karajan-code 4.65.0 → 4.66.0

package/bin/kj-hook.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * kj-hook <guard>: runs one Sentinel guard from the installed kj package
+ * (KJC-TSK-1203, ADR 0030). The project's hooks name the guard; its code lives
+ * here, outside the project tree, so editing the project cannot change it.
+ * Only the guard is loaded, never the CLI: a hook pays node, not kj's start.
+ * A name outside the closed list blocks (exit 2): a wiring that names no known
+ * guard cannot be trusted to guard anything.
+ */
+import process from "node:process";
+import { runGuard } from "../src/harden/sentinel-guards.js";
+
+await runGuard(process.argv[2]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.65.0",
+  "version": "4.66.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -67,6 +67,7 @@
   ],
   "bin": {
     "kj": "bin/kj.js",
+    "kj-hook": "bin/kj-hook.js",
     "kj-tail": "bin/kj-tail",
     "kj-trash": "packages/ai-trash/bin/kj-trash.js",
     "karajan-mcp": "bin/karajan-mcp.js",

package/packages/hu-board/src/preflight.js

@@ -29,7 +29,8 @@
 
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { getHuBoardPlansDirs } from './db.js';
 
 function runQuiet(cmd, opts = {}) {
@@ -71,10 +72,24 @@ function checkGitRemote(projectDir) {
       blocking: false
     };
   }
-  // Capture first remote URL for display.
-  const firstLine = r.out.split('\n')[0] || '';
-  const remoteUrl = firstLine.split(/\s+/)[1] || '(unknown)';
-  return { id: 'git_remote', label: 'Repositorio remoto', status: 'ok', detail: remoteUrl, blocking: false };
+  // KJC-BUG-0398: origin is the remote that matters, not the first alphabetically; a remote
+  // whose URL is a local path that no longer exists is garbage, named with its removal.
+  // `git remote -v` is "<name>\t<url> (fetch|push)": a URL may hold spaces, and fetch and push may differ.
+  const entries = r.out.split('\n').map((line) => /^(\S+)\t(.+) \((?:fetch|push)\)$/.exec(line)).filter(Boolean).map(([, name, url]) => ({ name, url }));
+  const shown = (entries.find((e) => e.name === 'origin') ?? entries[0])?.url ?? '(unknown)';
+  // A local remote is an absolute or ./ ../ path (resolved from the project) or a file:// URL.
+  const localPath = (url) => {
+    if (url.startsWith('file://')) {
+      try { return fileURLToPath(url); } catch { return null; } // host-qualified or malformed: not judged
+    }
+    return /^(\/|\.\.?\/)/.test(url) ? resolve(projectDir, url) : null;
+  };
+  const dead = [...new Set(entries.filter(({ url }) => localPath(url) && !existsSync(localPath(url))).map((e) => e.name))];
+  if (dead.length === 0) return { id: 'git_remote', label: 'Repositorio remoto', status: 'ok', detail: shown, blocking: false };
+  return {
+    id: 'git_remote', label: 'Repositorio remoto', status: 'warn', detail: shown, blocking: false,
+    consequence: `Remotos que apuntan a carpetas que ya no existen: ${dead.join(', ')}. No sirven y confunden; bórralos con: ${dead.map((n) => `git remote remove -- '${n.replaceAll("'", "'\\''")}'`).join(' && ')}`,
+  };
 }
 
 function checkGitBranch(projectDir) {

package/scripts/esbuild-sea.config.mjs

@@ -29,9 +29,13 @@ const seaTransformPlugin = {
       // KJC-TSK-0915 (ADR 0014): the Sentinel's guard modules are read as TEXT at
       // load time, to be copied into a project's harness. A single-file bundle has
       // no sibling files, so the text is inlined here, before import.meta.url goes.
+      // KJC-BUG-0402: a guard's own import.meta.url is text here; spelled with an
+      // escaped dot it stays the same string at run time and out of the rewrite below.
       const SENTINEL_READ = /readFileSync\(new URL\("(\.\/sentinel\/[\w-]+\.mjs)", import\.meta\.url\), "utf8"\)/g;
       if (SENTINEL_READ.test(contents)) {
-        contents = contents.replace(SENTINEL_READ, (_m, rel) => JSON.stringify(readFileSync(path.resolve(path.dirname(args.path), rel), "utf8")));
+        const escapedDot = `${String.fromCodePoint(92)}u002e`;
+        const asText = (rel) => JSON.stringify(readFileSync(path.resolve(path.dirname(args.path), rel), "utf8")).replaceAll("import.meta.url", `import.meta${escapedDot}url`);
+        contents = contents.replace(SENTINEL_READ, (_m, rel) => asText(rel));
         modified = true;
       }
 

package/src/checks/guarantee-level.js

@@ -9,6 +9,8 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { detectHostAgent } from "../utils/agent-detect.js";
+import { wiringState } from "../harden/harness-hooks.js";
+import { SENTINEL_WIRING } from "../harden/sentinel-hooks.js";
 
 /** Pure: computes the three tiers from observable facts. */
 export function guaranteeLevel({ host, harnessWired, policyDeclared, policyWorkflow }) {
@@ -28,10 +30,11 @@ export function guaranteeLevel({ host, harnessWired, policyDeclared, policyWorkf
 
 /** Facts from disk + env; injectable for tests. */
 export function collectGuaranteeFacts({ projectDir = process.cwd(), deps = {} } = {}) {
-  const { detectHost = detectHostAgent, exists = existsSync } = deps;
+  // KJC-TSK-1208 (ADR 0030): the Sentinel is its wiring now, not files in the project.
+  const { detectHost = detectHostAgent, exists = existsSync, sentinelWired = () => wiringState({ projectDir, entries: SENTINEL_WIRING }).missing.length === 0 } = deps;
   return guaranteeLevel({
     host: detectHost(),
-    harnessWired: exists(join(projectDir, ".karajan", "harness", "pretooluse-sentinel.mjs")),
+    harnessWired: sentinelWired(),
     policyDeclared: exists(join(projectDir, ".karajan", "policy.yml")),
     policyWorkflow: exists(join(projectDir, ".github", "workflows", "kj-policy.yml")),
   });

package/src/checks/repo-state.js

@@ -19,10 +19,13 @@
 
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const STRATEGY_MANUAL = "manual";
 
+// KJC-BUG-0398: a remote's name is free text; quoted, it can never be read as a command.
+const shellQuote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
 const git = (projectDir, args) => execFileSync("git", ["-C", projectDir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
 const gitOk = (projectDir, args) => { try { git(projectDir, args); return true; } catch { return false; } };
 
@@ -77,6 +80,26 @@ export function createRepoStateCheck({ projectDir }) {
         });
       }
 
+      // KJC-BUG-0398: a remote whose URL is a local folder that no longer exists is garbage
+      // (four /tmp imports lived two months here unnoticed, and the board showed one as the remote).
+      // `git remote -v` is "<name>\t<url> (fetch|push)": a URL may hold spaces, and fetch and push may differ.
+      // A local remote is an absolute or ./ ../ path (resolved from the project) or a file:// URL.
+      const localPath = (url) => {
+        if (url.startsWith("file://")) {
+          try { return fileURLToPath(url); } catch { return null; } // host-qualified or malformed: not judged
+        }
+        return /^(\/|\.\.?\/)/.test(url) ? resolve(dir, url) : null;
+      };
+      const dead = git(dir, ["remote", "-v"]).split("\n").map((l) => /^(\S+)\t(.+) \((?:fetch|push)\)$/.exec(l))
+        .filter((m) => m && localPath(m[2]) && !existsSync(localPath(m[2]))).map((m) => m[1]);
+      const deadRemotes = [...new Set(dead)];
+      if (deadRemotes.length) {
+        symptoms.push({
+          detail: `remotos que apuntan a carpetas que ya no existen: ${deadRemotes.join(", ")}`,
+          fix: deadRemotes.map((n) => `git remote remove -- ${shellQuote(n)}`).join(" && "),
+        });
+      }
+
       if (symptoms.length === 0) return { ok: true, severity: "info", detail: "el repositorio está en orden" };
       return {
         ok: false,

package/src/cli/register-meta.js

@@ -42,8 +42,8 @@ import { policyAddCommand } from "../policy/add.js";
 import { withConfig } from "./_shared.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { spawnSync } from "node:child_process";
 import { verifySentinelScripts, resolveSentinelRoot } from "../harden/sentinel-hooks.js";
+import { runGuard } from "../harden/sentinel-guards.js";
 import { boardGate } from "../review/board-pending.js";
 import { panelDeviation } from "../environment/panel.js";
 import { detectHostAgent } from "../utils/agent-detect.js";
@@ -697,14 +697,15 @@ export function registerMeta(program, { pkgVersion }) {
   const sentinel = program.command("sentinel").description("Deterministic method supervisor wired into the harness hooks (Claude Code)");
   sentinel.command("status")
     .description("Print the per-session method facts (sources/tests edited, escapes used) and any open violation the Stop gate would block on")
-    .action(() => {
-      const script = join(resolveSentinelRoot(), ".karajan", "harness", "stop.mjs");
-      if (!existsSync(script)) {
+    .action(async () => {
+      if (!existsSync(join(resolveSentinelRoot(), ".karajan", "harness"))) {
         console.log("sentinel: not installed in this project — run `kj harden` (standard profile or higher)");
         process.exitCode = 1;
         return;
       }
-      process.exitCode = spawnSync("node", [script, "--status"], { stdio: "inherit" }).status ?? 0;
+      // KJC-TSK-1208 (ADR 0030): the Stop guard of this kj, in its report mode.
+      process.argv.push("--status");
+      await runGuard("stop");
     });
   sentinel.command("verify")
     .description("Verify the harness scripts match this kj install — the root of trust is the installed package, not the project tree; exit 1 lists what was modified")
@@ -720,6 +721,13 @@ export function registerMeta(program, { pkgVersion }) {
       else console.log(res.ok ? "sentinel verify: scripts intactos" : `sentinel verify: modificados fuera de kj harden: ${res.mismatched.join(", ")} — restaura con kj harden`);
       process.exitCode = res.ok ? 0 : 1;
     });
+  // KJC-TSK-1204 (ADR 0030): the single-file binary has no kj-hook, so its
+  // wiring runs the guards through here, from the same closed list.
+  sentinel.command("hook <guard>")
+    .description("Run one Sentinel guard from this kj install, reading the hook's input from stdin (the wiring of a single-file kj; npm installs use kj-hook)")
+    .action(async (guard) => {
+      await runGuard(guard);
+    });
   // KJC-TSK-0868: el anfitrión escribiendo con otro coder declarado no se
   // bloquea, se registra. El Stop gate pregunta una vez por sesión.
   sentinel.command("panel-check")

package/src/harden/advisory.js

@@ -13,6 +13,8 @@ import { join } from "node:path";
 
 import { findManagedBlock } from "../utils/managed-markers.js";
 import { findAlternative } from "./alternatives.js";
+import { wiringState } from "./harness-hooks.js";
+import { SENTINEL_WIRING } from "./sentinel-hooks.js";
 import { CONFIGS_BY_LANGUAGE, UNIVERSAL_CONFIGS } from "./config-templates.js";
 import { detectStackRoots } from "./stack-roots.js";
 
@@ -169,14 +171,15 @@ export function classifyArtifact(searchDir, artifact, altDirs = [searchDir]) {
 // KJC-BUG-0335 (#2094): the method's own pieces, not only the configs. Without
 // them the report said "0 missing" while the review gate demanded the Sentinel.
 const METHOD_PIECES = [
+  // KJC-TSK-1208 (ADR 0030): the Sentinel is its wiring to the installed kj, not files.
   { id: "sentinel", what: "the Sentinel (it records the session, the RAG queries the review gate needs among them)",
-    files: [".karajan/harness/pretooluse-sentinel.mjs", ".karajan/harness/posttooluse.mjs", ".karajan/harness/stop.mjs"] },
+    files: [".claude/settings.json"], missingOf: (projectDir) => wiringState({ projectDir, entries: SENTINEL_WIRING }).missing },
   { id: "git-hooks", what: "the git hooks", files: [".karajan/hooks/pre-commit", ".karajan/hooks/commit-msg", ".karajan/hooks/pre-push"] },
 ];
 
-function methodPiece(projectDir, { id, what, files }) {
+function methodPiece(projectDir, { id, what, files, missingOf }) {
   const head = { dir: ".", id, file: files[0], currentVersion: null, managedVersion: null, upToDate: null, improvements: [], mergeable: false };
-  const missing = files.filter((f) => !existsSync(join(projectDir, f)));
+  const missing = missingOf ? missingOf(projectDir) : files.filter((f) => !existsSync(join(projectDir, f)));
   return missing.length === 0
     ? { ...head, status: "KJ_MANAGED", foundAt: files[0], recommendation: "keep", rationale: `${what}: installed` }
     : { ...head, status: "MISSING", foundAt: null, missing, recommendation: "install", rationale: `kj harden (without --report) installs ${what}; missing: ${missing.join(", ")}` };

package/src/harden/branch-protection.js

@@ -7,6 +7,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { runCommand } from "../utils/process.js";
+import { assertGhIdentity } from "../hu/gh-identity.js";
 
 // Scheduled or advisory kj workflows: they never block a PR, so they are never required.
 const NOT_REQUIRED = new Set(["kj-mutation.yml", "kj-steward.yml"]);
@@ -34,7 +35,8 @@ const protectionPath = ({ owner, repo, branch }) => `repos/${owner}/${repo}/bran
 
 function protectCommand({ checks, ...target }) {
   const contexts = checks.map((c) => `-f ${shellQuote(`required_status_checks[contexts][]=${c}`)}`).join(" ");
-  return `gh api -X PUT ${protectionPath(target)} -F 'required_status_checks[strict]=false' ${contexts} -F enforce_admins=false -F required_pull_request_reviews=null -F restrictions=null -F allow_force_pushes=false`;
+  // KJC-BUG-0401: enforce_admins=true; an agent working with an admin's token would skip every check otherwise.
+  return `gh api -X PUT ${protectionPath(target)} -F 'required_status_checks[strict]=false' ${contexts} -F enforce_admins=true -F required_pull_request_reviews=null -F restrictions=null -F allow_force_pushes=false`;
 }
 
 const addCommand = ({ missing, ...target }) =>
@@ -62,24 +64,37 @@ export async function protectionAdvice({ owner, repo, branch, checks, run = runC
     if (/404|not protected/i.test(`${res.stderr}${res.stdout}`)) return { status: "unprotected", command: protectCommand({ ...target, checks }) };
     return { status: "unverified", reason: (res.stderr || res.stdout || "gh failed").trim(), settings: settingsUrl(target), missing: checks };
   }
-  const statusChecks = JSON.parse(res.stdout || "{}").required_status_checks;
+  const protection = JSON.parse(res.stdout || "{}");
+  const statusChecks = protection.required_status_checks;
   if (!statusChecks) return { status: "no-checks", settings: settingsUrl(target), missing: checks };
   const existing = new Set(statusChecks.contexts ?? []);
   const missing = checks.filter((c) => !existing.has(c));
-  return missing.length === 0 ? { status: "ok" } : { status: "missing", missing, command: addCommand({ ...target, missing }) };
+  // KJC-BUG-0401: required checks an admin skips are not required for an agent holding an admin's token.
+  const bindAdmins = protection.enforce_admins?.enabled === false ? `gh api -X POST ${protectionPath(target)}/enforce_admins` : null;
+  if (missing.length > 0) return { status: "missing", missing, command: [addCommand({ ...target, missing }), bindAdmins].filter(Boolean).join(" && ") };
+  if (bindAdmins) return { status: "admins-exempt", command: bindAdmins };
+  return { status: "ok" };
 }
 
 // Owner and repo go into a command an admin copies: only the characters GitHub allows in them.
 const GITHUB_REMOTE = /github\.com[^:/]*[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?$/;
 
 /** kj harden's last step: on a GitHub remote, what the base branch needs and who runs it. */
-export async function adviseBranchProtection({ projectDir, branch, logger, run = runCommand }) {
+export async function adviseBranchProtection({ projectDir, branch, logger, run = runCommand, identity = assertGhIdentity }) {
   const checks = requiredChecksFrom(projectDir);
   if (checks.length === 0) return null;
   const remote = await run("git", ["-C", projectDir, "remote", "get-url", "origin"]).catch(() => null);
   const match = remote?.exitCode === 0 ? GITHUB_REMOTE.exec(remote.stdout.trim()) : null;
   if (!match) return null;
-  const advice = await protectionAdvice({ owner: match[1], repo: match[2], branch, checks, run });
+  // KJC-BUG-0401: read the protection as the account the clone declares; another one gets a 404
+  // and kj said "not protected" about a protected branch.
+  let advice;
+  try {
+    identity({ projectDir });
+    advice = await protectionAdvice({ owner: match[1], repo: match[2], branch, checks, run });
+  } catch (err) {
+    advice = { status: "unverified", reason: err.message, settings: settingsUrl({ owner: match[1], repo: match[2] }), missing: checks };
+  }
   if (advice.status === "ok") {
     logger.info?.(`  • branch protection: ${branch} requires the ${checks.length} kj check(s)`);
     return advice;
@@ -90,6 +105,7 @@ export async function adviseBranchProtection({ projectDir, branch, logger, run =
     missing: `${branch} does not require ${advice.missing?.length} kj check(s) (${list}). An admin runs (kj never does):`,
     "no-checks": `${branch} is protected but requires no status checks. An admin enables "Require status checks" and adds ${list} in:`,
     unverified: `could not read the protection of ${branch} (${advice.reason}). An admin checks that ${list} are required in:`,
+    "admins-exempt": `${branch} requires the kj checks, but admins can merge without them, and an agent working with an admin's token would. An admin runs (kj never does):`,
   }[advice.status];
   logger.warn?.(`  ⚠ branch protection: ${why}`);
   logger.warn?.(`      ${advice.command ?? advice.settings}`);

package/src/harden/harness-hooks.js

@@ -10,30 +10,14 @@
  * supports tool hooks.
  */
 
-import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { isSea } from "node:sea";
 
-const SCRIPT_BODY = `#!/usr/bin/env node
-// kj tool gate (KJC-TSK-0710) — managed by \`kj harden\`. Exit 2 blocks the
-// tool call (stderr explains why); anything unexpected fails OPEN (exit 0)
-// so a gate bug never bricks the session.
-import console from "node:console";
-import process from "node:process";
-import { existsSync } from "node:fs";
-let raw = "";
-process.stdin.on("data", (d) => { raw += d; });
-process.stdin.on("end", () => {
-  try {
-    const { tool_name: tool, tool_input: input = {} } = JSON.parse(raw);
-    if (tool === "Write" && input.file_path && existsSync(input.file_path)) {
-      console.error("kj tool gate: Write over an EXISTING file destroys unseen changes — use Edit for targeted changes.");
-      process.exit(2);
-    }
-  } catch { /* fail open */ }
-  process.exit(0);
-});
-`;
+// KJC-TSK-1204 (ADR 0030): the tool gate is a module of the package, like the
+// Sentinel's guards, so kj-hook can run it from there.
+const SCRIPT_BODY = readFileSync(new URL("./sentinel/pretooluse.mjs", import.meta.url), "utf8");
 
 /** Write a managed hook script under .karajan/harness/ and return its path. */
 /**
@@ -50,6 +34,62 @@ export function writeHarnessScript(projectDir, name, body) {
   return abs;
 }
 
+/**
+ * KJC-TSK-1204 (ADR 0030): the hook runs the guard from the installed kj, never
+ * a copy in the project. npm installs have kj-hook; the single-file kj, or an
+ * install whose kj-hook is not on the PATH yet (a linked kj predating it), runs
+ * it through `kj sentinel hook`, which exists wherever kj harden ran. Without
+ * the runner, a hook before a tool blocks (no kj, no governance: the
+ * maintainer's decision) and any other one warns.
+ */
+export const kjHookOnPath = () => spawnSync("sh", ["-c", "command -v kj-hook"], { stdio: "ignore" }).status === 0;
+
+export function guardCommand(guard, { blocking = false, viaKj = isSea() || !kjHookOnPath() } = {}) {
+  const [bin, run] = viaKj ? ["kj", `kj sentinel hook ${guard}`] : ["kj-hook", `kj-hook ${guard}`];
+  const missing = `echo "karajan: ${bin} no está en el PATH — instala kj (npm i -g @karajan-family/code); sin él el Sentinel no gobierna esta sesión" >&2`;
+  return `if command -v ${bin} >/dev/null 2>&1; then ${run}; else ${missing}${blocking ? "; exit 2" : ""}; fi`;
+}
+
+/** The wiring kj harden wrote before ADR 0030: node running the project's copy. */
+const withoutLegacy = (list, script) => {
+  const legacy = `node ${join(".karajan", "harness", script)}`;
+  return list.flatMap((e) => {
+    if (!Array.isArray(e?.hooks) || !e.hooks.some((h) => h?.command === legacy)) return [e];
+    const hooks = e.hooks.filter((h) => h?.command !== legacy);
+    return hooks.length ? [{ ...e, hooks }] : [];
+  });
+};
+
+/**
+ * KJC-TSK-1206 (ADR 0030): the wiring is what decides which guard runs, so it is
+ * what gets verified. Every expected entry must call its guard, by the package
+ * runner or by the old `node .karajan/harness/<script>`; `missing` names each
+ * one that does not, and an unreadable settings file is missing everything.
+ * "files" = some entry still runs the project's copies, so those copies are live
+ * and verified as before; "wiring" = every entry runs the installed kj.
+ */
+export function wiringState({ projectDir, entries }) {
+  let hooks;
+  try {
+    hooks = JSON.parse(readFileSync(join(projectDir, ".claude", "settings.json"), "utf8"))?.hooks;
+  } catch {
+    hooks = null;
+  }
+  if (!hooks || typeof hooks !== "object") return { mode: "wiring", missing: [".claude/settings.json (sin hooks legibles)"] };
+  const missing = [];
+  let legacy = false;
+  for (const { event, matcher, script } of entries) {
+    const guard = script.replace(/\.mjs$/, "");
+    const runner = [true, false].map((viaKj) => guardCommand(guard, { blocking: event === "PreToolUse", viaKj }));
+    const old = `node ${join(".karajan", "harness", script)}`;
+    const here = (Array.isArray(hooks[event]) ? hooks[event] : []).filter((e) => e?.matcher === matcher).flatMap((e) => (Array.isArray(e?.hooks) ? e.hooks : []));
+    if (here.some((h) => runner.includes(h?.command))) continue;
+    if (here.some((h) => h?.command === old)) legacy = true;
+    else missing.push(`${event} → ${guard}`);
+  }
+  return { mode: legacy ? "files" : "wiring", missing: [...new Set(missing)] };
+}
+
 /**
  * Merge hook entries into .claude/settings.json. Preserve, never clobber:
  * invalid JSON or a hook event with an unexpected (non-array) shape is the
@@ -76,13 +116,15 @@ export function mergeClaudeHooks({ projectDir, logger = console, entries }) {
       return { wired: false };
     }
   }
+  const viaKj = isSea() || !kjHookOnPath();
   for (const { event, matcher, script } of entries) {
-    const list = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
+    const list = withoutLegacy(Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [], script);
+    const command = guardCommand(script.replace(/\.mjs$/, ""), { blocking: event === "PreToolUse", viaKj });
     const present = list.some(
-      (e) => JSON.stringify(e).includes(script) && (matcher === undefined || e?.matcher === matcher),
+      (e) => (e?.hooks || []).some((h) => h?.command === command) && (matcher === undefined || e?.matcher === matcher),
     );
     if (!present) {
-      const cmd = { type: "command", command: `node ${join(".karajan", "harness", script)}` };
+      const cmd = { type: "command", command };
       list.push(matcher === undefined ? { hooks: [cmd] } : { matcher, hooks: [cmd] });
     }
     settings.hooks[event] = list;
@@ -105,7 +147,17 @@ function resolveProjectRoot(dir) {
   }
 }
 
-/** Write the script and merge the PreToolUse entries into .claude/settings.json. */
+/** The tool gate's place in the host settings. */
+export const HARNESS_WIRING = [
+  { event: "PreToolUse", matcher: "Write", script: "pretooluse.mjs" },
+  { event: "PreToolUse", matcher: "Bash", script: "pretooluse.mjs" },
+];
+
+/**
+ * Merge the tool gate's PreToolUse entries into .claude/settings.json. KJC-TSK-1208
+ * (ADR 0030): the gate runs from the installed kj, so the copy an older kj wrote
+ * into the project is retired once the hooks call the package's.
+ */
 export function installHarnessHooks({ projectDir = process.cwd(), logger = console } = {}) {
   // KJC-BUG-0223: el harness es del proyecto y vive en su raiz. Instalado desde
   // un subdirectorio sembraba ahi un segundo `.karajan/harness` que no gobierna
@@ -113,14 +165,8 @@ export function installHarnessHooks({ projectDir = process.cwd(), logger = conso
   const root = resolveProjectRoot(projectDir);
   if (root !== projectDir) logger?.info?.(`kj harden: el harness es del proyecto, se instala en su raíz (${root})`);
   projectDir = root;
-  const scriptAbs = writeHarnessScript(projectDir, "pretooluse.mjs", SCRIPT_BODY);
-  const { wired } = mergeClaudeHooks({
-    projectDir,
-    logger,
-    entries: [
-      { event: "PreToolUse", matcher: "Write", script: "pretooluse.mjs" },
-      { event: "PreToolUse", matcher: "Bash", script: "pretooluse.mjs" },
-    ],
-  });
-  return { script: scriptAbs, wired };
+  const { wired } = mergeClaudeHooks({ projectDir, logger, entries: HARNESS_WIRING });
+  const copy = join(projectDir, ".karajan", "harness", "pretooluse.mjs");
+  if (wired && existsSync(copy)) rmSync(copy);
+  return { wired };
 }

package/src/harden/hook-templates.js

@@ -159,6 +159,11 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
         "if git diff --cached --name-only --diff-filter=d | grep -qE '^(\\.claude/[^/]*\\.lock|\\.claude/scheduled_tasks\\.lock|\\.kj/|\\.karajan/identity\\.local\\.yml|\\.karajan/harness/sentinel-state\\.json)'; then",
         "  echo 'kj harden: agent runtime files are staged (.claude/*.lock, .kj/, identity.local.yml, sentinel-state.json) — unstage them: git restore --staged <path>'; exit 1",
         "fi",
+        "# KJC-TSK-1205 (ADR 0030): a tampered Sentinel is caught before each commit,",
+        "# not only when the turn ends. Only where it is installed; no kj, no check.",
+        "if [ -d .karajan/harness ] && command -v kj >/dev/null 2>&1; then",
+        "  kj sentinel verify >/dev/null 2>&1 || { echo 'kj harden: the Sentinel is tampered with (kj sentinel verify says how) — restore it with kj harden'; exit 1; }",
+        "fi",
         "# v4 review gate (ENV-C1, opt-in via `kj review --install-gate`):",
         "# a staged diff only enters with a recorded cross-AI approved verdict.",
         "# KJC-BUG-0165: the gate is active once the marker is COMMITTED (HEAD),",