karajan-code 4.1.11 → 4.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.1.11",
+  "version": "4.2.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/register-pipeline.js

@@ -211,6 +211,7 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--check", "Verify the recorded verdict matches the staged diff (exit 0/1, hook-friendly)")
     .option("--range <range>", "Review a git range (e.g. main..HEAD) instead of the staged diff")
     .option("--install-gate", "Enable the pre-commit review gate for this project (creates .karajan/review-gate)")
+    .option("--no-sonar", "Skip the deterministic Sonar pre-gate that runs before the cross-AI verdict")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "review", flags, async ({ config, logger }) => {
         // ENV-B1 (KJC-TSK-0637): the gate mode records a verdict tied to

package/src/commands/review-gate.js

@@ -10,10 +10,11 @@ import { checkVerdict } from "../review/verdict-store.js";
 import { runOneShotReview } from "../review/one-shot-review.js";
 import { runSolomonArbitration } from "../review/solomon-arbitration.js";
 import { ensureGateTrackable } from "../review/gate-gitignore.js";
+import { runSonarPregate, formatSonarFinding } from "../review/sonar-pregate.js";
 
 // Raw git always — never a wrapped/compressing runner (KJC-BUG-0115).
-async function rawDiff(range) {
-  const args = range ? ["diff", range] : ["diff", "--cached"];
+async function rawDiff(range, extraArgs = []) {
+  const args = range ? ["diff", range, ...extraArgs] : ["diff", "--cached", ...extraArgs];
   const res = await runCommand("git", args);
   if (res.exitCode !== 0) {
     throw new Error(res.stderr?.trim() || `git ${args.join(" ")} failed`);
@@ -29,7 +30,11 @@ function printVerdict(record) {
   }
   console.log(`✗ REJECTED by ${record.reviewer} — ${record.issues.length} blocking issue(s):`);
   for (const issue of record.issues) {
-    const where = issue.file ? ` [${issue.file}${issue.line ? `:${issue.line}` : ""}]` : "";
+    let where = "";
+    if (issue.file) {
+      const line = issue.line ? `:${issue.line}` : "";
+      where = ` [${issue.file}${line}]`;
+    }
     console.log(`  - (${issue.severity || "high"})${where} ${issue.description || issue.id}`);
     if (issue.suggested_fix) console.log(`    fix: ${issue.suggested_fix}`);
   }
@@ -48,7 +53,8 @@ export async function solomonCommand({ config, logger = null, flags = {} }) {
   if (res.ruling === "approve") {
     console.log(`⚖ Solomon (${res.solomon}) rules for the brain — verdict recorded, the gate is open.`);
   } else {
-    console.log(`⚖ Solomon${res.solomon ? ` (${res.solomon})` : ""} rules for the reviewer — obey and fix:`);
+    const who = res.solomon ? ` (${res.solomon})` : "";
+    console.log(`⚖ Solomon${who} rules for the reviewer — obey and fix:`);
   }
   if (res.reasoning) console.log(`  ${res.reasoning}`);
   process.exitCode = res.ruling === "approve" ? 0 : 1;
@@ -89,7 +95,39 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     return res;
   }
 
-  const record = await runOneShotReview({ diff, task: flags.task, config, logger, projectDir });
+  // KJC-TSK-0676: deterministic pre-gate — sonar findings on the changed
+  // files come back BEFORE any AI opinion. Blocking severities reject
+  // without spending reviewer tokens; the rest travel with the task so
+  // the cross-AI reviewer weighs them. Unavailable sonar degrades loudly.
+  let task = flags.task;
+  if (flags.sonar !== false) {
+    const files = (await rawDiff(flags.range, ["--name-only"])).split("\n").map((f) => f.trim()).filter(Boolean);
+    const pre = await runSonarPregate({ config, stagedFiles: files, logger });
+    if (!pre.available) {
+      console.log(`⚠ sonar pre-gate skipped: ${pre.reason}`);
+    } else {
+      const found = [...pre.blocking, ...pre.advisory];
+      if (found.length > 0) {
+        console.log(`Sonar on the changed files — ${pre.blocking.length} blocking, ${pre.advisory.length} advisory (project total: ${pre.totalProject}):`);
+        for (const f of found) console.log(`  - ${formatSonarFinding(f)}`);
+      }
+      if (pre.blocking.length > 0) {
+        console.log("✗ REJECTED by sonar (deterministic) — fix the blocking findings; the cross-AI reviewer was not invoked.");
+        process.exitCode = 1;
+        return {
+          verdict: "rejected", reviewer: "sonar",
+          issues: pre.blocking.map((i) => ({ severity: i.severity, file: undefined, description: formatSonarFinding(i) })),
+        };
+      }
+      if (pre.advisory.length > 0) {
+        task = `${task || "Review the following diff for correctness, security and maintainability."}\n\n`
+          + `Deterministic Sonar findings on these files (fold them into your review):\n`
+          + pre.advisory.map((f) => `- ${formatSonarFinding(f)}`).join("\n");
+      }
+    }
+  }
+
+  const record = await runOneShotReview({ diff, task, config, logger, projectDir });
   printVerdict(record);
   process.exitCode = record.verdict === "approved" ? 0 : 1;
   return record;

package/src/review/sonar-pregate.js

@@ -0,0 +1,63 @@
+/**
+ * Sonar pre-gate for `kj review --staged` (KJC-TSK-0676, user request
+ * 2026-07-23). With the brain outside the core (v4), skipping sonar is one
+ * decision away — proven the day the brain itself shipped 3 sonar issues in
+ * new code. Hung off the review gate, it becomes a gate, not discipline:
+ * deterministic findings on the STAGED files come back before any AI
+ * verdict, and BLOCKER/CRITICAL ones reject without spending reviewer
+ * tokens. Unavailable sonar degrades loudly ({available:false, reason}) —
+ * a laptop without Docker still commits.
+ */
+
+import { runSonarScan } from "../sonar/scanner.js";
+import { getOpenIssues } from "../sonar/api.js";
+import { acquireToolLock } from "../utils/tool-governor.js";
+
+const BLOCKING_SEVERITIES = new Set(["BLOCKER", "CRITICAL"]);
+
+/** Repo-relative path of a sonar issue (component is "<projectKey>:<path>"). */
+export function issueFile(issue) {
+  const component = String(issue?.component || "");
+  const idx = component.indexOf(":");
+  return idx === -1 ? component : component.slice(idx + 1);
+}
+
+/** One printable line per finding: (SEVERITY) [file:line] rule — message. */
+export function formatSonarFinding(issue) {
+  const line = issue.line ? `:${issue.line}` : "";
+  return `(${issue.severity}) [${issueFile(issue)}${line}] ${issue.rule} — ${issue.message}`;
+}
+
+/**
+ * Scan the project (single-flight via the tool governor) and return the
+ * open issues that live on the staged files, split by blocking severity.
+ * Every failure path degrades to {available:false, reason} — the pre-gate
+ * never breaks the review, it only refuses to stay silent.
+ */
+export async function runSonarPregate({ config, stagedFiles = [], logger = null }) {
+  if (config?.review_gate?.sonar === false) {
+    return { available: false, reason: "disabled in config (review_gate.sonar: false)" };
+  }
+  let lock = null;
+  try {
+    lock = await acquireToolLock("sonar-scanner", { timeoutMs: 300_000 });
+    const scan = await runSonarScan(config);
+    if (!scan.ok) {
+      return { available: false, reason: (scan.stderr || scan.stdout || "sonar scan failed").trim() };
+    }
+    const res = await getOpenIssues(config, scan.projectKey);
+    const staged = new Set(stagedFiles);
+    const onStaged = (res.issues || []).filter((i) => staged.has(issueFile(i)));
+    return {
+      available: true,
+      blocking: onStaged.filter((i) => BLOCKING_SEVERITIES.has(String(i.severity).toUpperCase())),
+      advisory: onStaged.filter((i) => !BLOCKING_SEVERITIES.has(String(i.severity).toUpperCase())),
+      totalProject: res.total ?? (res.issues || []).length,
+    };
+  } catch (err) {
+    logger?.warn?.(`[sonar-pregate] ${err.message}`);
+    return { available: false, reason: err.message };
+  } finally {
+    lock?.release?.();
+  }
+}