claude-crap 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -5,6 +5,104 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.4] - 2026-04-13
+
+### Fixed
+
+- **MCP server workspace root resolution (follow-up to 0.4.3)** —
+  v0.4.3 attempted to fix the workspace-cache bug by setting
+  `"CLAUDE_PROJECT_DIR": "${CLAUDE_PROJECT_DIR}"` in `plugin/.mcp.json`
+  env, on the assumption that Claude Code would expand the variable.
+  It does not — only `${CLAUDE_PLUGIN_ROOT}` is expanded inside
+  `.mcp.json`. The literal string `${CLAUDE_PROJECT_DIR}` was passed
+  through to `process.env.CLAUDE_PROJECT_DIR`, the MCP server happily
+  used it as a path, and `auto_scan` returned 0 files because the
+  "workspace" was a literal template string. This release fixes that:
+  - **Reverted** the broken `.mcp.json` env entry.
+  - **Defensive `${...}` literal detection.** Any env var whose value
+    matches `^${VAR_NAME}$` is treated as unset by `sanitizeEnvPath()`,
+    so an unexpanded template can never leak through as a "valid" path.
+  - **Parent-cwd fallback.** `loadConfig()` now delegates to
+    `discoverWorkspaceRoot()`, which walks a 4-strategy chain:
+    `CLAUDE_PROJECT_DIR` → `CLAUDE_CRAP_PLUGIN_ROOT` → parent process
+    cwd (via `lsof` on macOS, `/proc/<pid>/cwd` on Linux) →
+    `process.cwd()`. Claude Code's cwd IS the user's workspace, so the
+    parent-cwd probe is the most reliable fallback when env-var
+    inheritance is unavailable.
+
+### Added
+
+- **`discoverWorkspaceRoot(options)`** export from `src/config.ts` with
+  an injectable `readParentCwd` for testability.
+- **11 new characterization tests** in `src/tests/config.test.ts`
+  covering literal `${...}` detection on every source, parent-cwd
+  fallback ordering, and the `process.cwd()` last-resort. Suite total:
+  **366 tests across 95 suites**.
+
+## [0.4.3] - 2026-04-13
+
+### Fixed
+
+- **MCP server workspace root (incomplete fix)** — `loadConfig()` now
+  reads `CLAUDE_PROJECT_DIR` ahead of `CLAUDE_CRAP_PLUGIN_ROOT` and
+  `process.cwd()`, so SARIF reports stop landing inside the plugin
+  cache directory.
+- **`.mcp.json` env pass-through** — added an explicit
+  `"CLAUDE_PROJECT_DIR": "${CLAUDE_PROJECT_DIR}"` entry to forward the
+  variable to the MCP server process.
+  > **Known issue (fixed in 0.4.4):** Claude Code does NOT expand
+  > `${CLAUDE_PROJECT_DIR}` inside `.mcp.json` env (only
+  > `${CLAUDE_PLUGIN_ROOT}` is expanded), so the literal template
+  > string was passed through and broke workspace resolution
+  > completely. Upgrade to 0.4.4.
+
+## [0.4.2] - 2026-04-13
+
+### Changed
+
+- **Default strictness changed from `strict` to `warn`** so existing
+  projects with findings can adopt the plugin without being hard-blocked
+  on every task close. Teams that want hard enforcement set
+  `"strictness": "strict"` in `.claude-crap.json` explicitly.
+
+### Fixed
+
+- **Plugin infrastructure directories excluded from scans** — added
+  `plugin/`, `hooks/`, `skills/`, `.claude-plugin/`, and `.claude-sonar/`
+  to `DEFAULT_SKIP_DIRS`. These directories used to inflate workspace
+  LOC totals and produce false complexity hotspots in the dashboard.
+  The hooks-layer `LOC_WALK_SKIP_DIRS` was synced to match so the Stop
+  quality gate computes TDR over the same file set as the MCP server.
+
+## [0.4.1] - 2026-04-13
+
+### Fixed
+
+- **Launcher dependency validation** — the launcher now verifies that
+  every externalized package (`@modelcontextprotocol/sdk`, `fastify`,
+  `@fastify/static`, `pino`, `web-tree-sitter`, `tree-sitter-wasms`,
+  `picomatch`) actually exists inside `node_modules/` instead of just
+  checking that the directory is present. Fixes the case where a new
+  dependency was added but cached `node_modules/` is stale.
+- **Cache sync clears stale `node_modules/`** — `build:plugin` now
+  deletes `node_modules/` in every cached plugin version after copying
+  updated files, forcing the launcher to re-install with the correct
+  dependency set on the next session boot.
+
+### Changed
+
+- **`handleToolCall` refactored** — the 10-case switch (cyclomatic
+  complexity 32) was extracted into 10 named handlers, leaving
+  `handleToolCall` as a thin dispatcher (CC 11). Each handler handles
+  exactly one MCP tool and is independently testable.
+
+### Added
+
+- **`docs/supported-languages.md`** — per-language setup, detection
+  rules, scanner behavior, monorepo discovery, file exclusions, and a
+  walkthrough for adding a new language. Linked from the README
+  Documentation section.
+
 ## [0.4.0] - 2026-04-13
 
 ### Added

package/README.md

@@ -240,7 +240,7 @@ added via `.claude-crap.json`:
 
 ```bash
 npm install          # postinstall builds dist/ automatically
-npm test             # 339 tests across 89 suites
+npm test             # 366 tests across 95 suites
 npm run build:fast   # esbuild dev build (10-20x faster than tsc)
 npm run doctor       # full diagnostic
 ```

package/dist/config.d.ts

@@ -9,8 +9,8 @@
  *   user settings  →  plugin.json "options"  →  .mcp.json "env"  →  this file
  *
  * If any environment variable is missing or empty, a safe default is used,
- * but the loader NEVER invents stochastic values and NEVER performs I/O.
- * This module is the single source of truth for runtime configuration.
+ * but the loader NEVER invents stochastic values. This module is the
+ * single source of truth for runtime configuration.
  *
  * @module config
  */
@@ -28,7 +28,7 @@ export type MaintainabilityRating = "A" | "B" | "C" | "D" | "E";
  * configuration at runtime — any change must go through a server restart.
  */
 export interface CrapConfig {
-    /** Absolute path to the plugin root on disk. Defaults to `process.cwd()`. */
+    /** Absolute path to the user's workspace. Resolved via {@link discoverWorkspaceRoot}. */
     readonly pluginRoot: string;
     /** Directory (relative to the workspace) where consolidated SARIF reports are written. */
     readonly sarifOutputDir: string;
@@ -43,6 +43,32 @@ export interface CrapConfig {
     /** Local TCP port the Vue.js dashboard will bind to. */
     readonly dashboardPort: number;
 }
+/**
+ * Parameters accepted by {@link discoverWorkspaceRoot}. The only field is
+ * an injectable `readParentCwd` implementation so that tests can pin the
+ * fallback behavior without spawning `lsof` or reading `/proc`.
+ */
+export interface DiscoverWorkspaceOptions {
+    readParentCwd?: () => string | undefined;
+}
+/**
+ * Resolve the user's workspace directory. Strategy, in strict priority
+ * order:
+ *
+ *   1. `CLAUDE_PROJECT_DIR`      (sanitized — ignored if it's `${...}`)
+ *   2. `CLAUDE_CRAP_PLUGIN_ROOT` (sanitized — legacy explicit override)
+ *   3. Parent process cwd       (Claude Code's cwd = the workspace)
+ *   4. `process.cwd()`          (last-resort fallback; usually wrong for
+ *                                MCP servers because Claude Code sets
+ *                                cwd to the plugin cache directory)
+ *
+ * This function NEVER returns an unexpanded `${...}` template; any source
+ * that contains one is skipped as if it were unset.
+ *
+ * @param options Injection points for tests.
+ * @returns       A concrete filesystem path.
+ */
+export declare function discoverWorkspaceRoot(options?: DiscoverWorkspaceOptions): string;
 /**
  * Build the complete {@link CrapConfig} from the current process environment.
  *

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAUvC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAmED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,wBAA6B,GAAG,MAAM,CAapF;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAUvC"}

package/dist/config.js

@@ -9,11 +9,103 @@
  *   user settings  →  plugin.json "options"  →  .mcp.json "env"  →  this file
  *
  * If any environment variable is missing or empty, a safe default is used,
- * but the loader NEVER invents stochastic values and NEVER performs I/O.
- * This module is the single source of truth for runtime configuration.
+ * but the loader NEVER invents stochastic values. This module is the
+ * single source of truth for runtime configuration.
  *
  * @module config
  */
+import { execFileSync } from "node:child_process";
+import { readlinkSync } from "node:fs";
+/**
+ * Detects an unexpanded `.mcp.json` variable template such as
+ * `${CLAUDE_PROJECT_DIR}`. Claude Code only expands `${CLAUDE_PLUGIN_ROOT}`
+ * inside `.mcp.json`; every other `${VAR}` is passed through verbatim and
+ * must NOT be treated as a real filesystem path.
+ */
+function isLiteralVarTemplate(value) {
+    if (value === undefined)
+        return false;
+    return /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value.trim());
+}
+/**
+ * Normalize an environment variable that is expected to contain a path.
+ * Returns `undefined` if the value is missing, empty, or an unexpanded
+ * `${...}` template. Any non-empty concrete string is returned as-is.
+ */
+function sanitizeEnvPath(value) {
+    if (value === undefined || value === "")
+        return undefined;
+    if (isLiteralVarTemplate(value))
+        return undefined;
+    return value;
+}
+/**
+ * Read the current working directory of the parent process. Claude Code
+ * spawns MCP servers with its own cwd set to the user's workspace, so the
+ * parent's cwd is the most reliable fallback when `CLAUDE_PROJECT_DIR` is
+ * not inherited (e.g. because Claude Code only exports it for hooks).
+ *
+ * Returns `undefined` on any platform or failure mode the probe cannot
+ * handle — callers must be prepared for a missing result.
+ */
+function readParentCwdDefault() {
+    try {
+        const ppid = process.ppid;
+        if (!ppid || ppid === 0)
+            return undefined;
+        if (process.platform === "linux") {
+            // /proc/<pid>/cwd is a symlink to the process's cwd.
+            return readlinkSync(`/proc/${ppid}/cwd`);
+        }
+        if (process.platform === "darwin") {
+            // `lsof -a -p <pid> -d cwd -F n` emits a single line starting with
+            // `n<path>` for the cwd file descriptor. `-F` keeps the output
+            // machine-readable.
+            const output = execFileSync("lsof", ["-a", "-p", String(ppid), "-d", "cwd", "-F", "n"], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+                timeout: 2000,
+            });
+            const match = output.match(/^n(.+)$/m);
+            return match?.[1];
+        }
+        // Windows and other platforms: no reliable no-dep probe.
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve the user's workspace directory. Strategy, in strict priority
+ * order:
+ *
+ *   1. `CLAUDE_PROJECT_DIR`      (sanitized — ignored if it's `${...}`)
+ *   2. `CLAUDE_CRAP_PLUGIN_ROOT` (sanitized — legacy explicit override)
+ *   3. Parent process cwd       (Claude Code's cwd = the workspace)
+ *   4. `process.cwd()`          (last-resort fallback; usually wrong for
+ *                                MCP servers because Claude Code sets
+ *                                cwd to the plugin cache directory)
+ *
+ * This function NEVER returns an unexpanded `${...}` template; any source
+ * that contains one is skipped as if it were unset.
+ *
+ * @param options Injection points for tests.
+ * @returns       A concrete filesystem path.
+ */
+export function discoverWorkspaceRoot(options = {}) {
+    const readParentCwd = options.readParentCwd ?? readParentCwdDefault;
+    const fromProjectDir = sanitizeEnvPath(process.env.CLAUDE_PROJECT_DIR);
+    if (fromProjectDir)
+        return fromProjectDir;
+    const fromPluginRoot = sanitizeEnvPath(process.env.CLAUDE_CRAP_PLUGIN_ROOT);
+    if (fromPluginRoot)
+        return fromPluginRoot;
+    const fromParent = sanitizeEnvPath(readParentCwd());
+    if (fromParent)
+        return fromParent;
+    return process.cwd();
+}
 /**
  * Parse a numeric environment variable, falling back to `fallback` when the
  * variable is undefined or empty. Throws if the value is present but not a
@@ -66,7 +158,7 @@ function parseRating(raw, fallback) {
  */
 export function loadConfig() {
     return {
-        pluginRoot: process.env.CLAUDE_CRAP_PLUGIN_ROOT ?? process.cwd(),
+        pluginRoot: discoverWorkspaceRoot(),
         sarifOutputDir: process.env.CLAUDE_CRAP_SARIF_OUTPUT_DIR ?? ".claude-crap/reports",
         crapThreshold: parseNumber("CLAUDE_CRAP_CRAP_THRESHOLD", process.env.CLAUDE_CRAP_CRAP_THRESHOLD, 30),
         cyclomaticMax: parseNumber("CLAUDE_CRAP_CYCLOMATIC_MAX", process.env.CLAUDE_CRAP_CYCLOMATIC_MAX, 15),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAiCH;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,GAAuB,EAAE,QAAgB;IAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,GAAG,0BAA0B,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,GAAuB,EAAE,QAA+B;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,gCAAgC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,UAAmC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,EAAE;QAChE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,sBAAsB;QAClF,aAAa,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC;QACpG,aAAa,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC;QACpG,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,CAAC;QACtE,aAAa,EAAE,WAAW,CAAC,6BAA6B,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,EAAE,CAAC;QACtG,aAAa,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC;KACvG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiCvC;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,qDAAqD;YACrD,OAAO,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,mEAAmE;YACnE,+DAA+D;YAC/D,oBAAoB;YACpB,MAAM,MAAM,GAAG,YAAY,CACzB,MAAM,EACN,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,EAClD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CACF,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAoC,EAAE;IAC1E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAEpE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC5E,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC;IACpD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,GAAuB,EAAE,QAAgB;IAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,GAAG,0BAA0B,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,GAAuB,EAAE,QAA+B;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,gCAAgC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,UAAmC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,UAAU,EAAE,qBAAqB,EAAE;QACnC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,sBAAsB;QAClF,aAAa,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC;QACpG,aAAa,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC;QACpG,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,CAAC;QACtE,aAAa,EAAE,WAAW,CAAC,6BAA6B,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,EAAE,CAAC;QACtG,aAAa,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC;KACvG,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-crap",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Deterministic QA plugin for Claude Code — CRAP index, Technical Debt Ratio, tree-sitter AST, SARIF 2.1.0, hooks, and a local Vue dashboard.",
   "keywords": [
     "claude-code",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://code.claude.com/schemas/plugin.json",
   "name": "claude-crap",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Deterministic Quality Assurance plugin for Claude Code. Wraps every Write / Edit / Bash tool call with a PreToolUse gatekeeper, a PostToolUse verifier, and a Stop quality gate backed by CRAP index, Technical Debt Ratio, tree-sitter AST metrics, and SARIF 2.1.0 reports. Forbids the agent from writing functional code before a test safety net exists.",
   "author": {
     "name": "Alan Hernandez",

package/plugin/bundle/mcp-server.mjs

@@ -7358,6 +7358,52 @@ function countLines(source) {
 }
 
 // src/config.ts
+import { execFileSync } from "node:child_process";
+import { readlinkSync } from "node:fs";
+function isLiteralVarTemplate(value) {
+  if (value === void 0) return false;
+  return /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value.trim());
+}
+function sanitizeEnvPath(value) {
+  if (value === void 0 || value === "") return void 0;
+  if (isLiteralVarTemplate(value)) return void 0;
+  return value;
+}
+function readParentCwdDefault() {
+  try {
+    const ppid = process.ppid;
+    if (!ppid || ppid === 0) return void 0;
+    if (process.platform === "linux") {
+      return readlinkSync(`/proc/${ppid}/cwd`);
+    }
+    if (process.platform === "darwin") {
+      const output = execFileSync(
+        "lsof",
+        ["-a", "-p", String(ppid), "-d", "cwd", "-F", "n"],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 2e3
+        }
+      );
+      const match = output.match(/^n(.+)$/m);
+      return match?.[1];
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function discoverWorkspaceRoot(options = {}) {
+  const readParentCwd = options.readParentCwd ?? readParentCwdDefault;
+  const fromProjectDir = sanitizeEnvPath(process.env.CLAUDE_PROJECT_DIR);
+  if (fromProjectDir) return fromProjectDir;
+  const fromPluginRoot = sanitizeEnvPath(process.env.CLAUDE_CRAP_PLUGIN_ROOT);
+  if (fromPluginRoot) return fromPluginRoot;
+  const fromParent = sanitizeEnvPath(readParentCwd());
+  if (fromParent) return fromParent;
+  return process.cwd();
+}
 function parseNumber(name, raw, fallback) {
   if (raw === void 0 || raw === "") return fallback;
   const value = Number(raw);
@@ -7376,7 +7422,7 @@ function parseRating(raw, fallback) {
 }
 function loadConfig() {
   return {
-    pluginRoot: process.env.CLAUDE_CRAP_PLUGIN_ROOT ?? process.cwd(),
+    pluginRoot: discoverWorkspaceRoot(),
     sarifOutputDir: process.env.CLAUDE_CRAP_SARIF_OUTPUT_DIR ?? ".claude-crap/reports",
     crapThreshold: parseNumber("CLAUDE_CRAP_CRAP_THRESHOLD", process.env.CLAUDE_CRAP_CRAP_THRESHOLD, 30),
     cyclomaticMax: parseNumber("CLAUDE_CRAP_CYCLOMATIC_MAX", process.env.CLAUDE_CRAP_CYCLOMATIC_MAX, 15),