fetch|push)\)$/.exec(l))
+        .filter((m) => m && localPath(m[2]) && !existsSync(localPath(m[2]))).map((m) => m[1]);
+      const deadRemotes = [...new Set(dead)];
+      if (deadRemotes.length) {
+        symptoms.push({
+          detail: `remotos que apuntan a carpetas que ya no existen: ${deadRemotes.join(", ")}`,
+          fix: deadRemotes.map((n) => `git remote remove -- ${shellQuote(n)}`).join(" && "),
+        });
+      }
+
       if (symptoms.length === 0) return { ok: true, severity: "info", detail: "el repositorio está en orden" };
       return {
         ok: false,

package/src/harden/branch-protection.js

@@ -7,6 +7,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { runCommand } from "../utils/process.js";
+import { assertGhIdentity } from "../hu/gh-identity.js";
 
 // Scheduled or advisory kj workflows: they never block a PR, so they are never required.
 const NOT_REQUIRED = new Set(["kj-mutation.yml", "kj-steward.yml"]);
@@ -34,7 +35,8 @@ const protectionPath = ({ owner, repo, branch }) => `repos/${owner}/${repo}/bran
 
 function protectCommand({ checks, ...target }) {
   const contexts = checks.map((c) => `-f ${shellQuote(`required_status_checks[contexts][]=${c}`)}`).join(" ");
-  return `gh api -X PUT ${protectionPath(target)} -F 'required_status_checks[strict]=false' ${contexts} -F enforce_admins=false -F required_pull_request_reviews=null -F restrictions=null -F allow_force_pushes=false`;
+  // KJC-BUG-0401: enforce_admins=true; an agent working with an admin's token would skip every check otherwise.
+  return `gh api -X PUT ${protectionPath(target)} -F 'required_status_checks[strict]=false' ${contexts} -F enforce_admins=true -F required_pull_request_reviews=null -F restrictions=null -F allow_force_pushes=false`;
 }
 
 const addCommand = ({ missing, ...target }) =>
@@ -62,24 +64,37 @@ export async function protectionAdvice({ owner, repo, branch, checks, run = runC
     if (/404|not protected/i.test(`${res.stderr}${res.stdout}`)) return { status: "unprotected", command: protectCommand({ ...target, checks }) };
     return { status: "unverified", reason: (res.stderr || res.stdout || "gh failed").trim(), settings: settingsUrl(target), missing: checks };
   }
-  const statusChecks = JSON.parse(res.stdout || "{}").required_status_checks;
+  const protection = JSON.parse(res.stdout || "{}");
+  const statusChecks = protection.required_status_checks;
   if (!statusChecks) return { status: "no-checks", settings: settingsUrl(target), missing: checks };
   const existing = new Set(statusChecks.contexts ?? []);
   const missing = checks.filter((c) => !existing.has(c));
-  return missing.length === 0 ? { status: "ok" } : { status: "missing", missing, command: addCommand({ ...target, missing }) };
+  // KJC-BUG-0401: required checks an admin skips are not required for an agent holding an admin's token.
+  const bindAdmins = protection.enforce_admins?.enabled === false ? `gh api -X POST ${protectionPath(target)}/enforce_admins` : null;
+  if (missing.length > 0) return { status: "missing", missing, command: [addCommand({ ...target, missing }), bindAdmins].filter(Boolean).join(" && ") };
+  if (bindAdmins) return { status: "admins-exempt", command: bindAdmins };
+  return { status: "ok" };
 }
 
 // Owner and repo go into a command an admin copies: only the characters GitHub allows in them.
 const GITHUB_REMOTE = /github\.com[^:/]*[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?$/;
 
 /** kj harden's last step: on a GitHub remote, what the base branch needs and who runs it. */
-export async function adviseBranchProtection({ projectDir, branch, logger, run = runCommand }) {
+export async function adviseBranchProtection({ projectDir, branch, logger, run = runCommand, identity = assertGhIdentity }) {
   const checks = requiredChecksFrom(projectDir);
   if (checks.length === 0) return null;
   const remote = await run("git", ["-C", projectDir, "remote", "get-url", "origin"]).catch(() => null);
   const match = remote?.exitCode === 0 ? GITHUB_REMOTE.exec(remote.stdout.trim()) : null;
   if (!match) return null;
-  const advice = await protectionAdvice({ owner: match[1], repo: match[2], branch, checks, run });
+  // KJC-BUG-0401: read the protection as the account the clone declares; another one gets a 404
+  // and kj said "not protected" about a protected branch.
+  let advice;
+  try {
+    identity({ projectDir });
+    advice = await protectionAdvice({ owner: match[1], repo: match[2], branch, checks, run });
+  } catch (err) {
+    advice = { status: "unverified", reason: err.message, settings: settingsUrl({ owner: match[1], repo: match[2] }), missing: checks };
+  }
   if (advice.status === "ok") {
     logger.info?.(`  • branch protection: ${branch} requires the ${checks.length} kj check(s)`);
     return advice;
@@ -90,6 +105,7 @@ export async function adviseBranchProtection({ projectDir, branch, logger, run =
     missing: `${branch} does not require ${advice.missing?.length} kj check(s) (${list}). An admin runs (kj never does):`,
     "no-checks": `${branch} is protected but requires no status checks. An admin enables "Require status checks" and adds ${list} in:`,
     unverified: `could not read the protection of ${branch} (${advice.reason}). An admin checks that ${list} are required in:`,
+    "admins-exempt": `${branch} requires the kj checks, but admins can merge without them, and an agent working with an admin's token would. An admin runs (kj never does):`,
   }[advice.status];
   logger.warn?.(`  ⚠ branch protection: ${why}`);
   logger.warn?.(`      ${advice.command ?? advice.settings}`);

package/src/harden/supervisor-commit.js

@@ -30,6 +30,11 @@ const HARNESS_PREFIX = ".karajan/harness/";
 // with the repo is sealed with the supervisor, so a policy change enters only
 // with the human's signed act. kj.config.yml is machine-local: CI never sees it.
 export const GOVERNANCE_FILES = [".karajan/policy.yml", ".karajan/rules.yml"];
+// KJC-BUG-0400: the CI workflows are sealed the same way, by hash: a PR could
+// otherwise rewrite the check that judges it and pass with a forged seal.
+const WORKFLOW_FILE = /^\.github\/workflows\/[^/]+\.ya?ml$/;
+/** A file the seal covers by its hash alone: the governance config and every CI workflow. */
+export const isSealedConfig = (file) => GOVERNANCE_FILES.includes(file) || WORKFLOW_FILE.test(file);
 
 const sha256 = (abs) => createHash("sha256").update(readFileSync(abs)).digest("hex");
 
@@ -83,7 +88,7 @@ export async function commitSupervisorRegeneration({
   // KJC-BUG-0244 (grebla #958): el commit sellado solo lleva el supervisor, pero
   // un stage ajeno se quedaba en esta rama y el siguiente commit caía aquí con la
   // card equivocada. Se para ANTES de pedir nada al humano y se nombra.
-  const foreign = run(["diff", "--cached", "--name-only"]).split("\n").filter((f) => f && !f.startsWith(HOOKS_PREFIX) && f !== PROVENANCE_FILE && !GOVERNANCE_FILES.includes(f));
+  const foreign = run(["diff", "--cached", "--name-only"]).split("\n").filter((f) => f && !f.startsWith(HOOKS_PREFIX) && f !== PROVENANCE_FILE && !isSealedConfig(f));
   if (foreign.length > 0) {
     throw new Error(
       `harden --commit: hay cambios en el stage que no son del supervisor (${foreign.slice(0, 5).join(", ")}${foreign.length > 5 ? ", …" : ""}): commitéalos en su rama o sácalos del stage (git restore --staged <ficheros>) antes de sellar`,
@@ -92,8 +97,10 @@ export async function commitSupervisorRegeneration({
   // Capa 4 (test adversarial 6-sep: un huérfano a init con pty falso y
   // prompts a ciegas llegó hasta aquí): nonce aleatorio tecleado de vuelta.
   seal.confirm(deps.confirm);
-  const tracked = new Set(run(["ls-files", "--", ...GOVERNANCE_FILES]).split("\n").filter(Boolean));
-  const governance = GOVERNANCE_FILES.filter((f) => existsSync(join(projectDir, f)) || tracked.has(f));
+  const tracked = new Set(run(["ls-files", "--", ...GOVERNANCE_FILES, ".github/workflows"]).split("\n").filter(Boolean));
+  const onDisk = (() => { try { return readdirSync(join(projectDir, ".github", "workflows")).map((f) => `.github/workflows/${f}`); } catch { return []; } })();
+  const candidates = [...new Set([...GOVERNANCE_FILES, ...onDisk, ...tracked])].filter(isSealedConfig).sort();
+  const governance = candidates.filter((f) => existsSync(join(projectDir, f)) || tracked.has(f));
   const governanceDrift = governance.length === 0 ? [] : run(["status", "--porcelain", "--", ...governance]).split("\n").map((l) => l.slice(3).trim()).filter(Boolean);
   const drift = [...supervisorDrift({ projectDir, gitFn: run }), ...governanceDrift];
   // La provenance describe SIEMPRE el estado COMPLETO del supervisor (cazado

package/src/harden/workflow-templates.js

@@ -67,6 +67,8 @@ export const WORKFLOWS = [
 // PL-C (KJC-TSK-0735) — tier C del ADR 0001: re-check merge-blocking en CI
 // (cubre el hook local manipulado). Solo se siembra con policy declarada;
 // npx PINEADO a la versión del kj que corrió harden — jamás @latest en CI.
+// KJC-BUG-0399: the judge is never the PR's code. A repo that ships kj itself
+// judges with the kj of the BASE branch, checked out apart; the PR is only data.
 export const policyWorkflowFor = (kjVersion, kjName = "karajan-code") => [
   "name: Policy",
   "on:",
@@ -87,7 +89,15 @@ export const policyWorkflowFor = (kjVersion, kjName = "karajan-code") => [
   "        env:",
   "          BASE_REF: ${{ github.base_ref }}",
   "        run: |",
-  `          if [ -f bin/kj.js ]; then npm ci --ignore-scripts && KJ="node bin/kj.js"; else KJ="npx --yes ${kjName}@${kjVersion}"; fi`,
+  '          JUDGE="$RUNNER_TEMP/kj-judge"',
+  '          git fetch --no-tags origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"',
+  '          if git cat-file -e "origin/${BASE_REF}:bin/kj.js" 2>/dev/null; then',
+  '            git worktree add --detach "$JUDGE" "origin/${BASE_REF}"',
+  '            (cd "$JUDGE" && npm ci --ignore-scripts)',
+  '            KJ="node $JUDGE/bin/kj.js"',
+  "          else",
+  `            KJ="npx --yes ${kjName}@${kjVersion}"`,
+  "          fi",
   '          $KJ policy check --range "origin/${BASE_REF}...HEAD" --strict',
 ].join("\n");
 

package/src/hu/team-board-mirror.js

@@ -4,15 +4,20 @@
  * rewritten from the issues every time kj reads them. It is a view: changing it is done
  * with kj hu move, never from the web, and the board refuses to edit it.
  */
-import { savePlan } from "../plan/plan-store.js";
+import { rm } from "node:fs/promises";
+import path from "node:path";
+import { plansDir, savePlan } from "../plan/plan-store.js";
 
-export const MIRROR_PLAN_ID = "plan_github-board";
+// KJC-BUG-0397: the board reads plan-*.json only and groups a plan by its projectDir;
+// the mirror was plan_github-board.json with no projectDir, so it was never shown.
+export const MIRROR_PLAN_ID = "plan-github-board";
+const LEGACY_MIRROR_FILE = "plan_github-board.json";
 
 /** The shared board as a plan the web board can show, marked read-only. */
 export async function writeTeamMirror(projectDir, rows, { repo }) {
   const now = new Date().toISOString();
   const plan = {
-    version: 2, planId: MIRROR_PLAN_ID, name: "github", alias: "github",
+    version: 2, planId: MIRROR_PLAN_ID, name: "github", alias: "github", projectDir,
     task: `Shared HU Board: GitHub Issues of ${repo}`,
     status: "ready", readonly: "github", createdAt: now,
     hus: rows.map((r) => ({
@@ -22,5 +27,6 @@ export async function writeTeamMirror(projectDir, rows, { repo }) {
     })),
   };
   await savePlan(projectDir, plan);
+  await rm(path.join(plansDir(projectDir), LEGACY_MIRROR_FILE), { force: true });
   return plan;
 }

package/src/policy/engine.js

@@ -35,7 +35,8 @@ export const SUPERVISOR_DEFAULTS = [
     // KJC-TSK-1033 (owner's decision, 13-oct): a policy change is authorized where
     // it is USED (commit, CI, release), whatever wrote it: only the human's seal lifts it.
     id: "defaults.governance.write",
-    pattern: /(^|\/)\.karajan\/(policy|rules)\.yml\b/,
+    // KJC-BUG-0400: the CI workflows too; a PR could rewrite the check that judges it.
+    pattern: /(^|\/)\.karajan\/(policy|rules)\.yml\b|(^|\/)\.github\/workflows\/[^/\s]+\.ya?ml\b/,
     message: "es configuración de gobierno: solo entra sellada por la persona (kj harden --commit, firmado desde su móvil)",
   },
 ];

package/src/policy/supervisor-verify.js

@@ -11,7 +11,7 @@ import { resolve, sep } from "node:path";
 import { renderCanonicalHook } from "../harden/harden-engine.js";
 import { provenanceSignature } from "../harden/phone-sign.js";
 import { canonicalHarnessBody } from "../harden/sentinel-hooks.js";
-import { GOVERNANCE_FILES, PROVENANCE_FILE } from "../harden/supervisor-commit.js";
+import { isSealedConfig, PROVENANCE_FILE } from "../harden/supervisor-commit.js";
 
 const HOOKS_PREFIX = ".karajan/hooks/";
 const HARNESS_PREFIX = ".karajan/harness/";
@@ -69,7 +69,7 @@ export function verifiedSupervisorFiles({ projectDir, trackedOnly = false }) {
     if (typeof entry?.file !== "string") continue;
     // KJC-TSK-1032: the governance config has no canonical render; the sealed
     // hash, signed by the roster where there is one, is the proof.
-    if (GOVERNANCE_FILES.includes(entry.file)) {
+    if (isSealedConfig(entry.file)) {
       const abs = resolve(projectDir, entry.file);
       let st = null;
       try { st = lstatSync(abs); } catch { /* absent */ }