karajan-code 4.49.3 → 4.49.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.49.3",
+  "version": "4.49.4",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -76,6 +76,7 @@
     "postinstall": "node scripts/postinstall.js",
     "setup": "node scripts/install.js",
     "test": "vitest run",
+    "test:scenarios": "vitest run --config tests/scenarios/vitest.config.js --root .",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "lint": "eslint src/ packages/",

package/src/cli/register-pipeline.js

@@ -259,7 +259,12 @@ export function registerPipeline(program, { pkgVersion }) {
         // ENV-B1 (KJC-TSK-0637): the gate mode records a verdict tied to
         // the exact diff so the pre-commit hook can enforce cross-AI review.
         if (flags.staged || flags.check || flags.range || flags.installGate || flags.prune) {
-          await reviewGateCommand({ config, logger, flags: { ...flags, task } });
+          // KJC-BUG-0349: the gate's task is optional, but --task-file carries
+          // the evidence the reviewer must weigh; it was never read here.
+          const gateTask = task || flags.taskFile
+            ? await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger })
+            : task;
+          await reviewGateCommand({ config, logger, flags: { ...flags, task: gateTask } });
           return;
         }
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });

package/src/sonar/scanner.js

@@ -8,7 +8,7 @@ import { waitForAnalysis } from "./api.js";
 import { resolveSonarProjectKey } from "./project-key.js";
 import {
   resolveSonarHost,
-  resolveSonarToken as resolveToken,
+  resolveSonarTokenAsync,
   resolveSonarCredentials,
 } from "./config-resolver.js";
 
@@ -210,8 +210,9 @@ async function maybeRunCoverage(config) {
   return checkLcovExists(lcovPath, blockOnFailure, run.stdout || "");
 }
 
-async function resolveSonarTokenWithFallback(config, apiHost) {
-  const explicitToken = resolveToken(config);
+export async function resolveSonarTokenWithFallback(config, apiHost) {
+  // KJC-BUG-0350: the async resolver also reads the token the bootstrap persisted.
+  const explicitToken = await resolveSonarTokenAsync(config);
   if (explicitToken) return explicitToken;
 
   const { user: adminUser, passwords } = await resolveSonarCredentials(config);