karajan-code 4.67.0 → 4.68.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.67.0",
+  "version": "4.68.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/register-meta.js

@@ -1119,7 +1119,8 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--no-config", "Skip lint/format/commit config files (hooks only)")
     .option("--no-ci", "Skip CI quality workflows")
     .option("--no-guidelines", "Skip AI-agent guideline files (AGENTS.md/CLAUDE.md)")
-    .option("--no-sandbox", "Leave the host Bash sandbox alone (by default it is turned on where it can start)")
+    .option("--sandbox", "Turn the host Bash sandbox on where it can start (off by default: it blocks gh, push and Sonar)")
+    .option("--no-sandbox", "Leave the host Bash sandbox alone (the default; kept for existing scripts)")
     .option("--mutation", "Also seed an opt-in nightly/manual mutation CI job (never a PR gate)")
     .option("--only <dirs...>", "Harden only these language roots (e.g. frontend backend)")
     .option("--exclude <globs...>", "Skip language roots matching these globs (e.g. wrappers)")
@@ -1137,7 +1138,7 @@ export function registerMeta(program, { pkgVersion }) {
           config: flags.config !== false,
           ci: flags.ci !== false,
           guidelines: flags.guidelines !== false,
-          sandbox: flags.sandbox !== false,
+          sandbox: flags.sandbox === true,
           mutation: Boolean(flags.mutation),
           only: flags.only ?? [],
           exclude: flags.exclude ?? [],

package/src/commands/harden.js

@@ -92,7 +92,7 @@ export async function hardenCommand({
   only = [],
   exclude = [],
   commitSupervisor = false,
-  sandbox = true,
+  sandbox = false,
   kjVersion = null,
   // KJC-BUG-0289: the contract files already dirty before anything was generated
   // (kj init captures them before writing its own). What is dirty NOW is the person's.
@@ -162,7 +162,8 @@ export async function hardenCommand({
       // sin sello, que es como una sesión se dejaba sin herramientas.
       const sh = installSentinelHooks({ projectDir, logger, human: commitSupervisor });
       result.sentinelHooks = sh.wired ? "wired" : "script-only";
-      // KJC-TSK-1092: the host sandbox, on by default wherever it can start here.
+      // KJC-TSK-1092/1241: the host sandbox, only when asked (kj harden --sandbox):
+      // inside it kj run cannot push, open the PR or reach Sonar on localhost.
       if (sandbox) result.sandbox = installSandbox({ projectDir, logger }).state;
     }
   } catch (err) {

package/src/harden/hook-commands.js

@@ -8,7 +8,7 @@
  * commands depend on what the project defines). Unknown language ⇒ no commands,
  * leaving only the universal POSIX-shell checks.
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 // KJC-BUG-0411 (#2563): uv and poetry keep pytest and ruff in the project's
@@ -32,6 +32,23 @@ const FORMAT_WRITE_BY_LANGUAGE = {
   php: { command: "vendor/bin/php-cs-fixer fix", extensions: [".php"] },
 };
 
+// KJC-TSK-1239: JS/TS takes the formatter the project declares, from its node_modules.
+// Declared both? The one its scripts call wins; else prettier, the more common.
+const JS_TS = [".js", ".mjs", ".cjs", ".jsx", ".ts", ".mts", ".cts", ".tsx"];
+const JS_FORMATTERS = [
+  { pkg: "prettier", bin: "prettier", inScripts: /\bprettier\b/, command: "node_modules/.bin/prettier --write" },
+  { pkg: "@biomejs/biome", bin: "biome", inScripts: /\bbiome\b/, command: "node_modules/.bin/biome format --write" },
+];
+function jsFormatWrite(projectDir) {
+  let pkg;
+  try { pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8")); } catch { return null; }
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const scripts = Object.values(pkg.scripts ?? {}).join("\n");
+  const usable = JS_FORMATTERS.filter((f) => deps[f.pkg] && existsSync(join(projectDir, "node_modules", ".bin", f.bin)));
+  const chosen = usable.find((f) => f.inScripts.test(scripts)) ?? usable[0];
+  return chosen ? { command: chosen.command, extensions: JS_TS } : null;
+}
+
 const runnerFor = (language, projectDir) => (language === "python" && projectDir
   ? PYTHON_RUNNERS.find(([lock]) => existsSync(join(projectDir, lock)))?.[1] ?? null
   : null);
@@ -46,6 +63,7 @@ export function commandsForLanguage(language, projectDir = null) {
 
 /** The write-mode formatter of a language and the extensions it takes, or null. */
 export function formatWriteFor(language, projectDir = null) {
+  if (language === "javascript" || language === "typescript") return projectDir ? jsFormatWrite(projectDir) : null;
   const entry = FORMAT_WRITE_BY_LANGUAGE[language];
   if (!entry) return null;
   return { ...entry, command: [runnerFor(language, projectDir), entry.command].filter(Boolean).join(" ") };