karajan-code 4.15.0 → 4.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.15.0",
+  "version": "4.16.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/packages/ai-trash/src/install.js

@@ -8,7 +8,14 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
 export const DEFAULT_SETTINGS_PATH = join(homedir(), ".claude", "settings.json");
-export const HOOK_COMMAND = "kj-trash hook";
+// KJC-BUG-0095: the bare command fails SILENTLY when the bin drops off PATH
+// (nvm switch, global reinstall) — the anti-delete net goes down without
+// notice. The installed line fails CLOSED: a missing bin blocks the tool
+// call (exit 2) naming the net and the remedy, never a quiet pass-through.
+export const LEGACY_HOOK_COMMAND = "kj-trash hook";
+export const HOOK_COMMAND =
+  "if command -v kj-trash >/dev/null 2>&1; then exec kj-trash hook; fi; " +
+  "echo 'kj-trash: bin not on PATH — the anti-delete net is DOWN. Fix: npm i -g karajan-code (or remove this hook from ~/.claude/settings.json).' >&2; exit 2";
 const MATCHER = "Bash";
 
 async function readSettings(path) {
@@ -34,6 +41,20 @@ export function patchSettings(settings, command = HOOK_COMMAND, matcher = MATCHE
     entry = { matcher, hooks: [{ type: "command", command }] };
     preToolUse.push(entry);
     mutated = true;
+  } else if (hasHookCommand(entry, LEGACY_HOOK_COMMAND) && command !== LEGACY_HOOK_COMMAND) {
+    // KJC-BUG-0095 migration: upgrade the silent legacy line in place —
+    // deduped (reviewer catch): an entry already carrying the new line
+    // must end up with a single copy, not legacy-turned-duplicate.
+    let seen = false;
+    entry.hooks = entry.hooks
+      .map((h) => (h.type === "command" && h.command === LEGACY_HOOK_COMMAND ? { ...h, command } : h))
+      .filter((h) => {
+        if (!(h.type === "command" && h.command === command)) return true;
+        if (seen) return false;
+        seen = true;
+        return true;
+      });
+    mutated = true;
   } else if (!hasHookCommand(entry, command)) {
     entry.hooks = [...(entry.hooks ?? []), { type: "command", command }];
     mutated = true;

package/scripts/verify-pack.mjs

@@ -208,7 +208,17 @@ try {
   // better-sqlite3's native build by default, so DB-backed commands need
   // `pnpm approve-builds`; that's surfaced as a doctor warning, KJC-BUG-0092 —
   // not a gate failure, since it's inherent to pnpm.) Auto-skips without pnpm.
-  const hasPnpm = spawnSync("pnpm", ["--version"], { encoding: "utf8", env: childEnv }).status === 0;
+  // KJC-BUG-0135: `npm run` leaks npm_config_* into the child env, and pnpm
+  // maps those variables onto its own config — which can re-anchor it to THIS
+  // repo (7-aug incident: the repo's node_modules converted to pnpm layout,
+  // native bindings wiped, and simple-git-hooks' hook overwrote
+  // .karajan/hooks). The smoke runs with a scrubbed env and a pinned --dir,
+  // and the tripwire below turns any host contamination into a loud gate
+  // failure instead of a silent green.
+  const pnpmEnv = Object.fromEntries(Object.entries(childEnv).filter(([k]) => !/^npm_config_/i.test(k)));
+  const HOST_MARKERS = ["pnpm-lock.yaml", "pnpm-workspace.yaml", path.join("node_modules", ".pnpm")];
+  const hostMarkersBefore = new Set(HOST_MARKERS.filter((m) => fs.existsSync(path.join(repoRoot, m))));
+  const hasPnpm = spawnSync("pnpm", ["--version"], { encoding: "utf8", env: pnpmEnv }).status === 0;
   if (!hasPnpm) {
     console.log("verify-pack: pnpm not installed — skipping pnpm smoke (npm path covered above) ⚠");
   } else {
@@ -224,11 +234,11 @@ try {
     // versions (supply-chain protection), so right after publishing
     // karajan-core it silently resolves an OLD one and this smoke fails on
     // missing subpaths. The gate verifies packaging, not release-age policy.
-    spawnSync("pnpm", ["add", tgzPath, "--store-dir", path.join(pnpmTmp, ".store"), "--config.minimum-release-age=0"], {
-      encoding: "utf8",
-      env: childEnv,
-      cwd: pnpmTmp,
-    });
+    spawnSync(
+      "pnpm",
+      ["add", tgzPath, "--dir", pnpmTmp, "--ignore-workspace", "--store-dir", path.join(pnpmTmp, ".store"), "--config.minimum-release-age=0"],
+      { encoding: "utf8", env: pnpmEnv, cwd: pnpmTmp },
+    );
     const pnpmBin = path.join(pnpmTmp, "node_modules", ".bin", "kj");
     if (!fs.existsSync(pnpmBin)) fail(`kj binary missing after pnpm install: ${pnpmBin}`);
     let pnpmVersion;
@@ -242,6 +252,18 @@ try {
     }
     console.log(`verify-pack: pnpm install + kj --version → ${pnpmVersion} ✓ (DB build needs \`pnpm approve-builds\`)`);
   }
+  // Tripwire (KJC-BUG-0135): the smoke must NEVER touch the host repo. If a
+  // pnpm artifact appeared at the repo root during this run, the gate fails
+  // naming it — never a green over a contaminated tree.
+  const contaminated = HOST_MARKERS.filter(
+    (m) => !hostMarkersBefore.has(m) && fs.existsSync(path.join(repoRoot, m)),
+  );
+  if (contaminated.length > 0) {
+    fail(
+      `pnpm smoke contaminated the host repo: ${contaminated.join(", ")} appeared at the repo root`,
+      "remove the listed files and run `npm ci` to restore the npm layout; then verify .karajan/hooks with `git status`",
+    );
+  }
 
   console.log(`\n✓ verify-pack: karajan-code@${expectedVersion} installs clean and runs.`);
 } finally {

package/src/agents/base-agent.js

@@ -60,7 +60,7 @@ export class BaseAgent {
       // a PATH is a partial overlay and merges over the inherited env first,
       // so an overlay caller can never cost the child PATH/HOME.
       const complete = options.env && ("PATH" in options.env || "Path" in options.env);
-      const base = complete ? options.env : { ...process.env, ...(options.env || {}) };
+      const base = complete ? options.env : { ...process.env, ...options.env };
       options = {
         ...options,
         env: buildAgentEnv(base, {

package/src/checks/release-check.js

@@ -28,9 +28,7 @@ async function genericChecks(projectDir) {
   checks.push({ name: "manifest", ok: Boolean(version), detail: version ? `version ${version}` : "package.json has no version" });
 
   const clPath = join(projectDir, "CHANGELOG.md");
-  if (!existsSync(clPath)) {
-    checks.push({ name: "changelog-current", ok: false, detail: "no CHANGELOG.md — the release story must exist before the release" });
-  } else {
+  if (existsSync(clPath)) {
     const cl = readFileSync(clPath, "utf8");
     const topVersioned = (cl.match(/^## \[(\d+\.\d+\.\d+)\]/m) || [])[1] || null;
     // Content still sitting under [Unreleased] means unpromoted entries —
@@ -39,25 +37,20 @@ async function genericChecks(projectDir) {
     const unreleasedBody = afterUnreleased.split(/^## \[/m)[0] ?? "";
     const pending = /\S/.test(unreleasedBody);
     const ok = topVersioned === version && !pending;
-    checks.push({
-      name: "changelog-current",
-      ok,
-      detail: ok
-        ? `top section is [${version}], Unreleased empty`
-        : pending
-          ? `[Unreleased] still carries content — promote it into [${version}] before releasing`
-          : `top CHANGELOG section is [${topVersioned ?? "none"}] but the manifest says ${version} — promote Unreleased before releasing`,
-    });
+    let detail = `top section is [${version}], Unreleased empty`;
+    if (pending) detail = `[Unreleased] still carries content — promote it into [${version}] before releasing`;
+    else if (!ok) detail = `top CHANGELOG section is [${topVersioned ?? "none"}] but the manifest says ${version} — promote Unreleased before releasing`;
+    checks.push({ name: "changelog-current", ok, detail });
+  } else {
+    checks.push({ name: "changelog-current", ok: false, detail: "no CHANGELOG.md — the release story must exist before the release" });
   }
 
   const tagsOut = await runCommand("git", ["-C", projectDir, "tag", "--list", "v[0-9]*"]);
   const tags = (tagsOut.stdout || "").split("\n").map((t) => t.trim().replace(/^v/, "")).filter((t) => /^\d+\.\d+\.\d+$/.test(t));
   const ahead = version ? tags.filter((t) => semverCmp(t, version) > 0) : [];
-  checks.push({
-    name: "tags",
-    ok: ahead.length === 0,
-    detail: ahead.length ? `tag(s) ahead of the manifest exist: v${ahead.join(", v")}` : (tags.includes(version) ? `v${version} already tagged` : `tag v${version} pending (created after publish)`),
-  });
+  let tagDetail = tags.includes(version) ? `v${version} already tagged` : `tag v${version} pending (created after publish)`;
+  if (ahead.length > 0) tagDetail = `tag(s) ahead of the manifest exist: v${ahead.join(", v")}`;
+  checks.push({ name: "tags", ok: ahead.length === 0, detail: tagDetail });
   return { checks, version, pkg };
 }
 

package/src/commands/env.js

@@ -62,7 +62,7 @@ export async function envInstallCommand({ config = null, logger = null, flags =
     // The effective backend feeds the render on EVERY non-error path —
     // chosen, declared-in-file or default — so the playbook never falls
     // back to hu-board while the selection said otherwise.
-    config = { ...config, state_backend: sel.backend, board: sel.boardName ? { ...(config?.board || {}), name: sel.boardName } : config?.board };
+    config = { ...config, state_backend: sel.backend, board: sel.boardName ? { ...config?.board, name: sel.boardName } : config?.board };
   } catch (err) {
     console.log(`⚠ board selection failed (${err.message}) — continuing with the configured default`);
   }

package/src/commands/harden.js

@@ -184,7 +184,10 @@ export async function hardenCommand({
   const verb = dryRun ? "would install" : "installed";
   logger.info?.(`kj harden (${profile}) — ${verb} ${result.hooks.length} hook(s) → ${result.hooksPath}`);
   for (const h of result.hooks) logger.info?.(`  • ${h.hook}: ${h.action}`);
-  for (const c of out.configs) logger.info?.(`  • ${c.file}: ${c.action}${c.note ? ` (${c.note})` : ""}`);
+  for (const c of out.configs) {
+    const note = c.note ? ` (${c.note})` : "";
+    logger.info?.(`  • ${c.file}: ${c.action}${note}`);
+  }
   for (const w of out.workflows) logger.info?.(`  • ${w.file}: ${w.action}`);
   for (const g of out.guidelines) logger.info?.(`  • ${g.file}: ${g.action}`);
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");

package/src/commands/rag.js

@@ -98,7 +98,8 @@ export async function ragQueryCommand({ text, config, logger, flags = {} }) {
     // KJC-TSK-0697 — `--library` targets the distilled-canon collection:
     // its own project namespace plus the kind filter.
     const library = Boolean(flags.library);
-    const project = library ? LIBRARY_PROJECT : (flags.project === "all" ? null : (flags.project || detected || null));
+    let project = flags.project === "all" ? null : (flags.project || detected || null);
+    if (library) project = LIBRARY_PROJECT;
     // KJC-BUG-0061 follow-up: align the CLI `--json` shape with the MCP
     // handler. The MCP tool responds `{ hits: [], empty: true, topK, scope }`
     // so agents (and the `/kj-rag-query` skill from Camino B) have a
@@ -115,9 +116,8 @@ export async function ragQueryCommand({ text, config, logger, flags = {} }) {
     // Safe by grammar: parseWhere (core where-parser.js) accepts ONLY
     // AND-joined key=value pairs — an OR or parens never parses, so the
     // composed clause cannot leak past the kind filter; it fails loudly.
-    const where = library
-      ? (flags.where ? `kind=library AND ${flags.where}` : "kind=library")
-      : (flags.where || null);
+    let where = flags.where || null;
+    if (library) where = flags.where ? `kind=library AND ${flags.where}` : "kind=library";
     const rerankOpts = flags.rerank ? { model: flags.rerankModel } : null;
     const hits = await query(db, makeGovernedEmbedder(config), text, { topK, scope, project, mode, alpha, where, rerankOpts });
     if (flags.json) {

package/src/commands/review-gate.js

@@ -26,6 +26,9 @@ async function enforceCardFirst({ config, projectDir }) {
   const branch = branchRes.stdout?.trim() || "HEAD";
   const card = await checkCardFirst({ config, projectDir, branch });
   if (card.mode === "warn") console.log(`⚠ card-first: ${card.reason}`);
+  // KJC-TSK-0732: the verification LEVEL is part of the verdict — a pass on
+  // branch-ref alone must never read as a tracker-verified pass.
+  if (card.note) console.log(`⚠ card-first: ${card.note}`);
   if (card.mode === "exempt" && card.reason.includes("KJ_ALLOW_NO_CARD")) console.log(`⚠ card-first exempt: ${card.reason}`);
   if (!card.ok) {
     console.log(`✗ card-first gate: ${card.reason}`);

package/src/config/defaults.js

@@ -66,7 +66,9 @@ const DEFAULTS = {
   // through the host agent's MCP/tools, never mirrored by kj. There is NO
   // "none": Karajan does not run without a board.
   state_backend: "hu-board",
-  board: { name: null },
+  // verify_cmd (KJC-TSK-0732): user adapter that checks a card ref against
+  // the real tracker — prints {exists, live, status} JSON; {ref} substituted.
+  board: { name: null, verify_cmd: null },
   // Method gates (KJC-PCS-0068): rules climb from playbook text to
   // deterministic enforcement. card_first: "auto" = block with hu-board
   // (fully verifiable), warn with planning-game/external (presence only);

package/src/environment/board-select.js

@@ -53,6 +53,7 @@ export async function pickStateBackend({ projectDir = process.cwd(), home = os.h
   const backend = external ? "external" : value;
   const boardName = external ? value.slice("external:".length) : null;
   await persistStateBackend(projectDir, backend, boardName);
-  logger.info?.(`✓ board: ${backend}${boardName ? ` (${boardName})` : ""} — persisted in .karajan/kj.config.yml`);
+  const suffix = boardName ? ` (${boardName})` : "";
+  logger.info?.(`✓ board: ${backend}${suffix} — persisted in .karajan/kj.config.yml`);
   return { backend, boardName, source: "chosen" };
 }

package/src/harden/hook-templates.js

@@ -109,7 +109,7 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
         "# POSIX-safe extraction (no grep -o): the ref is the leading",
         "# card-shaped token of the branch's last segment (feat/REF-desc).",
         "seg=$(printf '%s' \"$branch\" | tr '[:upper:]' '[:lower:]'); seg=\"${seg##*/}\"",
-        "ref=$(printf '%s' \"$seg\" | sed -nE 's/^([a-z][a-z0-9]{1,9}(-[a-z][a-z0-9]{1,9})*-[0-9]{1,6})(-.*)?$/\\1/p')",
+        String.raw`ref=$(printf '%s' "$seg" | sed -nE 's/^([a-z][a-z0-9]{1,9}(-[a-z][a-z0-9]{1,9})*-[0-9]{1,6})(-.*)?$/\1/p')`,
         'header=$(head -n1 "$msg_file")',
         'if [ -n "$ref" ] && [ -n "$header" ]; then',
         '  case "$header" in',
@@ -122,7 +122,7 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
         "        stamp=$(printf '%s' \"$ref\" | tr '[:lower:]' '[:upper:]')",
         '        new_header="$header ($stamp)"',
         '        if [ "${#new_header}" -le 100 ]; then',
-        "          { printf '%s\\n' \"$new_header\"; tail -n +2 \"$msg_file\"; } > \"$msg_file.kjtmp\" && mv \"$msg_file.kjtmp\" \"$msg_file\"",
+        String.raw`          { printf '%s\n' "$new_header"; tail -n +2 "$msg_file"; } > "$msg_file.kjtmp" && mv "$msg_file.kjtmp" "$msg_file"`,
         "        fi",
         "      fi",
         "      ;;",

package/src/orchestrator/direct-actions.js

@@ -26,6 +26,17 @@ const ALLOWED_COMMANDS = [
   "bundle install", "composer install", "dotnet restore"
 ];
 
+// KJC-BUG-0099: a dependency install must not be arbitrary code execution —
+// lifecycle hooks (postinstall & friends) run whatever the dependency ships.
+// The allow-list above names the INTENT; execution appends the ecosystem's
+// script-skipping flag. Ecosystems without package hooks run untouched.
+const HARDEN_FLAGS = {
+  npm: ["--ignore-scripts"],
+  pnpm: ["--ignore-scripts"],
+  yarn: ["--ignore-scripts"],
+  composer: ["--no-scripts", "--no-plugins"],
+};
+
 /**
  * True when `target` resolves to a path inside `base` (or is `base` itself).
  * Uses path.relative instead of a string prefix check: a naive
@@ -64,7 +75,7 @@ async function runCommand({ cmd, cwd }) {
     // Even though `cmd` is allow-listed, defense-in-depth: switched to
     // execFileSync with a tokenised arg array so no shell expansion at all.
     const [program, ...args] = cmd.trim().split(/\s+/);
-    const output = execFileSync(program, args, {
+    const output = execFileSync(program, [...args, ...(HARDEN_FLAGS[program] ?? [])], {
       cwd: cwd || process.cwd(),
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],

package/src/review/card-first.js

@@ -8,6 +8,7 @@
  */
 import { listPlans, loadPlan } from "../plan/plan-store.js";
 import { escapeRegExp } from "../utils/escape-regexp.js";
+import { verifyCardAlive } from "./card-verify.js";
 
 const LIVE_STATUSES = new Set(["pending", "running", "failed"]);
 // Card-shaped reference: LIN-123, bb-002 and multi-segment ids like
@@ -44,7 +45,7 @@ async function findLiveCardInBranch(projectDir, branch) {
   return closedHit;
 }
 
-export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, env = process.env }) {
+export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, env = process.env, deps = {} }) {
   if (env.KJ_ALLOW_NO_CARD === "1") {
     return { ok: true, mode: "exempt", reason: "KJ_ALLOW_NO_CARD=1 (explicit escape hatch)" };
   }
@@ -73,11 +74,24 @@ export async function checkCardFirst({ config = {}, projectDir = process.cwd(),
       : { ok: true, mode: "warn", reason };
   }
 
-  // planning-game / external: presence check only — liveness lives in the
-  // project's own board, out of local reach.
-  if (CARD_REF_RE.test(branch)) return { ok: true, mode: "pass", ref: branch.match(CARD_REF_RE)[0] };
-  const effective = policy === "auto" ? "warn" : policy;
+  // planning-game / external: presence check, upgraded to LIVENESS against
+  // the real tracker when board.verify_cmd declares an adapter
+  // (KJC-TSK-0732, issue #1371). Unverifiable degrades honestly — the
+  // result names its level so nobody mistakes branch-ref for tracker.
   const boardName = config.board?.name || backend;
+  const effective = policy === "auto" ? "warn" : policy;
+  if (CARD_REF_RE.test(branch)) {
+    const ref = branch.match(CARD_REF_RE)[0];
+    const { verifyFn = verifyCardAlive } = deps;
+    const v = await verifyFn({ ref, verifyCmd: config.board?.verify_cmd, projectDir });
+    if (v.verified === false) {
+      const reason = `branch references ${ref} but ${boardName} reports it "${v.status}" — card-first needs a live card in the tracker (create/reopen it there)`;
+      return effective === "block"
+        ? { ok: false, mode: "block", reason, level: v.level }
+        : { ok: true, mode: "warn", reason, level: v.level };
+    }
+    return { ok: true, mode: "pass", ref, level: v.level, ...(v.note ? { note: v.note } : {}) };
+  }
   const reason = `no card reference in branch "${branch}" — card-first on ${boardName}: create the card there and name the branch after it (e.g. feat/ABC-123-summary)`;
   return effective === "block"
     ? { ok: false, mode: "block", reason }

package/src/review/card-verify.js

@@ -0,0 +1,83 @@
+/**
+ * card-verify — KJC-TSK-0732 (issue #1371). With a declared tracker,
+ * card-first upgrades "the branch names a card" to "the tracker says that
+ * card is ALIVE". Transport-agnostic: `board.verify_cmd` is the USER'S
+ * adapter (their CLI/MCP wrapper — credentials never enter kj) printing
+ * {exists, live, status?} JSON on stdout. Unverifiable NEVER blocks: it
+ * degrades to branch-ref level SAYING SO — a gate must not claim a check
+ * it didn't make, in either direction. Definitive verdicts are cached
+ * briefly; degradations never are, so recovery is immediate.
+ */
+import { exec } from "node:child_process";
+import { createHash } from "node:crypto";
+import { promisify } from "node:util";
+import fs from "node:fs";
+import path from "node:path";
+import { extractFirstJson } from "../utils/json-extract.js";
+
+const execAsync = promisify(exec);
+export const VERIFY_TIMEOUT_MS = 4000;
+const CACHE_TTL_MS = 10 * 60 * 1000;
+// The ref lands inside a shell command (the user's adapter template), so it
+// must be inert BY CONSTRUCTION — card-ref alphabet only, anchored (codex
+// catch: same injection class as the tournament coder names).
+const SAFE_REF_RE = /^[a-z0-9][a-z0-9-]{0,63}$/i;
+
+const defaultExec = async (cmd, { cwd }) =>
+  execAsync(cmd, { cwd, timeout: VERIFY_TIMEOUT_MS, maxBuffer: 1024 * 1024 });
+
+function cachePath(projectDir) {
+  return path.join(projectDir, ".kj", "cache", "card-verify.json");
+}
+
+/** @returns {Promise<{level: "tracker"|"branch-ref", verified: boolean|null, status?: string|null, note?: string}>}
+ *  verified: true = alive · false = definitively not · null = degraded. */
+export async function verifyCardAlive({ ref, verifyCmd, projectDir = process.cwd(), deps = {} }) {
+  const { execFn = defaultExec, now = Date.now } = deps;
+  if (!verifyCmd) {
+    return {
+      level: "branch-ref", verified: null,
+      note: "card-first checked the branch reference only — set board.verify_cmd to verify the card against your tracker",
+    };
+  }
+
+  if (!SAFE_REF_RE.test(String(ref))) {
+    return {
+      level: "branch-ref", verified: null,
+      note: `tracker verification skipped — ref "${String(ref).slice(0, 30)}" is outside the card-ref alphabet`,
+    };
+  }
+  let cache = {};
+  try {
+    cache = JSON.parse(fs.readFileSync(cachePath(projectDir), "utf8"));
+  } catch { /* no cache yet */ }
+  // Keyed by adapter AND ref (reviewer catch): a verdict from one
+  // verify_cmd must never answer for a different one.
+  const key = `${createHash("sha256").update(verifyCmd).digest("hex").slice(0, 12)}:${ref}`;
+  const hit = cache[key];
+  if (hit && now() - hit.at < CACHE_TTL_MS) return hit.result;
+
+  const cmd = verifyCmd.includes("{ref}") ? verifyCmd.replaceAll("{ref}", ref) : `${verifyCmd} ${ref}`;
+  try {
+    const { stdout } = await execFn(cmd, { cwd: projectDir });
+    const parsed = extractFirstJson(String(stdout));
+    if (!parsed || typeof parsed.exists !== "boolean") {
+      throw new Error("adapter must print JSON {exists, live, status} on stdout");
+    }
+    const alive = parsed.exists && parsed.live !== false;
+    const result = alive
+      ? { level: "tracker", verified: true, status: parsed.status ?? null }
+      : { level: "tracker", verified: false, status: parsed.status ?? (parsed.exists ? "not-live" : "not-found") };
+    try {
+      fs.mkdirSync(path.dirname(cachePath(projectDir)), { recursive: true });
+      fs.writeFileSync(cachePath(projectDir), JSON.stringify({ ...cache, [key]: { at: now(), result } }));
+    } catch { /* cache is best-effort — the verdict stands without it */ }
+    return result;
+  } catch (err) {
+    const why = String(err.message || err).split("\n")[0].slice(0, 120);
+    return {
+      level: "branch-ref", verified: null,
+      note: `tracker verification degraded to branch-ref (${why}) — fix board.verify_cmd or its credentials`,
+    };
+  }
+}

package/src/sonar/scanner.js

@@ -47,13 +47,17 @@ export function buildScannerOpts(projectKey, scanner = {}) {
     opts.push(`-Dsonar.javascript.lcov.reportPaths=${scanner.javascript_lcov_report_paths}`);
   }
   const rules = scanner.disabled_rules || [];
-  rules.forEach((rule, i) => {
-    opts.push(
-      `-Dsonar.issue.ignore.multicriteria=e${i + 1}`,
-      `-Dsonar.issue.ignore.multicriteria.e${i + 1}.ruleKey=${rule}`,
-      `-Dsonar.issue.ignore.multicriteria.e${i + 1}.resourceKey=**/*`
-    );
-  });
+  if (rules.length > 0) {
+    // KJC-BUG-0139: the list property is declared ONCE — one `multicriteria=`
+    // per rule was last-wins, silently un-ignoring every rule but the final one.
+    opts.push(`-Dsonar.issue.ignore.multicriteria=${rules.map((_, i) => `e${i + 1}`).join(",")}`);
+    rules.forEach((rule, i) => {
+      opts.push(
+        `-Dsonar.issue.ignore.multicriteria.e${i + 1}.ruleKey=${rule}`,
+        `-Dsonar.issue.ignore.multicriteria.e${i + 1}.resourceKey=**/*`
+      );
+    });
+  }
   return opts.join(" ");
 }
 

package/src/tournament/judge.js

@@ -123,9 +123,8 @@ export async function judgeTournament({ tournamentDir, config = {}, logger = con
   let solomon = null;
   if (escalated) {
     if (!solomonFn) {
-      throw new Error(
-        `tournament: ${verdict.tie ? "empate declarado" : `discrepancia juez(${judgeTop}) vs scoreboard(${boardTop})`} y sin árbitro configurado`
-      );
+      const why = verdict.tie ? "empate declarado" : `discrepancia juez(${judgeTop}) vs scoreboard(${boardTop})`;
+      throw new Error(`tournament: ${why} y sin árbitro configurado`);
     }
     solomon = await solomonFn({
       judgeRanking: verdict.ranking,

package/src/tournament/scoreboard.js

@@ -17,7 +17,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
-const TESTS_RE = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[a-z]+$/;
+const TESTS_RE = /(?:(?:^|\/)(?:tests?|__tests__|spec)\/)|(?:\.(?:test|spec)\.[a-z]+$)/;
 const MUTATE_TIMEOUT_MS = 10 * 60 * 1000;
 
 // EXACT unified-diff header forms — an added line whose content starts with

package/src/utils/update-check.js

@@ -17,7 +17,8 @@ const HIGHLIGHT_MAX = 160;
  * ("Minor. **The method, enforced.** …"), bold stripped, truncated. Pure.
  */
 export function parseChangelogHighlight(markdown, version) {
-  const section = String(markdown).split(new RegExp(`^## \\[${version.replaceAll(".", "\\.")}\\][^\\n]*$`, "m"))[1];
+  const escapedVersion = version.replaceAll(".", String.raw`\.`);
+  const section = String(markdown).split(new RegExp(String.raw`^## \[${escapedVersion}\][^\n]*$`, "m"))[1];
   if (!section) return null;
   const firstLine = section.split(/^##|^###/m)[0].split("\n").map((l) => l.trim()).find(Boolean);
   if (!firstLine) return null;