karajan-code 4.70.4 → 5.0.0

package/src/commands/audit.js

@@ -289,141 +289,144 @@ export async function auditCommand({ task, config, logger, dimensions, json, age
     const deterministicCtx = await role.collectDeterministic(roleInput);
     const deterministicMd = formatDeterministicSummary(deterministicCtx);
 
-    // KJC-TSK-0471 — Harness Scorecard (Docker one-shot, golden metric).
-    // Runs after the deterministic phase, before the LLM. Auto-skipped on
-    // --no-harness or if `runHarnessSection` surfaces an error (graceful
-    // degradation: a missing Docker daemon must not break `kj audit`).
-    let harnessSummary = null;
-    if (!noHarness) {
-      try {
-        harnessSummary = await runHarnessSection({
-          projectDir: config?.projectDir || process.cwd(),
-          harnessConfig: config?.audit?.harness || null,
-        });
-        if (harnessSummary?.ok && !harnessSummary.skipped) {
-          runLog.logText(`[audit] harness score=${harnessSummary.score}/100 grade=${harnessSummary.grade}`);
-        }
-      } catch (e) {
-        harnessSummary = { ok: false, error: e?.message || String(e) };
-        runLog.logText(`[audit] harness skipped: ${harnessSummary.error}`);
-      }
-    }
+    const harnessSummary = noHarness ? null : await runHarness({ config, runLog });
     const harnessMd = formatHarnessSection(harnessSummary);
 
     // --json suppresses the interactive flow regardless: it would mangle
     // a script's stdout. JSON consumers always get the full audit unless
     // they explicitly pass deterministicOnly.
     const reportPath = await resolveReportFilePath(reportFile, json);
-    let runLlm = !deterministicOnly;
-    if (runLlm && !json && !yes) {
-      console.log(deterministicMd);
-      console.log("");
-      const ok = await promptContinueWithLlm({ promptFn });
-      runLlm = ok;
-      if (!ok) logger.info("LLM analysis skipped (deterministic-only mode).");
-    }
+    const runLlm = await chooseLlm({ deterministicOnly, json, yes, deterministicMd, promptFn, logger });
+    const invocation = { task, dimensions, noSonar, noOsv, noSemgrep, noHarness, noAiSlop, json, deterministicOnly, yes };
+    const ctx = { config, logger, runLog, json, trend, invocation, deterministicCtx, deterministicMd, harnessSummary, harnessMd, reportPath };
+    if (!runLlm) return deterministicOnlyAudit(ctx);
+    return llmAudit({ ...ctx, roleInput, available, fallbackCandidates });
+  });
+}
 
-    if (!runLlm) {
-      // Deterministic-only path. Produce the report from what we already
-      // have, persist it (md or json), and exit. Zero tokens spent.
-      const harnessJson = harnessSummaryForJson(harnessSummary);
-      const currentHarness = harnessSummary?.ok && !harnessSummary.skipped ? harnessSummary : null;
-      const history = loadAuditHistoryContext(config?.projectDir || process.cwd(), currentHarness, { showTrend: trend });
-      const historyMd = composeHistoryBlock(history);
-      const stdoutContent = json
-        ? JSON.stringify({ deterministic: deterministicCtx, harnessScore: harnessJson, harnessScoreDiff: history.diff, mode: "deterministic-only" }, null, 2)
-        : (deterministicOnly ? `${deterministicMd}\n${harnessMd}${historyMd}` : `${harnessMd}${historyMd}`);
-      if (json || deterministicOnly || harnessMd) console.log(stdoutContent);
-
-      if (reportPath) {
-        let payload;
-        if (reportPath.endsWith(".json")) {
-          payload = JSON.stringify({ deterministic: deterministicCtx, harnessScore: harnessJson, harnessScoreDiff: history.diff, mode: "deterministic-only" }, null, 2);
-        } else {
-          const header = await buildReportHeader(config?.projectDir, describeInvocation({ task, dimensions, noSonar, noOsv, noSemgrep, noHarness, noAiSlop, json, deterministicOnly, yes }));
-          payload = `${header}${deterministicMd}\n${harnessMd}${historyMd}`;
-        }
-        await fs.writeFile(reportPath, payload, "utf8");
-        runLog.logText(`[audit] report written (deterministic-only) → ${reportPath}`);
-        logger.info(`Audit report written: ${reportPath}`);
-      }
-      persistAuditRun(config?.projectDir || process.cwd(), { runId: new Date().toISOString(), timestamp: new Date().toISOString(), gitSha: null, harness: harnessSummary?.ok && !harnessSummary.skipped ? harnessSummary : null, rawReportPath: reportPath });
-      logger.info("Audit completed (deterministic-only).");
-      return { ok: true, mode: "deterministic-only", reportPath: reportPath || undefined };
-    }
+/**
+ * KJC-TSK-0471 — Harness Scorecard (Docker one-shot, golden metric).
+ * Runs after the deterministic phase, before the LLM. Skipped on
+ * --no-harness; an error from `runHarnessSection` degrades gracefully
+ * (a missing Docker daemon must not break `kj audit`).
+ */
+async function runHarness({ config, runLog }) {
+  try {
+    const summary = await runHarnessSection({
+      projectDir: config?.projectDir || process.cwd(),
+      harnessConfig: config?.audit?.harness || null,
+    });
+    if (summary?.ok && !summary.skipped) runLog.logText(`[audit] harness score=${summary.score}/100 grade=${summary.grade}`);
+    return summary;
+  } catch (e) {
+    const summary = { ok: false, error: e?.message || String(e) };
+    runLog.logText(`[audit] harness skipped: ${summary.error}`);
+    return summary;
+  }
+}
 
-    // Continue with the LLM phase using the already-collected context.
-    const progress = createCliProgressReporter({ role: "auditor" });
-    let roleResult;
-    try {
-      // KJC-BUG-0094: resilient fallback — if the configured provider/model
-      // is down (e.g. an inherited model like "claude-fable-5" is offline),
-      // degrade to the provider default, then to the next installed provider,
-      // reusing the deterministic context so no static analysis is re-run.
-      roleResult = await runAuditWithFallback({
-        config, logger,
-        roleInput: { ...roleInput, onOutput: progress.onOutput },
-        deterministicCtx,
-        available,
-        candidates: fallbackCandidates,
-        onFallback: (cand) => logger.warn(`Audit provider fallback → ${cand.provider}${cand.model ? ` (${cand.model})` : " (default model)"}`),
-      });
-      progress.finish(roleResult.ok ? "done" : "failed");
-    } catch (err) { progress.finish("failed"); throw err; }
-
-    if (!roleResult.ok) {
-      const err = roleResult.result?.error || "Audit failed";
-      throw new Error(err);
-    }
+/** Two-phase audit (KJC-TSK-0364): asks before spending tokens, unless --json, --yes or --deterministic-only. */
+async function chooseLlm({ deterministicOnly, json, yes, deterministicMd, promptFn, logger }) {
+  if (deterministicOnly) return false;
+  if (json || yes) return true;
+  console.log(deterministicMd);
+  console.log("");
+  const ok = await promptContinueWithLlm({ promptFn });
+  if (!ok) logger.info("LLM analysis skipped (deterministic-only mode).");
+  return ok;
+}
 
-    const parsed = roleResult.result;
-    const usage = roleResult.usage;
-    if (parsed?.summary?.overallHealth) {
-      runLog.logText(`[audit] findings=${parsed.summary.totalFindings} (critical=${parsed.summary.critical}, high=${parsed.summary.high})`);
-    }
-    if (usage?.available) {
-      runLog.logText(`[audit] usage tokens=${usage.total_tokens} cost=$${(usage.cost_usd ?? 0).toFixed(4)} duration=${(usage.durationMs / 1000).toFixed(1)}s`);
-    }
+const scoredHarness = (summary) => (summary?.ok && !summary.skipped ? summary : null);
 
-    const harnessJson = harnessSummaryForJson(harnessSummary);
-    const currentHarness = harnessSummary?.ok && !harnessSummary.skipped ? harnessSummary : null;
-    const history = loadAuditHistoryContext(config?.projectDir || process.cwd(), currentHarness, { showTrend: trend });
-    const historyMd = composeHistoryBlock(history);
-    let stdoutContent;
-    if (json) {
-      const jsonPayload = parsed
-        ? { ...parsed, harnessScore: harnessJson, harnessScoreDiff: history.diff, usage: usage || undefined }
-        : { ...roleResult, harnessScore: harnessJson, harnessScoreDiff: history.diff, usage: usage || undefined };
-      stdoutContent = JSON.stringify(jsonPayload, null, 2);
-    } else if (parsed?.summary?.overallHealth) {
-      stdoutContent = `${formatAudit(parsed, usage)}\n${harnessMd}${historyMd}`;
-    } else if (parsed?.raw) {
-      stdoutContent = parsed.raw + (usage ? `\n\n${formatUsageSummary(usage) || ""}` : "") + `\n${harnessMd}${historyMd}`;
-    } else {
-      stdoutContent = `${roleResult.summary || "Audit complete."}\n${harnessMd}${historyMd}`;
-    }
-    console.log(stdoutContent);
-
-    if (reportPath) {
-      let payload;
-      if (reportPath.endsWith(".json")) {
-        const jsonPayload = parsed
-          ? { ...parsed, harnessScore: harnessJson, harnessScoreDiff: history.diff, usage: usage || undefined }
-          : { ...roleResult, harnessScore: harnessJson, harnessScoreDiff: history.diff, usage: usage || undefined };
-        payload = JSON.stringify(jsonPayload, null, 2);
-      } else {
-        const header = await buildReportHeader(config?.projectDir, describeInvocation({ task, dimensions, noSonar, noOsv, noSemgrep, noHarness, noAiSlop, json, deterministicOnly, yes }));
-        payload = header + stdoutContent + "\n";
-      }
-      await fs.writeFile(reportPath, payload, "utf8");
-      runLog.logText(`[audit] report written → ${reportPath}`);
-      logger.info(`Audit report written: ${reportPath}`);
-    }
+/** The harness score as JSON and the history block, shared by both paths. */
+function harnessReport({ config, harnessSummary, trend }) {
+  const history = loadAuditHistoryContext(config?.projectDir || process.cwd(), scoredHarness(harnessSummary), { showTrend: trend });
+  return { harnessJson: harnessSummaryForJson(harnessSummary), history, historyMd: composeHistoryBlock(history) };
+}
 
-    persistAuditRun(config?.projectDir || process.cwd(), { runId: new Date().toISOString(), timestamp: new Date().toISOString(), gitSha: null, harness: harnessSummary?.ok && !harnessSummary.skipped ? harnessSummary : null, rawReportPath: reportPath });
-    logger.info("Audit completed.");
-    return { ok: true, reportPath: reportPath || undefined };
-  });
+async function writeReport({ ctx, payloadJson, markdownBody, note }) {
+  const { config, runLog, logger, reportPath, invocation } = ctx;
+  if (!reportPath) return;
+  const payload = reportPath.endsWith(".json")
+    ? payloadJson
+    : `${await buildReportHeader(config?.projectDir, describeInvocation(invocation))}${markdownBody}`;
+  await fs.writeFile(reportPath, payload, "utf8");
+  runLog.logText(`[audit] report written${note} → ${reportPath}`);
+  logger.info(`Audit report written: ${reportPath}`);
+}
+
+function persistRun(ctx) {
+  const now = new Date().toISOString();
+  persistAuditRun(ctx.config?.projectDir || process.cwd(), { runId: now, timestamp: now, gitSha: null, harness: scoredHarness(ctx.harnessSummary), rawReportPath: ctx.reportPath });
+}
+
+/** Deterministic-only path: the report from what was already collected, persisted, zero tokens spent. */
+async function deterministicOnlyAudit(ctx) {
+  const { json, invocation, deterministicCtx, deterministicMd, harnessMd, reportPath, logger } = ctx;
+  const { harnessJson, history, historyMd } = harnessReport(ctx);
+  const payloadJson = JSON.stringify({ deterministic: deterministicCtx, harnessScore: harnessJson, harnessScoreDiff: history.diff, mode: "deterministic-only" }, null, 2);
+  let stdoutContent = `${harnessMd}${historyMd}`;
+  if (json) stdoutContent = payloadJson;
+  else if (invocation.deterministicOnly) stdoutContent = `${deterministicMd}\n${harnessMd}${historyMd}`;
+  if (json || invocation.deterministicOnly || harnessMd) console.log(stdoutContent);
+  await writeReport({ ctx, payloadJson, markdownBody: `${deterministicMd}\n${harnessMd}${historyMd}`, note: " (deterministic-only)" });
+  persistRun(ctx);
+  logger.info("Audit completed (deterministic-only).");
+  return { ok: true, mode: "deterministic-only", reportPath: reportPath || undefined };
+}
+
+/**
+ * KJC-BUG-0094: resilient fallback — if the configured provider/model
+ * is down (e.g. an inherited model like "claude-fable-5" is offline),
+ * degrade to the provider default, then to the next installed provider,
+ * reusing the deterministic context so no static analysis is re-run.
+ */
+async function runLlmPhase({ config, logger, roleInput, deterministicCtx, available, fallbackCandidates }) {
+  const progress = createCliProgressReporter({ role: "auditor" });
+  try {
+    const roleResult = await runAuditWithFallback({
+      config, logger,
+      roleInput: { ...roleInput, onOutput: progress.onOutput },
+      deterministicCtx,
+      available,
+      candidates: fallbackCandidates,
+      onFallback: (cand) => logger.warn(`Audit provider fallback → ${cand.provider}${cand.model ? ` (${cand.model})` : " (default model)"}`),
+    });
+    progress.finish(roleResult.ok ? "done" : "failed");
+    return roleResult;
+  } catch (err) {
+    progress.finish("failed");
+    throw err;
+  }
+}
+
+function llmStdout({ parsed, usage, roleResult, harnessMd, historyMd }) {
+  if (parsed?.summary?.overallHealth) return `${formatAudit(parsed, usage)}\n${harnessMd}${historyMd}`;
+  if (parsed?.raw) return parsed.raw + (usage ? `\n\n${formatUsageSummary(usage) || ""}` : "") + `\n${harnessMd}${historyMd}`;
+  return `${roleResult.summary || "Audit complete."}\n${harnessMd}${historyMd}`;
+}
+
+/** The LLM phase, over the deterministic context already collected. */
+async function llmAudit(ctx) {
+  const { json, runLog, logger, harnessMd, reportPath } = ctx;
+  const roleResult = await runLlmPhase(ctx);
+  if (!roleResult.ok) throw new Error(roleResult.result?.error || "Audit failed");
+  const parsed = roleResult.result;
+  const usage = roleResult.usage;
+  if (parsed?.summary?.overallHealth) {
+    runLog.logText(`[audit] findings=${parsed.summary.totalFindings} (critical=${parsed.summary.critical}, high=${parsed.summary.high})`);
+  }
+  if (usage?.available) {
+    runLog.logText(`[audit] usage tokens=${usage.total_tokens} cost=$${(usage.cost_usd ?? 0).toFixed(4)} duration=${(usage.durationMs / 1000).toFixed(1)}s`);
+  }
+  const { harnessJson, history, historyMd } = harnessReport(ctx);
+  const payloadJson = JSON.stringify({ ...(parsed || roleResult), harnessScore: harnessJson, harnessScoreDiff: history.diff, usage: usage || undefined }, null, 2);
+  const stdoutContent = json ? payloadJson : llmStdout({ parsed, usage, roleResult, harnessMd, historyMd });
+  console.log(stdoutContent);
+  await writeReport({ ctx, payloadJson, markdownBody: `${stdoutContent}\n`, note: "" });
+  persistRun(ctx);
+  logger.info("Audit completed.");
+  return { ok: true, reportPath: reportPath || undefined };
 }
 
 // Exposed for tests — kept module-private otherwise.

package/src/commands/board.js

@@ -2,9 +2,10 @@ import fs from "node:fs";
 import http from "node:http";
 import path from "node:path";
 import net from "node:net";
-import { execFileSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { getKarajanHome } from "../utils/paths.js";
 import { projectSlug as slugOfDir } from "../plan/plan-store.js";
+import { mainCheckout } from "../utils/main-checkout.js";
 import { getPortOccupant } from "../utils/port-occupant.js";
 
 const BOARD_DIR = path.resolve(import.meta.dirname, "../../packages/hu-board");
@@ -90,16 +91,11 @@ export function buildBoardUrl(port, projectSlug) {
 }
 
 /**
- * KJC-TSK-0884: the board slug of a project is its PARENT repo's, even from a
- * `kj worktree` lane, or the lane opens an empty view.
+ * KJC-TSK-0884: the board slug of a project is its main checkout's (#2566), even from a
+ * lane or a subfolder, or the lane opens an empty view. A git failure throws, never falls back.
  */
 export function boardSlug(projectDir) {
-  let dir = projectDir;
-  try {
-    const common = execFileSync("git", ["-C", projectDir, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (path.basename(common) === ".git") dir = path.dirname(common);
-  } catch { /* not a git repo: the dir is the project */ }
-  return slugOfDir(dir);
+  return slugOfDir(mainCheckout(projectDir));
 }
 
 /**

package/src/commands/check.js

@@ -25,16 +25,7 @@ export async function checkCommand({ projectDir = process.cwd(), profile = "stan
   // An evaluation error (corrupt store, git failure) is a failing check, never
   // a silent pass: the only tolerated non-red state is the explicit "no index".
   const ragCoverage = await createRagCoverageCheck().detect({ config, projectDir }).catch((err) => ({ ok: false, severity: "fail", detail: `rag coverage could not be evaluated: ${err.message}` }));
-  // KJC-TSK-0694: same deal for the MCP inventory — a nudge, never a gate.
-  // KJC-TSK-0728: observed agent CLIs ride the same snapshot as "(cli)"
-  // entries, so a newly-appeared agent binary trips the same drift question.
-  let aiSurface = null;
-  try {
-    const clis = (await detectObservedAgents().catch(() => []))
-      .filter((a) => a.available)
-      .map((a) => `${a.name} (cli)`);
-    aiSurface = checkAiSurface({ projectDir, extraSurface: clis });
-  } catch { /* inventory is best-effort */ }
+  const aiSurface = await observedAiSurface(projectDir);
 
   // KJC-TSK-1059: young dependencies the branch brings in, a warning outside the review.
   const depCooldown = await branchCooldownLines({ projectDir, base: config?.base_branch ?? "main", thresholdHours: config?.supply_chain?.cooldown_hours })
@@ -48,10 +39,35 @@ export async function checkCommand({ projectDir = process.cwd(), profile = "stan
     return ok ? 0 : 1;
   }
 
+  printReport({ profile, result, method, ragCoverage, aiSurface, depCooldown, audit, config, ok, logger });
+  return ok ? 0 : 1;
+}
+
+// KJC-TSK-0694: same deal for the MCP inventory — a nudge, never a gate.
+// KJC-TSK-0728: observed agent CLIs ride the same snapshot as "(cli)"
+// entries, so a newly-appeared agent binary trips the same drift question.
+async function observedAiSurface(projectDir) {
+  try {
+    const clis = (await detectObservedAgents().catch(() => []))
+      .filter((a) => a.available)
+      .map((a) => `${a.name} (cli)`);
+    return checkAiSurface({ projectDir, extraSurface: clis });
+  } catch { return null; /* inventory is best-effort */ }
+}
+
+const mark = (ok) => (ok ? "✓" : "✗");
+
+function verdictLine(ok, harnessOk) {
+  if (ok) return "Harness OK.";
+  if (harnessOk) return "RAG index drift detected — a gate cannot protect what it cannot see.";
+  return "Harness drift detected — run `kj harden` to repair.";
+}
+
+function printReport({ profile, result, method, ragCoverage, aiSurface, depCooldown, audit, config, ok, logger }) {
   logger.info?.(`kj check (${profile})`);
-  for (const c of result.checks) logger.info?.(`  ${c.ok ? "✓" : "✗"} ${c.id}: ${c.detail}`);
+  for (const c of result.checks) logger.info?.(`  ${mark(c.ok)} ${c.id}: ${c.detail}`);
   if (method) logger.info?.(`  method: ${formatMethodStats(method)}`);
-  logger.info?.(`  ${ragCoverage.ok ? "✓" : "✗"} rag-coverage: ${ragCoverage.detail}`);
+  logger.info?.(`  ${mark(ragCoverage.ok)} rag-coverage: ${ragCoverage.detail}`);
   if (aiSurface) logger.info?.(`  ${formatAiSurface(aiSurface)}`);
   for (const line of depCooldown) logger.info?.(`  ${line}`);
   logger.info?.(`  ${audit.line}`);
@@ -59,8 +75,5 @@ export async function checkCommand({ projectDir = process.cwd(), profile = "stan
   // said out loud next to everything else that describes the project. Never
   // a check: it has no ok/fail, it informs.
   logger.info?.(`  ${panelSummary(config)}`);
-  if (ok) logger.info?.("Harness OK.");
-  else if (result.ok) logger.info?.("RAG index drift detected — a gate cannot protect what it cannot see.");
-  else logger.info?.("Harness drift detected — run `kj harden` to repair.");
-  return ok ? 0 : 1;
+  logger.info?.(verdictLine(ok, result.ok));
 }

package/src/commands/doctor.js

@@ -33,6 +33,7 @@ import { getNodeChecks } from "../checks/node.js";
 import { getNativeBuildChecks } from "../checks/native-build.js";
 import { getPortChecks } from "../checks/ports.js";
 import { getTokenChecks } from "../checks/tokens.js";
+import { getAgentTokenChecks } from "../checks/agent-token.js";
 import { getMcpHealthChecks } from "../checks/mcp-health.js";
 import { getSkillsChecks } from "../checks/skills.js";
 import { getDirSetupChecks } from "../checks/dir-setup.js";
@@ -72,6 +73,7 @@ function buildChecks(config, { projectOnly = false } = {}) {
     ...getPhoneChecks(),
     ...getPortChecks(),
     ...getTokenChecks(config),
+    ...getAgentTokenChecks({ projectDir }),
     ...getMcpHealthChecks(),
     ...getSkillsChecks(),
     ...getCiChecks(),