karajan-code 4.70.2 → 4.70.4

package/src/harden/phone-sign.js

@@ -36,7 +36,9 @@ async function relayConfig(fetchFn) {
 }
 const SIGN_PAGE = "https://karajancode.com/sign";
 const POLL_INTERVAL_MS = 2000;
-const TTL_MS = 60000;
+// KJC-BUG-0432: 60 s was too short to scan, read the files and sign, and the page still said
+// "signed" after kj had given up. 150 s leaves time and stays under the relay's 3 min window.
+const TTL_MS = 150000;
 
 /** Spinner en su sitio (una línea, con \r) solo en TTY; no-op fuera de TTY o en tests. */
 function makeSpinner() {

package/src/harden/published-pin.js

@@ -0,0 +1,34 @@
+/**
+ * published-pin — the karajan-code version a seeded workflow may pin (KJC-BUG-0420).
+ *
+ * A consumer repo's CI installs kj from npm, so the pin must be a published
+ * version. A checkout ahead of npm pins the newest published version that is
+ * not newer than itself; when the registry cannot confirm anything, the
+ * running version stays and the note says so.
+ */
+
+import { isNewerVersion } from "../utils/update-check.js";
+
+const packumentUrl = (name) => `https://registry.npmjs.org/${encodeURIComponent(name)}`;
+
+async function publishedVersions(name, fetchFn) {
+  const res = await fetchFn(packumentUrl(name), { headers: { Accept: "application/vnd.npm.install-v1+json" } });
+  if (!res.ok) throw new Error(`registry responded ${res.status}`);
+  return Object.keys((await res.json()).versions ?? {});
+}
+
+/** @returns {Promise<{version: string, note?: string}>} */
+export async function publishedPin({ name, version, fetchFn = fetch }) {
+  const unconfirmed = (why) => ({ version, note: `could not confirm on npm that ${name}@${version} is published (${why}); the workflow pins it as is` });
+  let published;
+  try {
+    published = await publishedVersions(name, fetchFn);
+  } catch (err) {
+    return unconfirmed(err.message);
+  }
+  if (published.includes(version)) return { version };
+  const older = published.filter((v) => !v.includes("-") && !isNewerVersion(v, version));
+  const newest = older.reduce((best, v) => (best && !isNewerVersion(v, best) ? best : v), null);
+  if (!newest) return unconfirmed("no published version at or below it");
+  return { version: newest, note: `${name}@${version} is not on npm yet; the workflow pins ${newest}, the newest published one` };
+}

package/src/harden/sentinel/posttooluse.mjs

@@ -196,10 +196,12 @@ process.stdin.on("end", () => {
       const ps = spawnSync("kj", ["pr-size", "--json"], { cwd: ROOT, encoding: "utf8", timeout: 5000 });
       let size = null;
       try { size = JSON.parse(String(ps.stdout || "").trim().split(String.fromCharCode(10)).pop()); } catch { size = null; }
-      const crossed = size ? [200, 150].find((t) => size.added > t) : undefined;
+      // KJC-BUG-0435: net lines, as the CI gate counts them; a kj older than 0434 reports only added.
+      const lines = size ? (size.net ?? size.added) : 0;
+      const crossed = size ? [200, 150].find((t) => lines > t) : undefined;
       if (crossed && (s.size_warned || 0) < crossed) {
         s.size_warned = crossed;
-        sizeNote = "karajan sentinel: la rama ya suma " + size.added + " lineas contables (" + size.testAdded + " de tests); " + (crossed >= 200 ? "pasa el limite de 200 del CI: parte antes de seguir" : "pasa de 150: planea la particion ahora, no en el stage");
+        sizeNote = "karajan sentinel: la rama ya suma " + lines + " lineas netas contables (" + size.testAdded + " de tests); " + (crossed >= 200 ? "pasa el limite de 200 del CI: parte antes de seguir" : "pasa de 150: planea la particion ahora, no en el stage");
       }
     }
     const ids = Object.keys(state.sessions);

package/src/harden/sentinel/pretooluse-sentinel.mjs

@@ -11,9 +11,9 @@ import { appendFileSync, existsSync, readFileSync, realpathSync, statSync } from
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, boardGate, pendingMoves, pendingText, stagedVerdict } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
+import { commitStaging, isGhIssueCreate, isPublishCommand, isReadOnlyCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
 import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
 import { sandboxCovers, shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
@@ -85,8 +85,9 @@ process.stdin.on("end", () => {
     // caught by the Stop gate's checksum verification, which blocks the turn.
     // KJC-TSK-1114: where the host sandbox denies writing them, the sandbox guards them instead.
     // KJC-BUG-0425 (ADR 0036): text a command only publishes or stores (a PR description) is not a write.
+    // KJC-BUG-0429: nor is a command made only of known readers (an allow-list, not a write blocklist).
     const SUPERVISOR_PATHS = [".claude/settings.json", ".karajan/hooks", ".karajan/harness"];
-    if (tool === "Bash" && PROTECTED.test(stripTextOnlyCommandValues(String(input.command || "")).replaceAll("\\", "/")) && !sandboxCovers(ROOT, SUPERVISOR_PATHS)) {
+    if (tool === "Bash" && !isReadOnlyCommand(String(input.command || "")) && PROTECTED.test(stripTextOnlyCommandValues(String(input.command || "")).replaceAll("\\", "/")) && !sandboxCovers(ROOT, SUPERVISOR_PATHS)) {
       console.error("karajan sentinel: los ficheros del supervisor no se tocan desde Bash — consultalos con la tool Read/Grep; solo el humano los modifica, fuera de la sesion." + doc("supervisor"));
       process.exit(2);
     }
@@ -634,6 +635,24 @@ process.stdin.on("end", () => {
         console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta saltarlo, lo hace tu usuario en su terminal." + doc("escapes"));
         process.exit(2);
       }
+      // KJC-BUG-0455 (#2933): the verdict of the staged diff, checked HERE as well as in
+      // the pre-commit hook: a repo whose hook does not run the gate, or a review piped into
+      // tail that hid its failure, let a commit through with no verdict at all.
+      const plan = commitStaging(cmd);
+      if (plan.commits) {
+        // 4.x: the hook payload carries no cwd; the session works in the project root.
+        const verdict = stagedVerdict(plan.dir ? resolve(ROOT, plan.dir) : ROOT);
+        if (verdict.gate && plan.stages) {
+          console.error("karajan sentinel: stagea y commitea en comandos separados — el veredicto se comprueba sobre lo que ya esta stageado, y este comando stagea a la vez que commitea (git add/rm/mv, -a o rutas en git commit). Stagea por nombre, pasa kj review --staged y luego git commit." + doc("commit-verdict"));
+          process.exit(2);
+        }
+        // Only an approved verdict passes, or nothing staged (a merge: git itself decides).
+        if (verdict.gate && verdict.state !== "approved" && verdict.state !== "empty") {
+          const why = { rejected: "el review de este diff fue RECHAZADO por " + (verdict.reviewer || "el reviewer") + " — corrige y vuelve a pasar kj review --staged", unknown: "git no pudo leer el diff stageado, asi que el veredicto no se puede comprobar" }[verdict.state] || "no hay veredicto para el diff stageado — pasa kj review --staged (solo, sin tuberias que oculten si falla)";
+          console.error("karajan sentinel: commit sin veredicto aprobado: " + why + "." + doc("commit-verdict"));
+          process.exit(2);
+        }
+      }
       // KJC-BUG-0296 (#1989): the staged set is reviewed by name. A blanket
       // git add -A / git add . / git add -u put a Claude scheduler lock into
       // main; and the agent's runtime files (the .claude locks, .kj/, the local

package/src/harden/sentinel/sentinel-lib.mjs

@@ -4,6 +4,7 @@
 import process from "node:process";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 const here = dirname(fileURLToPath(import.meta.url));
@@ -65,6 +66,28 @@ export const bootstrapPhase = () => {
   try { execSync("git rev-parse --verify HEAD", { cwd: ROOT, stdio: ["ignore", "ignore", "ignore"] }); return false; }
   catch { return true; }
 };
+// KJC-BUG-0455 (#2933): the cross-AI verdict of the diff staged in `dir`, read the way
+// `kj review --check` reads it (sha256 of `git diff --cached`, trailing blanks trimmed,
+// in <top>/.karajan/reviews). gate:false when the repo has not committed the gate marker.
+// state: approved | rejected | missing | empty (nothing staged) | unknown (git failed).
+export const stagedVerdict = (dir) => {
+  const git = (args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  // No commit yet (or no repo): no committed marker can exist, as the hook reads it.
+  if (git(["rev-parse", "--verify", "-q", "HEAD"]).status !== 0) return { gate: false };
+  // A git error is not a missing marker: it fails closed.
+  const marker = git(["ls-tree", "--name-only", "HEAD", ".karajan/review-gate"]);
+  if (marker.status !== 0) return { gate: true, state: "unknown" };
+  if (!marker.stdout.trim()) return { gate: false };
+  const top = git(["rev-parse", "--show-toplevel"]).stdout?.trim();
+  const diff = git(["diff", "--cached"]);
+  if (!top || diff.status !== 0) return { gate: true, state: "unknown" };
+  if (!diff.stdout.trim()) return { gate: true, state: "empty" };
+  const hash = createHash("sha256").update(diff.stdout.trimEnd(), "utf8").digest("hex");
+  try {
+    const v = JSON.parse(readFileSync(join(top, ".karajan", "reviews", hash + ".json"), "utf8"));
+    return { gate: true, state: v.verdict === "approved" ? "approved" : "rejected", reviewer: v.reviewer || null };
+  } catch { return { gate: true, state: "missing" }; }
+};
 // KJC-BUG-0198/0262: a card split across PRs is carried while another PR of it is
 // open. kj decides with that checkable fact, the same answer for commit and push
 // (the Stop gate still holds the turn: the board owes the move); when kj does not

package/src/harden/sentinel/sentinel-shell.mjs

@@ -264,5 +264,114 @@ export const withoutRedirections = (words) => {
   return rest;
 };
 
+// KJC-BUG-0429 (ADR 0036): the guards decide by write verb. These readers were picked
+// because no option of theirs writes a file or runs a program; a command made only of
+// them, with output to the session, /dev/null or another descriptor, writes nothing.
+// KJC-BUG-0437: never git, whose reads run what its config names (filters, textconv,
+// diff.external, fsmonitor); the Read tool reads those files instead.
+const READERS = new Set(["cat", "head", "tail", "grep", "egrep", "fgrep", "ls", "wc", "diff", "cmp", "stat", "jq", "sha256sum", "sha1sum", "md5sum"]);
+
+const REDIRECTION = /^(\d*)(>>|>&|>\||>|<)(.*)$/;
+const quietRedirections = (words) => words.every((w, i) => {
+  const m = REDIRECTION.exec(w);
+  if (!m) return true;
+  const [, , op, glued] = m;
+  const target = glued || words[i + 1] || "";
+  if (op === "<") return target !== "";
+  if (op === ">&") return /^\d$/.test(target);
+  return (op === ">" || op === ">>") && target === "/dev/null";
+});
+
+/**
+ * Whether the command only reads: every simple command is a known reader and no
+ * output goes to a file. Substitution, subshells, heredocs, expansion, newlines
+ * or assignments are not provably that.
+ * @param {string} cmd
+ */
+export const isReadOnlyCommand = (cmd) => {
+  const bare = stripInertQuotes(String(cmd));
+  if (/[(){}`\n]|<</.test(bare) || LIVE_EXPANSION.test(bare)) return false;
+  const segs = shellSegments(cmd);
+  return segs.length > 0 && segs.every((words) => {
+    const rest = withoutRedirections(words);
+    return quietRedirections(words) && READERS.has(rest[0]);
+  });
+};
+
 /** Short flags of a cluster stop at "e": the rest is -e's value (-fen = -f -e n). */
 export const shortOpts = (a) => (/^-[a-zA-Z]/.test(a) ? a.slice(1).split("e")[0] : "");
+
+// KJC-BUG-0455 (#2933): git commit's options that take a value, and the git verbs that
+// change the index. A commit that stages in the same command commits a diff nobody
+// could have reviewed yet: the verdict is checked against what is staged BEFORE it runs.
+const COMMIT_VALUE_OPTS = new Set(["-m", "-F", "-C", "-c", "-t", "--message", "--file", "--reuse-message", "--reedit-message", "--template", "--author", "--date", "--cleanup", "--fixup", "--squash", "--trailer", "--pathspec-from-file"]);
+const COMMIT_VALUE_SHORT = new Set(["m", "F", "C", "c", "t"]);
+const INDEX_VERBS = new Set(["add", "rm", "mv", "stage", "restore", "reset", "apply", "update-index"]);
+
+/** Where `git` is in a segment and its verb, skipping git's global options; null when not git. */
+const gitVerbOf = (words) => {
+  if (words[0]?.slice(words[0].lastIndexOf("/") + 1) !== "git") return null;
+  let i = 1;
+  let dir = null;
+  while (i < words.length) {
+    const w = words[i];
+    if (GIT_GLOBAL_WITH_VALUE.has(w)) {
+      if (w === "-C") {
+        dir = words[i + 1] ?? null;
+      }
+      i += 2; // the option and its value
+    } else if (GIT_GLOBAL_FLAG.test(w)) {
+      i += 1;
+    } else {
+      break;
+    }
+  }
+  return { verb: words[i], at: i, dir };
+};
+
+/** How many words a git commit argument takes, and whether it makes the commit stage on its own. */
+const commitArg = (a) => {
+  if (a === "--all") return { stages: true, words: 1 };
+  if (a.startsWith("--")) {
+    // --message=x carries its value; --message x takes the next word.
+    return { stages: false, words: COMMIT_VALUE_OPTS.has(a) ? 2 : 1 };
+  }
+  if (/^-[a-zA-Z]/.test(a)) {
+    const cluster = a.slice(1);
+    const valueAt = [...cluster].findIndex((c) => COMMIT_VALUE_SHORT.has(c));
+    const flags = valueAt < 0 ? cluster : cluster.slice(0, valueAt);
+    if (flags.includes("a")) return { stages: true, words: 1 };
+    // -m x takes the next word; -mx carries its value.
+    return { stages: false, words: valueAt === cluster.length - 1 ? 2 : 1 };
+  }
+  return { stages: true, words: 1 }; // a pathspec
+};
+
+/** -a/--all, or a path (with or without --), makes git commit stage on its own. */
+const commitStagesItself = (args) => {
+  let i = 0;
+  while (i < args.length) {
+    if (args[i] === "--") {
+      return i + 1 < args.length;
+    }
+    const { stages, words } = commitArg(args[i]);
+    if (stages) {
+      return true;
+    }
+    i += words;
+  }
+  return false;
+};
+
+/**
+ * Does the command run git commit, and does it stage in the same command?
+ * @param {string} cmd
+ * @returns {{commits: boolean, stages: boolean, dir: string|null}}
+ */
+export const commitStaging = (cmd) => {
+  const gits = shellSegments(cmd).map((words) => ({ words, g: gitVerbOf(words) })).filter((s) => s.g);
+  const commits = gits.filter((s) => s.g.verb === "commit");
+  if (commits.length === 0) return { commits: false, stages: false, dir: null };
+  const stages = gits.some((s) => INDEX_VERBS.has(s.g.verb)) || commits.some((s) => commitStagesItself(s.words.slice(s.g.at + 1)));
+  return { commits: true, stages, dir: commits[0].g.dir };
+};

package/src/harden/workflow-engine.js

@@ -14,6 +14,7 @@ import { dirname } from "node:path";
 
 import { parse as parseYaml } from "yaml";
 import { upsertManagedBlock } from "../utils/managed-markers.js";
+import { publishedPin } from "./published-pin.js";
 import { extraWorkflowsFor, mutationWorkflowFor, qualityWorkflowFor, policyWorkflowFor, stewardWorkflowFor, WORKFLOWS } from "./workflow-templates.js";
 
 // KJC-BUG-0424: on the PR that brings this change GitHub runs neither YAML (the base's
@@ -56,9 +57,20 @@ export function isPublishableNpm(projectDir) {
   }
 }
 
-/** Lockfile-detected package manager (KJC-BUG-0131): npm ci kills pnpm/yarn CI. */
+const KNOWN_PMS = new Set(["npm", "pnpm", "yarn", "bun"]);
+
+/**
+ * The project's package manager (KJC-BUG-0131: npm ci kills pnpm/yarn CI).
+ * KJC-BUG-0450 (#2789): the same answer for hooks and workflows; the
+ * packageManager field of package.json first, then the lockfile.
+ */
 export function detectPackageManager(projectDir) {
+  try {
+    const declared = String(JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8")).packageManager || "").split("@")[0];
+    if (KNOWN_PMS.has(declared)) return declared;
+  } catch { /* no or unreadable package.json: the lockfile decides */ }
   if (existsSync(join(projectDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join(projectDir, "bun.lock")) || existsSync(join(projectDir, "bun.lockb"))) return "bun";
   if (existsSync(join(projectDir, "yarn.lock"))) return "yarn";
   return "npm";
 }
@@ -73,6 +85,25 @@ function hasLintScript(projectDir) {
   }
 }
 
+const policyDeclared = (projectDir) => existsSync(join(projectDir, ".karajan", "policy.yml"));
+
+// STW-E (KJC-TSK-0793): the scheduled sweep is OPT-IN — the project says
+// steward.action: true in its config; nothing is imposed by default.
+function stewardActionOn(projectDir) {
+  try {
+    return parseYaml(readFileSync(join(projectDir, ".karajan", "kj.config.yml"), "utf8"))?.steward?.action === true;
+  } catch {
+    return false; // no config — no action
+  }
+}
+
+/** KJC-BUG-0420: the published kj version the policy and steward workflows pin; null when neither is seeded. */
+export async function resolveKjPin({ projectDir, fetchFn } = {}) {
+  const own = ownPkg();
+  if (!own || !(policyDeclared(projectDir) || stewardActionOn(projectDir))) return null;
+  return publishedPin({ name: own.name, version: own.version, fetchFn });
+}
+
 export function installWorkflows({
   projectDir = process.cwd(),
   language = null,
@@ -94,14 +125,10 @@ export function installWorkflows({
   // pinear: la plumbeada por el CLI (SEA) o la propia; "latest" es último
   // recurso inalcanzable en los caminos reales.
   const pinned = kjVersion ?? ownPkg()?.version ?? "latest";
-  const policy = existsSync(join(projectDir, ".karajan", "policy.yml"))
+  const policy = policyDeclared(projectDir)
     ? { file: "kj-policy.yml", blockId: "wf-policy", body: policyWorkflowFor(pinned, ownPkg()?.name ?? "karajan-code") }
     : null;
-  // STW-E (KJC-TSK-0793): the scheduled sweep is OPT-IN — the project says
-  // steward.action: true in its config; nothing is imposed by default.
-  let stewardOn = false;
-  try { stewardOn = parseYaml(readFileSync(join(projectDir, ".karajan", "kj.config.yml"), "utf8"))?.steward?.action === true; } catch { /* no config — no action */ }
-  const steward = stewardOn ? { file: "kj-steward.yml", blockId: "wf-steward", body: stewardWorkflowFor(pinned, ownPkg()?.name ?? "karajan-code") } : null;
+  const steward = stewardActionOn(projectDir) ?{ file: "kj-steward.yml", blockId: "wf-steward", body: stewardWorkflowFor(pinned, ownPkg()?.name ?? "karajan-code") } : null;
   const all = [...WORKFLOWS, ...(quality ? [quality] : []), ...extras, ...(mut ? [mut] : []), ...(policy ? [policy] : []), ...(steward ? [steward] : [])];
   const results = [];
   for (const wf of all) {

package/src/mcp/handlers/hu-handlers.js

@@ -4,44 +4,67 @@
  */
 
 import { handleSuggestion } from "../suggest-handler.js";
+import { runKjCommand } from "../run-kj.js";
 import {
   resolveProjectDir,
   failPayload,
 } from "../shared-helpers.js";
 
+export const HU_STATUSES = ["pending", "running", "done", "failed", "skipped"];
+
+/**
+ * KJC-BUG-0452 (#2815): kj_hu used the old kj run store, so an agent saw an empty
+ * board while `kj hu list` showed every card. It runs the CLI's own `kj hu` in a
+ * subprocess: the same board (local, shared or a lane's), and stdout, which is
+ * this server's protocol channel, stays clean.
+ */
+async function kjHu(projectDir, args) {
+  const res = await runKjCommand({ command: "hu", commandArgs: [...args, "--json"], options: { projectDir } });
+  if (!res.ok) return { error: `kj hu ${args[0]} failed: ${res.errorSummary || res.stderr || "no output"}` };
+  const line = String(res.stdout || "").trim().split("\n").reverse().find((l) => /^[[{]/.test(l.trim()));
+  try { return { data: JSON.parse(line) }; } catch { return { error: `kj hu ${args[0]} answered no JSON: ${String(res.stdout || "").slice(0, 200)}` }; }
+}
+
+const notOnBoard = (id) => `HU ${id} is not on the board — kj_hu list shows its cards`;
+
+async function createHu(projectDir, a) {
+  if (!a.title) return failPayload("Missing required field: title (required for create)");
+  const args = ["add", a.title, ...(a.acceptanceCriteria ? ["--ac", a.acceptanceCriteria] : []), ...(a.ref ? ["--ref", a.ref] : [])];
+  const added = await kjHu(projectDir, args);
+  if (added.error) return failPayload(added.error);
+  if (!a.status || a.status === "pending") return { ok: true, hu: added.data };
+  return moveHu(projectDir, added.data.short_id || added.data.id, a.status);
+}
+
+async function moveHu(projectDir, huId, status) {
+  if (!HU_STATUSES.includes(status)) return failPayload(`Unknown status "${status}": use ${HU_STATUSES.join(", ")}`);
+  const moved = await kjHu(projectDir, ["move", huId, status]);
+  return moved.error ? failPayload(moved.error) : { ok: true, hu: moved.data };
+}
+
 export async function handleHu(a, server) {
   const action = a.action;
   if (!action) return failPayload("Missing required field: action");
-
   const projectDir = await resolveProjectDir(server, a.projectDir);
-  const { createManualHu, listHus, getHu, updateHuStatus } = await import("../../hu/store.js");
 
   switch (action) {
-    case "create": {
-      if (!a.title) return failPayload("Missing required field: title (required for create)");
-      const hu = await createManualHu(projectDir, {
-        title: a.title,
-        description: a.description,
-        status: a.status,
-        acceptanceCriteria: a.acceptanceCriteria
-      });
-      return { ok: true, hu };
-    }
+    case "create":
+      return createHu(projectDir, a);
     case "list": {
-      const hus = await listHus(projectDir);
-      return { ok: true, hus };
+      const listed = await kjHu(projectDir, ["list"]);
+      return listed.error ? failPayload(listed.error) : { ok: true, hus: listed.data };
     }
     case "get": {
       if (!a.huId) return failPayload("Missing required field: huId (required for get)");
-      const hu = await getHu(projectDir, a.huId);
-      return { ok: true, hu };
+      const listed = await kjHu(projectDir, ["list"]);
+      if (listed.error) return failPayload(listed.error);
+      const hu = listed.data.find((h) => h.id === a.huId || h.short_id === a.huId);
+      return hu ? { ok: true, hu } : failPayload(notOnBoard(a.huId));
     }
-    case "update": {
+    case "update":
       if (!a.huId) return failPayload("Missing required field: huId (required for update)");
       if (!a.status) return failPayload("Missing required field: status (required for update)");
-      const hu = await updateHuStatus(projectDir, a.huId, a.status);
-      return { ok: true, hu };
-    }
+      return moveHu(projectDir, a.huId, a.status);
     default:
       return failPayload(`Unknown hu action: ${action}`);
   }

package/src/mcp/tools.js

@@ -335,17 +335,17 @@ export const tools = [
   },
   {
     name: "kj_hu",
-    description: "Manage user stories (HUs) in the local board",
+    description: "Manage user stories (HUs) in the HU Board, the same board `kj hu` uses (local or shared)",
     inputSchema: {
       type: "object",
       required: ["action"],
       properties: {
         action: { type: "string", enum: ["create", "update", "list", "get"], description: "Action to perform" },
         title: { type: "string", description: "HU title (required for create)" },
-        description: { type: "string", description: "HU description" },
-        acceptanceCriteria: { type: "string", description: "Acceptance criteria" },
+        acceptanceCriteria: { type: "string", description: "Acceptance criteria, one per line" },
+        ref: { type: "string", description: "Id of this card's replica in the external tracker (Planning Game, Jira, Linear...)" },
         huId: { type: "string", description: "HU ID (required for update/get)" },
-        status: { type: "string", description: "HU status (for create/update)", enum: ["pending", "coding", "reviewing", "done", "failed", "blocked"] },
+        status: { type: "string", description: "HU status (for create/update)", enum: ["pending", "running", "done", "failed", "skipped"] },
         projectDir: { type: "string", description: "Project directory (defaults to cwd)" }
       }
     }

package/src/orchestrator/stages/suite-green-stage.js

@@ -39,7 +39,9 @@ export async function runSuiteGreenStage({ config, logger, emitter, eventBase, s
   }
   const timeout = Number(config?.development?.test_timeout_ms) > 0 ? Number(config.development.test_timeout_ms) : DEFAULT_TIMEOUT_MS;
   const run = runTestsImpl || (async () => {
-    const res = await runCommand("bash", ["-lc", command], { cwd: projectDir, timeout });
+    // KJC-BUG-0427: never a login shell, which re-reads the person's profile and may rewrite
+    // PATH (nvm drops node when npm_config_prefix is set): the suite runs in kj's own environment.
+    const res = await runCommand("bash", ["-c", command], { cwd: projectDir, timeout });
     return { exitCode: res.exitCode ?? 1, output: `${res.stdout || ""}\n${res.stderr || ""}` };
   });
   const res = await run(command);

package/src/policy/engine.js

@@ -9,7 +9,7 @@
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { stripTextOptionValues } from "../harden/sentinel/sentinel-shell.mjs";
+import { isReadOnlyCommand, stripTextOptionValues } from "../harden/sentinel/sentinel-shell.mjs";
 import {
   ALLOW_VERDICT,
   checkArtifacts,
@@ -36,7 +36,8 @@ export const SUPERVISOR_DEFAULTS = [
     // it is USED (commit, CI, release), whatever wrote it: only the human's seal lifts it.
     id: "defaults.governance.write",
     // KJC-BUG-0400: the CI workflows too; a PR could rewrite the check that judges it.
-    pattern: /(^|\/)\.karajan\/(policy|rules)\.yml\b|(^|\/)\.github\/workflows\/[^/\s]+\.ya?ml\b/,
+    // KJC-BUG-0429: in shell text a relative path follows a blank or a quote, not a slash.
+    pattern: /(^|[^\w.-])\.karajan\/(policy|rules)\.yml\b|(^|[^\w.-])\.github\/workflows\/[^/\s]+\.ya?ml\b/,
     message: "es configuración de gobierno: solo entra sellada por la persona (kj harden --commit, firmado desde su móvil)",
   },
 ];
@@ -84,7 +85,12 @@ export function evalToolCall(policy, { role = "coder", tool, input = {}, root =
   // KJC-BUG-0343: the inert prose of a text option (--title, --error, -m...) is
   // not a target: a report naming a supervisor path is not a write to it. A path
   // anywhere else, or a value that can expand, is still judged.
-  if (tool === "Bash") return evalShell(policy, role, stripTextOptionValues(String(input.command ?? "")));
+  if (tool === "Bash") {
+    const command = stripTextOptionValues(String(input.command ?? ""));
+    // KJC-BUG-0429 (ADR 0036): a command that only reads may name the guarded files;
+    // the role's own shell rules still judge it.
+    return evalShell(isReadOnlyCommand(command) ? { ...policy, defaults: [] } : policy, role, command);
+  }
   if (READONLY_TOOLS.has(tool) || !policy.roles?.[role]) return ALLOW_VERDICT;
   return denyVerdict(`roles.${role}.tools`, `tool "${tool}" fuera del registro de la policy — no verificable para el rol declarado ${role}`);
 }

package/src/policy/supervisor-verify.js

@@ -15,8 +15,8 @@ import { HOST_SETTINGS, isSealedConfig, PROVENANCE_FILE } from "../harden/superv
 
 const HOOKS_PREFIX = ".karajan/hooks/";
 const HARNESS_PREFIX = ".karajan/harness/";
-// globalHooksDir es el único texto libre que se interpola en el render:
-// vocabulario cerrado de ruta o la provenance no verifica NADA.
+// HU-2762: el render ya no interpola globalHooksDir; se conserva el guard para
+// provenances antiguas, donde era texto libre: vocabulario cerrado o no verifica NADA.
 const SAFE_DIR = /^(\$HOME)?(\/[\w.@%+~-]+)+$/;
 
 const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");

package/src/review/dual-review.js

@@ -47,10 +47,11 @@ function verdictOf(sides, findings, coverage) {
   if (blockers.length) return { status: "rejected", approved: false, reason: `confirmed blocker(s): ${blockers.map(where).join(", ")}`, summary };
   const rejecting = sides.filter((s) => !s.verdict?.approved).map((s) => s.reviewer);
   if (rejecting.length === 0 && !coverage.truncated) return { status: "approved", approved: true, summary };
-  const reason = rejecting.length
-    ? `${rejecting.join(" and ")} rejected, but no blocking finding was confirmed by the other family`
-    : "not every file was reviewed";
-  return { status: "partial", approved: false, reason, summary };
+  const dispute = rejecting.length ? `${rejecting.join(" and ")} rejected, but no blocking finding was confirmed by the other family` : null;
+  // KJC-BUG-0453 (#2921): "partial" only when files were left out (they are in coverage.unreviewed);
+  // everything reviewed and the reviewers disagreeing is "disputed".
+  if (coverage.truncated) return { status: "partial", approved: false, reason: ["not every file was reviewed", dispute].filter(Boolean).join("; "), summary };
+  return { status: "disputed", approved: false, reason: dispute, summary };
 }
 
 /** The two sides (reviewer, model, verdict, coverage, findings, outcomes, verification) as one result. */

package/src/review/gate-hook.js

@@ -0,0 +1,39 @@
+/**
+ * KJC-BUG-0447 (issue #2655): is the review gate actually ENFORCED? The marker
+ * only declares it; what refuses a commit is a pre-commit hook that runs
+ * `kj review --check`. Checked where git will look (core.hooksPath, local or
+ * global, or .git/hooks), never assumed from a hooks path being configured.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+// The contract: a line that RUNS the check and stops the commit when it fails, as the
+// pre-commit kj harden writes (`kj review --check || { ...; exit 1; }`) or `|| exit 1`.
+// A comment, the phrase inside an echo, `|| true`, `|| exit 0` or a group that does
+// not END in `exit N` (N > 0) enforce nothing. Right after `||`, a bare `exit` keeps
+// the failing check's status; inside a group it would take the previous command's.
+const GATE_LINE = /^\s*kj review --check\s*\|\|\s*(?:exit(?:\s+[1-9]\d*)?\s*(?:;|#|$)|\{(?:[^}]*;)?\s*exit\s+[1-9]\d*\s*;?\s*\})/;
+const runsGate = (body) => body.split("\n").some((line) => GATE_LINE.test(line));
+
+/** @returns {{enforced: boolean, hooksDir: string|null, reason: string|null}} */
+export function gateHookStatus(projectDir) {
+  let hooksDir;
+  try {
+    // --git-path hooks honours core.hooksPath (repo or global) and worktrees.
+    const rel = execFileSync("git", ["rev-parse", "--git-path", "hooks"], { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    hooksDir = path.resolve(projectDir, rel);
+  } catch {
+    return { enforced: false, hooksDir: null, reason: "not a git repository: no hook can enforce the gate" };
+  }
+  const hook = path.join(hooksDir, "pre-commit");
+  let body;
+  try { body = fs.readFileSync(hook, "utf8"); } catch {
+    return { enforced: false, hooksDir, reason: `no pre-commit hook in ${hooksDir}, where git looks for hooks` };
+  }
+  if (!runsGate(body)) return { enforced: false, hooksDir, reason: `${hook} does not run kj review --check` };
+  try { fs.accessSync(hook, fs.constants.X_OK); } catch {
+    return { enforced: false, hooksDir, reason: `${hook} is not executable, so git skips it` };
+  }
+  return { enforced: true, hooksDir, reason: null };
+}

package/src/review/one-shot-review.js

@@ -14,12 +14,13 @@ import { buildReviewerPrompt } from "../prompts/reviewer.js";
 import { resolveReviewProfile } from "./profiles.js";
 import { parseReviewVerdict } from "./parser.js";
 import { detectAvailableAgents, detectHostAgent } from "../utils/agent-detect.js";
+import { accountLabel } from "../utils/agent-home.js";
 import { saveVerdict, diffHash } from "./verdict-store.js";
 import { summarizeGeneratedFiles } from "./prompt-diff.js";
 import { reportUnparseableVerdict } from "./unparseable-verdict.js";
 import { detectWorkspace } from "./workspace.js";
 import { branchOf } from "./correction-rounds.js";
-import { isQuotaExhausted, candidateStatus, pickQuotaFallback, formatCandidateMenu } from "./reviewer-fallback.js";
+import { isQuotaExhausted, candidateStatus, pickQuotaFallback, formatCandidateMenu, reviewerFailureMessage } from "./reviewer-fallback.js";
 
 // Cross-AI preference when the configured reviewer IS the host.
 const CROSS_ORDER = ["codex", "claude", "gemini", "opencode", "aider"];
@@ -60,6 +61,7 @@ export async function runOneShotReview({
   // review can never unlock a commit of one's own.
   reviewerOverride = null,
   persist = true,
+  env = process.env,
 }) {
   if (!diff || !diff.trim()) {
     throw new Error("nothing to review — the diff is empty (stage your changes or pass --range)");
@@ -79,7 +81,9 @@ export async function runOneShotReview({
       // KJC-BUG-0347: generated files summarized; the verdict still binds to the full diff.
       diff: summarizeGeneratedFiles(diff), reviewRules: rules, mode: "standard", provider: who, projectDir,
     });
-    logger?.info?.(`kj review: host=${hostAgent || "none"} → reviewer=${who} (cross-AI)`);
+    // KJC-TSK-1344: with two subscriptions per CLI, say which account reviews.
+    const account = accountLabel(who, { env });
+    logger?.info?.(`kj review: host=${hostAgent || "none"} → reviewer=${who} (cross-AI)${account ? ` [${account}]` : ""}`);
     return createAgentFn(who, cfg, logger).reviewTask({ prompt, role: "reviewer" });
   };
 
@@ -115,7 +119,7 @@ export async function runOneShotReview({
   }
 
   if (!result?.ok) {
-    throw new Error(`reviewer ${activeReviewer} failed: ${result?.error || "no output"}`);
+    throw new Error(reviewerFailureMessage(activeReviewer, result?.error));
   }
 
   // KJC-BUG-0146, second half: parseMaybeJsonString only PARSES — it returns whatever JSON came