karajan-code 4.70.3 → 5.0.0

package/src/commands/harden.js

@@ -25,12 +25,20 @@ import { installHarnessHooks } from "../harden/harness-hooks.js";
 import { installSentinelHooks } from "../harden/sentinel-hooks.js";
 import { installSandbox } from "../harden/sandbox.js";
 import { detectStackRoots } from "../harden/stack-roots.js";
-import { installWorkflows, resolveKjPin } from "../harden/workflow-engine.js";
+import { detectPackageManager, installWorkflows, resolveKjPin } from "../harden/workflow-engine.js";
 import { adviseBranchProtection } from "../harden/branch-protection.js";
 import { detectTestFramework } from "../utils/project-detect.js";
 import { ensureIdentity } from "../identity/bootstrap.js";
 import { commitContract, contractChanges } from "../environment/contract-commit.js";
 
+// How each package manager runs a package.json script in a hook (`bun test` is bun's own runner, not the script).
+const HOOK_RUNNERS = {
+  npm: { run: (s) => `npm run -s ${s}`, test: "npm test" },
+  pnpm: { run: (s) => `pnpm run -s ${s}`, test: "pnpm test" },
+  yarn: { run: (s) => `yarn run ${s}`, test: "yarn test" },
+  bun: { run: (s) => `bun run ${s}`, test: "bun run test" },
+};
+
 const JS_TEST_CMD = {
   vitest: "npx vitest run",
   jest: "npx jest",
@@ -51,10 +59,12 @@ export async function resolveCmds(projectDir, language) {
   if (existsSync(pkgPath)) {
     try {
       const scripts = JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {};
-      if (scripts.lint) cmds.lint = "npm run -s lint";
-      if (scripts["format:check"]) cmds.format = "npm run -s format:check";
-      else if (scripts.format) cmds.format = "npm run -s format";
-      if (scripts.test) cmds.test = "npm test";
+      // KJC-BUG-0450 (#2789): the project's own package manager, as the workflows use it.
+      const pm = HOOK_RUNNERS[detectPackageManager(projectDir)] ?? HOOK_RUNNERS.npm;
+      if (scripts.lint) cmds.lint = pm.run("lint");
+      if (scripts["format:check"]) cmds.format = pm.run("format:check");
+      else if (scripts.format) cmds.format = pm.run("format");
+      if (scripts.test) cmds.test = pm.test;
     } catch {
       /* unreadable package.json → fall back to framework detection */
     }
@@ -150,57 +160,13 @@ export async function hardenCommand({
   const baseBranch = await resolveBaseBranch(projectDir);
   let result;
   try {
-    result = await installHooks({ projectDir, profile, cmds, dryRun, baseBranch });
-    // KJC-TSK-0710 — the TOOL gate: rules imposed at tool time (Claude Code
-    // PreToolUse). Standard+ only; minimal stays hooks-lite.
-    if (profile !== "minimal" && !dryRun) {
-      const hh = installHarnessHooks({ projectDir, logger });
-      result.harnessHooks = hh.wired ? "wired" : "script-only";
-      // KJC-TSK-0713 — the Sentinel: method state + Stop gate (turn cannot
-      // end red). Same Claude-only harness surface as the tool gate.
-      // KJC-BUG-0193: solo un humano avanza lo que un humano selló. Sin
-      // --commit, un guardia sellado se queda como está en lugar de quedarse
-      // sin sello, que es como una sesión se dejaba sin herramientas.
-      const sh = installSentinelHooks({ projectDir, logger, human: commitSupervisor });
-      result.sentinelHooks = sh.wired ? "wired" : "script-only";
-      // KJC-TSK-1092/1241: the host sandbox, only when asked (kj harden --sandbox):
-      // inside it kj run cannot push, open the PR or reach Sonar on localhost.
-      if (sandbox) result.sandbox = installSandbox({ projectDir, logger }).state;
-    }
+    result = await installSupervisor({ projectDir, profile, cmds, dryRun, baseBranch, commitSupervisor, sandbox, logger });
   } catch (err) {
     if (json) logger.info?.(JSON.stringify({ ok: false, error: err.message }));
     else logger.error?.(`kj harden: ${err.message}`);
     return { ok: false, error: err.message };
   }
-
-  // Config (lint/format/commit) ships with standard+, per language root so a
-  // fullstack monorepo is hardened on every side, not just one.
-  const withConfig = config && profile !== "minimal";
-  const cfg = withConfig ? installConfigsForRoots({ projectDir, roots, dryRun }) : null;
-  const withCi = ci && profile !== "minimal";
-  // KJC-BUG-0420: consumer CI installs kj from npm, so the workflows pin a published version.
-  const pin = withCi ? await resolveKjPin({ projectDir, fetchFn }) : null;
-  if (pin?.note) logger.warn?.(`⚠ ${pin.note}`);
-  const wf = withCi
-    ? installWorkflows({ projectDir, language: roots[0]?.language ?? null, root: roots[0]?.dir ?? ".", profile, mutation, dryRun, kjVersion: pin?.version ?? null })
-    : null;
-  const withGuidelines = guidelines && profile !== "minimal";
-  // KJC-BUG-0199 (issue #1773): the same detected language the workflows and
-  // the configs already use — a Python project must not be told to use `const`.
-  const gl = withGuidelines ? installGuidelines({ projectDir, language: roots[0]?.language ?? null, dryRun }) : null;
-  // KJC-TSK-0879: in a Rulesync repo, spread the rules only if the project opted in.
-  if (withGuidelines && !dryRun) {
-    let kjConfig = null;
-    try { kjConfig = (await loadConfig(projectDir))?.config; } catch { /* no kj config: not opted in */ }
-    maybeRulesyncGenerate({ projectDir, config: kjConfig, logger });
-  }
-  const out = {
-    ok: true,
-    ...result,
-    configs: cfg?.configs ?? [],
-    workflows: wf?.workflows ?? [],
-    guidelines: gl?.guidelines ?? [],
-  };
+  const out = { ok: true, ...result, ...(await installExtras({ projectDir, roots, profile, config, ci, guidelines, mutation, dryRun, fetchFn, logger })) };
   // KJC-BUG-0289 (#1984): what kj harden generates, kj commits (KJC-BUG-0273's
   // path): only that, never on the base branch. Left to the agent, 3.2k generated
   // lines exceeded its own PR size and stayed untracked. The seal (--commit, ADR
@@ -216,6 +182,58 @@ export async function hardenCommand({
     return out;
   }
 
+  printHardenSummary({ out, result, profile, dryRun, logger });
+  if (!dryRun) await afterInstall({ out, result, projectDir, profile, commitSupervisor, kjVersion, logger });
+  return out;
+}
+
+/** The git hooks and, from standard up, the tool gate, the Sentinel and the optional sandbox. */
+async function installSupervisor({ projectDir, profile, cmds, dryRun, baseBranch, commitSupervisor, sandbox, logger }) {
+  const result = await installHooks({ projectDir, profile, cmds, dryRun, baseBranch });
+  // KJC-TSK-0710 — the TOOL gate: rules imposed at tool time (Claude Code
+  // PreToolUse). Standard+ only; minimal stays hooks-lite.
+  if (profile === "minimal" || dryRun) return result;
+  const hh = installHarnessHooks({ projectDir, logger });
+  result.harnessHooks = hh.wired ? "wired" : "script-only";
+  // KJC-TSK-0713 — the Sentinel: method state + Stop gate (turn cannot
+  // end red). Same Claude-only harness surface as the tool gate.
+  // KJC-BUG-0193: solo un humano avanza lo que un humano selló. Sin
+  // --commit, un guardia sellado se queda como está en lugar de quedarse
+  // sin sello, que es como una sesión se dejaba sin herramientas.
+  const sh = installSentinelHooks({ projectDir, logger, human: commitSupervisor });
+  result.sentinelHooks = sh.wired ? "wired" : "script-only";
+  // KJC-TSK-1092/1241: the host sandbox, only when asked (kj harden --sandbox):
+  // inside it kj run cannot push, open the PR or reach Sonar on localhost.
+  if (sandbox) result.sandbox = installSandbox({ projectDir, logger }).state;
+  return result;
+}
+
+/** Configs, workflows and guidelines (standard+), with the language detected for the first root. */
+async function installExtras({ projectDir, roots, profile, config, ci, guidelines, mutation, dryRun, fetchFn, logger }) {
+  const full = profile !== "minimal";
+  const language = roots[0]?.language ?? null;
+  // Config (lint/format/commit) ships with standard+, per language root so a
+  // fullstack monorepo is hardened on every side, not just one.
+  const cfg = config && full ? installConfigsForRoots({ projectDir, roots, dryRun }) : null;
+  // KJC-BUG-0420: consumer CI installs kj from npm, so the workflows pin a published version.
+  const pin = ci && full ? await resolveKjPin({ projectDir, fetchFn }) : null;
+  if (pin?.note) logger.warn?.(`⚠ ${pin.note}`);
+  const wf = ci && full ? installWorkflows({ projectDir, language, root: roots[0]?.dir ?? ".", profile, mutation, dryRun, kjVersion: pin?.version ?? null }) : null;
+  const withGuidelines = guidelines && full;
+  // KJC-BUG-0199 (issue #1773): the same detected language the workflows and
+  // the configs already use — a Python project must not be told to use `const`.
+  const gl = withGuidelines ? installGuidelines({ projectDir, language, dryRun }) : null;
+  // KJC-TSK-0879: in a Rulesync repo, spread the rules only if the project opted in.
+  if (withGuidelines && !dryRun) {
+    let kjConfig = null;
+    try { kjConfig = (await loadConfig(projectDir))?.config; } catch { /* no kj config: not opted in */ }
+    maybeRulesyncGenerate({ projectDir, config: kjConfig, logger });
+  }
+  return { configs: cfg?.configs ?? [], workflows: wf?.workflows ?? [], guidelines: gl?.guidelines ?? [] };
+}
+
+/** KJC-TSK-1257: what was installed, file by file, in the order it always had. */
+function printHardenSummary({ out, result, profile, dryRun, logger }) {
   const verb = dryRun ? "would install" : "installed";
   logger.info?.(`kj harden (${profile}) — ${verb} ${result.hooks.length} hook(s) → ${result.hooksPath}`);
   for (const h of result.hooks) logger.info?.(`  • ${h.hook}: ${h.action}`);
@@ -227,48 +245,49 @@ export async function hardenCommand({
     logger.info?.(`  • ${w.file}: ${w.action}`);
     if (w.note) logger.warn?.(`⚠ ${w.note}`);
   }
-  for (const g of out.guidelines) {
-    logger.info?.(`  • ${g.file}: ${g.action}`);
-    // KJC-BUG-0206: quitar reglas no puede leerse como "updated" y nada más.
-    if (g.shrank) logger.warn?.(`    ⚠ ${g.file} queda con MENOS reglas que antes — revisa si el lenguaje detectado es el que crees (kj check lo dice)`);
-    // KJC-BUG-0232: cuales. Si una es tuya, vivia dentro del bloque: va fuera.
-    if (g.removed?.length) {
-      for (const line of g.removed.slice(0, 10)) logger.warn?.(`      - ${line.length > 120 ? `${line.slice(0, 117)}...` : line}`);
-      if (g.removed.length > 10) logger.warn?.(`      (+${g.removed.length - 10} más)`);
-      logger.warn?.("      Si alguna es vuestra, estaba dentro del bloque gestionado: recuperadla de git y ponedla fuera de él.");
-    }
-  }
+  for (const g of out.guidelines) printGuideline(g, logger);
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");
+}
+
+function printGuideline(g, logger) {
+  logger.info?.(`  • ${g.file}: ${g.action}`);
+  // KJC-BUG-0206: quitar reglas no puede leerse como "updated" y nada más.
+  if (g.shrank) logger.warn?.(`    ⚠ ${g.file} queda con MENOS reglas que antes — revisa si el lenguaje detectado es el que crees (kj check lo dice)`);
+  // KJC-BUG-0232: cuales. Si una es tuya, vivia dentro del bloque: va fuera.
+  if (!g.removed?.length) return;
+  for (const line of g.removed.slice(0, 10)) logger.warn?.(`      - ${line.length > 120 ? `${line.slice(0, 117)}...` : line}`);
+  if (g.removed.length > 10) logger.warn?.(`      (+${g.removed.length - 10} más)`);
+  logger.warn?.("      Si alguna es vuestra, estaba dentro del bloque gestionado: recuperadla de git y ponedla fuera de él.");
+}
+
+/** After a real install: who works the clone, the branch protection advice and, if asked, the human seal. */
+async function afterInstall({ out, result, projectDir, profile, commitSupervisor, kjVersion, logger }) {
   // IDN-A (KJC-TSK-0762): a hardened clone declares who works it. Captured
   // only with a human confirming; headless runs get the pending command.
-  if (!dryRun) {
-    const id = await ensureIdentity({ projectDir, logger });
-    out.identity = id.declared ? id.identity : null;
-    if (id.pending) {
-      out.identityPending = id.pending;
-      out.identityCommand = id.command;
-    }
+  const id = await ensureIdentity({ projectDir, logger });
+  out.identity = id.declared ? id.identity : null;
+  if (id.pending) {
+    out.identityPending = id.pending;
+    out.identityCommand = id.command;
   }
   // KJC-TSK-0928: the method's checks only stop a merge with branch protection; kj says the exact command.
-  if (!dryRun) out.branchProtection = await adviseBranchProtection({ projectDir, branch: await resolveBaseBranch(projectDir), logger });
+  out.branchProtection = await adviseBranchProtection({ projectDir, branch: await resolveBaseBranch(projectDir), logger });
   // KJC-BUG-0161 / ADR 0009 (opción A): --commit versiona la regeneración
   // del supervisor con procedencia sellada. Acto humano — el guard vive en
   // commitSupervisorRegeneration y rechaza sesiones de agente.
-  if (commitSupervisor && !dryRun) {
-    try {
-      out.supervisorCommit = await commitSupervisorRegeneration({
-        projectDir,
-        kjVersion: kjVersion ?? "unknown",
-        generation: result.generation ?? { profile },
-        logger,
-      });
-    } catch (err) {
-      // Fallar ALTO (catch de codex): un --commit que no commitea no puede
-      // devolver ok — quien lo pidió debe verlo, no descubrirlo después.
-      logger.error?.(`kj harden: ${err.message}`);
-      out.supervisorCommit = { committed: false, reason: err.message };
-      out.ok = false;
-    }
+  if (!commitSupervisor) return;
+  try {
+    out.supervisorCommit = await commitSupervisorRegeneration({
+      projectDir,
+      kjVersion: kjVersion ?? "unknown",
+      generation: result.generation ?? { profile },
+      logger,
+    });
+  } catch (err) {
+    // Fallar ALTO (catch de codex): un --commit que no commitea no puede
+    // devolver ok — quien lo pidió debe verlo, no descubrirlo después.
+    logger.error?.(`kj harden: ${err.message}`);
+    out.supervisorCommit = { committed: false, reason: err.message };
+    out.ok = false;
   }
-  return out;
 }

package/src/commands/hu-start.js

@@ -0,0 +1,52 @@
+/**
+ * `kj hu start <id> [slug]` (KJC-TSK-1372, #2853, step 7 of #2566): starting a task is one
+ * step, in the order that works. In 5.0 the host agent does the work inside a lane, so a lane
+ * that comes before its card gets its writes refused later. This command:
+ * 1. finds the card and refuses, before creating anything, if it does not exist or someone else holds it;
+ * 2. opens its lane with `kj worktree start <id>-<slug>` (feat/<id>-<slug> from origin/<base>, set up);
+ * 3. moves the card to running, which claims it, and prints the cd.
+ */
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+import { worktreeCommand } from "./worktree.js";
+
+const SLUG_MAX = 40;
+const KJ_BIN = fileURLToPath(new URL("../../bin/kj.js", import.meta.url));
+
+/** KJC-TSK-1324: `kj code --card <id> "<title>"` in the lane, output inherited (the board's log). */
+const runCoderIn = ({ cwd, card, task }) =>
+  spawnSync(process.execPath, [KJ_BIN, "code", "--card", card, task], { cwd, stdio: "inherit" }).status ?? 1;
+
+/** A lane slug from a card's title: ascii, lowercase, dashes; "task" when nothing is left. */
+export function slugOf(title) {
+  const slug = String(title ?? "").normalize("NFD").replace(/\p{M}/gu, "").toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, SLUG_MAX).replace(/-+$/, "");
+  return slug || "task";
+}
+
+/**
+ * @param {{ config: object, args: string[], deps: { findCard: Function, worktree?: Function },
+ *   move: () => Promise<unknown>, who: string|null, emit: Function }} opts
+ */
+export async function startAction({ config, args, flags = {}, deps, move, who, emit }) {
+  const [ref, slugArg] = args;
+  if (!ref) throw new Error("usage: kj hu start <id> [slug]");
+  const card = await deps.findCard(ref);
+  if (!card) throw new Error(`${ref} not found — see kj hu list`);
+  if (card.claimed_by && card.claimed_by !== who) {
+    throw new Error(`${ref} is held by ${card.claimed_by}: ask them, or take it explicitly with kj hu move ${ref} running --release`);
+  }
+  const lane = await (deps.worktree ?? worktreeCommand)({ config, action: "start", args: [`${ref}-${slugArg || slugOf(card.title)}`], flags: {} });
+  try {
+    await move();
+  } catch (err) {
+    throw new Error(`lane ${lane.branch} is ready but ${ref} is not running yet (${err.message}): kj hu move ${ref} running`, { cause: err });
+  }
+  // KJC-TSK-1324: the board's ▶ has the panel coder write the card in its lane; review and commit stay with you.
+  if (flags.code) {
+    const status = (deps.runCoder ?? runCoderIn)({ cwd: lane.path, card: ref, task: card.title });
+    if (status !== 0) throw new Error(`the coder (kj code --card ${ref}) ended with exit ${status} in ${lane.path}`);
+  }
+  return emit({ id: ref, branch: lane.branch, lane: lane.path }, `✓ ${ref} started in its lane ${lane.branch}\n  cd ${lane.path}`);
+}