karajan-code 4.7.0 → 4.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.7.0",
+  "version": "4.8.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/audit/deterministic-summary.js

@@ -65,7 +65,7 @@ function formatAiSlopBlock(slop) {
 
 function formatInjectionBlock(inj) {
   if (!inj.available) return ["### Prompt-injection scan", `- Status: not available — ${inj.reason || "scan failed"}`, ""];
-  const lines = ["### Prompt-injection scan (specs / domain / onboarding)", `- Files scanned: ${inj.scanned ?? 0}`, `- Findings: ${inj.total ?? 0}`];
+  const lines = ["### Prompt-injection scan (agent-context surface: CLAUDE/AGENTS/GEMINI.md, templates, .rulesync, .karajan)", `- Files scanned: ${inj.scanned ?? 0}`, `- Findings: ${inj.total ?? 0}`];
   if ((inj.total ?? 0) > 0) {
     for (const [severity, items] of Object.entries(groupInjectionBySeverity(inj.findings || []))) {
       if (items.length === 0) continue;

package/src/audit/injection-findings.js

@@ -17,6 +17,15 @@ const SCAN_TARGETS = [
   { rel: ".karajan/specs", kind: "dir" },
   { rel: ".karajan/onboarding", kind: "dir" },
   { rel: ".karajan/domain.md", kind: "file" },
+  // KJC-TSK-0695: the agent-context surface — whatever lands in the host
+  // agent's context every session is the real injection vector.
+  { rel: "CLAUDE.md", kind: "file" },
+  { rel: "AGENTS.md", kind: "file" },
+  { rel: "GEMINI.md", kind: "file" },
+  { rel: ".cursorrules", kind: "file" },
+  { rel: path.join(".github", "copilot-instructions.md"), kind: "file" },
+  { rel: "templates", kind: "dir" },
+  { rel: ".rulesync", kind: "dir" },
 ];
 
 export async function collectInjectionFindings(rootDir, logger = null) {

package/src/cli/register-meta.js

@@ -379,6 +379,7 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--trend", "Append a sparkline of the harness score across the last 10 runs (uses .karajan/audit-history.db). KJC-TSK-0473.")
     .option("--report-file <path>", "Write the audit report to disk in addition to stdout. <path> may be a file (extension drives format: .md or .json) or a directory (creates audit-<ISO>.<md|json> inside). $KJ_AUDIT_REPORT_DIR env var is used as default directory if no --report-file is given.")
     .option("--deterministic-only", "Skip the LLM analysis entirely. Print/persist only the deterministic findings (basalCost, sonar, stack, growth-delta, webperf). Zero tokens spent. Compatible with --report-file and --json.")
+    .option("--security", "Focused deterministic security pass: prompt-injection scan over the agent-context surface (CLAUDE.md/AGENTS.md/templates/.rulesync/.karajan) + OSV + Semgrep + Sonar. Skips basal-cost, webperf, madge, knip, ai-slop, harness and the LLM — zero tokens. Designed for agents to self-invoke when a task touches sensitive surface (KJC-TSK-0695).")
     .option("-y, --yes", "Auto-confirm the 'Continue with LLM analysis?' prompt. Useful in scripts that want the full audit non-interactively. CI/non-TTY paths already auto-confirm without this flag.")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "audit", flags, async ({ config, logger }) => {
@@ -402,6 +403,7 @@ export function registerMeta(program, { pkgVersion }) {
           noAiSlop: flags.aiSlop === false,
           reportFile: flags.reportFile || null,
           deterministicOnly: Boolean(flags.deterministicOnly),
+          security: Boolean(flags.security),
           yes: Boolean(flags.yes),
           trend: Boolean(flags.trend),
         });

package/src/commands/audit.js

@@ -237,7 +237,10 @@ function describeInvocation({ task, dimensions, noSonar, noOsv, noSemgrep, noHar
   return parts.join(" ");
 }
 
-export async function auditCommand({ task, config, logger, dimensions, json, agentReadiness, path: pathArg, noSonar = false, noOsv = false, noSemgrep = false, noHarness = false, noAiSlop = false, reportFile = null, deterministicOnly = false, yes = false, trend = false, promptFn = null }) {
+export async function auditCommand({ task, config, logger, dimensions, json, agentReadiness, path: pathArg, noSonar = false, noOsv = false, noSemgrep = false, noHarness = false, noAiSlop = false, reportFile = null, deterministicOnly = false, yes = false, trend = false, promptFn = null, security = false }) {
+  // KJC-TSK-0695: --security = the focused pass an agent self-invokes.
+  // Deterministic by definition (zero tokens) and skips non-security stages.
+  if (security) { deterministicOnly = true; noHarness = true; noAiSlop = true; }
   // --agent-readiness is a STANDALONE, deterministic, LLM-free audit
   // dimension. It scores any third-party repo for AI-agent readability
   // (llms.txt presence, page token budgets, robots allowlist, etc.).
@@ -281,6 +284,7 @@ export async function auditCommand({ task, config, logger, dimensions, json, age
       noOsv,
       noSemgrep,
       noAiSlop,
+      ...(security ? { securityOnly: true } : {}),
     };
     const deterministicCtx = await role.collectDeterministic(roleInput);
     const deterministicMd = formatDeterministicSummary(deterministicCtx);

package/src/config/overrides.js

@@ -77,8 +77,11 @@ const UNDEF_CHECK_FLAGS = [
 ];
 
 function applyRoleOverrides(out, flags) {
+  // A provider override is always a string (`--security codex`). A bare
+  // boolean means the flag belongs to the command itself (`kj audit
+  // --security`, KJC-TSK-0695) and must not become a provider.
   for (const [flag, role] of ROLE_PROVIDER_FLAGS) {
-    if (flags[flag]) out.roles[role].provider = flags[flag];
+    if (typeof flags[flag] === "string" && flags[flag]) out.roles[role].provider = flags[flag];
   }
   // coder/reviewer also update top-level aliases
   if (flags.coder) out.coder = flags.coder;

package/src/environment/briefs.js

@@ -79,6 +79,7 @@ const B = {
       [
         "These findings are never overridable — not even by Solomon arbitration.",
         "PII is never logged; new dependencies need a reason and a pinned version.",
+        "Sensitive surface (auth, user input, secrets, network, deps)? Self-invoke `kj audit --security` — deterministic, zero tokens: prompt-injection over the agent-context files + OSV + Semgrep + Sonar — and remediate the findings before requesting review.",
       ],
       "findings with severity, category and file:line — or an explicit 'no security surface touched'."),
   },

package/src/environment/playbook.js

@@ -66,6 +66,8 @@ Invariants (the git gates enforce these — they are not suggestions):
   and it must be reviewed again. Disagree with a rejection? \`kj solomon\`.
 - Security findings are never overridable — not even by arbitration. You
   absorb the security role: \`kj brief security\` states what must be true.
+  Task touches auth, user input, secrets, network or deps? Run
+  \`kj audit --security\` (zero tokens) and remediate BEFORE the review.
 - A design decision the card's AC don't cover belongs to the USER: record
   it as a proposed ADR (\`kj adr add\`) and ask — never bury it in a PR
   bullet. An oversized-diff warning is not an opinion either: partition,

package/src/roles/audit-role.js

@@ -48,13 +48,17 @@ export class AuditRole extends AgentRole {
    *   execute() would gather internally)
    */
   async collectDeterministic(input) {
+    // KJC-TSK-0695: securityOnly = the focused pass an agent self-invokes
+    // when a task touches sensitive surface. Only the security collectors
+    // run (sonar, osv, semgrep, injection) — zero tokens, fast.
+    const securityOnly = typeof input === "object" ? Boolean(input?.securityOnly) : false;
     const noSonar = typeof input === "object" ? Boolean(input?.noSonar) : false;
     const noOsv = typeof input === "object" ? Boolean(input?.noOsv) : false;
     const noSemgrep = typeof input === "object" ? Boolean(input?.noSemgrep) : false;
-    const noMadge = typeof input === "object" ? Boolean(input?.noMadge) : false;
-    const noKnip = typeof input === "object" ? Boolean(input?.noKnip) : false;
+    const noMadge = (typeof input === "object" ? Boolean(input?.noMadge) : false) || securityOnly;
+    const noKnip = (typeof input === "object" ? Boolean(input?.noKnip) : false) || securityOnly;
     const noInjectionScan = typeof input === "object" ? Boolean(input?.noInjectionScan) : false;
-    const noAiSlop = typeof input === "object" ? Boolean(input?.noAiSlop) : false;
+    const noAiSlop = (typeof input === "object" ? Boolean(input?.noAiSlop) : false) || securityOnly;
     const projectDir = this.config?.projectDir || process.cwd();
     let basalCost = null;
     let growthDelta = null;
@@ -67,11 +71,13 @@ export class AuditRole extends AgentRole {
     let deadExports = null;
     let injectionFindings = null;
     let aiSlop = null;
-    try {
-      basalCost = await measureBasalCost(projectDir);
-      const previous = await loadPreviousAudit(projectDir);
-      growthDelta = computeGrowthDelta(basalCost, previous);
-    } catch { /* basal cost is best-effort */ }
+    if (!securityOnly) {
+      try {
+        basalCost = await measureBasalCost(projectDir);
+        const previous = await loadPreviousAudit(projectDir);
+        growthDelta = computeGrowthDelta(basalCost, previous);
+      } catch { /* basal cost is best-effort */ }
+    }
     try {
       stack = await detectProjectStack(projectDir);
     } catch { /* stack detect is best-effort */ }
@@ -80,9 +86,11 @@ export class AuditRole extends AgentRole {
         sonarFindings = await collectSonarFindings(this.config, this.logger);
       } catch { /* sonar fetch is best-effort */ }
     }
-    try {
-      webperf = collectWebPerfInput(stack, this.config);
-    } catch { /* webperf input is best-effort */ }
+    if (!securityOnly) {
+      try {
+        webperf = collectWebPerfInput(stack, this.config);
+      } catch { /* webperf input is best-effort */ }
+    }
     // OSV vulnerabilities — KJC-TSK-0365. Best-effort: missing
     // osv-scanner binary returns available:false and the audit
     // continues without the section.