karajan-code 4.70.4 → 5.0.1

package/src/git/hu-automation.js

@@ -1,243 +0,0 @@
-/**
- * Per-HU git automation: branch, commit, push, PR per HU story.
- * Called from the HU sub-pipeline wrapper in orchestrator.js.
- */
-import { commitAll, pushBranch, createPullRequest, hasChanges } from "../utils/git.js";
-import { runCommand } from "../utils/process.js";
-import { stampStagedVerdict } from "../review/verdict-store.js";
-
-/**
- * Build a git-safe branch name for an HU story.
- * @param {string} prefix - e.g. "feat/"
- * @param {object} story - HU story {id, title}
- * @returns {string}
- */
-export function buildHuBranchName(prefix, story) {
-  const baseSlug = String(story.title || story.id || "hu")
-    .toLowerCase()
-    .replaceAll(/[^a-z0-9]+/g, "-")
-    .replaceAll(/^-+|-+$/g, "")
-    .slice(0, 40);
-  return `${prefix}${story.id}-${baseSlug}`;
-}
-
-/**
- * Resolve the base branch for a given HU based on its dependencies.
- * If it has no blocked_by, uses config.base_branch.
- * If it has parents, uses the last-created parent branch (assumes parents ran first).
- *
- * @param {object} story - the HU story
- * @param {Map<string,string>} huBranches - map of huId → branchName (already created)
- * @param {string} baseBranch - config.base_branch fallback
- * @returns {string} base branch name
- */
-export function resolveHuBase(story, huBranches, baseBranch) {
-  const parents = story.blocked_by || [];
-  if (parents.length === 0) return baseBranch;
-  // Walk parents in reverse order of declaration to find the most recent one
-  for (let i = parents.length - 1; i >= 0; i--) {
-    const parentBranch = huBranches.get(parents[i]);
-    if (parentBranch) return parentBranch;
-  }
-  return baseBranch;
-}
-
-/**
- * Resolve to an actually-existing local ref. Tries the preferred branch
- * first, then `main` and `master`, then plain `HEAD` as last resort.
- *
- * Why: N6 plan-flow dogfooding (2026-05-07) on a `git init -q` repo
- * with `init.defaultBranch=master` produced 7 identical warnings:
- *   `failed to create branch feat/...-001 from main:
- *    fatal: 'main' is not a commit and a branch can't be created`.
- * Every HU then fell back to running on the original branch, which
- * defeats the per-HU isolation the sub-pipeline was supposed to give.
- *
- * The configured base_branch is honoured when it exists; otherwise we
- * pick the most likely default. HEAD always exists once the repo has
- * any commit, so the fallback never throws past the gate.
- *
- * @param {string} preferred
- * @returns {Promise<string>}
- */
-async function resolveExistingBranchRef(preferred) {
-  const candidates = [preferred, "main", "master", "HEAD"]
-    .filter((c, i, arr) => c && arr.indexOf(c) === i); // unique, truthy
-  for (const ref of candidates) {
-    const probe = await runCommand("git", ["rev-parse", "--verify", "--quiet", ref], {});
-    if (probe.exitCode === 0) return ref;
-  }
-  return preferred; // give up; caller will surface the original error
-}
-
-/** Whether a branch name references the card, as a whole token (BB-002 is not BB-0022). */
-export function branchReferencesCard(branch, cardId) {
-  const id = String(cardId).replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-  return new RegExp(`(^|[^a-z0-9])${id}([^a-z0-9]|$)`, "i").test(String(branch || ""));
-}
-
-async function cardBranch({ cardId, story, config, logger }) {
-  const head = await runCommand("git", ["rev-parse", "--abbrev-ref", "HEAD"], {});
-  const current = head.exitCode === 0 ? head.stdout.trim() : "";
-  if (branchReferencesCard(current, cardId)) {
-    logger.info(`HU ${story.id}: on '${current}', the branch of card ${cardId}`);
-    return current;
-  }
-  const branchName = buildHuBranchName(config.git?.branch_prefix || "feat/", { id: cardId, title: story.title });
-  // A card branch left by an earlier run keeps its commits: taken, never reset.
-  const exists = await runCommand("git", ["rev-parse", "--verify", "--quiet", branchName], {});
-  const base = exists.exitCode === 0 ? null : await resolveExistingBranchRef(config.base_branch || "main");
-  const how = base ? `created from '${base}'` : "taken";
-  const res = await runCommand("git", base ? ["checkout", "-b", branchName, base] : ["checkout", branchName], {});
-  if (res.exitCode !== 0) {
-    logger.warn(`HU git: branch ${branchName} could not be ${how}: ${res.stderr}`);
-    return null;
-  }
-  logger.info(`HU ${story.id}: branch '${branchName}' ${how} for card ${cardId}`);
-  return branchName;
-}
-
-/**
- * Create a branch for an HU starting from its resolved base.
- * Returns the branch name created (or null if git automation is disabled).
- *
- * @param {object} params
- * @param {object} params.story
- * @param {Map} params.huBranches
- * @param {object} params.config
- * @param {object} params.logger
- * @returns {Promise<string|null>}
- */
-export async function prepareHuBranch({ story, huBranches, config, logger, cardId = null }) {
-  if (!config.git?.auto_commit && !config.git?.auto_push && !config.git?.auto_pr) {
-    return null;
-  }
-  // KJC-BUG-0249 (#1896): with a Planning Game card the run is that card's
-  // work and lives on ONE branch named after it: the current one when it
-  // already references the card, else feat/<CARD-ID>-<slug>, created once
-  // and shared by every HU. HU ids name branches only when there is no card.
-  if (cardId) {
-    const known = huBranches.get(cardId);
-    const branch = known ?? (await cardBranch({ cardId, story, config, logger }));
-    if (!branch) return null;
-    huBranches.set(cardId, branch);
-    huBranches.set(story.id, branch);
-    return branch;
-  }
-  const baseBranch = resolveHuBase(story, huBranches, config.base_branch || "main");
-  const effectiveBase = await resolveExistingBranchRef(baseBranch);
-  if (effectiveBase !== baseBranch) {
-    logger.info(`HU git: configured base '${baseBranch}' not found locally — using '${effectiveBase}' instead`);
-  }
-  const prefix = config.git?.branch_prefix || "feat/";
-  const branchName = buildHuBranchName(prefix, story);
-
-  // Checkout from the resolved base. Use `git checkout -B` to overwrite if rerun.
-  const res = await runCommand("git", ["checkout", "-B", branchName, effectiveBase], {});
-  if (res.exitCode !== 0) {
-    logger.warn(`HU git: failed to create branch ${branchName} from ${effectiveBase}: ${res.stderr}`);
-    return null;
-  }
-  huBranches.set(story.id, branchName);
-  logger.info(`HU ${story.id}: branch '${branchName}' from '${effectiveBase}'`);
-  return branchName;
-}
-
-/**
- * KJC-BUG-0248 (#1895): the remedy for a push git refused, read from its
- * message. GitHub refuses a push that adds or changes a workflow file when
- * the token lacks the `workflow` scope; that one has an exact fix.
- */
-export function pushRemedy(message, branch) {
-  if (/workflow/i.test(message) && /scope/i.test(message)) {
-    return `the token lacks the workflow scope: run gh auth refresh -h github.com -s workflow, then git push origin ${branch}`;
-  }
-  return `push the branch yourself: git push origin ${branch}`;
-}
-
-/** The warnings a run reports when the push or the PR of any HU failed. */
-export function collectGitWarnings(results) {
-  return results.flatMap((r) => (r.result?.git?.errors ?? []).map((e) => `${r.huId}: ${e.step} failed: ${e.message}. ${e.remedy}`));
-}
-
-/**
- * After an HU is approved, commit its changes and optionally push + create PR.
- * A push or PR that fails is not only a warn line: it travels in `errors`
- * with its remedy, so the run's result says it (KJC-BUG-0248).
- *
- * @param {object} params
- * @param {object} params.story
- * @param {string} params.branchName
- * @param {object} params.config
- * @param {object} params.logger
- * @returns {Promise<{committed: boolean, pushed: boolean, prUrl: string|null, branch: string|null, errors: Array<{step: string, message: string, remedy: string}>}>}
- */
-export async function finalizeHuCommit({ story, branchName, config, logger, cwd = null }) {
-  const result = { committed: false, pushed: false, prUrl: null, branch: branchName || null, errors: [] };
-  if (!branchName) return result;
-
-  const changed = await hasChanges(cwd);
-  if (!changed) {
-    logger.info(`HU ${story.id}: no changes to commit`);
-    return result;
-  }
-
-  const title = story.title || story.id;
-  const commitMsg = `feat(${story.id}): ${title}`;
-  if (config.git?.auto_commit) {
-    // KJC-BUG-0323: this commit runs after the HU's reviewer approved, so it
-    // records that verdict for the staged diff, as the other post-review commits do.
-    const commitRes = await commitAll(commitMsg, cwd, {
-      beforeCommit: ({ paths } = {}) => stampStagedVerdict({
-        projectDir: cwd || config.projectDir || process.cwd(),
-        paths,
-        reviewer: config.reviewer || "pipeline-reviewer",
-        summary: `kj run HU ${story.id}: reviewer approved`,
-      }),
-    });
-    if (commitRes) {
-      result.committed = true;
-      logger.info(`HU ${story.id}: committed on '${branchName}'`);
-    }
-  }
-
-  if (config.git?.auto_push && result.committed) {
-    try {
-      await pushBranch(branchName, cwd);
-      result.pushed = true;
-      logger.info(`HU ${story.id}: pushed '${branchName}'`);
-    } catch (err) {
-      const remedy = pushRemedy(err.message, branchName);
-      result.errors.push({ step: "push", message: err.message, remedy });
-      logger.warn(`HU ${story.id}: push failed: ${err.message} (${remedy})`);
-    }
-  }
-
-  if (config.git?.auto_pr && result.pushed) {
-    try {
-      const prBody = [
-        `## HU ${story.id}: ${title}`,
-        "",
-        story.certified?.text || "",
-        "",
-        "### Acceptance criteria",
-        ...(story.acceptance_criteria || []).map(c => `- ${c}`)
-      ].join("\n");
-      const url = await createPullRequest({
-        baseBranch: config.base_branch || "main",
-        branch: branchName,
-        title: commitMsg,
-        body: prBody,
-        cwd
-      });
-      result.prUrl = url;
-      logger.info(`HU ${story.id}: PR created ${url}`);
-    } catch (err) {
-      const remedy = `open the PR yourself: gh pr create --base ${config.base_branch || "main"} --head ${branchName}`;
-      result.errors.push({ step: "pr", message: err.message, remedy });
-      logger.warn(`HU ${story.id}: PR creation failed: ${err.message} (${remedy})`);
-    }
-  }
-
-  return result;
-}

package/src/git/hu-snapshot.js

@@ -1,10 +0,0 @@
-// Shim de compatibilidad: hu-snapshot vive ahora en karajan-core.
-// Mantenemos esta ruta para que callers internos del CLI (orchestrator,
-// runners) sigan funcionando sin tocar imports.
-export {
-  snapshotRefForHu,
-  createHuSnapshot,
-  hasHuSnapshot,
-  restoreHuSnapshot,
-  removeHuSnapshot,
-} from "karajan-core/hu-snapshot";

package/src/git/symlink-targets.js

@@ -1,57 +0,0 @@
-/**
- * KJC-BUG-0414 (#2606, from #2564): Solomon told the coder to drop a file from the commit as a
- * mirror of another, but the other was a symlink to it: the link would be committed dangling.
- * kj names the in-repo targets of the symlinks in a change, and a condition that takes one of
- * them out of the commit is dropped before it reaches the coder.
- */
-import { lstatSync, readlinkSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-
-/** The in-repo target of each symlink among `paths` (relative to projectDir). */
-export function symlinkTargets(projectDir, paths) {
-  const root = resolve(projectDir);
-  return paths.flatMap((link) => {
-    try {
-      const abs = join(root, link);
-      if (!lstatSync(abs).isSymbolicLink()) return [];
-      const target = relative(root, resolve(dirname(abs), readlinkSync(abs)));
-      const outside = target === ".." || target.startsWith(`..${sep}`) || isAbsolute(target);
-      return target && !outside ? [{ link, target: target.split(sep).join("/") }] : [];
-    } catch {
-      return [];
-    }
-  });
-}
-
-// A `*` matches within one path segment, as in the shell.
-const segmentMatches = (pattern, name) => {
-  const parts = pattern.split("*");
-  if (parts.length === 1) return pattern === name;
-  if (!name.startsWith(parts[0]) || !name.endsWith(parts.at(-1))) return false;
-  let at = parts[0].length;
-  for (const part of parts.slice(1, -1)) {
-    const found = name.indexOf(part, at);
-    if (found < 0) return false;
-    at = found + part.length;
-  }
-  return at <= name.length - parts.at(-1).length;
-};
-const globMatches = (pattern, path) => {
-  const p = pattern.split("/");
-  const t = path.split("/");
-  return p.length === t.length && p.every((seg, i) => segmentMatches(seg, t[i]));
-};
-const REMOVES = /\b(unstage|remove|drop|exclude|delete|restore|reset|revert|rm|untrack|quitar|sacar|eliminar|excluir|borrar)\b/i;
-// Quoted strings are one token (a path may hold spaces); bare tokens lose surrounding punctuation.
-const TOKENS = /"([^"]+)"|'([^']+)'|`([^`]+)`|(\S+)/g;
-const tokensOf = (text) => [...String(text).matchAll(TOKENS)]
-  .map((m) => (m[1] ?? m[2] ?? m[3] ?? m[4]).replace(/^[([{]+/, "").replace(/[)\]}:;,]+$/, ""));
-// Named literally anywhere in the text (any character git allows), or by a glob token.
-const names = (condition, target) => String(condition).includes(target) || tokensOf(condition).some((t) => globMatches(t, target));
-
-/** Splits Solomon's conditions: the ones that would take a symlink's target out of the commit go to `dropped`. */
-export function keepSymlinkTargets(conditions, targets) {
-  const takesTargetOut = (condition) => REMOVES.test(condition) && targets.some(({ target }) => names(condition, target));
-  const dropped = targets.length ? conditions.filter(takesTargetOut) : [];
-  return { kept: conditions.filter((c) => !dropped.includes(c)), dropped };
-}

package/src/golden/asserter.js

@@ -1,92 +0,0 @@
-/**
- * Golden tasks asserter (KJC-TSK-0374). Parses a `summary.md` produced
- * by a real `kj run` and compares it against a GoldenTask's structural
- * expectations. Pure: no I/O, no subprocess. Subprocess driver lands
- * in PR-3a; the 3 fixtures + baseline + spec land in PR-3b.
- *
- * Three of the five assertion families live here (the ones derivable
- * from summary.md alone): expected_commits_min, expected_audit_status,
- * expected_plan_adherence_min. expected_test_files and
- * allowed_loc_range need filesystem access — PR-3a wires those.
- */
-
-import { escapeRegExp } from "../utils/escape-regexp.js";
-
-const COMMIT_LINE = /^- `([^`]+)`\s+(.*)$/;
-const SCORE_LINE = /^\*\*Score\*\*:\s*(\d+)\s*\/\s*100/m;
-const AUDIT_ROW = /^\|\s*`audit`\s*\|\s*([^|]+?)\s*\|/m;
-
-function extractSection(content, heading) {
-  const re = new RegExp(`^## ${escapeRegExp(heading)}\\s*$([\\s\\S]*?)(?=^## |\\Z)`, "m");
-  const m = content.match(re);
-  return m ? m[1].trim() : "";
-}
-
-function parseCommits(content) {
-  const section = extractSection(content, "Commits");
-  if (!section || /No commits/.test(section)) return [];
-  return section
-    .split("\n")
-    .map((line) => line.match(COMMIT_LINE))
-    .filter(Boolean)
-    .map(([, hash, message]) => ({ hash, message }));
-}
-
-function parseAuditStatus(content) {
-  const m = content.match(AUDIT_ROW);
-  if (!m) return null;
-  const cell = m[1];
-  if (/✅|pass/i.test(cell)) return "pass";
-  if (/❌|fail/i.test(cell)) return "fail";
-  if (/⚠|warn/i.test(cell)) return "warning";
-  return null;
-}
-
-function parsePlanAdherence(content) {
-  const section = extractSection(content, "Plan adherence");
-  if (!section) return null;
-  const m = section.match(SCORE_LINE);
-  if (!m) return null;
-  const score = Number(m[1]);
-  return Number.isFinite(score) ? score : null;
-}
-
-export function parseSummary(content) {
-  const text = String(content || "");
-  return {
-    commits: parseCommits(text),
-    auditStatus: parseAuditStatus(text),
-    planAdherenceScore: parsePlanAdherence(text),
-  };
-}
-
-export function assertFromSummary(task, parsed) {
-  const failures = [];
-
-  const fail = (kind, expected, actual, message) => failures.push({ kind, expected, actual, message });
-
-  if (parsed.commits.length < task.expected_commits_min) {
-    fail("commits_min", `>= ${task.expected_commits_min}`, parsed.commits.length,
-      `expected at least ${task.expected_commits_min} commit(s); got ${parsed.commits.length}`);
-  }
-
-  if (parsed.auditStatus !== task.expected_audit_status) {
-    const got = parsed.auditStatus === null ? "no audit row in summary" : `"${parsed.auditStatus}"`;
-    fail("audit_status", task.expected_audit_status, parsed.auditStatus,
-      `expected audit "${task.expected_audit_status}"; got ${got}`);
-  }
-
-  if (typeof task.expected_plan_adherence_min === "number") {
-    const score = parsed.planAdherenceScore;
-    const min = task.expected_plan_adherence_min;
-    if (score === null) {
-      fail("plan_adherence_missing", `>= ${min}`, null,
-        `expected plan adherence >= ${min}; summary has no Plan adherence section`);
-    } else if (score < min) {
-      fail("plan_adherence_below", `>= ${min}`, score,
-        `expected plan adherence >= ${min}; got ${score}`);
-    }
-  }
-
-  return { ok: failures.length === 0, failures };
-}

package/src/golden/loader.js

@@ -1,52 +0,0 @@
-/**
- * Golden tasks loader (KJC-TSK-0374). Reads + validates JSON files
- * under a directory; aggregates errors; rejects duplicate ids.
- */
-
-import fs from "node:fs/promises";
-import path from "node:path";
-import { safeParseGoldenTask } from "./schema.js";
-
-export async function loadGoldenTasks(dir) {
-  const entries = await fs.readdir(dir, { withFileTypes: true }).catch((err) => {
-    throw new Error(`golden tasks directory not readable: ${dir} (${err.code || err.message})`);
-  });
-  const jsonFiles = entries
-    .filter((e) => e.isFile() && e.name.endsWith(".json"))
-    .map((e) => path.join(dir, e.name))
-    .sort();
-
-  const tasks = [];
-  const errors = [];
-  const seenIds = new Map();
-
-  for (const filePath of jsonFiles) {
-    let raw;
-    try {
-      const content = await fs.readFile(filePath, "utf8");
-      raw = JSON.parse(content);
-    } catch (err) {
-      errors.push(`${path.basename(filePath)}: invalid JSON (${err.message})`);
-      continue;
-    }
-    const result = safeParseGoldenTask(raw);
-    if (!result.ok) {
-      const summary = result.issues.map((iss) => `  - ${iss.path || "(root)"}: ${iss.message}`).join("\n");
-      errors.push(`${path.basename(filePath)}:\n${summary}`);
-      continue;
-    }
-    const existing = seenIds.get(result.task.id);
-    if (existing) {
-      errors.push(`${path.basename(filePath)}: duplicate id "${result.task.id}" (also in ${existing})`);
-      continue;
-    }
-    seenIds.set(result.task.id, path.basename(filePath));
-    tasks.push(result.task);
-  }
-
-  if (errors.length > 0) {
-    throw new Error(`golden tasks failed validation:\n${errors.join("\n")}`);
-  }
-
-  return { tasks };
-}

package/src/golden/runner.js

@@ -1,92 +0,0 @@
-/**
- * Golden tasks subprocess runner (KJC-TSK-0374). Spawns `kj run` in
- * a sandbox dir, reads back summary.md, evaluates the schema's
- * filesystem-dependent assertions (expected_test_files, allowed_loc_range),
- * and merges them with `assertFromSummary` into a single result.
- *
- * The kj subprocess + diff calls are injected so unit tests can drive
- * the runner without spawning anything (real e2e is opt-in via PR-3b).
- */
-
-import fs from "node:fs/promises";
-import path from "node:path";
-import { runCommand as defaultRun } from "../utils/process.js";
-import { parseSummary, assertFromSummary } from "./asserter.js";
-
-async function findLatestSummary(workDir) {
-  const journalRoot = path.join(workDir, ".karajan", "sessions");
-  const sessions = await fs.readdir(journalRoot).catch(() => []);
-  if (sessions.length === 0) return null;
-  const stats = await Promise.all(sessions.map(async (id) => {
-    const file = path.join(journalRoot, id, "summary.md");
-    const stat = await fs.stat(file).catch(() => null);
-    return stat ? { file, mtimeMs: stat.mtimeMs } : null;
-  }));
-  const valid = stats.filter(Boolean).sort((a, b) => b.mtimeMs - a.mtimeMs);
-  return valid[0]?.file ?? null;
-}
-
-async function findMissingTestFiles(workDir, paths) {
-  const checks = await Promise.all(paths.map(async (rel) =>
-    [rel, await fs.stat(path.join(workDir, rel)).then(() => true).catch(() => false)]));
-  return checks.filter(([, ok]) => !ok).map(([rel]) => rel);
-}
-
-async function totalLocSince(workDir, baseSha, run) {
-  const res = await run("git", ["diff", "--numstat", `${baseSha}..HEAD`], { cwd: workDir }).catch(() => null);
-  if (!res || res.exitCode !== 0) return null;
-  return String(res.stdout || "").split("\n").filter(Boolean)
-    .map((l) => l.split("\t")).filter(([a]) => a !== "-")
-    .reduce((sum, [a]) => sum + Number(a || 0), 0);
-}
-
-export async function runGoldenTask(task, opts = {}) {
-  const run = opts.run || defaultRun;
-  const fsApi = opts.fs || fs;
-  const workDir = opts.workDir;
-  if (!workDir) throw new Error("runGoldenTask requires opts.workDir");
-
-  const baseSha = opts.baseSha || null;
-  const kjResult = await run("kj", ["run", task.prompt, "-y"], {
-    cwd: workDir,
-    timeout: (task.timeout_minutes || 30) * 60_000,
-  });
-
-  const summaryPath = opts.summaryPath || await findLatestSummary(workDir);
-  if (!summaryPath) {
-    return { ok: false, kjExit: kjResult?.exitCode ?? -1, failures: [{
-      kind: "no_summary", expected: "summary.md", actual: null,
-      message: "kj run finished without producing a summary.md",
-    }] };
-  }
-  const content = await fsApi.readFile(summaryPath, "utf8");
-  const parsed = parseSummary(content);
-  const summaryAssertion = assertFromSummary(task, parsed);
-
-  const failures = [...summaryAssertion.failures];
-
-  if (Array.isArray(task.expected_test_files) && task.expected_test_files.length > 0) {
-    const missing = await findMissingTestFiles(workDir, task.expected_test_files);
-    if (missing.length > 0) {
-      failures.push({ kind: "test_files_missing", expected: task.expected_test_files, actual: missing,
-        message: `expected test files not produced: ${missing.join(", ")}` });
-    }
-  }
-
-  if (baseSha) {
-    const loc = await totalLocSince(workDir, baseSha, run);
-    const [min, max] = task.allowed_loc_range;
-    if (loc !== null && (loc < min || loc > max)) {
-      failures.push({ kind: "loc_out_of_range", expected: `${min}..${max}`, actual: loc,
-        message: `LOC added (${loc}) is outside the allowed range [${min}, ${max}]` });
-    }
-  }
-
-  return {
-    ok: failures.length === 0,
-    kjExit: kjResult?.exitCode ?? null,
-    summaryPath,
-    parsed,
-    failures,
-  };
-}

package/src/golden/schema.js

@@ -1,41 +0,0 @@
-/**
- * Golden tasks regression suite — schema (KJC-TSK-0374). Pure data,
- * no I/O. See docs/golden-tasks.md (PR-3) for the full spec.
- */
-
-import * as v from "valibot";
-
-const NonEmptyString = v.pipe(v.string(), v.minLength(1));
-const Percent = v.pipe(v.number(), v.minValue(0), v.maxValue(100));
-
-const NonNegInt = v.pipe(v.number(), v.integer(), v.minValue(0));
-const LocRangeSchema = v.pipe(v.array(NonNegInt), v.length(2),
-  v.check((arr) => arr[0] <= arr[1], "allowed_loc_range: min must be <= max"));
-
-const GoldenTaskSchema = v.looseObject({
-  id: v.pipe(NonEmptyString, v.regex(/^[a-z0-9_-]+$/, "id must be lowercase a-z0-9_-")),
-  title: NonEmptyString,
-  prompt: NonEmptyString,
-  description: v.optional(v.string()),
-  timeout_minutes: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1)), 30),
-  expected_commits_min: NonNegInt,
-  expected_audit_status: v.picklist(["pass", "warning", "fail"]),
-  expected_test_files: v.array(NonEmptyString),
-  allowed_loc_range: LocRangeSchema,
-  expected_plan_adherence_min: v.optional(Percent),
-});
-
-/** @typedef {import("valibot").InferOutput<typeof GoldenTaskSchema>} GoldenTask */
-
-export function parseGoldenTask(raw) {
-  return v.parse(GoldenTaskSchema, raw);
-}
-
-export function safeParseGoldenTask(raw) {
-  const result = v.safeParse(GoldenTaskSchema, raw);
-  if (result.success) return { ok: true, task: result.output };
-  return { ok: false, issues: result.issues.map((iss) => ({
-    path: (iss.path || []).map((p) => p.key).join("."),
-    message: iss.message,
-  })) };
-}

package/src/guards/duplicate-members.js

@@ -1,86 +0,0 @@
-/**
- * Duplicate class members (KJC-TSK-0796) — a bug JavaScript refuses to report.
- *
- * Declaring the same member twice in a class is legal: the LAST one wins and the
- * first disappears in silence. No runtime error, no lint warning, no compiler
- * complaint. That is how a `updated()` that loaded the data was lost in GREBLA
- * and a tab stayed empty in production for 17 days.
- *
- * What matters is not that there is a duplicate — it is WHAT WAS LOST: the body
- * that will never run. That is what the finding says.
- *
- * Honest about its limits (the fourth verdict): a file this guard could not read,
- * or one whose member names are computed at runtime, is reported as NOT OBSERVABLE
- * — never as clean.
- */
-import { parse } from "@babel/parser";
-
-const plugins = (file) => [
-  ...(/\.(ts|tsx|mts|cts)$/.test(file) ? ["typescript"] : []),
-  ...(/\.(tsx|jsx)$/.test(file) || !/\.(ts|mts|cts)$/.test(file) ? ["jsx"] : []),
-  "decorators",
-];
-const isClass = (node) => node?.type === "ClassDeclaration" || node?.type === "ClassExpression";
-
-/** Walks every node of the tree; enough for a syntax-only guard (no scope analysis). */
-function walk(node, visit) {
-  if (!node || typeof node.type !== "string") return;
-  visit(node);
-  for (const key of Object.keys(node)) {
-    const child = node[key];
-    if (Array.isArray(child)) child.forEach((c) => walk(c, visit));
-    else if (child && typeof child.type === "string") walk(child, visit);
-  }
-}
-
-const memberName = (member) => {
-  if (member.computed) return null; // `[expr]() {}` — the name is not known until it runs
-  const key = member.key ?? member.id;
-  if (key?.type === "Identifier") return key.name;
-  if (key?.type === "PrivateName") return `#${key.id.name}`;
-  if (key?.type === "StringLiteral" || key?.type === "NumericLiteral") return String(key.value);
-  return null;
-};
-
-/**
- * @param {string} source
- * @param {{file?: string}} [where]
- * @returns {{findings: Array<object>, notObservable: {file: string, reason: string}|null}}
- *   Each finding: {file, className, member, lostLine, winnerLine, message}.
- */
-export function findDuplicateMembers(source, { file = "<source>" } = {}) {
-  let tree;
-  try {
-    tree = parse(source, { sourceType: "unambiguous", allowReturnOutsideFunction: true, plugins: plugins(file) });
-  } catch (err) {
-    return { findings: [], notObservable: { file, reason: `could not be parsed (${err.message}) — not read as clean` } };
-  }
-  const findings = [];
-  let computed = 0;
-  walk(tree, (node) => {
-    if (!isClass(node)) return;
-    const className = node.id?.name ?? "(anonymous)";
-    const seen = new Map();
-    for (const member of node.body.body) {
-      // get/set of the same name are legal, and a static member is a different slot from an
-      // instance one — treating either as a duplicate would be the false positive that gets a
-      // guard switched off (the credibility rule of KJC-PCS-0082).
-      // A TypeScript overload signature (TSDeclareMethod) declares the same name on purpose and
-      // carries no body: counting it would flag every overloaded method in the codebase.
-      if (member.type === "StaticBlock" || member.type === "TSDeclareMethod" || member.type === "TSIndexSignature" || member.kind === "get" || member.kind === "set") continue;
-      const name = memberName(member);
-      if (name === null) { computed += 1; continue; }
-      const key = `${member.static ? "static " : ""}${name}`;
-      const line = member.loc.start.line;
-      const first = seen.get(key);
-      if (first === undefined) { seen.set(key, line); continue; }
-      findings.push({
-        file, className, member: key, lostLine: first, winnerLine: line,
-        message: `${file}:${line} — ${className}: the ${key} of line ${first} never runs, the one of line ${line} replaces it`,
-      });
-      seen.set(key, line); // a third copy is reported against the second, not against the first
-    }
-  });
-  const notObservable = computed > 0 && findings.length === 0 ? { file, reason: `${computed} member name(s) computed at runtime — this file cannot be fully checked` } : null;
-  return { findings, notObservable };
-}