karajan-code 4.70.2 → 4.70.4

package/src/review/pr-requirements.js

@@ -9,7 +9,7 @@ import { join } from "node:path";
 import { AI_ATTRIBUTION, CONVENTIONAL_TYPES } from "../harden/hook-templates.js";
 import { loadPolicy } from "../policy/engine.js";
 import { runCommand } from "../utils/process.js";
-import { budgetedAdded } from "./loc-budget.js";
+import { budgetedNet } from "./loc-budget.js";
 import { checkTestsWithCode } from "./tests-with-code.js";
 
 const HEADER_MAX = 100;
@@ -37,13 +37,13 @@ export function prSizeLimit({ projectDir, config }) {
   };
 }
 
-/** Lines added that count against the budget (generated output and human docs exempt). */
+/** Net lines that count against the budget, as the CI gate counts them (generated output and human docs exempt). */
 export function sizeCheck({ numstat, limit }) {
-  const { added, exempt } = budgetedAdded(numstat);
+  const { net, exempt } = budgetedNet(numstat);
   const exemptNote = exempt > 0 ? ` (${exempt} exempt)` : "";
-  return added > limit
-    ? { id: "size", ok: false, detail: `${added} lines added${exemptNote}, over the ${limit}-line limit: partition the PR` }
-    : { id: "size", ok: true, detail: `${added} lines added${exemptNote}, within the ${limit}-line limit` };
+  return net > limit
+    ? { id: "size", ok: false, detail: `${net} net lines${exemptNote}, over the ${limit}-line limit: partition the PR` }
+    : { id: "size", ok: true, detail: `${net} net lines${exemptNote}, within the ${limit}-line limit` };
 }
 
 /** Conventional Commits headers (at most 100 characters) and no AI attribution in base..head. */

package/src/review/publish-pr.js

@@ -9,6 +9,8 @@ import { diffHash, loadVerdict } from "./verdict-store.js";
 import { isCleanMerge } from "./clean-merge.js";
 
 export const MARKER = (head) => `<!-- kj-review head=${head} -->`;
+/** Who may publish a kj review that counts: verify-pr ignores anyone else. */
+export const TRUSTED = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 
 // gh runs in the project's own directory, so it reads and writes the same repo the verdicts belong to.
 async function json(run, cmd, args, cwd) {
@@ -39,7 +41,8 @@ export async function publishPrReview({ projectDir, pr, run = runCommand }) {
   }
   if (uncovered.length > 0) throw new Error(`PR #${pr}: ${uncovered.length} commit(s) without an approved verdict of their exact diff, nothing published: ${uncovered.join(", ")}`);
   const reviews = await json(run, "gh", ["api", `repos/{owner}/{repo}/pulls/${pr}/reviews`], projectDir);
-  if ((reviews ?? []).some((r) => String(r.body ?? "").includes(MARKER(info.headRefOid)))) {
+  // KJC-BUG-0456: one a non-member posted (gh switched to another account) does not count in CI.
+  if ((reviews ?? []).some((r) => TRUSTED.has(r.author_association) && String(r.body ?? "").includes(MARKER(info.headRefOid)))) {
     return { published: false, reason: `a kj review for head ${info.headRefOid.slice(0, 7)} is already published` };
   }
   const body = [

package/src/review/reviewer-fallback.js

@@ -14,6 +14,7 @@ import { existsSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { checkBinary } from "../utils/agent-detect.js";
+import { agentAuthFiles } from "../utils/agent-home.js";
 
 export const REVIEWER_CANDIDATES = [
   {
@@ -70,9 +71,22 @@ export const REVIEWER_CANDIDATES = [
 
 const QUOTA_RE = /usage limit|quota|rate.?limit|credits? (?:exhausted|left: ?0)|hit your .{0,20}limit/i;
 
+// KJC-BUG-0451 (#2799): codex puts a `rate_limits` telemetry object in every JSON event;
+// it says how much quota is LEFT, so it is no evidence that the quota ran out.
+const RATE_LIMITS_TELEMETRY = /"rate_limits"\s*:\s*(?:\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}|null)/g;
+
 /** True when the agent error smells like exhausted quota, not a real failure. */
 export function isQuotaExhausted(text) {
-  return typeof text === "string" && QUOTA_RE.test(text);
+  return typeof text === "string" && QUOTA_RE.test(text.replace(RATE_LIMITS_TELEMETRY, ""));
+}
+
+// The CLI could not reach its service at all: a sandboxed shell or the network, not the reviewer.
+const UNREACHABLE_RE = /routing discovery failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|EAI_AGAIN|getaddrinfo|stream disconnected|network (?:error|is unreachable)/i;
+
+/** The real error, plus a hint when the reviewer CLI never reached its service. */
+export function reviewerFailureMessage(reviewer, error) {
+  const base = `reviewer ${reviewer} failed: ${error || "no output"}`;
+  return UNREACHABLE_RE.test(String(error || "")) ? `${base} — ${reviewer} could not reach its service (a sandboxed shell or the network?); run kj review from an unsandboxed shell` : base;
 }
 
 /** installed × authenticated for every candidate, from cheap local checks. */
@@ -86,8 +100,10 @@ export async function candidateStatus({ home = os.homedir(), checkBin = checkBin
       // Session-file heuristics, or env keys for CLIs (aider) that carry
       // no session file. Key present ≠ credit left — it is menu signal;
       // the failover only sticks if the candidate actually answers.
+      // KJC-TSK-1344: codex and claude keep the account where CODEX_HOME / CLAUDE_CONFIG_DIR say.
+      const files = agentAuthFiles(c.name, { home, env }) ?? c.authPaths.map((p) => path.join(home, p));
       const authenticated =
-        c.authPaths.some((p) => existsSync(path.join(home, p))) ||
+        files.some((f) => existsSync(f)) ||
         (c.authEnv || []).some((name) => Boolean(env[name]));
       return { ...c, installed, authenticated };
     }),

package/src/review/verify-pr.js

@@ -7,10 +7,11 @@
  */
 import { runCommand } from "../utils/process.js";
 import { diffHash } from "./verdict-store.js";
-import { MARKER } from "./publish-pr.js";
+import { MARKER, TRUSTED } from "./publish-pr.js";
 import { isCleanMerge } from "./clean-merge.js";
+import { verifiedSupervisorFiles } from "../policy/supervisor-verify.js";
+import { PROVENANCE_FILE } from "../harden/supervisor-commit.js";
 
-const TRUSTED = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 // The marker of a kj review for any head: what MARKER writes up to the head itself.
 const MARKER_PREFIX = MARKER("\0").split("\0")[0];
 // One line per commit, as publish-pr writes it: - `<sha7>` headline: approved by X (diff <hash12>)...
@@ -38,10 +39,33 @@ async function hashesOf(projectDir, sha, run) {
   return hashes;
 }
 
+// KJC-BUG-0388: kj harden --commit is the human's act, signed from the phone, and no AI
+// reviews it. The proof is the signature, never the message: a commit that only touches
+// files the roster-signed seal vouches for at the head is that act.
+async function isSealCommit(projectDir, sha, run, sealed) {
+  if (sealed.signed !== true) return false;
+  const res = await run("git", ["-C", projectDir, "diff", "--name-only", `${sha}^`, sha]);
+  if (res.exitCode !== 0) throw new Error(`git diff --name-only ${sha.slice(0, 7)} failed: ${(res.stderr || "").trim()}`);
+  const files = (res.stdout || "").split("\n").filter(Boolean);
+  // KJC-BUG-0438: the seal act writes the signed provenance; a commit without it only touched files.
+  if (!files.includes(PROVENANCE_FILE)) return false;
+  if (!files.every((f) => sealed.files.has(f) || (f === PROVENANCE_FILE && sealed.complete === true))) return false;
+  // What the commit leaves is byte for byte what the signed seal vouches for at the head: a
+  // precursor whose provenance or hooks a later commit replaced is not the seal act.
+  for (const f of files) if ((await blobAt(projectDir, sha, f, run)) !== (await blobAt(projectDir, "HEAD", f, run))) return false;
+  return true;
+}
+
+/** The blob id of a file at a revision, or null when the file is absent there. */
+async function blobAt(projectDir, rev, file, run) {
+  const res = await run("git", ["-C", projectDir, "rev-parse", "--verify", "--quiet", `${rev}:${file}`]);
+  return res.exitCode === 0 ? String(res.stdout || "").trim() : null;
+}
+
 /**
- * @returns {Promise<{ok: boolean, commits: number, problems: string[]}>}
+ * @returns {Promise<{ok: boolean, commits: number, problems: string[], sealCommits?: string[]}>}
  */
-export async function verifyPrReview({ projectDir, pr, run = runCommand }) {
+export async function verifyPrReview({ projectDir, pr, run = runCommand, sealed = null }) {
   const info = await json(run, ["pr", "view", String(pr), "--json", "headRefOid,commits"], projectDir);
   const commits = info.commits ?? [];
   // One review per line, every page: --slurp is missing from the gh that distros ship.
@@ -52,15 +76,21 @@ export async function verifyPrReview({ projectDir, pr, run = runCommand }) {
   // today's head: the diff hash of each commit is what proves it, and a commit pushed after
   // the review is simply not listed. "Update branch" no longer leaves the check red.
   const kjReviews = reviews.filter((r) => TRUSTED.has(r.author_association) && String(r.body ?? "").includes(MARKER_PREFIX));
-  if (kjReviews.length === 0) {
-    return { ok: false, commits: commits.length, problems: [`no kj review published by a member: run kj review --publish-pr ${pr}`] };
-  }
   const listed = new Map(kjReviews.flatMap((r) => [...r.body.matchAll(LISTED)].map((m) => [m[1], m[2]])));
   const problems = [];
+  const sealCommits = [];
+  let seal = sealed;
   for (const c of commits) {
     if (await isCleanMerge(projectDir, c.oid, run)) continue;
     const hash = listed.get(c.oid.slice(0, 7));
-    if (!hash || !(await hashesOf(projectDir, c.oid, run)).has(hash)) problems.push(`${c.oid.slice(0, 7)} (${c.messageHeadline}): no approved verdict for the diff it brings`);
+    if (hash && (await hashesOf(projectDir, c.oid, run)).has(hash)) continue;
+    seal ??= verifiedSupervisorFiles({ projectDir, trackedOnly: true });
+    if (await isSealCommit(projectDir, c.oid, run, seal)) sealCommits.push(c.oid.slice(0, 7));
+    else problems.push(`${c.oid.slice(0, 7)} (${c.messageHeadline}): no approved verdict for the diff it brings`);
   }
-  return { ok: problems.length === 0, commits: commits.length, problems };
+  // A PR that only brings the seal needs no review; anything else without one (a clean merge
+  // included, KJC-BUG-0438) is told to publish it.
+  const onlySeals = sealCommits.length > 0 && sealCommits.length === commits.length;
+  if (kjReviews.length === 0 && !onlySeals) problems.splice(0, problems.length, `no kj review published by a member: run kj review --publish-pr ${pr}`);
+  return { ok: problems.length === 0, commits: commits.length, problems, ...(sealCommits.length > 0 ? { sealCommits } : {}) };
 }

package/src/sonar/scanner.js

@@ -198,7 +198,8 @@ async function maybeRunCoverage(config) {
 
   const command = String(coverage.command || "").trim();
   const timeout = Number(coverage.timeout_ms) > 0 ? Number(coverage.timeout_ms) : 5 * 60 * 1000;
-  const run = await runCommand("bash", ["-lc", command], { timeout });
+  // KJC-BUG-0427: a plain shell in kj's environment; a login one may rewrite PATH.
+  const run = await runCommand("bash", ["-c", command], { timeout });
 
   if (run.exitCode !== 0) {
     if (blockOnFailure) {

package/src/utils/agent-home.js

@@ -0,0 +1,33 @@
+/**
+ * KJC-TSK-1344 — where each CLI keeps its account. One person may hold two
+ * subscriptions per CLI (personal and work): claude switches account with
+ * CLAUDE_CONFIG_DIR and codex with CODEX_HOME. kj passes both to the agents
+ * (role-env allows CLAUDE* and CODEX*), so it must also LOOK there for the
+ * session and the config, never at a fixed ~/.codex or ~/.claude.json.
+ */
+import os from "node:os";
+import path from "node:path";
+
+const ACCOUNT_VAR = { codex: "CODEX_HOME", claude: "CLAUDE_CONFIG_DIR" };
+
+export const codexHome = ({ home = os.homedir(), env = process.env } = {}) =>
+  env.CODEX_HOME || path.join(home, ".codex");
+
+export const claudeConfigFile = ({ home = os.homedir(), env = process.env } = {}) =>
+  path.join(env.CLAUDE_CONFIG_DIR || home, ".claude.json");
+
+/** Absolute files that mark a logged-in session, or null for agents without an account variable. */
+export function agentAuthFiles(agent, { home = os.homedir(), env = process.env } = {}) {
+  if (agent === "codex") return [path.join(codexHome({ home, env }), "auth.json")];
+  if (agent === "claude") {
+    const dir = env.CLAUDE_CONFIG_DIR;
+    return dir ? [path.join(dir, ".claude.json"), path.join(dir, ".credentials.json")] : [path.join(home, ".claude.json"), path.join(home, ".claude")];
+  }
+  return null;
+}
+
+/** "CODEX_HOME=/path" when the variable moves the account, null on the default. */
+export function accountLabel(agent, { env = process.env } = {}) {
+  const name = ACCOUNT_VAR[agent];
+  return name && env[name] ? `${name}=${env[name]}` : null;
+}