karajan-code 4.70.4 → 5.0.0

package/src/checks/native-build.js

@@ -1,12 +1,11 @@
 /**
- * Native build availability check (KJC-BUG-0092).
+ * Native module check (KJC-BUG-0092, KJC-TSK-1353).
  *
- * better-sqlite3 ships a native addon compiled in a postinstall step. pnpm
- * blocks dependency build scripts by default (ERR_PNPM_IGNORED_BUILDS), so a
- * `pnpm add -g karajan-code` leaves the addon uncompiled: `kj --version` still
- * works (it never opens a DB) but any DB-backed command (board, rag, cost
- * tracking) crashes with "Cannot find module 'better-sqlite3'". This surfaces a
- * WARN in `kj doctor` with the exact remedy instead of a cryptic runtime crash.
+ * node-pty is kj's only native module since better-sqlite3 left (KJC-TSK-1353:
+ * every SQLite store runs on node:sqlite, built into Node). It is optional: it
+ * powers the HU Board's terminal. Where it needs its install script, pnpm
+ * (ERR_PNPM_IGNORED_BUILDS) and npm 12 (allowScripts) block it by default, so
+ * `kj doctor` warns with the exact remedy instead of a broken terminal.
  */
 
 import { execFileSync } from "node:child_process";
@@ -32,19 +31,7 @@ function defaultNpmMajor() {
  * allowScripts covers it; reinstalling blocks it again. Approve, then rebuild, in kj's dir.
  */
 export const npmAllowScriptsRemedy = (pkgDir = OWN_PKG_DIR) =>
-  `cd "${pkgDir}" && npm install-scripts approve better-sqlite3 && npm install-scripts approve node-pty && npm rebuild better-sqlite3 node-pty`;
-
-// The addon is installed but its native build is missing (a missing package needs a reinstall, not this).
-const UNBUILT_ADDON = /bindings file|better_sqlite3\.node/;
-
-/** A missing better-sqlite3 addon becomes an error that says how to build it; any other error passes as it is. */
-export function explainNativeLoadError(err, { npmMajor = defaultNpmMajor, pkgDir = OWN_PKG_DIR } = {}) {
-  if (!UNBUILT_ADDON.test(String(err?.message ?? err))) return err;
-  const remedy = (npmMajor() ?? 0) >= 12
-    ? `npm 12 skipped its install script (allowScripts); build it with: ${npmAllowScriptsRemedy(pkgDir)}`
-    : "run kj doctor for the exact fix on this install";
-  return new Error(`better-sqlite3 native addon is not built, so the RAG cannot open its index — ${remedy}`, { cause: err });
-}
+  `cd "${pkgDir}" && npm install-scripts approve node-pty && npm rebuild node-pty`;
 
 /** pnpm lays packages out under a `.pnpm` virtual store and symlinks them in. */
 function isPnpmInstall() {
@@ -54,50 +41,45 @@ function isPnpmInstall() {
   );
 }
 
-/** Force the native binding to load by opening an in-memory database. */
-async function defaultLoadDb() {
-  const Database = (await import("better-sqlite3")).default;
-  new Database(":memory:").close();
+/** Load node-pty's native binding. */
+async function defaultLoadPty() {
+  await import("node-pty");
 }
 
-export function createNativeBuildCheck({ loadDb = defaultLoadDb, isPnpm = isPnpmInstall, npmMajor = defaultNpmMajor, pkgDir = OWN_PKG_DIR } = {}) {
+const NO_TERMINAL = "the HU Board terminal is unavailable (everything else works)";
+
+export function createNativeBuildCheck({ loadPty = defaultLoadPty, isPnpm = isPnpmInstall, npmMajor = defaultNpmMajor, pkgDir = OWN_PKG_DIR } = {}) {
   return {
     name: "native-build",
-    label: "native modules (better-sqlite3)",
+    label: "native modules (node-pty)",
     strategy: STRATEGY.MANUAL,
     async detect() {
       try {
-        await loadDb();
-        return {
-          ok: true,
-          severity: "info",
-          detail: "better-sqlite3 native addon loads — DB-backed commands available",
-        };
+        await loadPty();
+        return { ok: true, severity: "info", detail: "node-pty loads — the HU Board terminal is available" };
       } catch (err) {
         const firstLine = String(err?.message || err).split("\n")[0];
         if (isPnpm()) {
           return {
             ok: false,
             severity: "warn",
-            detail: "better-sqlite3 native build was skipped — pnpm blocks dependency build scripts by default",
-            fix: "Approve the build then reinstall: `pnpm approve-builds better-sqlite3` — or install with npm: `npm i -g @karajan-family/code`",
+            detail: `node-pty native build was skipped — pnpm blocks dependency build scripts by default; ${NO_TERMINAL}`,
+            fix: "Approve the build then reinstall: `pnpm approve-builds node-pty` — or install with npm: `npm i -g @karajan-family/code`",
           };
         }
         if ((npmMajor() ?? 0) >= 12) {
           return {
             ok: false,
             severity: "warn",
-            detail: `better-sqlite3 failed to load: ${firstLine} — npm 12 skips dependency install scripts that allowScripts does not cover, so the native build never ran`,
+            detail: `node-pty failed to load: ${firstLine} — npm 12 skips dependency install scripts that allowScripts does not cover; ${NO_TERMINAL}`,
             fix: npmAllowScriptsRemedy(pkgDir),
           };
         }
         return {
           ok: false,
           severity: "warn",
-          // KJC-BUG-0118: the standalone (curl) binary ships without native
-          // modules by design — name the consequence (RAG/board/MCP need the
-          // npm install) instead of implying the install is broken.
-          detail: `better-sqlite3 failed to load: ${firstLine} — DB-backed features (RAG, board, MCP) unavailable; the standalone binary does not bundle native modules`,
+          // KJC-BUG-0118: the standalone (curl) binary ships without native modules by design.
+          detail: `node-pty failed to load: ${firstLine} — ${NO_TERMINAL}; the standalone binary does not bundle native modules`,
           fix: "Reinstall to rebuild native modules: `npm i -g @karajan-family/code`",
         };
       }

package/src/checks/runner.js

@@ -51,162 +51,25 @@ export async function runChecks(checks, ctx, options = {}) {
 
   const { config } = ctx;
   const startTotal = Date.now();
-  const entries = [];
+  const entries = checks.map((check) => entryFor(check, config));
   const overrides = {};
 
-  // Build applicable entries (skipped checks noted up front).
-  // A check.applies(config) may return:
-  //   - true / false — boolean form (back-compat).
-  //   - an object { applies: boolean, reason?: string } — when false, `reason`
-  //     is shown verbatim so users see WHY (e.g. "sonarqube.enabled is false
-  //     in kj.config.yml") instead of the opaque "Not applicable" message
-  //     that confused users debugging their config.
-  for (const check of checks) {
-    if (typeof check.applies !== "function") {
-      entries.push({ check, status: null, detail: null, runMs: 0, detectResult: null, remediated: false });
-      continue;
-    }
-    const verdict = check.applies(config);
-    const isObj = verdict && typeof verdict === "object" && "applies" in verdict;
-    const applies = isObj ? Boolean(verdict.applies) : Boolean(verdict);
-    if (applies) {
-      entries.push({ check, status: null, detail: null, runMs: 0, detectResult: null, remediated: false });
-      continue;
-    }
-    const reason = (isObj && typeof verdict.reason === "string" && verdict.reason.trim())
-      ? verdict.reason.trim()
-      : "Not applicable for current configuration";
-    entries.push({
-      check,
-      status: STATUS.SKIPPED,
-      detail: reason,
-      runMs: 0,
-      detectResult: null,
-      remediated: false,
-    });
-  }
-
   // Phase 1: detect in parallel with timeout.
   const detectBase = Date.now();
-  await Promise.all(
-    entries.map(async (entry) => {
-      if (entry.status === STATUS.SKIPPED) return;
-      const start = Date.now();
-      // Per-check override: checks that spawn slow tools (e.g. `npx <pkg>` cold
-      // start) declare detectTimeoutMs so the blanket pipeline timeout doesn't
-      // kill them. Falls back to the pipeline-wide timeoutMs.
-      const detectTimeoutMs = Number.isFinite(entry.check.detectTimeoutMs)
-        ? entry.check.detectTimeoutMs
-        : timeoutMs;
-      try {
-        const result = await withTimeout(entry.check.detect({ config, signal }), detectTimeoutMs, entry.check.name);
-        entry.detectResult = result;
-        entry.runMs = Date.now() - start;
-        entry.status = resolveStatusFromDetect(entry.check, result);
-        entry.detail = result.detail;
-        // KJC-BUG-0049: si el check es degradable y falló (status FAIL/WARN tras
-        // resolveStatusFromDetect), aplicar disables al overrides y degradar a WARN.
-        // Así el preflight no aborta — la feature opcional se desactiva con aviso.
-        if (!result.ok && entry.check.degradable && (entry.status === STATUS.FAIL || entry.status === STATUS.WARN)) {
-          for (const dotPath of entry.check.degradable.disables || []) {
-            setDotPath(overrides, dotPath, false);
-          }
-          entry.status = STATUS.WARN;
-          entry.detail = `${result.detail} → ${entry.check.degradable.warn}`;
-          entry.degraded = true;
-        }
-      } catch (err) {
-        entry.runMs = Date.now() - start;
-        if (err instanceof TimeoutError) {
-          entry.detectResult = { ok: false, severity: "warn", detail: `Timeout after ${detectTimeoutMs}ms` };
-          // A timeout on a degradable (optional) check must not block the
-          // pipeline: degrade to WARN and disable its feature flags, same as
-          // a regular failure (KJC-BUG-0049 semantics).
-          if (entry.check.degradable) {
-            for (const dotPath of entry.check.degradable.disables || []) {
-              setDotPath(overrides, dotPath, false);
-            }
-            entry.status = STATUS.WARN;
-            entry.detail = `${entry.detectResult.detail} → ${entry.check.degradable.warn}`;
-            entry.degraded = true;
-          } else {
-            entry.status = STATUS.TIMEOUT;
-            entry.detail = entry.detectResult.detail;
-          }
-        } else {
-          entry.detectResult = { ok: false, severity: "fail", detail: `Detection error: ${err.message}` };
-          entry.status = STATUS.FAIL;
-          entry.detail = entry.detectResult.detail;
-        }
-      }
-    })
-  );
+  await Promise.all(entries.map((entry) => detectEntry(entry, { config, signal, timeoutMs, overrides })));
   logger.info?.(`Detect phase done in ${Date.now() - detectBase}ms`);
 
-  // Phase 2: remediate sequentially (only in "fix" mode, only failing checks).
   if (mode !== "check-only") {
+    // Phase 2: remediate sequentially (only in "fix" mode, only failing checks).
     for (const entry of entries) {
-      if (!shouldAttemptRemediation(entry)) continue;
-      const { check, detectResult } = entry;
-      if (check.strategy === STRATEGY.PROMPT && !yes) {
-        const approved = await onConfirm(check.describe || `Fix: ${check.name}`);
-        if (!approved) {
-          logger.info?.(`User declined remediation for ${check.name}`);
-          continue;
-        }
-      }
-      const start = Date.now();
-      try {
-        const rem = await withTimeout(
-          check.remediate({ config, extra: detectResult.extra, signal, logger }),
-          remediateTimeoutMs,
-          `${check.name}:remediate`
-        );
-        entry.remediated = rem.fixed === true;
-        entry.runMs += Date.now() - start;
-        if (rem.fixed) {
-          if (rem.changes) mergeOverrides(overrides, rem.changes);
-          entry.detail = rem.detail;
-          entry.status = STATUS.FIXED;
-        } else {
-          entry.detail = rem.detail || entry.detail;
-          entry.status = STATUS.FAIL;
-        }
-      } catch (err) {
-        entry.runMs += Date.now() - start;
-        const msg = err instanceof TimeoutError ? `Remediation timeout after ${remediateTimeoutMs}ms` : `Remediation error: ${err.message}`;
-        entry.detail = msg;
-        entry.status = STATUS.FAIL;
-        logger.warn?.(`Remediation failed for ${check.name}: ${msg}`);
-      }
+      if (shouldAttemptRemediation(entry)) await remediateEntry(entry, { config, signal, logger, yes, onConfirm, remediateTimeoutMs, overrides });
     }
-
     // Phase 3: re-verify fixed checks using the config merged with any
     // runtime overrides applied by remediations. Without this merge, a check
     // that rebinds to a new port (override) would re-verify against the old
     // config and wrongly report failure.
     const verifyConfig = mergeConfigAndOverrides(config, overrides);
-    await Promise.all(
-      entries.filter((e) => e.remediated).map(async (entry) => {
-        const start = Date.now();
-        try {
-          const result = await withTimeout(
-            entry.check.detect({ config: verifyConfig, signal }),
-            Number.isFinite(entry.check.detectTimeoutMs) ? entry.check.detectTimeoutMs : timeoutMs,
-            `${entry.check.name}:reverify`
-          );
-          entry.runMs += Date.now() - start;
-          if (!result.ok) {
-            entry.status = STATUS.FAIL;
-            entry.detail = `${entry.detail} (but re-verify failed: ${result.detail})`;
-          }
-        } catch (err) {
-          entry.runMs += Date.now() - start;
-          entry.status = STATUS.FAIL;
-          entry.detail = `${entry.detail} (re-verify error: ${err.message})`;
-        }
-      })
-    );
+    await Promise.all(entries.filter((e) => e.remediated).map((entry) => reverifyEntry(entry, { verifyConfig, signal, timeoutMs })));
   }
 
   // Flatten into reports.
@@ -234,6 +97,129 @@ export async function runChecks(checks, ctx, options = {}) {
   };
 }
 
+// Build an applicable entry (skipped checks noted up front).
+// A check.applies(config) may return:
+//   - true / false — boolean form (back-compat).
+//   - an object { applies: boolean, reason?: string } — when false, `reason`
+//     is shown verbatim so users see WHY (e.g. "sonarqube.enabled is false
+//     in kj.config.yml") instead of the opaque "Not applicable" message
+//     that confused users debugging their config.
+function entryFor(check, config) {
+  const entry = { check, status: null, detail: null, runMs: 0, detectResult: null, remediated: false };
+  if (typeof check.applies !== "function") return entry;
+  const verdict = check.applies(config);
+  const isObj = verdict && typeof verdict === "object" && "applies" in verdict;
+  const applies = isObj ? Boolean(verdict.applies) : Boolean(verdict);
+  if (applies) return entry;
+  const reason = (isObj && typeof verdict.reason === "string" && verdict.reason.trim())
+    ? verdict.reason.trim()
+    : "Not applicable for current configuration";
+  return { ...entry, status: STATUS.SKIPPED, detail: reason };
+}
+
+// Per-check override: checks that spawn slow tools (e.g. `npx <pkg>` cold
+// start) declare detectTimeoutMs so the blanket pipeline timeout doesn't
+// kill them. Falls back to the pipeline-wide timeoutMs.
+const detectTimeoutOf = (check, timeoutMs) => (Number.isFinite(check.detectTimeoutMs) ? check.detectTimeoutMs : timeoutMs);
+
+// KJC-BUG-0049: an optional (degradable) check that fails or times out does not
+// block the pipeline: its feature flags are disabled and it degrades to WARN.
+function degrade(entry, overrides, detail) {
+  for (const dotPath of entry.check.degradable.disables || []) {
+    setDotPath(overrides, dotPath, false);
+  }
+  entry.status = STATUS.WARN;
+  entry.detail = `${detail} → ${entry.check.degradable.warn}`;
+  entry.degraded = true;
+}
+
+async function detectEntry(entry, { config, signal, timeoutMs, overrides }) {
+  if (entry.status === STATUS.SKIPPED) return;
+  const start = Date.now();
+  const detectTimeoutMs = detectTimeoutOf(entry.check, timeoutMs);
+  try {
+    const result = await withTimeout(entry.check.detect({ config, signal }), detectTimeoutMs, entry.check.name);
+    entry.detectResult = result;
+    entry.runMs = Date.now() - start;
+    entry.status = resolveStatusFromDetect(entry.check, result);
+    entry.detail = result.detail;
+    // Así el preflight no aborta — la feature opcional se desactiva con aviso.
+    if (!result.ok && entry.check.degradable && (entry.status === STATUS.FAIL || entry.status === STATUS.WARN)) {
+      degrade(entry, overrides, result.detail);
+    }
+  } catch (err) {
+    entry.runMs = Date.now() - start;
+    if (!(err instanceof TimeoutError)) {
+      entry.detectResult = { ok: false, severity: "fail", detail: `Detection error: ${err.message}` };
+      entry.status = STATUS.FAIL;
+      entry.detail = entry.detectResult.detail;
+      return;
+    }
+    entry.detectResult = { ok: false, severity: "warn", detail: `Timeout after ${detectTimeoutMs}ms` };
+    if (entry.check.degradable) {
+      degrade(entry, overrides, entry.detectResult.detail);
+    } else {
+      entry.status = STATUS.TIMEOUT;
+      entry.detail = entry.detectResult.detail;
+    }
+  }
+}
+
+async function remediateEntry(entry, { config, signal, logger, yes, onConfirm, remediateTimeoutMs, overrides }) {
+  const { check, detectResult } = entry;
+  if (check.strategy === STRATEGY.PROMPT && !yes) {
+    const approved = await onConfirm(check.describe || `Fix: ${check.name}`);
+    if (!approved) {
+      logger.info?.(`User declined remediation for ${check.name}`);
+      return;
+    }
+  }
+  const start = Date.now();
+  try {
+    const rem = await withTimeout(
+      check.remediate({ config, extra: detectResult.extra, signal, logger }),
+      remediateTimeoutMs,
+      `${check.name}:remediate`
+    );
+    entry.remediated = rem.fixed === true;
+    entry.runMs += Date.now() - start;
+    if (rem.fixed) {
+      if (rem.changes) mergeOverrides(overrides, rem.changes);
+      entry.detail = rem.detail;
+      entry.status = STATUS.FIXED;
+    } else {
+      entry.detail = rem.detail || entry.detail;
+      entry.status = STATUS.FAIL;
+    }
+  } catch (err) {
+    entry.runMs += Date.now() - start;
+    const msg = err instanceof TimeoutError ? `Remediation timeout after ${remediateTimeoutMs}ms` : `Remediation error: ${err.message}`;
+    entry.detail = msg;
+    entry.status = STATUS.FAIL;
+    logger.warn?.(`Remediation failed for ${check.name}: ${msg}`);
+  }
+}
+
+async function reverifyEntry(entry, { verifyConfig, signal, timeoutMs }) {
+  const start = Date.now();
+  try {
+    const result = await withTimeout(
+      entry.check.detect({ config: verifyConfig, signal }),
+      detectTimeoutOf(entry.check, timeoutMs),
+      `${entry.check.name}:reverify`
+    );
+    entry.runMs += Date.now() - start;
+    if (!result.ok) {
+      entry.status = STATUS.FAIL;
+      entry.detail = `${entry.detail} (but re-verify failed: ${result.detail})`;
+    }
+  } catch (err) {
+    entry.runMs += Date.now() - start;
+    entry.status = STATUS.FAIL;
+    entry.detail = `${entry.detail} (re-verify error: ${err.message})`;
+  }
+}
+
 function shouldAttemptRemediation(entry) {
   if (entry.status === STATUS.SKIPPED) return false;
   if (entry.status === STATUS.OK) return false;

package/src/cli/advanced-commands.js

@@ -13,9 +13,9 @@ export const CORE_COMMANDS = [
   // gets — it is the first command a new project ever runs.
   "bootstrap",
   "init",
-  "run",
+  "hu",
+  "review",
   "plan",
-  "status",
   "doctor",
   "harden",
   "config",
@@ -31,11 +31,11 @@ export const META_COMMANDS = ["advanced", "help"];
  * so a newly-registered command can never silently vanish from `kj advanced`.
  */
 export const ADVANCED_GROUPS = [
-  { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan", "tournament"] },
-  { title: "Análisis pre-run", commands: ["discover", "spec", "triage", "researcher", "architect", "onboard", "brief"] },
+  { title: "Agentes y revisión", commands: ["code", "solomon", "agent", "scan", "tournament"] },
+  { title: "Análisis previo", commands: ["discover", "spec", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch", "doc"] },
-  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy", "rules", "rulesync", "claims", "steward", "pr-size"] },
-  { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel", "identity", "security", "handoff"] },
+  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy", "rules", "rulesync", "claims", "steward", "pr-size", "main-guard"] },
+  { title: "Sesión / board", commands: ["report", "board", "adr", "worktree", "sentinel", "identity", "security", "handoff"] },
   { title: "Infra / setup", commands: ["install-tools", "ollama", "skills", "roles", "agents", "env"] },
   { title: "Mantenimiento", commands: ["clean", "sync", "telemetry", "report-issue"] },
 ];

package/src/cli/register-meta.js

@@ -1,8 +1,6 @@
 import { discoverCommand } from "../commands/discover.js";
 import { specRefineCommand } from "../commands/spec-refine.js";
-import { triageCommand } from "../commands/triage.js";
-import { researcherCommand } from "../commands/researcher.js";
-import { architectCommand } from "../commands/architect.js";
+import { writeSbom } from "../audit/sbom.js";
 import { onboardCommand } from "../commands/onboard.js";
 import { startCommand } from "../commands/start.js";
 import { goCommand } from "../commands/go.js";
@@ -19,10 +17,8 @@ import { qmdQueryCommand } from "../commands/qmd.js";
 import { ragMcpCommand } from "../commands/rag-mcp.js";
 import { watchStartCommand, watchStopCommand, watchStatusCommand } from "../commands/watch.js";
 import { auditCommand } from "../commands/audit.js";
-import { resumeCommand } from "../commands/resume.js";
 import { boardCommand } from "../commands/board.js";
 import { webperfCommand } from "../commands/webperf.js";
-import { undoCommand } from "../commands/undo.js";
 import { syncCommand } from "../commands/sync.js";
 import { cleanCommand } from "../commands/clean.js";
 import { checkCommand } from "../commands/check.js";
@@ -106,54 +102,6 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
 
-  program
-    .command("triage")
-    .description("Classify task complexity and recommend pipeline roles")
-    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
-    .option("--task-file <path>", "Read the task from a file (e.g. .md)")
-    .option("--triage <name>", "Override triage agent")
-    .option("--triage-model <name>", "Override triage model")
-    .option("--json", "Output raw JSON")
-    .action(async (task, flags) => {
-      await withConfig(pkgVersion, "triage", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
-        const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger, indexFirstBytes: config.docs?.indexFirstBytes });
-        await triageCommand({ task: resolvedTask, config, logger, json: flags.json });
-      });
-    });
-
-  program
-    .command("researcher")
-    .description("Research codebase for a task (files, patterns, constraints)")
-    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
-    .option("--task-file <path>", "Read the task from a file (e.g. .md)")
-    .option("--researcher <name>", "Override researcher agent")
-    .option("--researcher-model <name>", "Override researcher model")
-    .action(async (task, flags) => {
-      await withConfig(pkgVersion, "researcher", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
-        const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger, indexFirstBytes: config.docs?.indexFirstBytes });
-        await researcherCommand({ task: resolvedTask, config, logger });
-      });
-    });
-
-  program
-    .command("architect")
-    .description("Design solution architecture (layers, patterns, contracts)")
-    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
-    .option("--task-file <path>", "Read the task from a file (e.g. .md)")
-    .option("--architect <name>", "Override architect agent")
-    .option("--architect-model <name>", "Override architect model")
-    .option("--context <text>", "Additional context (e.g. researcher output)")
-    .option("--json", "Output raw JSON")
-    .action(async (task, flags) => {
-      await withConfig(pkgVersion, "architect", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
-        const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger, indexFirstBytes: config.docs?.indexFirstBytes });
-        await architectCommand({ task: resolvedTask, config, logger, context: flags.context, json: flags.json });
-      });
-    });
-
   program
     .command("onboard")
     .description("Analyze an existing codebase (brownfield) and produce an Architecture Brief")
@@ -317,7 +265,7 @@ export function registerMeta(program, { pkgVersion }) {
   // beats ordering a practice an agent can narrate without doing.
   const wt = program.command("worktree").description("Isolated task lanes (git worktrees) for the host agent");
   wt.command("start <slug>")
-    .description("Create a lane: worktree + feat/<slug> branch + dependency bootstrap")
+    .description("Create a lane: worktree + feat/<slug> branch from origin/<base> + dependency bootstrap")
     .action(async (slug, flags) => {
       await withConfig(pkgVersion, "worktree", flags, async ({ config }) => {
         await worktreeCommand({ config, action: "start", args: [slug], flags });
@@ -325,14 +273,16 @@ export function registerMeta(program, { pkgVersion }) {
     });
   wt.command("list")
     .description("List the active lanes")
+    .option("--json", "Each lane with its commits ahead of the base and the cards its branch names")
+    .option("--prs", "With --json, each lane's PR (one gh call)")
     .action(async (flags) => {
       await withConfig(pkgVersion, "worktree", flags, async ({ config }) => {
         await worktreeCommand({ config, action: "list", flags });
       });
     });
   wt.command("done <slug>")
-    .option("--force", "Remove the lane even with uncommitted changes")
-    .description("Remove a merged lane (refuses uncommitted changes without --force)")
+    .option("--force", "Remove the lane even with uncommitted changes, and delete its branch even if not merged")
+    .description("Remove a lane and delete its branch when merged into the base (refuses uncommitted changes without --force)")
     .action(async (slug, flags) => {
       await withConfig(pkgVersion, "worktree", flags, async ({ config }) => {
         await worktreeCommand({ config, action: "done", args: [slug], flags });
@@ -372,6 +322,16 @@ export function registerMeta(program, { pkgVersion }) {
         await huCommand({ config, action: "move", args: [id, status], flags });
       });
     });
+  // KJC-TSK-1372 (#2853): one step to start a task: card, lane, running.
+  hu.command("start <id> [slug]")
+    .description("Start a card: open its lane feat/<id>-<slug> from origin/<base> and move it to running (slug from the title if omitted)")
+    .option("--code", "Then have the panel coder write the card in the lane (kj code --card)")
+    .option("--json", "Machine-readable output")
+    .action(async (id, slug, flags) => {
+      await withConfig(pkgVersion, "hu", flags, async ({ config }) => {
+        await huCommand({ config, action: "start", args: [id, slug].filter(Boolean), flags });
+      });
+    });
   hu.command("list")
     .option("--json", "Machine-readable output")
     .action(async (flags) => {
@@ -801,6 +761,19 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
 
+  // KJC-TSK-1369 (ADR 0037): the audit job on every push to the protected branch.
+  program.command("main-guard")
+    .description("Audit a push to the protected branch: merges without their required checks, and the protection (exit 1 with a markdown report)")
+    .requiredOption("--repo <owner/repo>", "GitHub repository")
+    .requiredOption("--before <sha>", "The branch tip before the push")
+    .requiredOption("--after <sha>", "The branch tip after the push")
+    .requiredOption("--require <checks...>", "Required checks that every merge must have passed")
+    .option("--branch <name>", "Protected branch", "main")
+    .action(async (flags) => {
+      const { mainGuardCommand } = await import("../commands/main-guard.js");
+      await mainGuardCommand({ flags });
+    });
+
   const rag = program.command("rag").description("Retrieval-augmented search over Karajan plans, onboarding briefs and project code");
   rag.command("index")
     .description("Index plans + onboarding (and optionally project sources) into the local vector store")
@@ -947,8 +920,21 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--deterministic-only", "Skip the LLM analysis entirely. Print/persist only the deterministic findings (basalCost, sonar, stack, growth-delta, webperf). Zero tokens spent. Compatible with --report-file and --json.")
     .option("--security", "Focused deterministic security pass: prompt-injection scan over the agent-context surface (CLAUDE.md/AGENTS.md/templates/.rulesync/.karajan) + OSV + Semgrep + Sonar. Skips basal-cost, webperf, madge, knip, ai-slop, harness and the LLM — zero tokens. Designed for agents to self-invoke when a task touches sensitive surface (KJC-TSK-0695).")
     .option("-y, --yes", "Auto-confirm the 'Continue with LLM analysis?' prompt. Useful in scripts that want the full audit non-interactively. CI/non-TTY paths already auto-confirm without this flag.")
+    .option("--sbom <file>", "Only write the CycloneDX SBOM of the npm project's production dependencies to <file> (from package-lock.json) and stop. KJC-TSK-1255.")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "audit", flags, async ({ config, logger }) => {
+        if (flags.sbom) {
+          try {
+            const res = await writeSbom({ projectDir: config.projectDir || process.cwd(), file: flags.sbom });
+            if (flags.json) console.log(JSON.stringify(res));
+            else console.log(`SBOM (CycloneDX, ${res.components} components): ${res.file}`);
+          } catch (err) {
+            if (flags.json) console.log(JSON.stringify({ error: err.message }));
+            else logger.error(err.message);
+            process.exitCode = 1;
+          }
+          return;
+        }
         let resolvedTask = task;
         if (flags.taskFile) {
           const { readTaskFile } = await import("../utils/task-file.js");
@@ -997,21 +983,6 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
 
-  program
-    .command("resume")
-    .description("Resume a paused session")
-    .argument("<sessionId>")
-    .option("--answer <text>", "Answer to the question that caused the pause")
-    .option("--non-interactive", "Agents/CI: auto-answer prompts with their safe defaults; stop when there is none. Also enabled by KJ_NON_INTERACTIVE=1.")
-    .option("--json", "Output JSON only")
-    .action(async (sessionId, flags) => {
-      await withConfig(pkgVersion, "resume", flags, async ({ config, logger }) => {
-        const res = await resumeCommand({ sessionId, answer: flags.answer, config, logger, flags });
-        // KJC-TSK-0674 (issue #1289): same contract as kj run — an aborted
-        // resume must be observable by CI.
-        if (res?.aborted) process.exitCode = 1;
-      });
-    });
 
   program
     .command("update")
@@ -1061,17 +1032,6 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
 
-  program
-    .command("undo")
-    .description("Revert last pipeline run")
-    .option("--hard", "Discard all changes (default: soft reset, keeps changes staged)")
-    .action(async (flags) => {
-      await withConfig(pkgVersion, "undo", flags, async ({ logger }) => {
-        const result = await undoCommand({ hard: !!flags.hard, logger });
-        if (!result.ok) process.exit(1);
-      });
-    });
-
   program
     .command("sync")
     .description("Detect drift between code and the latest plan. Read-only by default; --apply writes a patch back to the Canvas.")