karajan-code 2.15.0 → 2.16.0

package/README.md

@@ -23,7 +23,9 @@
 
 ---
 
-> **v2.15.0 released** — Minor. Three epics, 30+ commits, ~4 000 LOC. (1) **Brain Recovery** (KJC-PCS-0044): universal error classifier with 7 rich classes (rate_limit_short, quota_daily, quota_monthly, api_down, auth_failed, network_timeout, silenced, unknown_fatal), `withBrainRecovery` wrapper wired into ALL agent invocations (no silent failures), persistent hibernation in `~/.kj/standby/<id>.json` with event-driven scheduler (no polling), `kj standby list` + `kj standby resume`, board reconcile at startup, **fallback chain** when quota exhausted with `retryAfter > 12h` (Claude → Codex → OpenCode → Aider, configurable per role via `kj init`). (2) **Model Routing + Undo** (KJC-PCS-0043): each HU gets `coder_model` + `reviewer_model` with cross-provider review by default (claude↔codex), per-HU override from board modal, OpenCode + Aider as first-class providers, ⏪ Undo button restores files via git snapshots. (3) **Self-Healing Plan** (KJC-PCS-0042): structural integrity pass breaks cycles + cleans orphan refs, smart convergence guard for self-fix loop, `kj plan fix [planId] [--prompt]` for iterating without regenerating, skip Sonar for SPIKE/DOC/RESEARCH HUs, eliminate Failed kanban column. 4 835/4 835 tests passing across 400 files. Safe upgrade from 2.14.3.
+> **v2.16.0 released** — Minor. Quality-focused release: **deterministic Sonar false-positive filter** (KJC-TSK-0416), wire universal de Brain Recovery completado en `semantic-detector` (TSK-0413 step D), codemod `replace(/regex/g, …)` → `replaceAll(/regex/g, …)` en 41 sitios, y limpieza de hallazgos del propio `kj audit` v2.15.0. The Sonar filter combines two mechanisms: (1) **static rules** `{ rule, filePattern, reason }` from a built-in catalog (covering common false positives like `javascript:S2699` on `tests/architecture/`) plus extensible via `config.sonar.false_positives`; (2) **inline ignores** with `// karajan-sonar-ignore: <ruleId>` on the issue line. Result: the coder stops burning tokens "fixing" non-broken assertions. Brain Recovery now wraps **every** AI call in the pipeline — `semantic-detector` was the last legacy caller. 4 846/4 846 tests passing across 401 files. Safe upgrade from 2.15.0.
+>
+> **v2.15.0** — Minor. Three epics, 30+ commits, ~4 000 LOC. (1) **Brain Recovery** (KJC-PCS-0044): universal error classifier with 7 rich classes (rate_limit_short, quota_daily, quota_monthly, api_down, auth_failed, network_timeout, silenced, unknown_fatal), `withBrainRecovery` wrapper wired into ALL agent invocations (no silent failures), persistent hibernation in `~/.kj/standby/<id>.json` with event-driven scheduler (no polling), `kj standby list` + `kj standby resume`, board reconcile at startup, **fallback chain** when quota exhausted with `retryAfter > 12h` (Claude → Codex → OpenCode → Aider, configurable per role via `kj init`). (2) **Model Routing + Undo** (KJC-PCS-0043): each HU gets `coder_model` + `reviewer_model` with cross-provider review by default (claude↔codex), per-HU override from board modal, OpenCode + Aider as first-class providers, ⏪ Undo button restores files via git snapshots. (3) **Self-Healing Plan** (KJC-PCS-0042): structural integrity pass breaks cycles + cleans orphan refs, smart convergence guard for self-fix loop, `kj plan fix [planId] [--prompt]` for iterating without regenerating, skip Sonar for SPIKE/DOC/RESEARCH HUs, eliminate Failed kanban column. 4 835/4 835 tests passing across 400 files. Safe upgrade from 2.14.3.
 >
 > **v2.14.2** — Patch. More dogfooding fallout from GRETA Plan 2 v2.14.1: the **▶ Run button** on the HU Board appeared on every `pending` card regardless of `blocked_by` (you could launch a HU whose deps don't exist yet — the user caught it instantly), and titles on the board lost their **`[EPICA]` prefix** at some point in v2.14.x evolution, making it impossible to tell at a glance which area of the plan a card belonged to. Fixes: `canRunHu` now requires `blockedBy.length === 0` before showing ▶; the planner prompt now demands `description: "[EPICA] one-sentence description"` with INFRA/SHARED fallbacks. Plus a new doc `docs/task-templates/spec-conventions.md` collecting the 6 SPEC conventions the planner v2.14.x understands (épicas, scope exclusions, transversal deps, reuse, async observers, explicit deps), so users don't have to rediscover them by dogfooding. 2 PRs (#687, #688). 4584/4584 tests passing. Safe upgrade from 2.14.1.
 >

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "2.15.0",
+  "version": "2.16.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/claude-agent.js

@@ -156,7 +156,7 @@ function summarizeToolCall(name, input = {}) {
     case "Glob": return `Glob ${input.pattern || ""}`.trim();
     case "Grep": return `Grep "${(input.pattern || "").slice(0, 60)}"${input.path ? ` in ${rel(input.path)}` : ""}`;
     case "Bash": {
-      const cmd = String(input.command || "").replace(/\s+/g, " ").slice(0, 100);
+      const cmd = String(input.command || "").replaceAll(/\s+/g, " ").slice(0, 100);
       return `Bash $ ${cmd}`;
     }
     case "TodoWrite": return `Todo ${(input.todos || []).length} items`;
@@ -259,7 +259,7 @@ export function createStreamJsonFilter(onOutput) {
         } else if (block.type === "tool_use") {
           onOutput({ stream, line: summarizeToolCall(block.name, block.input), kind: "tool" });
         } else if (block.type === "thinking" && block.thinking) {
-          onOutput({ stream, line: `thinking: ${block.thinking.slice(0, 80).replace(/\s+/g, " ")}…`, kind: "thinking" });
+          onOutput({ stream, line: `thinking: ${block.thinking.slice(0, 80).replaceAll(/\s+/g, " ")}…`, kind: "thinking" });
         }
       }
       return;

package/src/agents/codex-agent.js

@@ -11,7 +11,7 @@ import { resolveBin } from "./resolve-bin.js";
 function extractCodexTokens(stdout) {
   const match = (stdout || "").match(/tokens?\s+used\s*\n\s*([\d,]+)/i);
   if (!match) return null;
-  const total = Number(match[1].replace(/,/g, ""));
+  const total = Number(match[1].replaceAll(/,/g, ""));
   if (!Number.isFinite(total) || total <= 0) return null;
   return { tokens_in: 0, tokens_out: total };
 }

package/src/audit/agent-readiness.js

@@ -178,7 +178,7 @@ function safeRead(p) {
  * line counts keeps later byte-offset checks stable.
  */
 function stripFencedCodeBlocks(text) {
-  return text.replace(/^([ \t]*)(```|~~~)[^\n]*\n([\s\S]*?)\n\1\2[^\n]*$/gm, (match) => {
+  return text.replaceAll(/^([ \t]*)(```|~~~)[^\n]*\n([\s\S]*?)\n\1\2[^\n]*$/gm, (match) => {
     const lineCount = match.split("\n").length;
     return "\n".repeat(lineCount - 1);
   });

package/src/audit/basal-cost.js

@@ -18,7 +18,7 @@ const EXCLUDE_DIRS = new Set([
 ]);
 
 function slugify(projectDir) {
-  return path.basename(projectDir).replace(/[^a-zA-Z0-9_-]/g, "_");
+  return path.basename(projectDir).replaceAll(/[^a-zA-Z0-9_-]/g, "_");
 }
 
 async function walkSourceFiles(dir) {
@@ -144,9 +144,9 @@ function resolveImportSpecifier(fromFile, specifier) {
 // need the actual path inside the quotes to resolve the target module.
 function stripStringLiterals(content) {
   return content
-    .replace(/`[^`]*`/g, "``")
-    .replace(/"(?:\\.|[^"\\])*"/g, '""')
-    .replace(/'(?:\\.|[^'\\])*'/g, "''");
+    .replaceAll(/`[^`]*`/g, "``")
+    .replaceAll(/"(?:\\.|[^"\\])*"/g, '""')
+    .replaceAll(/'(?:\\.|[^'\\])*'/g, "''");
 }
 
 async function findDeadExports(sourceFiles) {

package/src/audit/webperf-input.js

@@ -39,7 +39,7 @@ function webperfHome() {
 }
 
 function projectSlug(projectDir) {
-  return path.basename(projectDir || process.cwd()).replace(/[^a-zA-Z0-9_-]/g, "_");
+  return path.basename(projectDir || process.cwd()).replaceAll(/[^a-zA-Z0-9_-]/g, "_");
 }
 
 /**

package/src/brain/standby-store.js

@@ -34,7 +34,7 @@ export function standbyDoneDir() {
 
 function sanitizeId(sessionId) {
   if (!sessionId || typeof sessionId !== "string") throw new Error("sessionId requerido");
-  return sessionId.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 120);
+  return sessionId.replaceAll(/[^a-zA-Z0-9._-]/g, "_").slice(0, 120);
 }
 
 /**

package/src/canvas/parse-md.js

@@ -218,7 +218,7 @@ function parseOperations(text) {
       if (testMatch && inAcceptance) {
         current.acceptance.push({
           type: testMatch[1].toLowerCase(),
-          content: testMatch[2].replace(/^`+|`+$/g, "").trim(),
+          content: testMatch[2].replaceAll(/^`+|`+$/g, "").trim(),
         });
       }
     }

package/src/commands/audit.js

@@ -157,7 +157,7 @@ async function resolveReportFilePath(flagValue, isJson) {
 
   let resolved;
   if (isDir) {
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const stamp = new Date().toISOString().replaceAll(/[:.]/g, "-");
     resolved = path.resolve(target, `audit-${stamp}.${ext}`);
   } else {
     resolved = path.resolve(target);

package/src/commands/plan/index.js

@@ -1,6 +1,4 @@
 // Barrel: re-export all plan sub-command handlers.
-import { planGenerateCommand } from "./generate.js";
-
 export { planGenerateCommand } from "./generate.js";
 export { planListCommand } from "./list.js";
 export { planShowCommand } from "./show.js";
@@ -11,6 +9,3 @@ export { planAddHuCommand } from "./add-hu.js";
 export { planRemoveHuCommand } from "./remove-hu.js";
 export { planMigrateResultCommand } from "./migrate-result.js";
 export { planFixCommand } from "./fix.js";
-
-// Keep backward compat — old callers import planCommand
-export const planCommand = planGenerateCommand;

package/src/commands/plan.js

@@ -12,5 +12,4 @@ export {
   planRemoveHuCommand,
   planMigrateResultCommand,
   planFixCommand,
-  planCommand,
 } from "./plan/index.js";

package/src/commands/webperf.js

@@ -26,7 +26,7 @@ function defaultReportDir() {
  * with audit history under ~/.karajan/.
  */
 function projectSlug(projectDir) {
-  return path.basename(projectDir || process.cwd()).replace(/[^a-zA-Z0-9_-]/g, "_");
+  return path.basename(projectDir || process.cwd()).replaceAll(/[^a-zA-Z0-9_-]/g, "_");
 }
 
 function formatHumanReport(result) {

package/src/domains/domain-synthesizer.js

@@ -80,7 +80,7 @@ function buildKeywords(task, hints) {
 
   const taskWords = task
     .toLowerCase()
-    .replace(/[^a-z0-9\s-]/g, " ")
+    .replaceAll(/[^a-z0-9\s-]/g, " ")
     .split(/\s+/)
     .filter(w => w.length > 3 && !stopWords.has(w));
 

package/src/git/hu-automation.js

@@ -14,8 +14,8 @@ import { runCommand } from "../utils/process.js";
 export function buildHuBranchName(prefix, story) {
   const baseSlug = String(story.title || story.id || "hu")
     .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
+    .replaceAll(/[^a-z0-9]+/g, "-")
+    .replaceAll(/^-+|-+$/g, "")
     .slice(0, 40);
   return `${prefix}${story.id}-${baseSlug}`;
 }

package/src/git/hu-snapshot.js

@@ -24,7 +24,7 @@ const REF_PREFIX = "refs/kj-snapshots/";
  */
 export function snapshotRefForHu(huId) {
   if (!huId) throw new Error("huId requerido");
-  const safe = String(huId).replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 80);
+  const safe = String(huId).replaceAll(/[^a-zA-Z0-9_-]/g, "_").slice(0, 80);
   return REF_PREFIX + safe;
 }
 

package/src/hu/auto-generator.js

@@ -24,7 +24,7 @@ export function deriveProjectName(originalTask) {
   ]);
   const words = originalTask
     .toLowerCase()
-    .replace(/[^\p{L}\p{N}\s-]/gu, " ")
+    .replaceAll(/[^\p{L}\p{N}\s-]/gu, " ")
     .split(/\s+/)
     .filter(w => w && !STOPWORDS.has(w));
   const meaningful = words.slice(0, 6);

package/src/orchestrator/repair/repair-detector.js

@@ -50,9 +50,9 @@ const INFEASIBLE_SIGNATURES = [
 export function failureSignature(cmd, errorOutput) {
   const cmdNorm = String(cmd || "").trim().slice(0, 200);
   const errNorm = String(errorOutput || "")
-    .replace(/\s+/g, " ")        // collapse whitespace
-    .replace(/\d+/g, "N")          // numbers tend to drift; line numbers, counts
-    .replace(/\/[^\s]+/g, "/PATH") // absolute paths drift across runs
+    .replaceAll(/\s+/g, " ")        // collapse whitespace
+    .replaceAll(/\d+/g, "N")          // numbers tend to drift; line numbers, counts
+    .replaceAll(/\/[^\s]+/g, "/PATH") // absolute paths drift across runs
     .trim()
     .slice(0, 300);
   return `${cmdNorm}|||${errNorm}`;

package/src/plan/adr-generator.js

@@ -38,11 +38,11 @@ function slugifyTitle(title) {
     // Decompose accents (NFD) then strip combining marks so "versión"
     // → "version", keeping the ADR id ASCII-only and filesystem-safe.
     .normalize("NFD")
-    .replace(/[̀-ͯ]/g, "")
-    .replace(/[^a-z0-9\s-]/g, "")
-    .replace(/\s+/g, "-")
-    .replace(/-+/g, "-")
-    .replace(/^-|-$/g, "")
+    .replaceAll(/[̀-ͯ]/g, "")
+    .replaceAll(/[^a-z0-9\s-]/g, "")
+    .replaceAll(/\s+/g, "-")
+    .replaceAll(/-+/g, "-")
+    .replaceAll(/^-|-$/g, "")
     .slice(0, 80) || "untitled";
 }
 

package/src/plan/plan-id.js

@@ -8,7 +8,7 @@
  */
 export function generatePlanId() {
   const now = new Date();
-  const ts = now.toISOString().replace(/[-:T]/g, "").replace(/\.\d+Z$/, "");
+  const ts = now.toISOString().replaceAll(/[-:T]/g, "").replace(/\.\d+Z$/, "");
   const rand = Math.random().toString(36).slice(2, 6);
   return `plan-${ts}-${rand}`;
 }
@@ -36,10 +36,10 @@ export function normaliseAlias(name) {
   if (!name || typeof name !== "string") return null;
   const slug = name
     .normalize("NFKD")
-    .replace(/[̀-ͯ]/g, "")        // strip diacritics
+    .replaceAll(/[̀-ͯ]/g, "")        // strip diacritics
     .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")            // non-alphanum → guion
-    .replace(/^-+|-+$/g, "")                // trim guiones extremos
+    .replaceAll(/[^a-z0-9]+/g, "-")            // non-alphanum → guion
+    .replaceAll(/^-+|-+$/g, "")                // trim guiones extremos
     .slice(0, 60);
   return slug || null;
 }

package/src/plan/plan-store.js

@@ -50,7 +50,7 @@ export function projectSlug(projectDir) {
   return projectDir
     .replace(/^\//, "")
     .replace(/[/\\]/g, "_")
-    .replace(/[^a-zA-Z0-9_.-]/g, "")
+    .replaceAll(/[^a-zA-Z0-9_.-]/g, "")
     .slice(0, 120);
 }
 

package/src/plan/plan-structural-pass.js

@@ -31,7 +31,7 @@ export function removeOrphanRefs(plan) {
   return fixes;
 }
 
-export function breakCycles(plan) {
+function breakCycles(plan) {
   const fixes = [];
   let cycles = findCycles(plan.hus);
   let budget = plan.hus.length;

package/src/roles/perf-role.js

@@ -25,7 +25,7 @@ import { BaseRole } from "./base-role.js";
 import { runWebperfScan } from "../webperf/scanner.js";
 
 function projectSlug(projectDir) {
-  return path.basename(projectDir || process.cwd()).replace(/[^a-zA-Z0-9_-]/g, "_");
+  return path.basename(projectDir || process.cwd()).replaceAll(/[^a-zA-Z0-9_-]/g, "_");
 }
 
 function defaultPersistDir() {

package/src/session/journal/decisions-writer.js

@@ -41,7 +41,7 @@ import { getSessionRoot } from "../../utils/paths.js";
  */
 
 function esc(text) {
-  return String(text ?? "").replace(/\|/g, "\\|");
+  return String(text ?? "").replaceAll(/\|/g, "\\|");
 }
 
 function formatConditions(conditions) {

package/src/session/journal/iteration-logger.js

@@ -28,7 +28,7 @@
  */
 
 function esc(text) {
-  return String(text ?? "").replace(/\|/g, "\\|");
+  return String(text ?? "").replaceAll(/\|/g, "\\|");
 }
 
 function formatDuration(ms) {

package/src/session/journal/summary-writer.js

@@ -33,7 +33,7 @@ import path from "node:path";
  */
 
 function esc(text) {
-  return String(text ?? "").replace(/\|/g, "\\|");
+  return String(text ?? "").replaceAll(/\|/g, "\\|");
 }
 
 function formatDuration(ms) {

package/src/skills/addyosmani-catalog.js

@@ -279,7 +279,7 @@ export async function listAvailableSlugs() {
  */
 export async function loadSkillBySlug(slug) {
   if (!slug || typeof slug !== "string") return null;
-  const safeSlug = slug.trim().replace(/[^A-Za-z0-9._-]/g, "");
+  const safeSlug = slug.trim().replaceAll(/[^A-Za-z0-9._-]/g, "");
   if (!safeSlug) return null;
 
   const skillPath = path.join(getSkillsRoot(), safeSlug, SKILL_FILE);

package/src/skills/semantic-detector.js

@@ -16,6 +16,7 @@
 
 import { createAgent } from "../agents/index.js";
 import { resolveRole } from "../config.js";
+import { withBrainRecovery } from "../brain/with-brain-recovery.js";
 
 /**
  * Curated catalog of skills the classifier is allowed to suggest. Keeping
@@ -106,15 +107,29 @@ export async function refineSkillsSemantically({ task, alreadyDetected = [], con
   }
 
   const prompt = PROMPT(task, SEMANTIC_CATALOG, alreadyDetected);
+  // KJC-TSK-0413 step D: wrap with Brain Recovery. semantic-detector usa
+  // signature legacy `runTask(prompt, opts)` — adapter normaliza al estándar
+  // `runTask({ prompt, timeoutMs })` que withBrainRecovery espera.
+  const adapter = {
+    provider: agent.provider,
+    runTask: (args) => agent.runTask(args.prompt, { timeoutMs: args.timeoutMs }),
+  };
   let res;
   try {
-    res = await agent.runTask(prompt, { timeoutMs: 30_000 });
+    res = await withBrainRecovery({
+      agent: adapter,
+      taskArgs: { prompt, timeoutMs: 30_000 },
+      role: "semantic-detector",
+      logger,
+    });
   } catch (err) {
     logger?.warn?.(`semantic-detector: classifier call failed (${err.message}) — skipping`);
     return [];
   }
   if (!res?.ok) {
-    logger?.debug?.("semantic-detector: classifier returned not-ok — skipping");
+    // En test env el sleep es no-op así que abort viene rápido. Skip-on-fail
+    // sigue siendo el comportamiento — semantic detection es best-effort.
+    logger?.debug?.(`semantic-detector: classifier returned not-ok (${res?.recovery?.class || "unknown"}) — skipping`);
     return [];
   }
 

package/src/skills/skills-cache.js

@@ -24,7 +24,7 @@ export function getCacheRoot() {
 
 function sanitize(name) {
   // Allow safe skill name characters, replace everything else with "_".
-  return String(name || "").replace(/[^A-Za-z0-9._-]/g, "_");
+  return String(name || "").replaceAll(/[^A-Za-z0-9._-]/g, "_");
 }
 
 function metaPath(name) {

package/src/sonar/api.js

@@ -2,6 +2,7 @@ import { runCommand } from "../utils/process.js";
 import { withRetry } from "../utils/retry.js";
 import { resolveSonarProjectKey } from "./project-key.js";
 import { resolveSonarToken } from "./config-resolver.js";
+import { filterFalsePositives } from "./issue-filter.js";
 
 class SonarApiError extends Error {
   constructor(message, { url, httpStatus, hint } = {}) {
@@ -83,10 +84,27 @@ export async function getOpenIssues(config, projectKey = null) {
   const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey });
   const body = await sonarFetch(config, `/api/issues/search?projectKeys=${effectiveProjectKey}&statuses=OPEN`);
 
+  let parsedIssues = [];
+  let parsedRaw = body;
   try {
     const parsed = JSON.parse(body);
-    return { total: parsed.total || 0, issues: parsed.issues || [], raw: parsed };
-  } catch { /* SonarQube response is not valid JSON */
-    return { total: 0, issues: [], raw: body };
-  }
+    parsedIssues = parsed.issues || [];
+    parsedRaw = parsed;
+  } catch { /* SonarQube response is not valid JSON */ }
+
+  // KJC-TSK-0416: pre-filtro de falsos positivos antes de devolver al
+  // caller. El coder, audit y scan consumen lo que pasa el filtro;
+  // suppressed se devuelve aparte para observabilidad.
+  const extraRules = config?.sonar?.false_positives || [];
+  const { kept, suppressed } = filterFalsePositives(parsedIssues, {
+    extraRules,
+    projectRoot: config?.projectDir,
+  });
+
+  return {
+    total: kept.length,
+    issues: kept,
+    suppressed,
+    raw: parsedRaw,
+  };
 }

package/src/sonar/config-resolver.js

@@ -16,7 +16,7 @@ const DEFAULT_HOST = "http://localhost:9000";
  */
 export function resolveSonarHost(rawHost) {
   const host = String(rawHost || DEFAULT_HOST)
-    .replace(/host\.docker\.internal/g, "localhost")
+    .replaceAll(/host\.docker\.internal/g, "localhost")
     .replace(/\/+$/, "");
   return host;
 }

package/src/sonar/issue-filter.js

@@ -0,0 +1,110 @@
+// KJC-TSK-0416: pre-filtro determinístico de falsos positivos Sonar.
+//
+// Antes de que los issues Sonar lleguen al coder como feedback (sonar-role)
+// o al auditor (audit), filtramos los que sabemos que son falsos positivos
+// por reglas conocidas. Sin esto el coder quemaba tokens intentando
+// "arreglar" cosas que no están rotas.
+//
+// Dos mecanismos complementarios:
+//   1. Rules estáticas: { rule, filePattern, reason } — match por reglaId
+//      + patrón de path. Cargadas por defecto del catálogo de FALSE_POSITIVES
+//      abajo + extensibles via config.sonar.false_positives.
+//   2. Inline ignore: `// karajan-sonar-ignore: <ruleId>` en la línea del
+//      issue (o la anterior) → suprime ese hit exacto.
+
+import fs from "node:fs";
+
+// Catálogo built-in de patrones conocidos. Cada entrada:
+//   { rule: "javascript:S2699", filePattern: RegExp, reason: "..." }
+// Ampliable via config.sonar.false_positives.
+export const DEFAULT_FALSE_POSITIVES = [
+  {
+    rule: "javascript:S2699",
+    filePattern: /tests\/architecture\//,
+    reason: "Tests structurales fallan vía expect(offenders, msg).toEqual([]) — Sonar no detecta el assert con mensaje custom",
+  },
+];
+
+/**
+ * Comprueba si una línea del file contiene `// karajan-sonar-ignore: <ruleId>`.
+ * Acepta la línea exacta del issue o la inmediatamente anterior.
+ *
+ * @param {string} filePath
+ * @param {number} line - 1-indexed
+ * @param {string} ruleId
+ * @returns {boolean}
+ */
+export function hasInlineIgnore(filePath, line, ruleId) {
+  if (!filePath || !line || !ruleId) return false;
+  if (!fs.existsSync(filePath)) return false;
+  try {
+    const lines = fs.readFileSync(filePath, "utf8").split("\n");
+    const idx = line - 1;
+    const candidates = [lines[idx], lines[idx - 1]].filter(Boolean);
+    const re = new RegExp(`karajan-sonar-ignore\\s*:\\s*${escapeRegex(ruleId)}\\b`);
+    return candidates.some((l) => re.test(l));
+  } catch {
+    return false;
+  }
+}
+
+function escapeRegex(s) {
+  return String(s).replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Filtra issues de Sonar separando los reales de los falsos positivos.
+ *
+ * @param {object[]} issues - array de Sonar issues (shape: { rule, component, line, message, severity, ... })
+ * @param {object} [opts]
+ * @param {object[]} [opts.extraRules] - rules adicionales del config
+ * @param {string} [opts.projectRoot] - para resolver component → ruta absoluta
+ * @returns {{ kept: object[], suppressed: object[] }}
+ */
+export function filterFalsePositives(issues, opts = {}) {
+  if (!Array.isArray(issues)) return { kept: [], suppressed: [] };
+  const rules = [...DEFAULT_FALSE_POSITIVES, ...(opts.extraRules || [])].map((r) => ({
+    ...r,
+    filePattern: r.filePattern instanceof RegExp ? r.filePattern : new RegExp(String(r.filePattern || ".*")),
+  }));
+  const projectRoot = opts.projectRoot || process.cwd();
+  const kept = [];
+  const suppressed = [];
+
+  for (const issue of issues) {
+    const path = componentToPath(issue.component);
+    let matched = null;
+
+    // 1. Rules estáticas.
+    for (const rule of rules) {
+      if (issue.rule === rule.rule && rule.filePattern.test(path)) {
+        matched = { rule: rule.rule, path, reason: rule.reason };
+        break;
+      }
+    }
+
+    // 2. Inline ignore (más caro — solo si la regla estática no matchea).
+    if (!matched && issue.rule && issue.line && path) {
+      const absPath = path.startsWith("/") ? path : `${projectRoot}/${path}`;
+      if (hasInlineIgnore(absPath, issue.line, issue.rule)) {
+        matched = { rule: issue.rule, path, reason: "inline `// karajan-sonar-ignore`" };
+      }
+    }
+
+    if (matched) {
+      suppressed.push({ ...issue, _suppressedBy: matched });
+    } else {
+      kept.push(issue);
+    }
+  }
+  return { kept, suppressed };
+}
+
+/**
+ * Sonar reporta component como `<projectKey>:<relativePath>`. Extrae el path.
+ */
+function componentToPath(component) {
+  if (typeof component !== "string") return "";
+  const colonIdx = component.indexOf(":");
+  return colonIdx >= 0 ? component.slice(colonIdx + 1) : component;
+}

package/src/sonar/scanner.js

@@ -164,7 +164,7 @@ async function ensureSonarProjectProperties(cwd = process.cwd()) {
     } catch {
       // no package.json or invalid JSON — use defaults
     }
-    const projectKey = (pkg.name || path.basename(cwd)).replace(/[^a-zA-Z0-9_.-]/g, "_");
+    const projectKey = (pkg.name || path.basename(cwd)).replaceAll(/[^a-zA-Z0-9_.-]/g, "_");
     const props = [
       `sonar.projectKey=${projectKey}`,
       `sonar.projectName=${pkg.name || path.basename(cwd)}`,

package/src/utils/derive-project-name-from-cwd.js

@@ -40,9 +40,9 @@ function prettifyName(raw) {
   if (!trimmed) return null;
   // Insert space at camelCase boundaries, then split on -/_/whitespace.
   const spaced = trimmed
-    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
-    .replace(/[-_]+/g, " ")
-    .replace(/\s+/g, " ")
+    .replaceAll(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .replaceAll(/[-_]+/g, " ")
+    .replaceAll(/\s+/g, " ")
     .trim();
   if (!spaced) return null;
   return spaced

package/src/utils/injection-guard.js

@@ -178,7 +178,7 @@ export function scanDiff(diff, opts = {}) {
 function excerpt(text, index) {
   const start = Math.max(0, index - 20);
   const end = Math.min(text.length, index + 100);
-  return text.slice(start, end).replace(/\n/g, "\\n").slice(0, 120);
+  return text.slice(start, end).replaceAll(/\n/g, "\\n").slice(0, 120);
 }
 
 function lineAt(text, index) {

package/src/utils/messages.js

@@ -48,7 +48,7 @@ const MESSAGES = {
  */
 export function msg(key, lang = "en", params = {}) {
   const template = MESSAGES[lang]?.[key] || MESSAGES.en[key] || key;
-  return template.replace(/\{(\w+)\}/g, (_, k) => params[k] ?? `{${k}}`);
+  return template.replaceAll(/\{(\w+)\}/g, (_, k) => params[k] ?? `{${k}}`);
 }
 
 /**