karajan-code 2.10.1 → 2.11.0

package/README.md

@@ -23,7 +23,11 @@
 
 ---
 
-> **v2.10.1 released** — Patch release. One-line fix for a stdout contamination bug in `kj audit --agent-readiness --json` (the `[info]` banner was breaking downstream `jq` pipes), plus polish in the asciinema demo scripts. Safe upgrade from 2.10.0.
+> **v2.11.0 released** — Dogfooding pass release. Two-day pass through a 10-level test plan surfaced and fixed a long tail of UX papercuts and three latent bugs that only show up on fresh `/tmp` repos: the `SonarStage` no longer loops on remoteless projects (was burning iterations until `max_iterations`-fallback-approval), the post-loop `commitAll` now tolerates the locale-specific "nothing to commit" race, the HU sub-pipeline branches off `master`/`HEAD` when the configured `main` doesn't exist, and `runFlow` now seals `session.status` at the boundary so `kj status` never shows zombi `running` runs again. Plus `hu-board` gains automatic ephemeral-project cleanup and an in-UI help modal for the five views. 14 PRs (#624–#637), 4452/4452 tests passing. Safe upgrade from 2.10.2.
+>
+> **v2.10.2** — Patch release. `kj init` wizard expanded from 9 prompts to a full setup: per-role provider selection (10 roles, "inherit / pick CLI / disable"), automatic SonarQube token generation via REST API (no more web UI walkthrough), git automation flags (`auto_commit/push/pr`) and HU Board security (bind host + port). +16 new tests. Safe upgrade from 2.10.1.
+>
+> **v2.10.1** — Patch release. One-line fix for a stdout contamination bug in `kj audit --agent-readiness --json` (the `[info]` banner was breaking downstream `jq` pipes), plus polish in the asciinema demo scripts. Safe upgrade from 2.10.0.
 >
 > **v2.10.0** — Agent-readiness release. Karajan is now the first orchestrator with a full agent-readability surface: an `llms.txt` index at the root, a `SKILL.md` per CLI command under `docs/agents/`, and a static auditor that scores any third-party repo against the same shape. Highlights: (1) **`kj audit --agent-readiness`** scores any repo 0–100 across seven checks (llms.txt, robots AI-bot allowlist, page token budgets ≤ 32 KB, heading hierarchy, agents/README, SKILL.md coverage). LLM-free, deterministic, JSON-able. Karajan-on-Karajan: **100/100**. (2) **Six new SKILL.md files** (`kj doctor / init / board / review / resume / clean`) under `docs/agents/`, all with the same `What it does · Inputs · Outputs · Side effects · Failure modes · Example` contract; CI guards every link in `llms.txt` resolves. (3) **Webperf quality gate inside the iteration loop** (`pipeline.perf.enabled`): PASS continues, FAIL pushes blocking-metric feedback to the coder, scanner-missing skips best-effort. (4) **HU Board hardening**: binds 127.0.0.1 by default, opt-in `--bind 0.0.0.0` enforces an auto-generated token, helmet headers, rate limiting at 300 req/min — "safe by default on a coffee-shop WiFi". (5) **a11y skills auto-route**: tasks mentioning `accessibility / WCAG / ARIA / screen reader / keyboard nav` automatically pull the `frontend-ui-engineering` skill. (6) **Asciinema demo scripts** under `docs/demos/` so the recordings re-record per release instead of rotting. 5 PRs merged (#605–#609 + #610), 4358/4358 tests passing. See [CHANGELOG.md](./CHANGELOG.md) for the full punch list.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "2.10.1",
+  "version": "2.11.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/audit/sonar-findings.js

@@ -22,6 +22,7 @@
 
 import { isSonarReachable } from "../sonar/manager.js";
 import { getOpenIssues, getQualityGateStatus } from "../sonar/api.js";
+import { canResolveSonarProjectKey } from "../sonar/project-key.js";
 
 /**
  * Collect deterministic Sonar findings for the audit prompt.
@@ -43,6 +44,17 @@ export async function collectSonarFindings(config, logger = null) {
     return { available: false, reason: `sonar host ${host} not reachable` };
   }
 
+  // No git remote and no explicit project_key → silent skip. This is the
+  // typical `kj run` in a fresh /tmp/... folder. Reporting it as a
+  // warning treats it like an error (which it isn't — sonar simply
+  // doesn't apply to a remoteless repo).
+  if (!(await canResolveSonarProjectKey(config))) {
+    return {
+      available: false,
+      reason: "not applicable: no git remote and no sonarqube.project_key configured",
+    };
+  }
+
   let issuesResult;
   try {
     issuesResult = await getOpenIssues(config);

package/src/cli/register-meta.js

@@ -24,7 +24,7 @@ export function registerMeta(program, { pkgVersion }) {
   program
     .command("discover")
     .description("Analyze task for gaps, ambiguities and missing info")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--mode <name>", "Discovery mode: gaps|momtest|wendel|classify|jtbd", "gaps")
     .option("--discover <name>", "Override discover agent")
@@ -41,7 +41,7 @@ export function registerMeta(program, { pkgVersion }) {
   program
     .command("triage")
     .description("Classify task complexity and recommend pipeline roles")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--triage <name>", "Override triage agent")
     .option("--triage-model <name>", "Override triage model")
@@ -57,7 +57,7 @@ export function registerMeta(program, { pkgVersion }) {
   program
     .command("researcher")
     .description("Research codebase for a task (files, patterns, constraints)")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--researcher <name>", "Override researcher agent")
     .option("--researcher-model <name>", "Override researcher model")
@@ -72,7 +72,7 @@ export function registerMeta(program, { pkgVersion }) {
   program
     .command("architect")
     .description("Design solution architecture (layers, patterns, contracts)")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--architect <name>", "Override architect agent")
     .option("--architect-model <name>", "Override architect model")

package/src/cli/register-pipeline.js

@@ -40,7 +40,7 @@ export function registerPipeline(program, { pkgVersion }) {
   program
     .command("run")
     .description("Run coder+sonar+reviewer loop")
-    .argument("[task]", "Task description (or use --task-file to read from a .md file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md). Alternative to the positional task argument.")
     .option("-y, --yes", "Skip the cwd confirmation prompt (CI / scripted runs).")
     .option("--planner <name>")
@@ -135,7 +135,7 @@ export function registerPipeline(program, { pkgVersion }) {
   program
     .command("code")
     .description("Run only coder")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--coder <name>")
     .option("--coder-model <name>")
@@ -150,7 +150,7 @@ export function registerPipeline(program, { pkgVersion }) {
   program
     .command("review")
     .description("Run only reviewer")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--reviewer <name>")
     .option("--reviewer-model <name>")

package/src/cli/register-plan.js

@@ -26,7 +26,7 @@ export function registerPlan(program, { pkgVersion }) {
   plan
     .command("generate", { isDefault: true })
     .description("Generate implementation plan with HUs")
-    .argument("[task]", "Task description (or use --task-file)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--planner <name>")
     .option("--planner-model <name>")

package/src/commands/board.js

@@ -126,14 +126,29 @@ export async function startBoard(desiredPort = 4000, opts = {}) {
   const karajanHome = getKarajanHome();
   fs.mkdirSync(karajanHome, { recursive: true });
 
+  // Open a log file for the daemon. Pre-fix the daemon was spawned
+  // with `stdio: "ignore"`, so every `console.log` from server.js
+  // (including the new [zombie-reaper] messages) went straight to
+  // /dev/null and the user had no way to see what was happening.
+  // The file is opened in append-only mode so successive starts
+  // don't truncate the history.
+  const logPath = path.join(karajanHome, "hu-board.log");
+  const logFd = fs.openSync(logPath, "a");
+  fs.writeSync(
+    logFd,
+    `\n--- kj board start at ${new Date().toISOString()} (port ${port}, bind ${bind}) ---\n`,
+  );
+
   // Use process.execPath (absolute path to current node binary) instead of "node".
   // Fixes ENOENT on nvm setups where `node` is not in the spawned process's PATH.
   const child = spawn(process.execPath, [serverPath], {
     env: { ...process.env, PORT: String(port), BIND_HOST: bind },
     detached: true,
-    stdio: "ignore",
+    stdio: ["ignore", logFd, logFd],
     cwd: BOARD_DIR
   });
+  // The parent doesn't need the fd anymore — the child inherited it.
+  fs.closeSync(logFd);
   // Swallow spawn errors so an HU Board failure never crashes the pipeline.
   child.on("error", () => { /* non-blocking — caller logs via tryAutoStartBoard catch */ });
   if (!child.pid) {
@@ -143,10 +158,16 @@ export async function startBoard(desiredPort = 4000, opts = {}) {
   // Detach for real: `detached: true` only sets up the new session;
   // without `unref()` the parent's event loop still holds a reference
   // to the child handle and `kj board start` hangs at the prompt
-  // instead of returning. Pair this with stdio:"ignore" (already set)
-  // to ensure the parent isn't waiting on any of the child's pipes.
+  // instead of returning.
   child.unref();
-  return { ok: true, alreadyRunning: false, pid: child.pid, url: buildBoardUrl(port, projectSlug), port };
+  return {
+    ok: true,
+    alreadyRunning: false,
+    pid: child.pid,
+    url: buildBoardUrl(port, projectSlug),
+    port,
+    logPath,
+  };
 }
 
 export async function stopBoard(opts = {}) {
@@ -273,6 +294,9 @@ export async function boardCommand({ action = "start", port = 4000, bind = "127.
         logger.info(`HU Board already running (PID ${result.pid}) at ${result.url}`);
       } else {
         logger.info(`HU Board started (PID ${result.pid}) at ${result.url}`);
+        if (result.logPath) {
+          logger.info(`Daemon logs: tail -f ${result.logPath}`);
+        }
         if (bind !== "127.0.0.1" && bind !== "localhost") {
           logger.warn(`HU Board bound to ${bind} — token auth enforced for non-loopback peers. Token: ~/.karajan/hu-board/token`);
         }

package/src/commands/init.js

@@ -13,6 +13,200 @@ import { detectOsLocale, SUPPORTED_LANGUAGES } from "../utils/locale.js";
 import { detectRtk } from "../utils/rtk-detect.js";
 import { installRtk } from "../utils/rtk-install.js";
 import { detectProjectStack } from "../utils/stack-detect.js";
+import { bootstrapSonarToken } from "../sonar/token-bootstrap.js";
+
+/**
+ * Roles asked individually after coder/reviewer. Each entry:
+ *   - key: config.roles.<key>.provider
+ *   - pipelineKey: config.pipeline.<key>.enabled (omit when not gated by a flag)
+ *   - default: which role's CLI to inherit ("coder" | "reviewer")
+ *   - allowDisable: true if "off" is a valid choice
+ *
+ * Order matters — keep the most-impactful first so the wizard never hides
+ * critical roles behind a long tail of opt-ins.
+ */
+const PER_ROLE_QUESTIONS = [
+  { key: "planner",     pipelineKey: "planner",     default: "coder",    allowDisable: true,  label: "Planner (decomposes complex tasks into HUs)" },
+  { key: "researcher",  pipelineKey: "researcher",  default: "coder",    allowDisable: true,  label: "Researcher (explores codebase before coding)" },
+  { key: "architect",   pipelineKey: "architect",   default: "coder",    allowDisable: true,  label: "Architect (designs solution + contracts)" },
+  { key: "tester",      pipelineKey: "tester",      default: "coder",    allowDisable: false, label: "Tester (verifies tests + coverage)" },
+  { key: "security",    pipelineKey: "security",    default: "coder",    allowDisable: false, label: "Security (OWASP audit)" },
+  { key: "solomon",     pipelineKey: "solomon",     default: "reviewer", allowDisable: false, label: "Solomon (judge AI for dilemmas)" },
+  { key: "refactorer",  pipelineKey: "refactorer",  default: "coder",    allowDisable: true,  label: "Refactorer (clarity passes)" },
+  { key: "impeccable",  pipelineKey: "impeccable",  default: "coder",    allowDisable: true,  label: "Impeccable (UI/UX audit — frontend only)" },
+  { key: "perf",        pipelineKey: "perf",        default: "coder",    allowDisable: true,  label: "Perf (Core Web Vitals gate — frontend only)" },
+  { key: "hu_reviewer", pipelineKey: "hu_reviewer", default: "reviewer", allowDisable: true,  label: "HU Reviewer (mandatory user-story certification)" },
+];
+
+// ---- Sub-asks ----
+
+async function askAgents(wizard, available, config, logger) {
+  if (available.length === 1) {
+    const only = available[0].name;
+    logger.info(`Only one agent available: ${only}. Using it for all roles.\n`);
+    config.coder = only;
+    config.reviewer = only;
+    config.roles.coder.provider = only;
+    config.roles.reviewer.provider = only;
+    return { coder: only, reviewer: only };
+  }
+
+  const agentOptions = available.map((a) => ({
+    label: `${a.name} (${a.version})`,
+    value: a.name,
+    available: true,
+  }));
+
+  const coder = await wizard.select("Select default CODER agent:", agentOptions);
+  config.coder = coder;
+  config.roles.coder.provider = coder;
+  logger.info(`  -> Coder: ${coder}`);
+
+  const reviewer = await wizard.select("Select default REVIEWER agent:", agentOptions);
+  config.reviewer = reviewer;
+  config.roles.reviewer.provider = reviewer;
+  logger.info(`  -> Reviewer: ${reviewer}`);
+
+  return { coder, reviewer };
+}
+
+/**
+ * For each non-coder/non-reviewer role, ask: use coder default | use reviewer
+ * default | pick a specific CLI | (when allowed) disable. The choice is
+ * persisted as `config.roles.<role>.provider` (null means "inherit from
+ * coder" at runtime). Pipeline-flag-gated roles also flip
+ * `config.pipeline.<role>.enabled`.
+ *
+ * `available.length === 1` short-circuits: every role uses the only CLI
+ * available, no point asking.
+ */
+async function askPerRoleProviders(wizard, available, config, { coder, reviewer }, logger) {
+  if (available.length <= 1) return;
+
+  logger.info("");
+  logger.info("Configure provider per role (Enter accepts the default):");
+
+  // Make sure containers exist for every role/pipeline key we touch —
+  // older configs may have a sparser shape than DEFAULTS.
+  config.roles = config.roles || {};
+  config.pipeline = config.pipeline || {};
+
+  for (const role of PER_ROLE_QUESTIONS) {
+    config.roles[role.key] = config.roles[role.key] || { provider: null, model: null };
+    if (role.pipelineKey) {
+      config.pipeline[role.pipelineKey] = config.pipeline[role.pipelineKey] || { enabled: false };
+    }
+
+    const defaultLabel = role.default === "coder" ? `coder (${coder})` : `reviewer (${reviewer})`;
+    const baseOptions = [
+      { label: `Use ${defaultLabel} — default`, value: "__default__", available: true },
+    ];
+    for (const a of available) {
+      if ((role.default === "coder" && a.name === coder) || (role.default === "reviewer" && a.name === reviewer)) continue;
+      baseOptions.push({ label: a.name, value: a.name, available: true });
+    }
+    if (role.allowDisable) {
+      baseOptions.push({ label: "Disable role", value: "__disabled__", available: true });
+    }
+
+    const choice = await wizard.select(`  ${role.label}:`, baseOptions);
+
+    if (choice === "__disabled__") {
+      if (role.pipelineKey) config.pipeline[role.pipelineKey].enabled = false;
+      logger.info(`    -> ${role.key}: disabled`);
+    } else if (choice === "__default__") {
+      // Inherit from coder/reviewer at runtime — leave provider null.
+      config.roles[role.key].provider = null;
+      if (role.pipelineKey) config.pipeline[role.pipelineKey].enabled = true;
+      logger.info(`    -> ${role.key}: ${defaultLabel}`);
+    } else {
+      config.roles[role.key].provider = choice;
+      if (role.pipelineKey) config.pipeline[role.pipelineKey].enabled = true;
+      logger.info(`    -> ${role.key}: ${choice}`);
+    }
+  }
+}
+
+async function askMethodology(wizard, config, logger) {
+  const methodology = await wizard.select("Development methodology:", [
+    { label: "TDD (test-driven development)", value: "tdd", available: true },
+    { label: "Standard (no TDD enforcement)", value: "standard", available: true },
+  ]);
+  config.development.methodology = methodology;
+  config.development.require_test_changes = methodology === "tdd";
+  logger.info(`  -> Methodology: ${methodology}`);
+}
+
+async function askLanguages(wizard, config, logger) {
+  const detectedLocale = detectOsLocale();
+  const allLangEntries = Object.entries(SUPPORTED_LANGUAGES).map(([code, name]) => ({
+    label: `${name} (${code})`,
+    value: code,
+    available: true,
+  }));
+  const languageOptions = [
+    ...allLangEntries.filter((o) => o.value === detectedLocale),
+    ...allLangEntries.filter((o) => o.value !== detectedLocale),
+  ];
+
+  const pipelineLang = await wizard.select("Pipeline language:", languageOptions);
+  config.language = pipelineLang;
+  logger.info(`  -> Pipeline language: ${pipelineLang}`);
+
+  const huLangOptions = [
+    ...allLangEntries.filter((o) => o.value === pipelineLang),
+    ...allLangEntries.filter((o) => o.value !== pipelineLang),
+  ];
+  const huLang = await wizard.select("HU language (for user stories):", huLangOptions);
+  config.hu_language = huLang;
+  logger.info(`  -> HU language: ${huLang}`);
+}
+
+async function askGitAutomation(wizard, config, logger) {
+  config.git = config.git || {};
+  const autoCommit = await wizard.confirm("Auto-commit per HU? (recommended for `kj run` so commits show up in git log)", false);
+  config.git.auto_commit = autoCommit;
+  logger.info(`  -> auto_commit: ${autoCommit}`);
+
+  const autoPush = await wizard.confirm("Auto-push to remote after each commit?", false);
+  config.git.auto_push = autoPush;
+  logger.info(`  -> auto_push: ${autoPush}`);
+
+  const autoPr = await wizard.confirm("Auto-open a Pull Request when the run finishes?", false);
+  config.git.auto_pr = autoPr;
+  logger.info(`  -> auto_pr: ${autoPr}`);
+
+  // Branch prefix only worth asking when auto_commit is on; otherwise leave default.
+  if (autoCommit) {
+    const prefix = await wizard.ask("Branch prefix (e.g. feat/, kj/, ai/) [feat/]: ");
+    config.git.branch_prefix = (prefix && prefix.trim()) || "feat/";
+    logger.info(`  -> branch_prefix: ${config.git.branch_prefix}`);
+  }
+}
+
+async function askBoardSecurity(wizard, config, logger) {
+  if (!config.hu_board?.enabled) return;
+
+  const bindChoice = await wizard.select(
+    "HU Board bind host:",
+    [
+      { label: "127.0.0.1 (loopback only — recommended for personal laptops)", value: "127.0.0.1", available: true },
+      { label: "0.0.0.0 (LAN exposure — token auth auto-enforced for non-loopback peers)", value: "0.0.0.0", available: true },
+    ],
+  );
+  config.hu_board.bind = bindChoice;
+  logger.info(`  -> HU Board bind: ${bindChoice}`);
+
+  if (bindChoice === "0.0.0.0") {
+    logger.info("     A secret token will be auto-generated on first start at ~/.karajan/hu-board/token (mode 0600).");
+    logger.info("     Open the URL printed by `kj board start` to grab it.");
+  }
+
+  const portInput = await wizard.ask("HU Board port [4000]: ");
+  const port = Number.parseInt(portInput, 10);
+  config.hu_board.port = Number.isFinite(port) && port > 0 && port < 65536 ? port : 4000;
+  logger.info(`  -> HU Board port: ${config.hu_board.port}`);
+}
 
 async function runWizard(config, logger) {
   const agents = await detectAvailableAgents();
@@ -41,30 +235,7 @@ async function runWizard(config, logger) {
 
   const wizard = createWizard();
   try {
-    if (available.length === 1) {
-      const only = available[0].name;
-      logger.info(`Only one agent available: ${only}. Using it for all roles.\n`);
-      config.coder = only;
-      config.reviewer = only;
-      config.roles.coder.provider = only;
-      config.roles.reviewer.provider = only;
-    } else {
-      const agentOptions = available.map((a) => ({
-        label: `${a.name} (${a.version})`,
-        value: a.name,
-        available: true
-      }));
-
-      const coder = await wizard.select("Select default CODER agent:", agentOptions);
-      config.coder = coder;
-      config.roles.coder.provider = coder;
-      logger.info(`  -> Coder: ${coder}`);
-
-      const reviewer = await wizard.select("Select default REVIEWER agent:", agentOptions);
-      config.reviewer = reviewer;
-      config.roles.reviewer.provider = reviewer;
-      logger.info(`  -> Reviewer: ${reviewer}`);
-    }
+    const { coder, reviewer } = await askAgents(wizard, available, config, logger);
 
     const enableTriage = await wizard.confirm("Enable triage (auto-classify task complexity)?", false);
     config.pipeline.triage = config.pipeline.triage || {};
@@ -84,38 +255,19 @@ async function runWizard(config, logger) {
     }
     logger.info(`  -> HU Board: ${enableHuBoard ? "enabled (auto-start on kj run)" : "disabled"}`);
 
-    const methodology = await wizard.select("Development methodology:", [
-      { label: "TDD (test-driven development)", value: "tdd", available: true },
-      { label: "Standard (no TDD enforcement)", value: "standard", available: true }
-    ]);
-    config.development.methodology = methodology;
-    config.development.require_test_changes = methodology === "tdd";
-    logger.info(`  -> Methodology: ${methodology}`);
-
-    const detectedLocale = detectOsLocale();
-    const allLangEntries = Object.entries(SUPPORTED_LANGUAGES).map(([code, name]) => ({
-      label: `${name} (${code})`,
-      value: code,
-      available: true
-    }));
-    // Put detected locale first so it becomes the default selection
-    const languageOptions = [
-      ...allLangEntries.filter((o) => o.value === detectedLocale),
-      ...allLangEntries.filter((o) => o.value !== detectedLocale)
-    ];
+    await askPerRoleProviders(wizard, available, config, { coder, reviewer }, logger);
+    await askMethodology(wizard, config, logger);
+    await askLanguages(wizard, config, logger);
 
-    const pipelineLang = await wizard.select("Pipeline language:", languageOptions);
-    config.language = pipelineLang;
-    logger.info(`  -> Pipeline language: ${pipelineLang}`);
+    logger.info("");
+    logger.info("Git automation:");
+    await askGitAutomation(wizard, config, logger);
 
-    // Reorder for HU language with pipeline language as default
-    const huLangOptions = [
-      ...allLangEntries.filter((o) => o.value === pipelineLang),
-      ...allLangEntries.filter((o) => o.value !== pipelineLang)
-    ];
-    const huLang = await wizard.select("HU language (for user stories):", huLangOptions);
-    config.hu_language = huLang;
-    logger.info(`  -> HU language: ${huLang}`);
+    if (enableHuBoard) {
+      logger.info("");
+      logger.info("HU Board security:");
+      await askBoardSecurity(wizard, config, logger);
+    }
 
     logger.info("");
   } finally {
@@ -125,6 +277,22 @@ async function runWizard(config, logger) {
   return config;
 }
 
+/**
+ * Backwards-compatible alias for `writeConfig`. Pre-KJC-BUG-0036 this
+ * wrapper was the *only* writer that stripped `sonarqube.enabled`
+ * before serialising — we needed it because the global `writeConfig`
+ * would happily persist the wizard's transient hint. KJC-BUG-0036
+ * moved that strip (and the equivalent `_deprecated` strip) into
+ * `writeConfig` itself, so this is now a thin alias kept around to
+ * keep callers and tests stable. Prefer `writeConfig` in new code.
+ *
+ * @param {string} configPath
+ * @param {object} config
+ */
+export async function writeInitConfig(configPath, config) {
+  await writeConfig(configPath, config);
+}
+
 async function handleConfigSetup({ config, configExists, interactive, configPath, logger }) {
   if (configExists && interactive) {
     const wizard = createWizard();
@@ -132,7 +300,7 @@ async function handleConfigSetup({ config, configExists, interactive, configPath
       const reconfigure = await wizard.confirm("Config already exists. Reconfigure?", false);
       if (reconfigure) {
         const updated = await runWizard(config, logger);
-        await writeConfig(configPath, updated);
+        await writeInitConfig(configPath, updated);
         logger.info(`Updated ${configPath}`);
       } else {
         logger.info("Keeping existing config.");
@@ -142,10 +310,10 @@ async function handleConfigSetup({ config, configExists, interactive, configPath
     }
   } else if (!configExists && interactive) {
     const updated = await runWizard(config, logger);
-    await writeConfig(configPath, updated);
+    await writeInitConfig(configPath, updated);
     logger.info(`Created ${configPath}`);
   } else if (!configExists) {
-    await writeConfig(configPath, config);
+    await writeInitConfig(configPath, config);
     logger.info(`Created ${configPath}`);
   }
 }
@@ -182,7 +350,7 @@ async function ensureCoderRules(coderRulesPath, logger) {
   logger.info("Created .karajan/coder-rules.md");
 }
 
-async function setupSonarQube(config, logger) {
+async function setupSonarQube(config, logger, { interactive } = {}) {
   if (config.sonarqube?.enabled === false) {
     logger.info("SonarQube disabled — skipping container setup.");
     return;
@@ -212,8 +380,32 @@ async function setupSonarQube(config, logger) {
   }
 
   logger.info("SonarQube container started");
+
+  // KJC-TSK-0367: try to bootstrap the analysis token automatically. The
+  // bootstrapper logs in with admin/admin, rotates the password if it's
+  // still the default, and POSTs to /api/user_tokens/generate. On 401 or
+  // any other failure, we fall back to the manual flow that was the only
+  // option before this card.
+  if (interactive) {
+    logger.info("Bootstrapping SonarQube token automatically...");
+    const result = await bootstrapSonarToken({
+      host: config.sonarqube.host || "http://localhost:9000",
+      configPath: getConfigPath(),
+    });
+    if (result.ok) {
+      config.sonarqube.token = result.token;
+      logger.info(`  -> Sonar token saved to ${result.savedTo}`);
+      if (result.passwordRotated) {
+        logger.info(`  -> Sonar admin password rotated. New value at ${result.passwordSavedTo}`);
+      }
+      return;
+    }
+    logger.warn(`Could not auto-generate Sonar token: ${result.reason}`);
+    logger.info("Falling back to manual flow:");
+  }
+
   logger.info("");
-  logger.info("To configure the SonarQube token:");
+  logger.info("To configure the SonarQube token manually:");
   logger.info("  1. Open http://localhost:9000");
   logger.info("  2. Log in (default credentials: admin / admin)");
   logger.info("  3. Go to: My Account > Security > Generate Token");
@@ -385,7 +577,7 @@ export async function initCommand({ logger, flags = {} }) {
       config.development.methodology = config.development.methodology || "tdd";
     }
 
-    await writeConfig(configPath, config);
+    await writeInitConfig(configPath, config);
   } else {
     logger.info("No project stack detected — using default configuration.");
   }
@@ -402,9 +594,15 @@ export async function initCommand({ logger, flags = {} }) {
     }
   }
 
-  await setupSonarQube(config, logger);
+  await setupSonarQube(config, logger, { interactive });
   await scaffoldCiGateway(config, flags, logger);
 
+  // Persist any changes setupSonarQube made (token, etc.) back to disk.
+  // Use writeInitConfig so the deprecated `sonarqube.enabled` key —
+  // which setupSonarQube still mutates as an in-memory hint — never
+  // reaches the YAML file.
+  await writeInitConfig(configPath, config);
+
   // Telemetry: anonymous install event (non-blocking)
   const { sendTelemetryEvent } = await import("../utils/telemetry.js");
   const { readFileSync } = await import("node:fs");
@@ -416,3 +614,14 @@ export async function initCommand({ logger, flags = {} }) {
     sendTelemetryEvent("install", { version }, config).catch(() => {});
   } catch { /* non-blocking */ }
 }
+
+// Internal exports for unit testing (KJC-TSK-0367)
+export const __test__ = {
+  askAgents,
+  askPerRoleProviders,
+  askMethodology,
+  askLanguages,
+  askGitAutomation,
+  askBoardSecurity,
+  PER_ROLE_QUESTIONS,
+};

package/src/config/loader.js

@@ -128,9 +128,40 @@ export async function loadConfig(projectDir) {
   return { config: merged, path: configPath, exists: globalExists, hasProjectConfig: !!projectConfig };
 }
 
+/**
+ * Runtime-only keys that the loader synthesises on every load (or that
+ * a wizard uses as transient in-memory hints). They MUST NOT survive
+ * to the on-disk YAML — otherwise the `kj run` deprecation warning
+ * fossilises (KJC-BUG-0036, observed in dogfooding 2026-05-07: the
+ * `_deprecated.sonarqubeEnabledKey: true` block ended up baked into
+ * `~/.karajan/kj.config.yml` and re-fired the warning on every run
+ * even after the user cleaned `sonarqube.enabled`).
+ *
+ * Pure: returns a shallow-copied config without the runtime keys —
+ * the caller's object is left untouched.
+ */
+function stripRuntimeOnlyKeys(config) {
+  if (!config || typeof config !== "object") return config;
+  const out = { ...config };
+  // _deprecated is loader-synthesised — never written intentionally.
+  if ("_deprecated" in out) delete out._deprecated;
+  // sonarqube.enabled was deprecated in v2.7.4. The init wizard still
+  // uses it as a hint to drive setupSonarQube during install, but the
+  // runtime ignores it. Persisting it would re-trigger the deprecation
+  // warning on every subsequent kj run.
+  if (out.sonarqube && typeof out.sonarqube === "object"
+      && Object.prototype.hasOwnProperty.call(out.sonarqube, "enabled")) {
+    const { enabled: _drop, ...rest } = out.sonarqube;
+    void _drop;
+    out.sonarqube = rest;
+  }
+  return out;
+}
+
 export async function writeConfig(configPath, config) {
   await ensureDir(path.dirname(configPath));
-  await fs.writeFile(configPath, yaml.dump(config, { lineWidth: 120 }), "utf8");
+  const sanitized = stripRuntimeOnlyKeys(config);
+  await fs.writeFile(configPath, yaml.dump(sanitized, { lineWidth: 120 }), "utf8");
 }
 
 // Declarative mappings for applyRunOverrides to reduce cognitive complexity.