karajan-code 1.48.0 → 1.49.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "1.48.0",
+  "version": "1.49.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/resolve-bin.js

@@ -26,7 +26,7 @@ function getNvmDirs() {
   const versionsDir = path.join(nvmDir, "versions", "node");
   try {
     return readdirSync(versionsDir).map(v => path.join(versionsDir, v, "bin"));
-  } catch {
+  } catch { /* nvm versions dir may not exist */
     return [];
   }
 }

package/src/audit/basal-cost.js

@@ -1,8 +1,11 @@
-import fs from "node:fs";
+import fs from "node:fs/promises";
 import path from "node:path";
-import { execFile, execFileSync } from "node:child_process";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 import { getKarajanHome } from "../utils/paths.js";
 
+const execFileAsync = promisify(execFile);
+
 const SOURCE_EXTENSIONS = new Set([
   ".js", ".mjs", ".cjs", ".ts", ".mts", ".cts", ".tsx", ".jsx",
   ".py", ".rb", ".go", ".rs", ".java", ".kt", ".swift", ".c", ".cpp", ".h",
@@ -18,11 +21,11 @@ function slugify(projectDir) {
   return path.basename(projectDir).replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 
-function walkSourceFiles(dir) {
+async function walkSourceFiles(dir) {
   // Use git ls-files for speed (instant vs recursive walk)
   try {
-    const output = execFileSync("git", ["ls-files", "--cached", "--others", "--exclude-standard"], { cwd: dir, encoding: "utf8", timeout: 5000 });
-    return output.trim().split("\n")
+    const { stdout } = await execFileAsync("git", ["ls-files", "--cached", "--others", "--exclude-standard"], { cwd: dir, encoding: "utf8", timeout: 5000 });
+    return stdout.trim().split("\n")
       .filter(f => f && SOURCE_EXTENSIONS.has(path.extname(f)) && !EXCLUDE_DIRS.has(f.split("/")[0]))
       .map(f => path.join(dir, f));
   } catch {
@@ -30,15 +33,15 @@ function walkSourceFiles(dir) {
     const files = [];
     let entries;
     try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch { /* directory not readable */
       return files;
     }
     for (const entry of entries) {
       if (EXCLUDE_DIRS.has(entry.name)) continue;
       const full = path.join(dir, entry.name);
       if (entry.isDirectory()) {
-        files.push(...walkSourceFiles(full));
+        files.push(...await walkSourceFiles(full));
       } else if (SOURCE_EXTENSIONS.has(path.extname(entry.name))) {
         files.push(full);
       }
@@ -47,19 +50,19 @@ function walkSourceFiles(dir) {
   }
 }
 
-function countLines(filePath) {
+async function countLines(filePath) {
   try {
-    const content = fs.readFileSync(filePath, "utf8");
+    const content = await fs.readFile(filePath, "utf8");
     return content.split("\n").length;
   } catch {
     return 0;
   }
 }
 
-function countDependencies(projectDir) {
+async function countDependencies(projectDir) {
   const pkgPath = path.join(projectDir, "package.json");
   try {
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+    const pkg = JSON.parse(await fs.readFile(pkgPath, "utf8"));
     const deps = Object.keys(pkg.dependencies || {});
     const devDeps = Object.keys(pkg.devDependencies || {});
     return { dependencies: deps.length, devDependencies: devDeps.length, total: deps.length + devDeps.length };
@@ -89,7 +92,7 @@ function runDepcheck(projectDir) {
   });
 }
 
-function findDeadExports(sourceFiles) {
+async function findDeadExports(sourceFiles) {
   const exportMap = new Map(); // file -> [exportName]
   const importedNames = new Set();
 
@@ -101,7 +104,7 @@ function findDeadExports(sourceFiles) {
   for (const file of sourceFiles) {
     let content;
     try {
-      content = fs.readFileSync(file, "utf8");
+      content = await fs.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -139,15 +142,15 @@ function findDeadExports(sourceFiles) {
 }
 
 export async function measureBasalCost(projectDir) {
-  const sourceFiles = walkSourceFiles(projectDir);
+  const sourceFiles = await walkSourceFiles(projectDir);
   let totalLines = 0;
   for (const f of sourceFiles) {
-    totalLines += countLines(f);
+    totalLines += await countLines(f);
   }
 
-  const depInfo = countDependencies(projectDir);
+  const depInfo = await countDependencies(projectDir);
   const depcheck = await runDepcheck(projectDir);
-  const deadExports = findDeadExports(sourceFiles);
+  const deadExports = await findDeadExports(sourceFiles);
 
   return {
     totalLines,
@@ -162,20 +165,20 @@ function auditDir() {
   return path.join(getKarajanHome(), "audits");
 }
 
-export function loadPreviousAudit(projectDir) {
+export async function loadPreviousAudit(projectDir) {
   const file = path.join(auditDir(), slugify(projectDir), "latest.json");
   try {
-    return JSON.parse(fs.readFileSync(file, "utf8"));
+    return JSON.parse(await fs.readFile(file, "utf8"));
   } catch {
     return null;
   }
 }
 
-export function saveAuditSnapshot(projectDir, metrics) {
+export async function saveAuditSnapshot(projectDir, metrics) {
   const dir = path.join(auditDir(), slugify(projectDir));
-  fs.mkdirSync(dir, { recursive: true });
+  await fs.mkdir(dir, { recursive: true });
   const snapshot = { ...metrics, timestamp: new Date().toISOString() };
-  fs.writeFileSync(path.join(dir, "latest.json"), JSON.stringify(snapshot, null, 2));
+  await fs.writeFile(path.join(dir, "latest.json"), JSON.stringify(snapshot, null, 2));
   return snapshot;
 }
 

package/src/bootstrap.js

@@ -38,7 +38,7 @@ async function checkGitRepo() {
   let ok = false;
   try {
     ok = await ensureGitRepo();
-  } catch {
+  } catch { /* git may not be installed */
     ok = false;
   }
   return {
@@ -156,7 +156,7 @@ async function readBootstrapFile(projectDir) {
   try {
     const raw = await fs.readFile(bootstrapPath(projectDir), "utf8");
     return JSON.parse(raw);
-  } catch {
+  } catch { /* bootstrap file may not exist or contain invalid JSON */
     return null;
   }
 }

package/src/commands/agents.js

@@ -51,7 +51,7 @@ export async function setAgent(role, provider, { global: isGlobal = false } = {}
     const { setSessionOverride } = await import("../mcp/preflight.js");
     setSessionOverride(role, provider);
     return { role, provider, scope: "session" };
-  } catch {
+  } catch { /* preflight module not available in CLI mode */
     // preflight module not available (CLI mode) — write to project config
     const projectConfigPath = getProjectConfigPath();
     const projectConfig = (await loadProjectConfig()) || {};

package/src/commands/board.js

@@ -10,7 +10,7 @@ function readPid() {
   try {
     const pid = Number.parseInt(fs.readFileSync(PID_FILE, "utf8").trim(), 10);
     return Number.isFinite(pid) ? pid : null;
-  } catch {
+  } catch { /* PID file does not exist */
     return null;
   }
 }
@@ -19,7 +19,7 @@ function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
+  } catch { /* process does not exist */
     return false;
   }
 }
@@ -55,7 +55,7 @@ export async function stopBoard() {
 
   try {
     process.kill(pid, "SIGTERM");
-  } catch {
+  } catch { /* process already dead */
     // already dead
   }
   try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }

package/src/commands/code.js

@@ -13,7 +13,7 @@ export async function codeCommand({ task, config, logger }) {
   if (config.coder_rules) {
     try {
       coderRules = await fs.readFile(config.coder_rules, "utf8");
-    } catch {
+    } catch { /* configured coder_rules path not found — try fallback */
       try { coderRules = await fs.readFile("coder-rules.md", "utf8"); } catch { /* no coder rules file */ }
     }
   }

package/src/commands/doctor.js

@@ -44,7 +44,7 @@ async function checkGitRepo() {
   let gitOk = false;
   try {
     gitOk = await ensureGitRepo();
-  } catch {
+  } catch { /* git check failed */
     gitOk = false;
   }
   return {
@@ -79,7 +79,7 @@ async function checkSonarQube(config) {
   if (config.sonarqube?.enabled !== false) {
     try {
       sonarOk = await isSonarReachable(sonarHost);
-    } catch {
+    } catch { /* sonar check failed */
       sonarOk = false;
     }
   }
@@ -130,7 +130,7 @@ async function checkSerena() {
   try {
     const serenaCheck = await runCommand("serena", ["--version"]);
     serenaOk = serenaCheck.exitCode === 0;
-  } catch {
+  } catch { /* serena not installed */
     serenaOk = false;
   }
   return {
@@ -181,7 +181,7 @@ async function checkBecariaSecrets() {
       detail: secretsOk ? "BECARIA_APP_ID + BECARIA_APP_PRIVATE_KEY found" : `Missing: ${missing}`,
       fix: secretsOk ? null : "Add BECARIA_APP_ID and BECARIA_APP_PRIVATE_KEY as GitHub repository secrets"
     };
-  } catch {
+  } catch { /* GitHub API error */
     return null;
   }
 }

package/src/commands/init.js

@@ -163,7 +163,7 @@ async function ensureCoderRules(coderRulesPath, logger) {
   let content;
   try {
     content = await fs.readFile(templatePath, "utf8");
-  } catch {
+  } catch { /* template not found, use inline default */
     content = [
       "# Coder Rules",
       "",
@@ -333,7 +333,7 @@ export async function initCommand({ logger, flags = {} }) {
   try {
     const rtkRes = await runCommand("rtk", ["--version"]);
     hasRtk = rtkRes.exitCode === 0;
-  } catch {
+  } catch { /* rtk not installed */
     hasRtk = false;
   }
   if (!hasRtk) {

package/src/commands/report.js

@@ -312,7 +312,7 @@ async function findSessionsByPgTask(dir, pgTask) {
       if (session.pg_task_id === pgTask) {
         matches.push(entry);
       }
-    } catch {
+    } catch { /* skip malformed session files */
       // skip malformed sessions
     }
   }

package/src/commands/review.js

@@ -53,7 +53,7 @@ export async function reviewCommand({ task, config, logger, baseRef }) {
       let review;
       try {
         review = JSON.parse(result.output);
-      } catch {
+      } catch { /* output is not JSON */
         review = { approved: true, summary: result.output };
       }
 

package/src/commands/roles.js

@@ -60,7 +60,7 @@ export async function showRole(roleName, config) {
     try {
       await fs.readFile(candidates[1], "utf8");
       source = "user";
-    } catch {
+    } catch { /* user role file not found */
       source = "built-in";
     }
   }

package/src/hu/store.js

@@ -1,6 +1,9 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { execSync } from "node:child_process";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
 import { getKarajanHome } from "../utils/paths.js";
 
 // FUTURE: hu-storage adapter for PG/Trello/etc — currently local files only
@@ -237,13 +240,14 @@ export function addSplittingMetadata(batch, huId, metadata) {
 /**
  * Detect project info from the given directory.
  * @param {string} cwd - Directory to detect project from.
- * @returns {{ name: string, remoteUrl: string|null }}
+ * @returns {Promise<{ name: string, remoteUrl: string|null }>}
  */
-export function detectProject(cwd) {
+export async function detectProject(cwd) {
   const name = path.basename(cwd);
   let remoteUrl = null;
   try {
-    remoteUrl = execSync("git remote get-url origin", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+    remoteUrl = stdout.trim();
   } catch { /* not a git repo or no remote */ }
   return { name, remoteUrl };
 }
@@ -276,7 +280,7 @@ async function loadProjectBatch(projectDir) {
   try {
     const raw = await fs.readFile(filePath, "utf8");
     return JSON.parse(raw);
-  } catch {
+  } catch { /* no saved batch for this project */
     return {
       project: projectSlug(projectDir),
       created_at: new Date().toISOString(),

package/src/mcp/orphan-guard.js

@@ -8,7 +8,7 @@ export function setupOrphanGuard({ intervalMs = DEFAULT_INTERVAL_MS, exitFn = ()
   const timer = setInterval(() => {
     try {
       process.kill(parentPid, 0);
-    } catch {
+    } catch { /* parent process is gone */
       clearInterval(timer);
       exitFn();
     }

package/src/mcp/server-handlers.js

@@ -201,7 +201,7 @@ export function buildAskQuestion(server) {
         }
       });
       return result.action === "accept" ? result.content?.answer || null : null;
-    } catch {
+    } catch { /* elicitInput not supported by client */
       return null;
     }
   };
@@ -221,7 +221,7 @@ async function attemptAutoResume({ err, config, logger, emitter, askQuestion, ru
   let session;
   try {
     session = await loadMostRecentSession();
-  } catch {
+  } catch { /* no session store or read error */
     return null;
   }
   if (!session || !["failed", "stopped"].includes(session.status)) return null;
@@ -484,7 +484,7 @@ export async function handleCodeDirect(a, server, extra) {
   if (config.coder_rules) {
     try {
       coderRules = await fs.readFile(config.coder_rules, "utf8");
-    } catch {
+    } catch { /* configured coder_rules path not found */
       try { coderRules = await fs.readFile("coder-rules.md", "utf8"); } catch { /* no coder rules file */ }
     }
   }

package/src/mcp/suggest-handler.js

@@ -16,7 +16,7 @@ async function findActiveSession(projectDir) {
   let entries;
   try {
     entries = await fs.readdir(sessionRoot, { withFileTypes: true });
-  } catch {
+  } catch { /* session root dir may not exist */
     return null;
   }
 
@@ -29,7 +29,7 @@ async function findActiveSession(projectDir) {
       if (session.status !== "running") continue;
       if (projectDir && session.projectDir && session.projectDir !== projectDir) continue;
       return session;
-    } catch {
+    } catch { /* session.json missing or malformed */
       continue;
     }
   }

package/src/orchestrator/hu-sub-pipeline.js

@@ -205,7 +205,7 @@ export async function runHuSubPipeline({ huReviewerResult, runIterationFn, emitt
   let orderedIds;
   try {
     orderedIds = topologicalSort(certifiedStories);
-  } catch {
+  } catch { /* cyclic dependency */
     orderedIds = certifiedStories.map(s => s.id);
   }
 

package/src/orchestrator/pre-loop-stages.js

@@ -677,7 +677,7 @@ export async function runHuReviewerStage({ config, logger, emitter, eventBase, s
   let batch;
   try {
     batch = await loadHuBatch(batchSessionId);
-  } catch {
+  } catch { /* no existing batch */
     batch = await createHuBatch(batchSessionId, stories);
   }
 
@@ -881,7 +881,7 @@ export async function runHuReviewerStage({ config, logger, emitter, eventBase, s
   let orderedIds;
   try {
     orderedIds = topologicalSort(certifiedStories);
-  } catch {
+  } catch { /* cyclic dependency */
     orderedIds = certifiedStories.map(s => s.id);
   }
 

package/src/orchestrator/preflight-checks.js

@@ -13,16 +13,16 @@ import { checkBinary } from "../utils/agent-detect.js";
 import { isSonarReachable, sonarUp } from "../sonar/manager.js";
 import { runCommand } from "../utils/process.js";
 import { emitProgress, makeEvent } from "../utils/events.js";
-import { loadSonarCredentials } from "../sonar/credentials.js";
-
-function normalizeApiHost(rawHost) {
-  return String(rawHost || "http://localhost:9000").replace(/host\.docker\.internal/g, "localhost");
-}
+import {
+  resolveSonarHost,
+  resolveSonarToken,
+  resolveSonarCredentials,
+} from "../sonar/config-resolver.js";
 
 function parseJsonSafe(text) {
   try {
     return JSON.parse(text);
-  } catch {
+  } catch { /* invalid JSON */
     return null;
   }
 }
@@ -60,10 +60,10 @@ async function checkSonarReachable(host) {
 }
 
 async function checkSonarAuth(config) {
-  const host = normalizeApiHost(config.sonarqube?.host);
+  const host = resolveSonarHost(config.sonarqube?.host);
 
   // Check explicit token first
-  const explicitToken = process.env.KJ_SONAR_TOKEN || process.env.SONAR_TOKEN || config.sonarqube?.token;
+  const explicitToken = resolveSonarToken(config);
   if (explicitToken) {
     // Validate the token works
     const res = await runCommand("curl", [
@@ -77,20 +77,14 @@ async function checkSonarAuth(config) {
     }
   }
 
-  // Try admin credentials: env vars → config → ~/.karajan/sonar-credentials.json (NO default admin/admin)
-  const fileCreds = await loadSonarCredentials() || {};
-  const adminUser = process.env.KJ_SONAR_ADMIN_USER || config.sonarqube?.admin_user || fileCreds.user;
-  const candidates = [
-    process.env.KJ_SONAR_ADMIN_PASSWORD,
-    config.sonarqube?.admin_password,
-    fileCreds.password
-  ].filter(Boolean);
+  // Try admin credentials via centralized resolver
+  const { user: adminUser, passwords } = await resolveSonarCredentials(config);
 
-  if (!adminUser || candidates.length === 0) {
+  if (!adminUser || passwords.length === 0) {
     return { name: "sonar-auth", ok: false, detail: "No Sonar token or admin credentials configured. Set KJ_SONAR_TOKEN, configure sonarqube.token in kj.config.yml, or save credentials in ~/.karajan/sonar-credentials.json." };
   }
 
-  for (const password of [...new Set(candidates)]) {
+  for (const password of passwords) {
     const validateRes = await runCommand("curl", [
       "-sS", "-u", `${adminUser}:${password}`,
       `${host}/api/authentication/validate`
@@ -151,7 +145,7 @@ async function checkSecurityAgent(config) {
 export async function runPreflightChecks({ config, logger, emitter, eventBase, resolvedPolicies, securityEnabled }) {
   const sonarEnabled = Boolean(config.sonarqube?.enabled) && resolvedPolicies.sonar !== false;
   const isExternalSonar = Boolean(config.sonarqube?.external);
-  const sonarHost = normalizeApiHost(config.sonarqube?.host);
+  const sonarHost = resolveSonarHost(config.sonarqube?.host);
 
   const result = {
     ok: true,

package/src/plugins/loader.js

@@ -21,7 +21,7 @@ async function listPluginFiles(dir) {
     return entries
       .filter((e) => e.isFile() && e.name.endsWith(".js"))
       .map((e) => path.join(dir, e.name));
-  } catch {
+  } catch { /* plugin dir does not exist */
     return [];
   }
 }

package/src/prompts/architect.js

@@ -69,7 +69,7 @@ export function parseArchitectOutput(raw) {
   let parsed;
   try {
     parsed = JSON.parse(jsonMatch[0]);
-  } catch {
+  } catch { /* architect output is not valid JSON */
     return null;
   }
 

package/src/review/parser.js

@@ -47,7 +47,7 @@ export function parseJsonOutput(raw) {
   try {
     const parsed = JSON.parse(cleaned);
     return normalizeReviewPayload(parsed);
-  } catch {
+  } catch { /* not a single JSON blob */
     const lines = cleaned
       .split("\n")
       .map((x) => x.trim())
@@ -57,7 +57,7 @@ export function parseJsonOutput(raw) {
     for (const line of lines) {
       try {
         parsedLines.push(JSON.parse(line));
-      } catch {
+      } catch { /* line is not JSON */
         continue;
       }
     }
@@ -71,7 +71,7 @@ export function parseJsonOutput(raw) {
       try {
         const parsed = JSON.parse(lines[i]);
         return normalizeReviewPayload(parsed);
-      } catch {
+      } catch { /* line is not JSON */
         continue;
       }
     }

package/src/roles/architect-role.js

@@ -104,7 +104,7 @@ export class ArchitectRole extends BaseRole {
         summary: buildSummary(parsed),
         usage: result.usage
       };
-    } catch {
+    } catch { /* agent output is not structured JSON */
       return {
         ok: true,
         result: {

package/src/roles/audit-role.js

@@ -63,7 +63,7 @@ export class AuditRole extends BaseRole {
     let growthDelta = null;
     try {
       basalCost = await measureBasalCost(projectDir);
-      const previous = loadPreviousAudit(projectDir);
+      const previous = await loadPreviousAudit(projectDir);
       growthDelta = computeGrowthDelta(basalCost, previous);
     } catch {
       // basal cost is best-effort, don't fail the audit
@@ -95,7 +95,7 @@ export class AuditRole extends BaseRole {
       }
 
       if (basalCost) {
-        try { saveAuditSnapshot(projectDir, basalCost); } catch { /* best-effort */ }
+        try { await saveAuditSnapshot(projectDir, basalCost); } catch { /* best-effort */ }
       }
 
       return {
@@ -111,7 +111,7 @@ export class AuditRole extends BaseRole {
         summary: buildSummary(parsed),
         usage: result.usage
       };
-    } catch {
+    } catch { /* agent output is not structured JSON */
       return {
         ok: true,
         result: { raw: result.output, provider },

package/src/roles/base-role.js

@@ -35,7 +35,7 @@ async function loadFirstExisting(paths) {
   for (const p of paths) {
     try {
       return await fs.readFile(p, "utf8");
-    } catch {
+    } catch { /* file not found */
       continue;
     }
   }

package/src/roles/discover-role.js

@@ -115,7 +115,7 @@ export class DiscoverRole extends BaseRole {
         summary: buildSummary(parsed, mode),
         usage: result.usage
       };
-    } catch {
+    } catch { /* agent output is not structured JSON */
       return buildUnstructuredResult(result.output, mode, provider, result.usage);
     }
   }

package/src/roles/hu-reviewer-role.js

@@ -95,7 +95,7 @@ export class HuReviewerRole extends BaseRole {
         summary: buildSummary(parsed),
         usage: result.usage
       };
-    } catch {
+    } catch { /* agent output is not structured JSON */
       return {
         ok: true,
         result: {

package/src/roles/researcher-role.js

@@ -116,7 +116,7 @@ export class ResearcherRole extends BaseRole {
         },
         summary: buildSummary(parsed)
       };
-    } catch {
+    } catch { /* agent output is not structured JSON */
       return {
         ok: true,
         result: {

package/src/roles/triage-role.js

@@ -112,7 +112,7 @@ export class TriageRole extends BaseRole {
         summary: `Triage: ${level} (${roles.length} role${roles.length === 1 ? "" : "s"})${decomposeNote}`,
         usage: result.usage
       };
-    } catch {
+    } catch { /* agent output is not structured JSON */
       return {
         ok: true,
         result: {

package/src/session-cleanup.js

@@ -71,7 +71,7 @@ export async function cleanupExpiredSessions({ logger } = {}) {
   let entries;
   try {
     entries = await fs.readdir(sessionRoot, { withFileTypes: true });
-  } catch {
+  } catch { /* session root does not exist */
     return { removed: 0, errors: [] };
   }
 

package/src/session-store.js

@@ -67,14 +67,14 @@ export async function loadMostRecentSession() {
   let entries;
   try {
     entries = await fs.readdir(SESSION_ROOT, { withFileTypes: true });
-  } catch {
+  } catch { /* session root does not exist yet */
     return null;
   }
   const dirs = entries.filter(e => e.isDirectory()).map(e => e.name).sort();
   for (let i = dirs.length - 1; i >= 0; i--) {
     try {
       return await loadSession(dirs[i]);
-    } catch {
+    } catch { /* session.json missing or malformed */
       continue;
     }
   }

package/src/skills/openskills-client.js

@@ -22,7 +22,7 @@ export async function isOpenSkillsAvailable() {
       timeout: 15_000
     });
     return result.exitCode === 0;
-  } catch {
+  } catch { /* openskills CLI not available */
     return false;
   }
 }

package/src/skills/skill-detector.js

@@ -149,7 +149,7 @@ export async function autoInstallSkills(neededSkills, projectDir) {
       } else {
         result.failed.push(skillName);
       }
-    } catch {
+    } catch { /* skill install threw */
       result.failed.push(skillName);
     }
   }
@@ -178,7 +178,7 @@ export async function cleanupAutoInstalledSkills(skillNames, projectDir) {
       } else {
         result.failed.push(name);
       }
-    } catch {
+    } catch { /* skill removal threw */
       result.failed.push(name);
     }
   }

package/src/sonar/api.js

@@ -1,6 +1,7 @@
 import { runCommand } from "../utils/process.js";
 import { withRetry } from "../utils/retry.js";
 import { resolveSonarProjectKey } from "./project-key.js";
+import { resolveSonarToken } from "./config-resolver.js";
 
 export class SonarApiError extends Error {
   constructor(message, { url, httpStatus, hint } = {}) {
@@ -13,7 +14,7 @@ export class SonarApiError extends Error {
 }
 
 function tokenFromConfig(config) {
-  return process.env.KJ_SONAR_TOKEN || config.sonarqube.token || "";
+  return resolveSonarToken(config) || "";
 }
 
 function parseHttpResponse(stdout) {
@@ -73,7 +74,7 @@ export async function getQualityGateStatus(config, projectKey = null) {
   try {
     const parsed = JSON.parse(body);
     return { ok: true, status: parsed.projectStatus?.status || "ERROR", conditions: parsed.projectStatus?.conditions || [], raw: parsed };
-  } catch {
+  } catch { /* SonarQube response is not valid JSON */
     return { ok: false, status: "ERROR", conditions: [], raw: body };
   }
 }
@@ -85,7 +86,7 @@ export async function getOpenIssues(config, projectKey = null) {
   try {
     const parsed = JSON.parse(body);
     return { total: parsed.total || 0, issues: parsed.issues || [], raw: parsed };
-  } catch {
+  } catch { /* SonarQube response is not valid JSON */
     return { total: 0, issues: [], raw: body };
   }
 }

package/src/sonar/config-resolver.js

@@ -0,0 +1,69 @@
+/**
+ * Centralized SonarQube configuration resolution.
+ *
+ * Single source of truth for host URL, token, and admin credentials.
+ * Consumers: scanner.js, preflight-checks.js, api.js.
+ */
+
+import { loadSonarCredentials } from "./credentials.js";
+
+const DEFAULT_HOST = "http://localhost:9000";
+
+/**
+ * Normalize SonarQube host URL for API calls (replace Docker-internal hostname).
+ * @param {string|undefined} rawHost - Raw host from config or env
+ * @returns {string} Normalized host URL without trailing slash
+ */
+export function resolveSonarHost(rawHost) {
+  const host = String(rawHost || DEFAULT_HOST)
+    .replace(/host\.docker\.internal/g, "localhost")
+    .replace(/\/+$/, "");
+  return host;
+}
+
+/**
+ * Resolve SonarQube auth token from (in priority order):
+ *   1. KJ_SONAR_TOKEN env var
+ *   2. config.sonarqube.token
+ *   3. SONAR_TOKEN env var
+ *
+ * @param {object} [config={}] - Karajan config object
+ * @returns {string|null} Token string or null if none found
+ */
+export function resolveSonarToken(config = {}) {
+  const token =
+    process.env.KJ_SONAR_TOKEN ||
+    config.sonarqube?.token ||
+    process.env.SONAR_TOKEN ||
+    null;
+  return token || null;
+}
+
+/**
+ * Resolve SonarQube admin credentials from (in priority order):
+ *   1. Env vars: KJ_SONAR_ADMIN_USER / KJ_SONAR_ADMIN_PASSWORD
+ *   2. Config: sonarqube.admin_user / sonarqube.admin_password
+ *   3. Credentials file: ~/.karajan/sonar-credentials.json
+ *
+ * Returns all candidate passwords (de-duped) so callers can try each.
+ *
+ * @param {object} [config={}] - Karajan config object
+ * @returns {Promise<{ user: string|null, passwords: string[] }>}
+ */
+export async function resolveSonarCredentials(config = {}) {
+  const fileCreds = (await loadSonarCredentials()) || {};
+
+  const user =
+    process.env.KJ_SONAR_ADMIN_USER ||
+    config.sonarqube?.admin_user ||
+    fileCreds.user ||
+    null;
+
+  const candidates = [
+    process.env.KJ_SONAR_ADMIN_PASSWORD,
+    config.sonarqube?.admin_password,
+    fileCreds.password,
+  ].filter(Boolean);
+
+  return { user, passwords: [...new Set(candidates)] };
+}

package/src/sonar/credentials.js

@@ -25,7 +25,7 @@ export async function loadSonarCredentials() {
       user: data.user || null,
       password: data.password || null
     };
-  } catch {
+  } catch { /* credentials file may not exist */
     return { user: null, password: null };
   }
 }

package/src/sonar/project-key.js

@@ -30,7 +30,7 @@ function parseUrlLikeRemote(remoteUrl) {
   try {
     const parsed = new URL(String(remoteUrl || "").trim());
     return { host: parsed.hostname, path: parsed.pathname.replace(/^\/+/, "") };
-  } catch {
+  } catch { /* not a valid URL */
     return null;
   }
 }

package/src/sonar/scanner.js

@@ -4,7 +4,11 @@ import path from "node:path";
 import { runCommand } from "../utils/process.js";
 import { sonarUp } from "./manager.js";
 import { resolveSonarProjectKey } from "./project-key.js";
-import { loadSonarCredentials } from "./credentials.js";
+import {
+  resolveSonarHost,
+  resolveSonarToken as resolveToken,
+  resolveSonarCredentials,
+} from "./config-resolver.js";
 
 export function buildScannerOpts(projectKey, scanner = {}) {
   const opts = [`-Dsonar.projectKey=${projectKey}`];
@@ -45,15 +49,11 @@ function normalizeScannerConfig(scanner = {}) {
 function parseJsonSafe(text) {
   try {
     return JSON.parse(text);
-  } catch {
+  } catch { /* invalid JSON */
     return null;
   }
 }
 
-function normalizeApiHost(rawHost) {
-  return String(rawHost || "http://localhost:9000").replaceAll("host.docker.internal", "localhost");
-}
-
 async function validateAdminCredentials(host, user, password) {
   const res = await runCommand("curl", [
     "-sS",
@@ -133,22 +133,14 @@ async function maybeRunCoverage(config) {
   return checkLcovExists(lcovPath, blockOnFailure, run.stdout || "");
 }
 
-async function resolveSonarToken(config, apiHost) {
-  const explicitToken = process.env.KJ_SONAR_TOKEN || process.env.SONAR_TOKEN || config.sonarqube.token;
+async function resolveSonarTokenWithFallback(config, apiHost) {
+  const explicitToken = resolveToken(config);
   if (explicitToken) return explicitToken;
 
-  // Resolve admin credentials from: env vars → config → ~/.karajan/sonar-credentials.json
-  const fileCreds = await loadSonarCredentials() || {};
-  const adminUser = process.env.KJ_SONAR_ADMIN_USER || config.sonarqube.admin_user || fileCreds.user;
-  const candidates = [
-    process.env.KJ_SONAR_ADMIN_PASSWORD,
-    config.sonarqube.admin_password,
-    fileCreds.password
-  ].filter(Boolean);
-
-  if (!adminUser || candidates.length === 0) return null;
+  const { user: adminUser, passwords } = await resolveSonarCredentials(config);
+  if (!adminUser || passwords.length === 0) return null;
 
-  for (const password of new Set(candidates)) {
+  for (const password of passwords) {
     const valid = await validateAdminCredentials(apiHost, adminUser, password);
     if (!valid) continue;
     const token = await generateUserToken(apiHost, adminUser, password);
@@ -205,7 +197,7 @@ export async function runSonarScan(config, projectKey = null) {
     ? Number(sonarConfig.timeouts.scanner_ms)
     : 15 * 60 * 1000;
   const sonarNetwork = sonarConfig.network || "karajan_sonar_net";
-  const apiHost = normalizeApiHost(rawHost);
+  const apiHost = resolveSonarHost(rawHost);
   const isLocalHost = /localhost|127\.0\.0\.1/.test(rawHost);
   const host = isLocalHost ? rawHost.replaceAll(/localhost|127\.0\.0\.1/g, "host.docker.internal") : rawHost;
 
@@ -219,7 +211,7 @@ export async function runSonarScan(config, projectKey = null) {
     };
   }
   await ensureSonarProjectProperties();
-  const token = await resolveSonarToken(config, apiHost);
+  const token = await resolveSonarTokenWithFallback(config, apiHost);
   if (!token) {
     return {
       ok: false,

package/src/utils/fs.js

@@ -9,7 +9,7 @@ export async function exists(filePath) {
   try {
     await fs.access(filePath);
     return true;
-  } catch {
+  } catch { /* file does not exist */
     return false;
   }
 }

package/src/utils/json-extract.js

@@ -54,7 +54,7 @@ export function extractFirstJson(raw) {
     if (depth === 0) {
       try {
         return JSON.parse(str.substring(start, i + 1));
-      } catch {
+      } catch { /* matched braces but not valid JSON */
         return null;
       }
     }

package/src/utils/project-detect.js

@@ -120,7 +120,7 @@ export async function detectSonarConfig(cwd = process.cwd()) {
   try {
     await fs.access(path.join(cwd, "sonar-project.properties"));
     return { configured: true };
-  } catch {
+  } catch { /* sonar-project.properties does not exist */
     return { configured: false };
   }
 }

package/src/utils/rtk-detect.js

@@ -12,7 +12,7 @@ export async function detectRtk() {
       return { available: true, version };
     }
     return { available: false, version: null };
-  } catch {
+  } catch { /* rtk binary not found */
     return { available: false, version: null };
   }
 }