karajan-code 4.70.3 → 5.0.0

package/src/harden/sentinel/pretooluse-sentinel.mjs

@@ -7,13 +7,13 @@
 import console from "node:console";
 import process from "node:process";
 import { dirname, join, relative, resolve } from "node:path";
-import { appendFileSync, existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, enterLane, holdLane, laneFor, laneRefusal, laneTop, load, save, session, boardGate, pendingMoves, pendingText, stagedVerdict } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { isGhIssueCreate, isPublishCommand, isReadOnlyCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
+import { commitStaging, isGhIssueCreate, isPublishCommand, isReadOnlyCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
 import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
 import { sandboxCovers, shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
@@ -26,7 +26,8 @@ let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
-    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, transcript_path: transcript = null } = JSON.parse(raw);
+    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, transcript_path: transcript = null, cwd = null } = JSON.parse(raw);
+    enterLane(load(), sid, cwd);
     // KJC-TSK-0920 (SNT-E): every deny ends with the same line, whatever gate it was.
     // KJC-TSK-0968 (HUM-E, ADR 0018): and leaves a record next to the state, with the
     // gate's own words: kj handoff takes the why from here, never from the agent.
@@ -50,7 +51,7 @@ process.stdin.on("end", () => {
       // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
       if (Object.hasOwn(touch, relT)) return;
       // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
-      const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
+      const gs = spawnSync("git", ["-C", laneTop(), "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
       const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
       Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
       save(st);
@@ -60,7 +61,9 @@ process.stdin.on("end", () => {
     // only the human, editing outside it.
     if (EDIT_TOOLS.includes(tool)) {
       const target = input.file_path || input.notebook_path;
-      const relT = target ? relative(ROOT, String(target)).replaceAll("\\", "/") : "";
+      // ADR 0034: judged in the lane the write lands in (its supervisor, its config).
+      const targetTop = target ? laneFor(target) : laneTop();
+      const relT = target ? relative(targetTop, String(target)).replaceAll("\\", "/") : "";
       if (relT && PROTECTED.test(relT)) {
         console.error("karajan sentinel: ese fichero es parte del supervisor (" + relT + ") — solo el humano desmonta el sentinel, editalo fuera de la sesion." + doc("supervisor"));
         process.exit(2);
@@ -74,7 +77,8 @@ process.stdin.on("end", () => {
         console.error("karajan sentinel: " + relT + " es configuracion de gobierno (politicas, gates, exclusiones): la cambia tu usuario, no la sesion. Si un gate te parece injusto, proponselo a tu usuario o usa kj report-issue." + doc("governance"));
         process.exit(2);
       }
-      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) noteFirstTouch(relT);
+      // The ledger is keyed by path in the session's lane: a write the lane guard will deny records nothing.
+      if (targetTop === laneTop() && relT && !relT.startsWith("..") && !relT.startsWith("/")) noteFirstTouch(relT);
     }
     // KJC-BUG-0261: rm / git rm is the session touching those files, noted before they go.
     if (tool === "Bash") for (const words of shellSegments(String(input.command || ""))) for (const f of removedFiles(words, ROOT)) noteFirstTouch(f);
@@ -202,9 +206,9 @@ process.stdin.on("end", () => {
       };
       const declaredGh = idLine("gh_user");
       const ghHostsPath = join(process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh"), "hosts.yml");
-      const activeGh = () => {
-        if (!existsSync(ghHostsPath)) return null;
-        const lines = readFileSync(ghHostsPath, "utf8").split(ESC_NL);
+      const activeGh = (hostsPath = ghHostsPath) => {
+        if (!existsSync(hostsPath)) return null;
+        const lines = readFileSync(hostsPath, "utf8").split(ESC_NL);
         const start = lines.findIndex((l) => l.startsWith("github.com:"));
         if (start < 0) return null;
         for (let k = start + 1; k < lines.length; k += 1) {
@@ -216,6 +220,19 @@ process.stdin.on("end", () => {
       };
       const words = (seg) => seg.trim().split(" ").filter((w) => w.length > 0 && w !== ESC_TAB);
       const headOf = (ws) => { let k = 0; while (k < ws.length && ws[k].indexOf("=") > 0 && ws[k].indexOf("=") < ws[k].length) k += 1; return ws.slice(k); };
+      // KJC-BUG-0459: `GH_CONFIG_DIR=<dir> gh ...` reads <dir>, not the hook's config.
+      const hostsOf = (ws) => {
+        const a = ws.slice(0, ws.length - headOf(ws).length).findLast((w) => w.startsWith("GH_CONFIG_DIR="));
+        if (!a) return null; // no assignment of its own (not the same as one naming the default dir)
+        const d = bare(a.slice("GH_CONFIG_DIR=".length)).replace(/^(~|\$HOME|\$\{HOME\})(?=\/|$)/, homedir());
+        return join(d, "hosts.yml");
+      };
+      // KJC-BUG-0459: a per-account gh (gh-tribbu, gh-ox: ADR 0040). The accounts guide makes
+      // gh-<account> run gh with GH_CONFIG_DIR=~/.config/gh-<account>: its config is READ, the
+      // wrapper is never executed by the hook.
+      const wrapperName = (w) => w.slice(w.lastIndexOf("/") + 1);
+      const isGhWrapper = (w) => /^gh-[A-Za-z0-9_.-]+$/.test(wrapperName(w));
+      const wrapperHosts = (w) => join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), wrapperName(w), "hosts.yml");
       // Wrapper shells hide the payload in a string (review catch): scan inside.
       const WRAPPERS =["sh", "bash", "zsh", "dash", "eval", "env", "xargs", "sudo", "nohup", "time", "exec"];
       let switchedTo = null;
@@ -223,12 +240,21 @@ process.stdin.on("end", () => {
       // $( and backticks are separators too (review catch): their payload is its own segment.
       const SEPS = [";", "&&", "||", "|", "$(", String.fromCharCode(96), "(", ")"];
       const bare = (w) => w.replaceAll(String.fromCharCode(39), "").replaceAll(String.fromCharCode(34), "");
-      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth); };
-      const checkSeg = (ws, depth) => {
+      // A rescanned payload inherits the config resolved outside it (`GH_CONFIG_DIR=<dir> env gh ...`).
+      const scan = (text, depth, inherited = null) => {
+        if (depth > 3) return;
+        for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) {
+          checkSeg(headOf(words(seg)), depth, hostsOf(words(seg)) ?? inherited);
+        }
+      };
+      // hostsPath: the config an explicit GH_CONFIG_DIR assignment selects, or null without one.
+      const checkSeg = (ws, depth, hostsPath = null) => {
         if (ws.length === 0) return;
         if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/wrapper token (review catch)
-          const j = ws.findIndex((w, i) => i > 0 && ["gh", ...WRAPPERS].includes(bare(w)));
-          if (j > 0) scan(ws.slice(j).map(bare).join(" "), depth + 1);
+          const j = ws.findIndex((w, i) => i > 0 && (["gh", ...WRAPPERS].includes(bare(w)) || isGhWrapper(bare(w))));
+          // `env GH_CONFIG_DIR=<dir> gh ...`: the assignments before the command go with it (review catch).
+          const assigns = ws.slice(1, Math.max(j, 1)).map(bare).filter((w) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(w));
+          if (j > 0) scan([...assigns, ...ws.slice(j).map(bare)].join(" "), depth + 1, hostsPath);
           return;
         }
         if (ws[0] === "gh") {
@@ -237,8 +263,15 @@ process.stdin.on("end", () => {
             return; // session commands ARE the remedy — never blocked
           }
           if (!declaredGh) { problems.push("gh without a declared identity for this clone — run: kj identity set"); return; }
-          const eff = switchedTo || activeGh();
-          if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ...");
+          const eff = hostsPath ? activeGh(hostsPath) : (switchedTo || activeGh());
+          if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ... (or use the gh of that account, e.g. gh-<account>)");
+        }
+        if (isGhWrapper(ws[0])) {
+          if (ws[1] === "auth") return; // its session commands are the remedy too
+          if (!declaredGh) { problems.push(ws[0] + " without a declared identity for this clone — run: kj identity set"); return; }
+          // Its own config even with an inline GH_CONFIG_DIR: the wrapper sets that variable itself.
+          const eff = activeGh(wrapperHosts(ws[0]));
+          if (eff !== declaredGh) problems.push(wrapperName(ws[0]) + " runs as '" + (eff || "no session") + "' (" + wrapperHosts(ws[0]) + ") but this clone is declared as '" + declaredGh + "' — use the gh of that account");
         }
         // KJC-TSK-1085 (ADR 0015): git commit/tag/rebase/push are no longer read here:
         // pre-commit checks the author, pre-push every pushed commit and the gh session.
@@ -249,24 +282,18 @@ process.stdin.on("end", () => {
         process.exit(2);
       }
     }
-    // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
-    // otro carril del MISMO repo se deniega ANTES del dano. Lectura libre.
+    // MONO-0 (ADR 0002) under ADR 0034 (KJC-TSK-1244): a write in another lane of the SAME
+    // repo is allowed while no other live session holds that lane; the session then holds it.
+    // A held lane is denied BEFORE the damage. Reads are free.
+    // Another lane of this repo => its toplevel; the session's own lane or no repo => null.
     const laneOf = (p) => {
-      // Sube al primer ancestro EXISTENTE (un subdir aun no creado escapaba).
-      let d = String(p);
-      if (!(existsSync(d) && statSync(d).isDirectory())) d = dirname(d);
-      while (d && !existsSync(d)) {
-        const up = dirname(d);
-        if (up === d) return null;
-        d = up;
-      }
-      // Canonicaliza (reviewer catch: un symlink local hacia otro carril
-      // esquivaba la clasificacion por ruta literal).
-      try { d = realpathSync(d); } catch { /* se clasifica tal cual */ }
-      return d ? foreignLane(d) : null;
+      const top = laneFor(p);
+      return top === laneTop() ? null : top;
     };
     const laneDeny = (what, lane) => {
-      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Sin escape (ADR 0015): un cruce deliberado lo hace tu usuario en su terminal." + doc("cross-lane"));
+      const why = holdLane(lane);
+      if (!why) return false;
+      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo " + why + (laneRefusal() ? " " + laneRefusal() : "") + ". Sin escape (ADR 0015): un cruce deliberado lo hace tu usuario en su terminal." + doc("cross-lane"));
       return true;
     };
     if (EDIT_TOOLS.includes(tool)) {
@@ -523,10 +550,12 @@ process.stdin.on("end", () => {
         }
       } catch { /* no report or unreadable — the Steward is not adopted here */ }
       const file = input.file_path || input.notebook_path;
-      const rel = file ? relative(ROOT, String(file)).replaceAll("\\", "/") : "";
+      // ADR 0034: the card, the branch and the RAG of the lane the write lands in.
+      const top = file ? laneFor(file) : laneTop();
+      const rel = file ? relative(top, String(file)).replaceAll("\\", "/") : "";
       // KJC-BUG-0279 (#1981): outside the repository there is no source to govern.
       if (rel && rel !== ".." && !rel.startsWith("../") && !rel.startsWith("/") && CODE.test(rel) && !TESTS.test(rel)) {
-        const branch = branchOf();
+        const branch = branchOf(top);
         const why = !branch ? null : BASE_BRANCHES.has(branch) ? "base" : !CARD.test(branch) ? "nocard" : null;
         // ADR 0015 (KJC-TSK-0925): no escape. Without a card there is no work.
         if (why) {
@@ -549,7 +578,7 @@ process.stdin.on("end", () => {
         // Solo se pregunta a git en el camino lento, cuando el gate iba a
         // denegar: exit 1 = git responde que no lo conoce; cualquier otro
         // resultado se comporta como hasta ahora y bloquea.
-        const fresh = () => !existsSync(String(file)) || spawnSync("git", ["-C", ROOT, "ls-files", "--error-unmatch", "--", rel], { encoding: "utf8" }).status === 1;
+        const fresh = () => !existsSync(String(file)) || spawnSync("git", ["-C", top, "ls-files", "--error-unmatch", "--", rel], { encoding: "utf8" }).status === 1;
         // A path outside this tree is another lane's business (the lane guard
         // above rules on it) and the ledger only holds in-repo paths.
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
@@ -570,7 +599,7 @@ process.stdin.on("end", () => {
             // esa: un indice vacio o por detras si tiene arreglo (kj rag index)
             // y sigue bloqueando, porque si no el gate desapareceria en
             // cualquier proyecto sin indexar. Nada legible = se bloquea.
-            const cov = spawnSync("kj", ["rag", "covers", rel, "--json"], { cwd: ROOT, encoding: "utf8" });
+            const cov = spawnSync("kj", ["rag", "covers", rel, "--json"], { cwd: top, encoding: "utf8" });
             let blind = null;
             let absent = null;
             try {
@@ -635,6 +664,23 @@ process.stdin.on("end", () => {
         console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta saltarlo, lo hace tu usuario en su terminal." + doc("escapes"));
         process.exit(2);
       }
+      // KJC-BUG-0455 (#2933): the verdict of the staged diff, checked HERE as well as in
+      // the pre-commit hook: a repo whose hook does not run the gate, or a review piped into
+      // tail that hid its failure, let a commit through with no verdict at all.
+      const plan = commitStaging(cmd);
+      if (plan.commits) {
+        const verdict = stagedVerdict(plan.dir ? resolve(cwd || ROOT, plan.dir) : (cwd || ROOT));
+        if (verdict.gate && plan.stages) {
+          console.error("karajan sentinel: stagea y commitea en comandos separados — el veredicto se comprueba sobre lo que ya esta stageado, y este comando stagea a la vez que commitea (git add/rm/mv, -a o rutas en git commit). Stagea por nombre, pasa kj review --staged y luego git commit." + doc("commit-verdict"));
+          process.exit(2);
+        }
+        // Only an approved verdict passes, or nothing staged (a merge: git itself decides).
+        if (verdict.gate && verdict.state !== "approved" && verdict.state !== "empty") {
+          const why = { rejected: "el review de este diff fue RECHAZADO por " + (verdict.reviewer || "el reviewer") + " — corrige y vuelve a pasar kj review --staged", unknown: "git no pudo leer el diff stageado, asi que el veredicto no se puede comprobar" }[verdict.state] || "no hay veredicto para el diff stageado — pasa kj review --staged (solo, sin tuberias que oculten si falla)";
+          console.error("karajan sentinel: commit sin veredicto aprobado: " + why + "." + doc("commit-verdict"));
+          process.exit(2);
+        }
+      }
       // KJC-BUG-0296 (#1989): the staged set is reviewed by name. A blanket
       // git add -A / git add . / git add -u put a Claude scheduler lock into
       // main; and the agent's runtime files (the .claude locks, .kj/, the local

package/src/harden/sentinel/sentinel-lib.mjs

@@ -2,7 +2,8 @@
 // Single source for every sentinel script: state, branch, classification,
 // and violations.
 import process from "node:process";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { execSync, spawnSync } from "node:child_process";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -34,24 +35,124 @@ export const session = (state, sid) => {
   state.sessions ||= {};
   return (state.sessions[sid] ||= { edited_sources: [], edited_tests: [], escapes: [], errors: [], blocks: 0 });
 };
-export const branchOf = () => {
-  try { return execSync("git rev-parse --abbrev-ref HEAD", { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); }
-  catch { return null; }
-};
 const _git = (args, cwd) => {
   try { return execSync("git " + args, { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); } catch { return ""; }
 };
+// MONO-0 (ADR 0002, amended by #2566): lane identity = worktree toplevel; repo
+// identity = git-common-dir. The session's lane is where the HOST says it works
+// (the hook payload's cwd, which EnterWorktree moves) when that is a worktree of
+// this same repo; otherwise the dir the guard is installed in. ROOT keeps the
+// harness (state, config); laneTop() is the git tree the session works in.
+// ADR 0033 (KJC-TSK-1236): a session switches into a lane only when no other live session
+// is there. Each session keeps one presence mark (its lane and when it last resolved it) in
+// the repo's git common dir. Entering is intent first, then a look: the session writes the
+// new lane, then reads the others' marks and steps back if another live one is there. Two
+// sessions entering together never both stay: the later write is seen by the later look.
+const LANE_TTL_MS = 30 * 60 * 1000;
+let _cwd = null;
+let _sid = null;
 let _home;
-// MONO-0 (ADR 0002): lane identity = worktree toplevel; repo identity =
-// git-common-dir. Same repo but another toplevel than OUR root => foreign
-// lane (returns its toplevel); anything else => null.
-export const foreignLane = (targetDir) => {
-  const top = _git("rev-parse --show-toplevel", targetDir);
-  if (!top) return null;
-  _home ||= { top: _git("rev-parse --show-toplevel", ROOT), common: _git("rev-parse --path-format=absolute --git-common-dir", ROOT) };
-  if (!_home.top || top === _home.top) return null;
-  const common = _git("rev-parse --path-format=absolute --git-common-dir", targetDir);
-  return common && common === _home.common ? top : null;
+let _refusal = null;
+const homeOf = (dir) => {
+  const [top = "", common = ""] = _git("rev-parse --show-toplevel --path-format=absolute --git-common-dir", dir).split("\n");
+  return { top, common };
+};
+export const enterLane = (_state, sid, cwd) => {
+  _cwd = cwd;
+  _sid = sid;
+  _home = undefined;
+  _refusal = null;
+};
+/** Why the session was kept out of the lane its cwd is in, or null. */
+export const laneRefusal = () => _refusal;
+const laneKey = (s) => createHash("sha256").update(String(s)).digest("hex").slice(0, 16);
+const readJson = (f) => { try { return JSON.parse(readFileSync(f, "utf8")); } catch { return null; } };
+const live = (at, now) => typeof at === "number" && now - at < LANE_TTL_MS;
+// ADR 0034: a mark also lists the lanes the session wrote in (`held`); another session holds
+// a lane when it is in it or wrote there within the period. Another session's mark that cannot
+// be read or parsed throws: the caller refuses rather than read it as a free lane.
+const heldByOther = (dir, top, now) => readdirSync(dir).filter((f) => f.startsWith("session-"))
+  .map((f) => JSON.parse(readFileSync(join(dir, f), "utf8")))
+  .some((r) => r?.sid !== _sid && ((r?.lane === top && live(r.at, now)) || live(r?.held?.[top], now)));
+const liveHeld = (mark, now) => Object.fromEntries(Object.entries(mark?.held ?? {}).filter(([, at]) => live(at, now)));
+// The lane the session may take: `lane` when it is home, already its live lane, or free.
+const claimLane = (root, lane, now = Date.now()) => {
+  if (!_sid || !root.common) return lane;
+  const dir = join(root.common, "kj-lanes");
+  const mark = join(dir, "session-" + laneKey(_sid) + ".json");
+  const write = (top) => writeFileSync(mark, JSON.stringify({ sid: _sid, lane: top, at: now, held: liveHeld(readJson(mark), now) }));
+  try {
+    mkdirSync(dir, { recursive: true });
+    const prev = readJson(mark);
+    if (lane.top !== root.top && !(prev?.lane === lane.top && live(prev.at, now))) {
+      write(lane.top);
+      if (heldByOther(dir, lane.top, now)) {
+        _refusal = "(" + lane.top + " tiene otra sesión viva: un carril, una sesión, ADR 0033)";
+        lane = root;
+      }
+    }
+    write(lane.top);
+  } catch {
+    if (lane.top !== root.top) {
+      _refusal = "(no se pudo reclamar " + lane.top + ")";
+      lane = root;
+      // Best effort: a mark left in the refused lane would keep others out for 30 min.
+      try { write(root.top); } catch { /* the session stays home either way */ }
+    }
+  }
+  return lane;
+};
+// Resolved on first use: a hook that never asks git pays no spawn.
+const home = () => {
+  if (_home) return _home;
+  const root = homeOf(ROOT);
+  const here = _cwd ? homeOf(_cwd) : null;
+  // git that cannot answer ("" common dir) never matches: fail closed to the install lane.
+  return (_home = claimLane(root, here?.top && root.common && here.common === root.common ? here : root));
+};
+export const laneTop = () => home().top || ROOT;
+/**
+ * ADR 0034 (KJC-TSK-1244): why the session may not write in lane `top`, or null once it holds it.
+ * Intent first, then a look, as a switch does (ADR 0033): the hold is written, then another
+ * live session in that lane takes it back out. Anything unreadable refuses.
+ */
+export const holdLane = (top, now = Date.now()) => {
+  const own = home();
+  if (top === laneTop()) return null;
+  if (!_sid || !own.common) return "(sin sesión identificada no se reclama " + top + ")";
+  const dir = join(own.common, "kj-lanes");
+  const mark = join(dir, "session-" + laneKey(_sid) + ".json");
+  try {
+    mkdirSync(dir, { recursive: true });
+    const mine = { sid: _sid, lane: own.top, at: now, ...readJson(mark) };
+    const held = liveHeld(mine, now);
+    writeFileSync(mark, JSON.stringify({ ...mine, held: { ...held, [top]: now } }));
+    if (!heldByOther(dir, top, now)) return null;
+    writeFileSync(mark, JSON.stringify({ ...mine, held }));
+    return "(" + top + " tiene otra sesión viva: un carril, una sesión, ADR 0033/0034)";
+  } catch {
+    return "(no se pudo reclamar " + top + ")";
+  }
+};
+export const branchOf = (top = laneTop()) => {
+  try { return execSync("git rev-parse --abbrev-ref HEAD", { cwd: top, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); }
+  catch { return null; }
+};
+// ADR 0034 (KJC-TSK-1243): the lane a write lands in is the worktree holding its path when
+// that worktree is of this repo; any other path is judged in the session's lane. It walks up
+// to the first existing dir (a subdir not created yet escaped) and canonicalizes it (a local
+// symlink into another lane was classified by its literal path).
+export const laneFor = (p) => {
+  let d = String(p);
+  while (d && !(existsSync(d) && statSync(d).isDirectory())) {
+    const up = dirname(d);
+    if (up === d) return laneTop();
+    d = up;
+  }
+  try { d = realpathSync(d); } catch { /* classified as is */ }
+  const target = homeOf(d);
+  const own = home();
+  return target.top && own.top && target.common && target.common === own.common ? target.top : laneTop();
 };
 // KJC-TSK-0765 board-sync: cards merged in this session but not yet moved in
 // the tracker. The method does not advance until the board is true.
@@ -65,6 +166,27 @@ export const bootstrapPhase = () => {
   try { execSync("git rev-parse --verify HEAD", { cwd: ROOT, stdio: ["ignore", "ignore", "ignore"] }); return false; }
   catch { return true; }
 };
+// KJC-BUG-0455 (#2933): the cross-AI verdict of the diff staged in `dir`, read the way
+// `kj review --check` reads it (sha256 of `git diff --cached`, trailing blanks trimmed,
+// in <top>/.karajan/reviews). gate:false when the repo has not committed the gate marker.
+// state: approved | rejected | missing | empty (nothing staged) | unknown (git failed).
+export const stagedVerdict = (dir) => {
+  const git = (args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  // No commit yet (or no repo): no committed marker exists. A git error fails closed.
+  if (git(["rev-parse", "--verify", "-q", "HEAD"]).status !== 0) return { gate: false };
+  const marker = git(["ls-tree", "--name-only", "HEAD", ".karajan/review-gate"]);
+  if (marker.status !== 0) return { gate: true, state: "unknown" };
+  if (!marker.stdout.trim()) return { gate: false };
+  const top = git(["rev-parse", "--show-toplevel"]).stdout?.trim();
+  const diff = git(["diff", "--cached"]);
+  if (!top || diff.status !== 0) return { gate: true, state: "unknown" };
+  if (!diff.stdout.trim()) return { gate: true, state: "empty" };
+  const hash = createHash("sha256").update(diff.stdout.trimEnd(), "utf8").digest("hex");
+  try {
+    const v = JSON.parse(readFileSync(join(top, ".karajan", "reviews", hash + ".json"), "utf8"));
+    return { gate: true, state: v.verdict === "approved" ? "approved" : "rejected", reviewer: v.reviewer || null };
+  } catch { return { gate: true, state: "missing" }; }
+};
 // KJC-BUG-0198/0262: a card split across PRs is carried while another PR of it is
 // open. kj decides with that checkable fact, the same answer for commit and push
 // (the Stop gate still holds the turn: the board owes the move); when kj does not
@@ -81,31 +203,35 @@ export const boardGate = (sid, pend) => {
 // files dirty, or local commits the remote does not have), not the ledger: after a
 // merged PR and a sync of main the ledger stays full while the base holds nothing.
 // Anything git cannot answer (no upstream, odd path) counts as work: fail closed.
-const baseHoldsWork = (files) => {
+const baseHoldsWork = (files, top) => {
   if (files.some((f) => !/^[A-Za-z0-9._/-]+$/.test(f))) return true;
   try {
-    if (execSync("git status --porcelain -- " + files.join(" "), { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim()) return true;
-    return execSync("git rev-list @{u}..HEAD", { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() !== "";
+    if (execSync("git status --porcelain -- " + files.join(" "), { cwd: top, stdio: ["ignore", "pipe", "ignore"] }).toString().trim()) return true;
+    return execSync("git rev-list @{u}..HEAD", { cwd: top, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() !== "";
   } catch { return true; }
 };
-export const violations = (s, branch, pending = pendingMoves(s)) => {
+// `top` is the tree the recorded paths are relative to: ROOT, or another lane (ADR 0034).
+// laneViolations: those of every other lane the session wrote in, each named by its lane.
+export const laneViolations = (s) => Object.entries(s?.lanes ?? {})
+  .flatMap(([top, rec]) => violations(rec, branchOf(top), [], top).map((x) => "[" + top + "] " + x));
+export const violations = (s, branch, pending = pendingMoves(s), top = ROOT) => {
   const v = pending.map(pendingText);
   if (!s || !(s.edited_sources || []).length) return v;
   if (bootstrapPhase()) return v;
-  if (BASE_BRANCHES.has(branch)) { if (baseHoldsWork(s.edited_sources)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion"); }
+  if (BASE_BRANCHES.has(branch)) { if (baseHoldsWork(s.edited_sources, top)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion"); }
   else if (branch && !CARD.test(branch)) v.push("La rama '" + branch + "' no referencia ninguna card — usa feat/<CARD-ID>-descripcion (y una card VIVA en el board)");
-  if (!(s.edited_tests || []).length && sessionAddsCode(s)) v.push("Fuentes editadas sin tocar un solo test (" + s.edited_sources.join(", ") + ") — escribe o actualiza el test que prueba el cambio");
+  if (!(s.edited_tests || []).length && sessionAddsCode(s, top)) v.push("Fuentes editadas sin tocar un solo test (" + s.edited_sources.join(", ") + ") — escribe o actualiza el test que prueba el cambio");
   return v;
 };
 // KJC-TSK-0795 AC1: deleting code adds no behavior to test — a session whose
 // source edits only REMOVED lines owes no test. Unreadable git = conservative
 // (the violation stands): a gate must never stand down on a shrug.
-const sessionAddsCode = (s) => {
+const sessionAddsCode = (s, top) => {
   const files = s.edited_sources || [];
   // _git builds a shell string: any path outside a strict charset stays out of
   // it — and the gate stays ARMED for it (conservative, and injection-proof).
   if (files.some((f) => !/^[A-Za-z0-9._/-]+$/.test(f))) return true;
-  const stat = _git("diff HEAD --numstat -- " + files.join(" "), ROOT);
+  const stat = _git("diff HEAD --numstat -- " + files.join(" "), top);
   if (!stat) return true;
   return stat.split(String.fromCharCode(10)).some((l) => {
     const a = l.trim().replaceAll(String.fromCharCode(9), " ").split(" ").filter(Boolean)[0];

package/src/harden/sentinel/sentinel-shell.mjs

@@ -300,3 +300,67 @@ export const isReadOnlyCommand = (cmd) => {
 
 /** Short flags of a cluster stop at "e": the rest is -e's value (-fen = -f -e n). */
 export const shortOpts = (a) => (/^-[a-zA-Z]/.test(a) ? a.slice(1).split("e")[0] : "");
+
+// KJC-BUG-0455 (#2933): a commit that stages in the same command commits a diff nobody
+// could have reviewed yet: the verdict is checked against what is staged BEFORE it runs.
+const COMMIT_VALUE_OPTS = new Set(["-m", "-F", "-C", "-c", "-t", "--message", "--file", "--reuse-message", "--reedit-message", "--template", "--author", "--date", "--cleanup", "--fixup", "--squash", "--trailer", "--pathspec-from-file"]);
+const COMMIT_VALUE_SHORT = new Set(["m", "F", "C", "c", "t"]);
+const INDEX_VERBS = new Set(["add", "rm", "mv", "stage", "restore", "reset", "apply", "update-index"]);
+
+/** Where `git` is in a segment and its verb, skipping git's global options; null when not git. */
+const gitVerbOf = (words) => {
+  if (words[0]?.slice(words[0].lastIndexOf("/") + 1) !== "git") return null;
+  let i = 1;
+  let dir = null;
+  while (i < words.length) {
+    const w = words[i];
+    if (GIT_GLOBAL_WITH_VALUE.has(w)) {
+      if (w === "-C") dir = words[i + 1] ?? null;
+      i += 2; // the option and its value
+    } else if (GIT_GLOBAL_FLAG.test(w)) {
+      i += 1;
+    } else {
+      break;
+    }
+  }
+  return { verb: words[i], at: i, dir };
+};
+
+/** How many words a git commit argument takes, and whether it makes the commit stage on its own. */
+const commitArg = (a) => {
+  if (a === "--all") return { stages: true, words: 1 };
+  if (a.startsWith("--")) {
+    // --message=x carries its value; --message x takes the next word.
+    return { stages: false, words: COMMIT_VALUE_OPTS.has(a) ? 2 : 1 };
+  }
+  if (/^-[a-zA-Z]/.test(a)) {
+    const cluster = a.slice(1);
+    const valueAt = [...cluster].findIndex((c) => COMMIT_VALUE_SHORT.has(c));
+    const flags = valueAt < 0 ? cluster : cluster.slice(0, valueAt);
+    if (flags.includes("a")) return { stages: true, words: 1 };
+    // -m x takes the next word; -mx carries its value.
+    return { stages: false, words: valueAt === cluster.length - 1 ? 2 : 1 };
+  }
+  return { stages: true, words: 1 }; // a pathspec
+};
+
+/** -a/--all, or a path (with or without --), makes git commit stage on its own. */
+const commitStagesItself = (args) => {
+  let i = 0;
+  while (i < args.length) {
+    if (args[i] === "--") return i + 1 < args.length;
+    const { stages, words } = commitArg(args[i]);
+    if (stages) return true;
+    i += words;
+  }
+  return false;
+};
+
+/** Does the command run git commit, and does it stage in the same command? → { commits, stages, dir } */
+export const commitStaging = (cmd) => {
+  const gits = shellSegments(cmd).map((words) => ({ words, g: gitVerbOf(words) })).filter((s) => s.g);
+  const commits = gits.filter((s) => s.g.verb === "commit");
+  if (commits.length === 0) return { commits: false, stages: false, dir: null };
+  const stages = gits.some((s) => INDEX_VERBS.has(s.g.verb)) || commits.some((s) => commitStagesItself(s.words.slice(s.g.at + 1)));
+  return { commits: true, stages, dir: commits[0].g.dir };
+};

package/src/harden/sentinel/sessionstart.mjs

@@ -6,7 +6,7 @@
 // Copied byte for byte into .karajan/harness; never fails a session (exit 0).
 import process from "node:process";
 import { spawnSync } from "node:child_process";
-import { CARD, ROOT, branchOf, load, pendingMoves } from "./sentinel-lib.mjs";
+import { CARD, ROOT, branchOf, enterLane, load, pendingMoves } from "./sentinel-lib.mjs";
 import { rulesDriftNotice } from "./sentinel-rules.mjs";
 
 const RULES = [
@@ -25,7 +25,8 @@ let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
-    const { session_id: sid = "default", source } = JSON.parse(raw || "{}");
+    const { session_id: sid = "default", source, cwd = null } = JSON.parse(raw || "{}");
+    enterLane(load(), sid, cwd);
     // KJC-TSK-0949: an MD changed and its compiled rules fell behind. Said at
     // every start, a new session included: that one gets this line and nothing else.
     const drift = rulesDriftNotice({ root: ROOT, run: spawnSync });

package/src/harden/sentinel/stop.mjs

@@ -10,7 +10,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { doc, load, save, branchOf, violations, ROOT } from "./sentinel-lib.mjs";
+import { doc, load, save, branchOf, enterLane, laneViolations, violations, ROOT } from "./sentinel-lib.mjs";
 // KJC-TSK-0774: when the turn ends green with cards closed, remind the user
 // where to look — the board URL if it runs (pid file alive), else how to start it.
 const boardHint = () => {
@@ -27,7 +27,7 @@ if (process.argv.includes("--status")) {
   if (!sessions.length) console.log("sentinel: sin actividad registrada en esta sesion");
   for (const [sid, s] of sessions) {
     console.log("session " + sid + ": sources=[" + (s.edited_sources || []).join(", ") + "] tests=[" + (s.edited_tests || []).join(", ") + "] escapes=[" + (s.escapes || []).join(", ") + "] blocks=" + (s.blocks || 0) + ((s.errors || []).length ? " errors=" + s.errors.length : "") + " rag=" + (s.rag_queries || []).length + " queries/" + (s.rag_hits || []).length + " sources");
-    for (const x of violations(s, branch)) console.log("  ROJO: " + x);
+    for (const x of [...violations(s, branch), ...laneViolations(s)]) console.log("  ROJO: " + x);
   }
   process.exit(0);
 }
@@ -36,8 +36,9 @@ process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
     if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
-    const { session_id: sid = "default", transcript_path: transcript = null } = JSON.parse(raw);
+    const { session_id: sid = "default", transcript_path: transcript = null, cwd = null } = JSON.parse(raw);
     const state = load();
+    enterLane(state, sid, cwd);
     // Tamper check runs regardless of session state: shell indirection leaves
     // no edit-tool record, but it cannot survive `kj sentinel verify`, whose
     // root of trust is the INSTALLED kj package (outside this project tree) —
@@ -87,7 +88,7 @@ process.stdin.on("end", () => {
         if ((p.stdout || "").trim()) console.error(p.stdout.trim());
       }
     }
-    const v = violations(s, branchOf());
+    const v = [...violations(s, branchOf()), ...laneViolations(s)];
     if (claimsBlock) v.push(claimsBlock);
     if (!v.length) {
       s.blocks = 0;

package/src/harden/workflow-engine.js

@@ -57,9 +57,20 @@ export function isPublishableNpm(projectDir) {
   }
 }
 
-/** Lockfile-detected package manager (KJC-BUG-0131): npm ci kills pnpm/yarn CI. */
+const KNOWN_PMS = new Set(["npm", "pnpm", "yarn", "bun"]);
+
+/**
+ * The project's package manager (KJC-BUG-0131: npm ci kills pnpm/yarn CI).
+ * KJC-BUG-0450 (#2789): the same answer for hooks and workflows; the
+ * packageManager field of package.json first, then the lockfile.
+ */
 export function detectPackageManager(projectDir) {
+  try {
+    const declared = String(JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8")).packageManager || "").split("@")[0];
+    if (KNOWN_PMS.has(declared)) return declared;
+  } catch { /* no or unreadable package.json: the lockfile decides */ }
   if (existsSync(join(projectDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join(projectDir, "bun.lock")) || existsSync(join(projectDir, "bun.lockb"))) return "bun";
   if (existsSync(join(projectDir, "yarn.lock"))) return "yarn";
   return "npm";
 }

package/src/harden/workflow-templates.js

@@ -19,7 +19,7 @@ export const PINNED_ACTIONS = {
   setupNode: "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4",
   setupPython: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5",
   setupGo: "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5",
-  setupPhp: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2",
+  setupPhp: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2",
 };
 
 export const NO_AI_ATTRIBUTION_WORKFLOW = [