karajan-code 4.70.3 → 5.0.0

package/src/sonar/scanner.js

@@ -85,7 +85,9 @@ export function buildScannerOpts(projectKey, scanner = {}, where = {}) {
   if (scanner.scm_disabled || where.linkedWorktree) opts.push("-Dsonar.scm.disabled=true");
   // KJC-TSK-0838: verbose is what makes the scanner name every indexed file.
   if (scanner.verbose) opts.push("-Dsonar.verbose=true");
+  if (scanner.project_name) opts.push(`-Dsonar.projectName=${scanner.project_name}`);
   if (scanner.sources) opts.push(`-Dsonar.sources=${scanner.sources}`);
+  if (scanner.tests) opts.push(`-Dsonar.tests=${scanner.tests}`);
   if (scanner.exclusions) opts.push(`-Dsonar.exclusions=${scanner.exclusions}`);
   if (scanner.test_inclusions) opts.push(`-Dsonar.test.inclusions=${scanner.test_inclusions}`);
   if (scanner.coverage_exclusions) opts.push(`-Dsonar.coverage.exclusions=${scanner.coverage_exclusions}`);
@@ -107,14 +109,15 @@ export function buildScannerOpts(projectKey, scanner = {}, where = {}) {
   return opts.join(" ");
 }
 
-function normalizeScannerConfig(scanner = {}) {
+// The folders are checked in the scanned directory (baseDir), not in process.cwd().
+function normalizeScannerConfig(scanner = {}, baseDir = process.cwd()) {
   const out = { ...scanner };
   if (typeof out.sources === "string" && out.sources.trim()) {
     const existing = out.sources
       .split(",")
       .map((s) => s.trim())
       .filter(Boolean)
-      .filter((entry) => fs.existsSync(entry));
+      .filter((entry) => fs.existsSync(path.resolve(baseDir, entry)));
 
     if (existing.length > 0) {
       out.sources = existing.join(",");
@@ -238,7 +241,7 @@ export async function resolveSonarTokenWithFallback(config, apiHost) {
 export function respectRepoProperties(scanner = {}, props = {}) {
   if (!props.existed) return scanner;
   const kept = { ...scanner };
-  for (const k of ["sources", "exclusions", "test_inclusions", "coverage_exclusions", "javascript_lcov_report_paths"]) delete kept[k];
+  for (const k of ["project_name", "sources", "tests", "exclusions", "test_inclusions", "coverage_exclusions", "javascript_lcov_report_paths"]) delete kept[k];
   return kept;
 }
 
@@ -271,100 +274,145 @@ export async function ensureSonarProjectProperties(cwd = process.cwd()) {
       const wanted = SOURCE_DIRS.map((d) => `${d}/`).join(", ");
       return { existed: false, declaredKey: null, written: false, nothingToScan: `no ${wanted} folder to analyse: write a sonar-project.properties declaring sonar.sources when the code arrives` };
     }
-    const projectKey = (pkg.name || path.basename(cwd)).replaceAll(/[^a-zA-Z0-9_.-]/g, "_");
-    const layout = [`sonar.sources=${sources.join(",")}`, ...(tests.length ? [`sonar.tests=${tests.join(",")}`] : [])];
-    const props = [
-      `sonar.projectKey=${projectKey}`,
-      `sonar.projectName=${pkg.name || path.basename(cwd)}`,
-      ...layout,
-      `sonar.javascript.lcov.reportPaths=coverage/lcov.info`,
-      `sonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/coverage/**`,
-    ].join("\n");
-    await fsPromises.writeFile(propsPath, props + "\n", "utf8");
-    // Said out loud: the file is new in the working tree and the team should see it.
-    const note = `sonar: wrote sonar-project.properties (${layout.join(", ")}): review it and commit it`;
-    return { existed: false, declaredKey: null, written: true, note };
+    // KJC-BUG-0445 (#2854): nothing is written in the tree (a lane kept the file
+    // untracked); the layout reaches the scanner as -D opts, under kj's config.
+    const layout = {
+      project_name: pkg.name || path.basename(cwd),
+      sources: sources.join(","),
+      ...(tests.length ? { tests: tests.join(",") } : {}),
+      exclusions: "**/node_modules/**,**/dist/**,**/build/**,**/coverage/**",
+    };
+    const declared = [`sonar.sources=${layout.sources}`, ...(layout.tests ? [`sonar.tests=${layout.tests}`] : [])];
+    const note = `sonar: no sonar-project.properties, kj scanned with ${declared.join(", ")}: commit one to own the layout`;
+    return { existed: false, declaredKey: null, written: false, layout, note };
   }
 }
 
-export async function runSonarScan(config, projectKey = null, { verbose = false, cwd = null } = {}) {
-  const scanCwd = cwd || process.cwd();
-  // KJC-TSK-0838 step 3 (monorepo): a nested package scans from its own
-  // directory under the key its properties declare — so the proof of
-  // coverage is about that package, not the root's `sonar.sources`.
-  const repoProps = await ensureSonarProjectProperties(scanCwd);
-  if (repoProps.nothingToScan) {
-    return { ok: false, skipped: true, projectKey: null, stdout: "", stderr: `sonar: ${repoProps.nothingToScan}`, exitCode: 0 };
-  }
-  let effectiveProjectKey;
-  if (cwd && !projectKey && repoProps.declaredKey) {
-    effectiveProjectKey = repoProps.declaredKey;
-  } else {
-    try {
-      effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey });
-    } catch (error) {
-      return {
-        ok: false,
-        projectKey: null,
-        stdout: "",
-        stderr: error?.message || String(error),
-        exitCode: 1
-      };
-    }
-  }
-  const sonarConfig = config?.sonarqube || {};
+function scanSettings(sonarConfig) {
   const rawHost = sonarConfig.host || "http://localhost:9000";
-  const isExternalSonar = sonarConfig.external === true;
-  const scannerTimeout = Number(sonarConfig?.timeouts?.scanner_ms) > 0
-    ? Number(sonarConfig.timeouts.scanner_ms)
-    : 15 * 60 * 1000;
-  const sonarNetwork = sonarConfig.network || "karajan_sonar_net";
-  const apiHost = resolveSonarHost(rawHost);
   const isLocalHost = /localhost|127\.0\.0\.1/.test(rawHost);
-  const host = isLocalHost ? rawHost.replaceAll(/localhost|127\.0\.0\.1/g, "host.docker.internal") : rawHost;
+  return {
+    rawHost,
+    isExternalSonar: sonarConfig.external === true,
+    scannerTimeout: Number(sonarConfig?.timeouts?.scanner_ms) > 0 ? Number(sonarConfig.timeouts.scanner_ms) : 15 * 60 * 1000,
+    sonarNetwork: sonarConfig.network || "karajan_sonar_net",
+    apiHost: resolveSonarHost(rawHost),
+    isLocalHost,
+    host: isLocalHost ? rawHost.replaceAll(/localhost|127\.0\.0\.1/g, "host.docker.internal") : rawHost,
+  };
+}
+
+const repoPropertiesNote = (repoProps, sonarConfig) => (repoProps.existed && sonarConfig.scanner?.sources
+  ? "sonar: the repo's sonar-project.properties wins over sonarqube.scanner.sources — kj passed only its ignore rules"
+  : null);
 
+// Server up, token resolved (and exported for the scanner), coverage generated:
+// the first step that fails is the scan's result.
+async function prepareServer(config, rawHost, apiHost) {
   const start = await sonarUp(rawHost);
   if (start.exitCode !== 0) {
-    return {
-      ok: false,
-      stdout: start.stdout || "",
-      stderr: start.stderr || "Failed to start SonarQube service",
-      exitCode: start.exitCode
-    };
+    return { failure: { ok: false, stdout: start.stdout || "", stderr: start.stderr || "Failed to start SonarQube service", exitCode: start.exitCode } };
   }
-  // KJC-BUG-0156: kj's -Dsonar.projectKey stays (scan and query must use the
-  // SAME key), but the repo's properties own the LAYOUT from here on.
   const token = await resolveSonarTokenWithFallback(config, apiHost);
   if (!token) {
-    return {
+    return { failure: {
       ok: false,
       stdout: "",
       stderr:
         "Unable to resolve Sonar token. Fix: (1) run 'kj init' to configure it, (2) set KJ_SONAR_TOKEN env var, or (3) add sonarqube.token to ~/.karajan/kj.config.yml.",
       exitCode: 1
-    };
+    } };
   }
   process.env.KJ_SONAR_TOKEN = token;
   const coverage = await maybeRunCoverage(config);
   if (!coverage.ok) {
-    return {
+    return { failure: {
       ok: false,
       stdout: coverage.stdout || "",
       stderr: coverage.stderr || "Failed to generate coverage report for SonarQube",
       exitCode: coverage.exitCode || 1
+    } };
+  }
+  return { token, coverage };
+}
+
+// A nested package (explicit cwd, no explicit key) scans under the key its properties declare.
+function scanProjectKey(config, projectKey, cwd, repoProps) {
+  if (cwd && !projectKey && repoProps.declaredKey) return repoProps.declaredKey;
+  return resolveSonarProjectKey(config, { projectKey });
+}
+
+function scannerCommand(pick, { scanCwd, isLocalHost, isExternalSonar, sonarNetwork }) {
+  if (pick.type === "native") return { cmd: pick.bin, args: [] };
+  return {
+    cmd: "docker",
+    args: [
+      "run",
+      "--rm",
+      "-v",
+      `${scanCwd}:/usr/src`,
+      ...(isLocalHost ? ["--add-host", "host.docker.internal:host-gateway"] : []),
+      ...(isLocalHost || isExternalSonar ? [] : ["--network", sonarNetwork]),
+      "-e", "SONAR_HOST_URL",
+      "-e", "SONAR_TOKEN",
+      "-e", "SONAR_SCANNER_OPTS",
+      "sonarsource/sonar-scanner-cli"
+    ]
+  };
+}
+
+// KJC-BUG-0263: the scan is done when the server has processed it; whoever reads
+// the issues next would otherwise get the previous analysis. Said out loud when
+// the log names no task to wait for.
+async function serverAnalysis(result, apiConfig) {
+  const taskId = /api\/ce\/task\?id=([\w-]+)/.exec(String(result.stdout || ""))?.[1];
+  if (!taskId) {
+    return { ok: true, analysisNote: "sonar: the scanner log names no analysis task, so kj could not wait for the server — issues may belong to the previous analysis" };
+  }
+  const done = await waitForAnalysis(apiConfig, taskId);
+  if (done.ok) return { ok: true, analysisNote: null };
+  return { ok: false, analysisNote: `sonar: the server did not finish analysis ${taskId} (${done.status}${done.timedOut ? ", timed out" : ""}) — its issues would be the previous analysis` };
+}
+
+export async function runSonarScan(config, projectKey = null, { verbose = false, cwd = null } = {}) {
+  const scanCwd = cwd || process.cwd();
+  // KJC-TSK-0838 step 3 (monorepo): a nested package scans from its own
+  // directory under the key its properties declare — so the proof of
+  // coverage is about that package, not the root's `sonar.sources`.
+  const repoProps = await ensureSonarProjectProperties(scanCwd);
+  if (repoProps.nothingToScan) {
+    return { ok: false, skipped: true, projectKey: null, stdout: "", stderr: `sonar: ${repoProps.nothingToScan}`, exitCode: 0 };
+  }
+  let effectiveProjectKey;
+  try {
+    effectiveProjectKey = await scanProjectKey(config, projectKey, cwd, repoProps);
+  } catch (error) {
+    return {
+      ok: false,
+      projectKey: null,
+      stdout: "",
+      stderr: error?.message || String(error),
+      exitCode: 1
     };
   }
+  const sonarConfig = config?.sonarqube || {};
+  const { rawHost, isExternalSonar, scannerTimeout, sonarNetwork, apiHost, isLocalHost, host } = scanSettings(sonarConfig);
+
+  const prepared = await prepareServer(config, rawHost, apiHost);
+  if (prepared.failure) return prepared.failure;
+  const { token, coverage } = prepared;
+  // KJC-BUG-0156: kj's -Dsonar.projectKey stays (scan and query must use the
+  // SAME key), but the repo's properties own the LAYOUT from here on.
   const scannerConfig = respectRepoProperties(
     normalizeScannerConfig({
+      ...repoProps.layout,
       ...sonarConfig.scanner,
       ...coverage.scannerPatch,
       ...(verbose ? { verbose: true } : {})
-    }),
+    }, scanCwd),
     repoProps
   );
-  const note = repoProps.existed && sonarConfig.scanner?.sources
-    ? "sonar: the repo's sonar-project.properties wins over sonarqube.scanner.sources — kj passed only its ignore rules"
-    : null;
+  const note = repoPropertiesNote(repoProps, sonarConfig);
 
   const pick = await pickSonarScanner(sonarConfig.scanner);
   // KJC-BUG-0225: en un carril, el plugin SCM del scanner (JGit) no sabe abrir
@@ -379,44 +427,11 @@ export async function runSonarScan(config, projectKey = null, { verbose = false,
     SONAR_SCANNER_OPTS: buildScannerOpts(effectiveProjectKey, scannerConfig, { linkedWorktree })
   };
 
-  let cmd, args;
-  if (pick.type === "native") {
-    cmd = pick.bin;
-    args = [];
-  } else {
-    cmd = "docker";
-    args = [
-      "run",
-      "--rm",
-      "-v",
-      `${scanCwd}:/usr/src`,
-      ...(isLocalHost ? ["--add-host", "host.docker.internal:host-gateway"] : []),
-      ...(isLocalHost || isExternalSonar ? [] : ["--network", sonarNetwork]),
-      "-e", "SONAR_HOST_URL",
-      "-e", "SONAR_TOKEN",
-      "-e", "SONAR_SCANNER_OPTS",
-      "sonarsource/sonar-scanner-cli"
-    ];
-  }
-
+  const { cmd, args } = scannerCommand(pick, { scanCwd, isLocalHost, isExternalSonar, sonarNetwork });
   const result = await runCommand(cmd, args, { timeout: scannerTimeout, env, cwd: scanCwd });
-  // KJC-BUG-0263: the scan is done when the server has processed it; whoever reads
-  // the issues next would otherwise get the previous analysis. Said out loud when
-  // the log names no task to wait for.
-  let ok = result.exitCode === 0;
-  let analysisNote = null;
-  if (ok) {
-    const taskId = /api\/ce\/task\?id=([\w-]+)/.exec(String(result.stdout || ""))?.[1];
-    if (taskId) {
-      const done = await waitForAnalysis({ ...config, sonarqube: { ...sonarConfig, host: apiHost } }, taskId);
-      if (!done.ok) {
-        ok = false;
-        analysisNote = `sonar: the server did not finish analysis ${taskId} (${done.status}${done.timedOut ? ", timed out" : ""}) — its issues would be the previous analysis`;
-      }
-    } else {
-      analysisNote = "sonar: the scanner log names no analysis task, so kj could not wait for the server — issues may belong to the previous analysis";
-    }
-  }
+  const { ok, analysisNote } = result.exitCode === 0
+    ? await serverAnalysis(result, { ...config, sonarqube: { ...sonarConfig, host: apiHost } })
+    : { ok: false, analysisNote: null };
   return {
     ok,
     projectKey: effectiveProjectKey,

package/src/steward/invariants.js

@@ -154,11 +154,12 @@ export function evaluateCoverageConfig({ projectDir }) {
   }
   return { verdict: VERDICTS.NOT_OBSERVABLE, evidence: "no coverage threshold configured anywhere — nothing measures the level", remedy: "instrument: configure a coverage threshold (any value the team stands behind — no 80% is demanded)" };
 }
-/** AC3 — phantom coverage: the two detectors exist (KJC-TSK-0800) but the
- * sweep does not yet discover test↔source pairs, so their output is INJECTED.
- * No output → not observable: never ok by absence of the detector's run. */
-export function evaluatePhantomCoverage({ phantoms } = {}) {
+/** AC3 — phantom coverage: the sweep (KJC-TSK-1343) runs the two detectors
+ * (KJC-TSK-0800) over the test↔source pairs and hands their output in.
+ * No output → not observable, with the sweep's reason: never ok by absence. */
+export function evaluatePhantomCoverage({ phantoms, reason } = {}) {
   if (!Array.isArray(phantoms)) {
+    if (reason) return { verdict: VERDICTS.NOT_OBSERVABLE, evidence: reason, remedy: "the detectors read Lit components in a git repository; until the project has them this invariant cannot be observed" };
     return { verdict: VERDICTS.NOT_OBSERVABLE, evidence: "the phantom detectors were not run", remedy: "instrument: run the detectors (steward/phantom-coverage) over the suite's test↔source pairs and feed their output" };
   }
   if (phantoms.length > 0) {

package/src/steward/phantom-sweep.js

@@ -0,0 +1,66 @@
+/**
+ * Phantom sweep (KJC-TSK-1343) — finds the test↔source pairs the phantom
+ * detectors (KJC-TSK-0800) need and runs them. Only Lit components sit inside
+ * the reachability perimeter, so only they can make a test a phantom; anywhere
+ * else the answer is NOT OBSERVABLE with its reason, never a clean bill.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { analyzeMemberReachability } from "../audit/member-reachability.js";
+import { detectPhantomUnit, detectPhantomE2E } from "./phantom-coverage.js";
+import { listProjectFiles } from "../rag/indexable.js";
+
+const CODE = /\.(m?js|jsx|ts|tsx|mts)$/;
+const TEST = /\.(test|spec)\.(m?js|jsx|ts|tsx|mts)$/;
+const RELATIVE_IMPORT = /(?:from\s*|import\s*\(\s*)["'](\.{1,2}\/[^"']+)["']/g;
+const SUFFIXES = ["", ".js", ".mjs", ".ts", ".tsx", ".jsx", "/index.js", "/index.ts"];
+
+/** The candidate sources a test imports through relative specifiers. */
+function importedCandidates(test, text, candidates) {
+  const out = new Set();
+  for (const [, spec] of text.matchAll(RELATIVE_IMPORT)) {
+    const base = path.posix.normalize(path.posix.join(path.posix.dirname(test), spec));
+    const hit = SUFFIXES.map((s) => base + s).find((p) => candidates.has(p));
+    if (hit) out.add(hit);
+  }
+  return out;
+}
+
+const defaultRead = (projectDir) => (rel) => fs.readFileSync(path.join(projectDir, rel), "utf8");
+
+/**
+ * @param {{projectDir: string, files?: string[]|null, read?: (rel: string) => string}} opts
+ * @returns {{observable: boolean, reason?: string, phantoms?: Array<object>}}
+ */
+export function sweepPhantoms({ projectDir, files = listProjectFiles(projectDir), read = defaultRead(projectDir) }) {
+  if (!Array.isArray(files)) return { observable: false, reason: "not a git repository: the project's tests and sources cannot be listed" };
+  const texts = new Map();
+  for (const f of files.filter((x) => CODE.test(x))) {
+    try { texts.set(f, read(f)); } catch { /* listed but gone from the tree: nothing to read */ }
+  }
+  const tests = [...texts.keys()].filter((f) => TEST.test(f));
+  const sources = [...texts.keys()].filter((f) => !TEST.test(f));
+  const analyzed = sources
+    .filter((f) => texts.get(f).includes("LitElement"))
+    .map((file) => ({ file, analysis: analyzeMemberReachability(texts.get(file), { file }) }))
+    .filter(({ analysis }) => analysis.observable && analysis.classes.some((c) => c.observable));
+  if (analyzed.length === 0) {
+    return { observable: false, reason: "no observable Lit component (LitElement): the reachability analysis only vouches for Lit" };
+  }
+  const candidates = new Map(analyzed
+    .filter(({ analysis }) => analysis.classes.some((c) => c.observable && c.unreachable.length > 0))
+    .map((c) => [c.file, c.analysis]));
+  const phantoms = [];
+  for (const test of tests) {
+    const testSource = texts.get(test);
+    for (const file of importedCandidates(test, testSource, candidates)) {
+      phantoms.push(...detectPhantomUnit({ sourceAnalysis: candidates.get(file), testSource, file: test }).phantoms);
+    }
+    for (const [file, analysis] of candidates) {
+      const found = detectPhantomE2E({ sourceText: texts.get(file), sourceAnalysis: analysis, testSource, file: test }).phantoms;
+      // a literal another source also carries may be alive there: never accused
+      phantoms.push(...found.filter((p) => !sources.some((s) => s !== file && texts.get(s).includes(p.literal))));
+    }
+  }
+  return { observable: true, phantoms };
+}

package/src/tournament/judge.js

@@ -58,33 +58,15 @@ function finalistBlock(board, torDir, coder) {
   ].filter(Boolean).join("\n");
 }
 
-/**
- * Judge a scored tournament: rank finalists, escalate on tie/disagreement.
- * @returns {Promise<{winner: string, judge: string|null, escalated: boolean, walkover?: boolean}>}
- */
-export async function judgeTournament({ tournamentDir, config = {}, logger = console, deps = {} }) {
-  const { judgeFn = defaultJudge, agentFn = defaultAgent, solomonFn = null } = deps;
-  const board = JSON.parse(fs.readFileSync(path.join(tournamentDir, "scoreboard.json"), "utf8"));
-  const finalists = board.rows.filter((r) => r.finalist).map((r) => r.coder);
-  const participants = board.rows.map((r) => r.coder);
-
-  if (finalists.length === 0) throw new Error("tournament: sin finalistas (todas las suites rojas) — no hay nada que juzgar");
-  if (finalists.length === 1) {
-    const judgement = { winner: finalists[0], judge: null, escalated: false, walkover: true, board_ranking: board.ranking };
-    fs.writeFileSync(path.join(tournamentDir, "judgement.json"), JSON.stringify(judgement, null, 2));
-    logger?.info?.(`torneo ${board.id}: ganador por walkover — ${finalists[0]} (único finalista)`);
-    return judgement;
-  }
-
-  const judge = await judgeFn({ config, participants });
-  if (!judge) {
-    throw new Error(
-      "tournament: sin juez limpio — todos los agentes disponibles compitieron o son el host. " +
-      "Un participante jamás juzga su propio torneo: quita un coder o añade un agente."
-    );
-  }
+function walkover({ board, tournamentDir, logger, winner }) {
+  const judgement = { winner, judge: null, escalated: false, walkover: true, board_ranking: board.ranking };
+  fs.writeFileSync(path.join(tournamentDir, "judgement.json"), JSON.stringify(judgement, null, 2));
+  logger?.info?.(`torneo ${board.id}: ganador por walkover — ${winner} (único finalista)`);
+  return judgement;
+}
 
-  const prompt = [
+function judgePrompt(board, finalists, tournamentDir) {
+  return [
     "Eres el JUEZ de un torneo de código: varios coders resolvieron la MISMA tarea de forma independiente.",
     "La fase determinista ya eliminó a los que suspendieron la suite. Tu trabajo: ordenar a los finalistas",
     "por calidad de solución (diseño, legibilidad, ausencia de sobre-ingeniería), con el scoreboard a la vista.",
@@ -95,49 +77,74 @@ export async function judgeTournament({ tournamentDir, config = {}, logger = con
     'Responde SOLO con JSON: {"ranking": ["coder", ...], "reasons": {"coder": "por qué"}, "tie": false}',
     "Declara tie:true únicamente si de verdad no puedes distinguirlos.",
   ].join("\n\n");
+}
 
-  logger?.info?.(`torneo ${board.id}: juez=${judge} sobre ${finalists.length} finalistas`);
-  const res = await agentFn({ judge, prompt, config, logger });
-  if (!res?.ok) throw new Error(`tournament: el juez ${judge} falló: ${res?.error || "sin salida"}`);
+function parseVerdict(output, judge, finalists) {
   let verdict;
   try {
-    verdict = JSON.parse(String(res.output).replace(/^[^{]*/, "").replace(/[^}]*$/, ""));
+    verdict = JSON.parse(String(output).replace(/^[^{]*/, "").replace(/[^}]*$/, ""));
   } catch {
     throw new Error(`tournament: el juez ${judge} no devolvió un veredicto parseable`);
   }
   // An LLM verdict is untrusted input: the ranking must name FINALISTS and
   // nobody else — a hallucinated coder must fail loud, never get crowned.
-  const isFinalist = (c) => finalists.includes(c);
-  if (!Array.isArray(verdict.ranking) || verdict.ranking.length === 0 || !verdict.ranking.every(isFinalist)) {
+  if (!Array.isArray(verdict.ranking) || verdict.ranking.length === 0 || !verdict.ranking.every((c) => finalists.includes(c))) {
     throw new Error(`tournament: ranking del juez inválido (${JSON.stringify(verdict.ranking)}) — debe nombrar solo finalistas: ${finalists.join(", ")}`);
   }
+  return verdict;
+}
 
-  // Only FIRST place crowns a winner: a judge that reorders lower positions
-  // but agrees on who wins is agreement, not a dispute for solomon.
+// Only FIRST place crowns a winner: a judge that reorders lower positions
+// but agrees on who wins is agreement, not a dispute for solomon.
+async function crownedBy({ verdict, board, finalists, solomonFn }) {
   const judgeTop = verdict.ranking?.[0];
   const boardTop = board.ranking[0];
-  const disagreement = judgeTop !== boardTop;
-  const escalated = Boolean(verdict.tie || disagreement);
+  const escalated = Boolean(verdict.tie || judgeTop !== boardTop);
+  if (!escalated) return { winner: judgeTop, solomon: null, escalated };
+  if (!solomonFn) {
+    const why = verdict.tie ? "empate declarado" : `discrepancia juez(${judgeTop}) vs scoreboard(${boardTop})`;
+    throw new Error(`tournament: ${why} y sin árbitro configurado`);
+  }
+  const solomon = await solomonFn({
+    judgeRanking: verdict.ranking,
+    boardRanking: board.ranking,
+    reasons: verdict.reasons,
+    tie: Boolean(verdict.tie),
+  });
+  if (!finalists.includes(solomon?.winner)) {
+    throw new Error(`tournament: solomon devolvió un ganador inválido (${solomon?.winner}) — debe ser finalista`);
+  }
+  return { winner: solomon.winner, solomon, escalated };
+}
 
-  let winner = judgeTop;
-  let solomon = null;
-  if (escalated) {
-    if (!solomonFn) {
-      const why = verdict.tie ? "empate declarado" : `discrepancia juez(${judgeTop}) vs scoreboard(${boardTop})`;
-      throw new Error(`tournament: ${why} y sin árbitro configurado`);
-    }
-    solomon = await solomonFn({
-      judgeRanking: verdict.ranking,
-      boardRanking: board.ranking,
-      reasons: verdict.reasons,
-      tie: Boolean(verdict.tie),
-    });
-    if (!isFinalist(solomon?.winner)) {
-      throw new Error(`tournament: solomon devolvió un ganador inválido (${solomon?.winner}) — debe ser finalista`);
-    }
-    winner = solomon.winner;
+/**
+ * Judge a scored tournament: rank finalists, escalate on tie/disagreement.
+ * @returns {Promise<{winner: string, judge: string|null, escalated: boolean, walkover?: boolean}>}
+ */
+export async function judgeTournament({ tournamentDir, config = {}, logger = console, deps = {} }) {
+  const { judgeFn = defaultJudge, agentFn = defaultAgent, solomonFn = null } = deps;
+  const board = JSON.parse(fs.readFileSync(path.join(tournamentDir, "scoreboard.json"), "utf8"));
+  const finalists = board.rows.filter((r) => r.finalist).map((r) => r.coder);
+  const participants = board.rows.map((r) => r.coder);
+
+  if (finalists.length === 0) throw new Error("tournament: sin finalistas (todas las suites rojas) — no hay nada que juzgar");
+  if (finalists.length === 1) return walkover({ board, tournamentDir, logger, winner: finalists[0] });
+
+  const judge = await judgeFn({ config, participants });
+  if (!judge) {
+    throw new Error(
+      "tournament: sin juez limpio — todos los agentes disponibles compitieron o son el host. " +
+      "Un participante jamás juzga su propio torneo: quita un coder o añade un agente."
+    );
   }
 
+  const prompt = judgePrompt(board, finalists, tournamentDir);
+  logger?.info?.(`torneo ${board.id}: juez=${judge} sobre ${finalists.length} finalistas`);
+  const res = await agentFn({ judge, prompt, config, logger });
+  if (!res?.ok) throw new Error(`tournament: el juez ${judge} falló: ${res?.error || "sin salida"}`);
+  const verdict = parseVerdict(res.output, judge, finalists);
+  const { winner, solomon, escalated } = await crownedBy({ verdict, board, finalists, solomonFn });
+
   const judgement = {
     winner, judge, escalated,
     judge_ranking: verdict.ranking, judge_reasons: verdict.reasons || {},

package/src/utils/agent-home.js

@@ -0,0 +1,33 @@
+/**
+ * KJC-TSK-1344 — where each CLI keeps its account. One person may hold two
+ * subscriptions per CLI (personal and work): claude switches account with
+ * CLAUDE_CONFIG_DIR and codex with CODEX_HOME. kj passes both to the agents
+ * (role-env allows CLAUDE* and CODEX*), so it must also LOOK there for the
+ * session and the config, never at a fixed ~/.codex or ~/.claude.json.
+ */
+import os from "node:os";
+import path from "node:path";
+
+const ACCOUNT_VAR = { codex: "CODEX_HOME", claude: "CLAUDE_CONFIG_DIR" };
+
+export const codexHome = ({ home = os.homedir(), env = process.env } = {}) =>
+  env.CODEX_HOME || path.join(home, ".codex");
+
+export const claudeConfigFile = ({ home = os.homedir(), env = process.env } = {}) =>
+  path.join(env.CLAUDE_CONFIG_DIR || home, ".claude.json");
+
+/** Absolute files that mark a logged-in session, or null for agents without an account variable. */
+export function agentAuthFiles(agent, { home = os.homedir(), env = process.env } = {}) {
+  if (agent === "codex") return [path.join(codexHome({ home, env }), "auth.json")];
+  if (agent === "claude") {
+    const dir = env.CLAUDE_CONFIG_DIR;
+    return dir ? [path.join(dir, ".claude.json"), path.join(dir, ".credentials.json")] : [path.join(home, ".claude.json"), path.join(home, ".claude")];
+  }
+  return null;
+}
+
+/** "CODEX_HOME=/path" when the variable moves the account, null on the default. */
+export function accountLabel(agent, { env = process.env } = {}) {
+  const name = ACCOUNT_VAR[agent];
+  return name && env[name] ? `${name}=${env[name]}` : null;
+}

package/src/utils/gh-account.js

@@ -0,0 +1,37 @@
+/**
+ * KJC-BUG-0458 (ADR 0040): with several gh accounts and parallel sessions, another session can
+ * switch the active account between `gh auth switch` and the gh calls kj makes, so kj posted a
+ * review under the wrong account. At startup kj pins GH_TOKEN to the repo's account, so every
+ * gh it runs inherits that token whatever the active account is by then. The account is the
+ * configured one, or else the owner of the origin remote. A token already set is never touched.
+ */
+import { execFileSync } from "node:child_process";
+
+// The owner segment of github.com remotes: https, ssh and ssh host aliases
+// (github.com-work:owner/repo.git). Any other host is not gh's to answer for.
+const OWNER = /(?:^|[@/])github\.com(?:-[\w.-]+)?[:/]([^/:\s]+)\/[^/\s]+?(?:\.git)?\/?$/;
+
+/** The owner of a github.com remote URL, or null for any other host. */
+export function remoteOwner(url) {
+  return OWNER.exec(String(url ?? "").trim())?.[1] ?? null;
+}
+
+const quiet = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+
+/**
+ * Pin GH_TOKEN for every gh child of this process.
+ * @returns {{account: string|null, reason: string|null}} the pinned account, or why none was
+ */
+export function pinGhAccount({ env = process.env, cwd = process.cwd(), account = null, exec = quiet } = {}) {
+  if (env.GH_TOKEN || env.GITHUB_TOKEN) return { account: null, reason: null };
+  let login = account;
+  if (!login) {
+    try { login = remoteOwner(exec("git", ["remote", "get-url", "origin"], cwd)); } catch { login = null; }
+  }
+  if (!login) return { account: null, reason: null };
+  let token;
+  try { token = exec("gh", ["auth", "token", "--user", login], cwd); } catch { token = ""; }
+  if (!token) return { account: null, reason: `gh has no logged-in account ${login}: gh calls use the active account` };
+  env.GH_TOKEN = token;
+  return { account: login, reason: null };
+}

package/src/utils/git.js

@@ -1,7 +1,6 @@
 import { runCommand } from "./process.js";
 import { getRunContext } from "./run-context.js";
 import { identityEnv } from "../git/run-identity.js";
-import { labelKarajanPr } from "../git/karajan-label.js";
 
 /**
  * Module-scoped runner — legacy back-compat for callers outside a
@@ -313,15 +312,3 @@ export async function hasRemote(cwd = null) {
 export async function pushBranch(branch, cwd = null) {
   await runGit(["push", "origin", branch], cwd ? { cwd } : {});
 }
-
-export async function createPullRequest({ baseBranch, branch, title, body, cwd = null }) {
-  const args = ["pr", "create", "--base", baseBranch, "--head", branch, "--title", title, "--body", body];
-  const res = await runCommand("gh", args, cwd ? { cwd } : {});
-  if (res.exitCode !== 0) {
-    throw new Error(`gh ${args.join(" ")} failed: ${res.stderr || res.stdout}`);
-  }
-  const url = res.stdout.trim();
-  // KJC-TSK-1123: the PR Karajan opens carries its label; a failure is logged, the PR stays.
-  await labelKarajanPr({ url, cwd });
-  return url;
-}

package/src/utils/home-migration.js

@@ -46,6 +46,9 @@ export async function migrateKjToKarajan({ dryRun = false, force = false } = {})
   // the developer's real HOME. Migrator's own tests pass `force: true`.
   if (process.env.VITEST && !force) return { migrated: false, reason: "vitest-skip" };
 
+  // KJC-BUG-0439: a KARAJAN_HOME chosen on purpose (CI, a sandbox, a canary) never receives
+  // the person's default ~/.kj; only an explicit KJ_HOME → KARAJAN_HOME pair is migrated.
+  if (process.env.KARAJAN_HOME && !process.env.KJ_HOME) return { migrated: false, reason: "explicit-home" };
   const sourceDir = process.env.KJ_HOME || path.join(os.homedir(), ".kj");
   const targetDir = process.env.KARAJAN_HOME || path.join(os.homedir(), ".karajan");
 
@@ -64,10 +67,13 @@ export async function migrateKjToKarajan({ dryRun = false, force = false } = {})
   if (dryRun) return { migrated: false, reason: "dry-run", sourceDir, targetDir };
 
   const backupDir = path.join(targetDir, "backup");
-  await fs.mkdir(backupDir, { recursive: true });
+  // The backup copies the person's files: readable by them only (KJC-BUG-0439).
+  await fs.mkdir(backupDir, { recursive: true, mode: 0o700 });
+  await fs.chmod(backupDir, 0o700);
   const ts = new Date().toISOString().replaceAll(/[:.]/g, "-");
   const backupPath = path.join(backupDir, `kj-pre-migration-${ts}.tar.gz`);
   await execa("tar", ["-czf", backupPath, "-C", path.dirname(sourceDir), path.basename(sourceDir)]);
+  await fs.chmod(backupPath, 0o600);
 
   const counts = {};
   for (const sub of MOVE_DIRS) {