code-auditor-mcp 3.0.0 → 3.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -366
- package/dist/utils/fileDiscovery.d.ts.map +1 -1
- package/dist/utils/fileDiscovery.js +15 -6
- package/dist/utils/fileDiscovery.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,387 +1,42 @@
|
|
|
1
1
|
# Code Auditor
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Architectural invariants enforced inside your AI agent's edit loop. When the agent writes code that breaks a project rule, Code Auditor catches it and blocks the edit. The agent sees the rule's message and fixes itself.
|
|
4
4
|
|
|
5
|
-
##
|
|
6
|
-
|
|
7
|
-
Given this `.codeauditor.json` in the project root:
|
|
8
|
-
|
|
9
|
-
```json
|
|
10
|
-
{
|
|
11
|
-
"rules": [
|
|
12
|
-
{
|
|
13
|
-
"id": "no-lokijs",
|
|
14
|
-
"kind": "import-ban",
|
|
15
|
-
"severity": "critical",
|
|
16
|
-
"module": "lokijs",
|
|
17
|
-
"message": "lokijs was replaced by better-sqlite3 in v3.1.0. Use the SQLite-backed CodeIndexDB instead."
|
|
18
|
-
}
|
|
19
|
-
]
|
|
20
|
-
}
|
|
21
|
-
```
|
|
22
|
-
|
|
23
|
-
An agent writes `import loki from 'lokijs'` in `src/broken.ts`. The Claude Code plugin hook fires on the edit and runs:
|
|
24
|
-
|
|
25
|
-
```bash
|
|
26
|
-
code-audit changed --json --fail-on critical
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
The output:
|
|
30
|
-
|
|
31
|
-
```json
|
|
32
|
-
[
|
|
33
|
-
{
|
|
34
|
-
"analyzer": "documentation",
|
|
35
|
-
"rule": "file-documentation",
|
|
36
|
-
"severity": "warning",
|
|
37
|
-
"message": "File lacks proper documentation header",
|
|
38
|
-
"file": "src/broken.ts",
|
|
39
|
-
"line": 1,
|
|
40
|
-
"column": 1,
|
|
41
|
-
"enclosingSymbol": "",
|
|
42
|
-
"suggestion": "",
|
|
43
|
-
"details": ""
|
|
44
|
-
},
|
|
45
|
-
{
|
|
46
|
-
"analyzer": "invariants",
|
|
47
|
-
"rule": "no-lokijs",
|
|
48
|
-
"severity": "critical",
|
|
49
|
-
"message": "lokijs was replaced by better-sqlite3 in v3.1.0. Use the SQLite-backed CodeIndexDB instead.",
|
|
50
|
-
"file": "src/broken.ts",
|
|
51
|
-
"line": 4,
|
|
52
|
-
"column": 1,
|
|
53
|
-
"enclosingSymbol": "",
|
|
54
|
-
"suggestion": "",
|
|
55
|
-
"details": "import-ban"
|
|
56
|
-
},
|
|
57
|
-
{
|
|
58
|
-
"analyzer": "schema",
|
|
59
|
-
"rule": "unknown-table",
|
|
60
|
-
"severity": "warning",
|
|
61
|
-
"message": "Reference to unknown table 'lokijs'",
|
|
62
|
-
"file": "src/broken.ts",
|
|
63
|
-
"line": 4,
|
|
64
|
-
"column": 13,
|
|
65
|
-
"enclosingSymbol": "",
|
|
66
|
-
"suggestion": "",
|
|
67
|
-
"details": "Reference to unknown table 'lokijs'"
|
|
68
|
-
}
|
|
69
|
-
]
|
|
70
|
-
```
|
|
71
|
-
|
|
72
|
-
Exit code 2 (because a `critical` severity violation exists). The agent sees the violations, removes the import, and the next run is clean:
|
|
73
|
-
|
|
74
|
-
```bash
|
|
75
|
-
code-audit changed --quiet && echo "clean"
|
|
76
|
-
# → clean
|
|
77
|
-
```
|
|
78
|
-
|
|
79
|
-
The agent never sees a generic "something is wrong" — it sees your rule's exact message, with the file and line, and can fix it immediately.
|
|
80
|
-
|
|
81
|
-
## Quick start
|
|
82
|
-
|
|
83
|
-
### Claude Code plugin (two commands)
|
|
84
|
-
|
|
85
|
-
```bash
|
|
86
|
-
claude plugin marketplace add BenAHammond/code-auditor-mcp
|
|
87
|
-
claude plugin install code-auditor
|
|
88
|
-
```
|
|
89
|
-
|
|
90
|
-
The plugin registers a hook that runs `code-audit changed` after every edit. Violations at `critical` severity block the edit and give the agent your rule's message.
|
|
91
|
-
|
|
92
|
-
### Generic MCP
|
|
93
|
-
|
|
94
|
-
```bash
|
|
95
|
-
# Claude Code
|
|
96
|
-
claude mcp add code-auditor -- npx code-auditor-mcp
|
|
97
|
-
|
|
98
|
-
# Cursor (.cursor/mcp.json)
|
|
99
|
-
{
|
|
100
|
-
"mcpServers": {
|
|
101
|
-
"code-auditor": {
|
|
102
|
-
"command": "npx",
|
|
103
|
-
"args": ["code-auditor-mcp", "--stdio"]
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
}
|
|
107
|
-
```
|
|
108
|
-
|
|
109
|
-
MCP tools available: `audit`, `search`, `index`, `config`, `code_map`, `tasks`, `guide`.
|
|
110
|
-
|
|
111
|
-
> **Note: `--ignore-scripts` installs are unsupported.** Code Auditor depends on two native packages — `better-sqlite3` and `@ast-grep/napi` — that ship platform binaries via install scripts. Running `npm install` with `--ignore-scripts` prevents those binaries from downloading and the tool won't start. Stock npm doesn't use this flag by default; it is only active in security-hardened or CI environments that configure it intentionally. If your environment requires `--ignore-scripts`, run `npm install` without the flag first, or use `npm approve-scripts` (npm 11+) to allow the specific packages.
|
|
112
|
-
|
|
113
|
-
### CLI
|
|
5
|
+
## Install
|
|
114
6
|
|
|
115
7
|
```bash
|
|
116
|
-
|
|
117
|
-
npx code-audit -f json # JSON for CI/CD
|
|
118
|
-
npx code-audit -f sarif # SARIF for GitHub Code Scanning
|
|
119
|
-
npx code-audit changed --json # diff-scoped audit
|
|
120
|
-
npx code-audit map -p . # codebase map to stdout
|
|
121
|
-
npx code-audit search "calls:validate" # search the index
|
|
8
|
+
npm install code-auditor-mcp
|
|
122
9
|
```
|
|
123
10
|
|
|
124
|
-
|
|
11
|
+
Then tell your agent to set it up:
|
|
125
12
|
|
|
126
|
-
|
|
13
|
+
## Prompt examples
|
|
127
14
|
|
|
128
|
-
|
|
15
|
+
**"Add a Claude Code hook that runs `code-audit changed --stdin --json --fail-on critical` on Write and Edit."**
|
|
129
16
|
|
|
130
|
-
|
|
17
|
+
**"Create a `.codeauditor.json` that bans lodash imports and prevents `src/languages/` from importing anything in `src/analyzers/`."**
|
|
131
18
|
|
|
132
|
-
|
|
133
|
-
{
|
|
134
|
-
"id": "no-lokijs",
|
|
135
|
-
"kind": "import-ban",
|
|
136
|
-
"severity": "critical",
|
|
137
|
-
"module": "lokijs",
|
|
138
|
-
"message": "lokijs was replaced by better-sqlite3 in v3.1.0."
|
|
139
|
-
}
|
|
140
|
-
```
|
|
141
|
-
|
|
142
|
-
Optional `except` field exempts specific files from the ban.
|
|
19
|
+
**"Run a full code audit and create tasks from the violations."**
|
|
143
20
|
|
|
144
|
-
|
|
21
|
+
**"Sync the code index and audit only what changed vs main."**
|
|
145
22
|
|
|
146
|
-
|
|
23
|
+
**"Add an ast-pattern rule that blocks `new Function(...)`."**
|
|
147
24
|
|
|
148
|
-
|
|
149
|
-
{
|
|
150
|
-
"id": "payment-calls-auth",
|
|
151
|
-
"kind": "call-constraint",
|
|
152
|
-
"severity": "critical",
|
|
153
|
-
"callee": "src/services/paymentService.ts#chargeCustomer",
|
|
154
|
-
"allowFrom": ["src/api/**"],
|
|
155
|
-
"message": "chargeCustomer() may only be called from API route handlers."
|
|
156
|
-
}
|
|
157
|
-
```
|
|
25
|
+
**"Add a naming rule requiring hooks in `src/hooks/` to start with `use`."**
|
|
158
26
|
|
|
159
|
-
|
|
27
|
+
**"Add a call-constraint so `chargeCustomer()` in `src/services/payment.ts` can only be called from `src/api/`."**
|
|
160
28
|
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
```json
|
|
164
|
-
{
|
|
165
|
-
"id": "languages-no-analyzers",
|
|
166
|
-
"kind": "module-boundary",
|
|
167
|
-
"severity": "critical",
|
|
168
|
-
"from": "src/languages/**",
|
|
169
|
-
"to": "src/analyzers/**",
|
|
170
|
-
"message": "The languages/ module must not depend on analyzers."
|
|
171
|
-
}
|
|
172
|
-
```
|
|
173
|
-
|
|
174
|
-
### naming
|
|
175
|
-
|
|
176
|
-
Enforce naming conventions for exported symbols in specific directories.
|
|
177
|
-
|
|
178
|
-
```json
|
|
179
|
-
{
|
|
180
|
-
"id": "hook-prefix",
|
|
181
|
-
"kind": "naming",
|
|
182
|
-
"severity": "warning",
|
|
183
|
-
"path": "src/hooks/**",
|
|
184
|
-
"exports": "^use[A-Z]",
|
|
185
|
-
"message": "Hooks in src/hooks/ must be prefixed with 'use'."
|
|
186
|
-
}
|
|
187
|
-
```
|
|
188
|
-
|
|
189
|
-
### ast-pattern
|
|
190
|
-
|
|
191
|
-
Match AST node patterns in source using ast-grep. This example bans `new Function(...)` — eval-by-another-name that bypasses static analysis.
|
|
192
|
-
|
|
193
|
-
```json
|
|
194
|
-
{
|
|
195
|
-
"id": "no-new-function",
|
|
196
|
-
"kind": "ast-pattern",
|
|
197
|
-
"severity": "critical",
|
|
198
|
-
"pattern": "new Function($$$)",
|
|
199
|
-
"message": "new Function() is eval-by-another-name — forbidden in this codebase"
|
|
200
|
-
}
|
|
201
|
-
```
|
|
202
|
-
|
|
203
|
-
Optional `language` field restricts to `"typescript"`, `"javascript"`, or `"go"`. Optional `path` field restricts to files matching a glob.
|
|
204
|
-
|
|
205
|
-
Rules are validated on startup — bad globs, duplicate IDs, missing fields, or mutually-exclusive options fail the audit rather than being silently skipped. Use `config rules_list` and `config rules_check` from the MCP server to introspect the rules your agent is operating under.
|
|
206
|
-
|
|
207
|
-
## Analyzers
|
|
208
|
-
|
|
209
|
-
Six built-in code quality analyzers run alongside invariant rules:
|
|
210
|
-
|
|
211
|
-
| Analyzer | What it detects |
|
|
212
|
-
|----------|----------------|
|
|
213
|
-
| **SOLID** | God classes, long methods, too many parameters, dependency inversion violations |
|
|
214
|
-
| **DRY** | Near-duplicate blocks across files using normalized token comparison |
|
|
215
|
-
| **React** | Missing key props, unused state, useEffect dependency issues, component size |
|
|
216
|
-
| **Documentation** | Missing or insufficient JSDoc on exported functions, classes, and parameters |
|
|
217
|
-
| **Data Access** | Raw SQL queries missing parameterization, N+1 query patterns |
|
|
218
|
-
| **Schema** | Zod/JSON Schema validation gaps on API boundaries |
|
|
219
|
-
|
|
220
|
-
Each analyzer's thresholds are configurable via `config.set` in the MCP server or via `.codeauditor.json`:
|
|
221
|
-
|
|
222
|
-
```json
|
|
223
|
-
{
|
|
224
|
-
"analyzerConfigs": {
|
|
225
|
-
"dry": { "similarityThreshold": 0.8, "minLineThreshold": 5 },
|
|
226
|
-
"solid": { "maxMethodsPerClass": 12, "maxParametersPerMethod": 4 }
|
|
227
|
-
}
|
|
228
|
-
}
|
|
229
|
-
```
|
|
230
|
-
|
|
231
|
-
## Diff-scoped auditing and hooks
|
|
232
|
-
|
|
233
|
-
`code-audit changed` audits only the functions whose content has changed since the last index sync. It is fast enough to sit inside an agent's edit loop.
|
|
234
|
-
|
|
235
|
-
### Scope options
|
|
236
|
-
|
|
237
|
-
| Scope | Description |
|
|
238
|
-
|-------|-------------|
|
|
239
|
-
| `changed` (default) | Files modified since last index sync |
|
|
240
|
-
| `git:<ref>` | Files changed vs. a git ref (`git:origin/main`) |
|
|
241
|
-
| `[paths...]` | Specific files or directories |
|
|
242
|
-
| `--stdin` | Read file paths from stdin (one per line) |
|
|
243
|
-
|
|
244
|
-
### Hook contract
|
|
245
|
-
|
|
246
|
-
```bash
|
|
247
|
-
# Audit changed files, output JSON, exit 2 on critical violations
|
|
248
|
-
code-audit changed --json --fail-on critical
|
|
249
|
-
|
|
250
|
-
# Audit specific files from stdin
|
|
251
|
-
git diff --name-only HEAD | code-audit changed --stdin --json
|
|
252
|
-
|
|
253
|
-
# Quiet mode: no output when clean
|
|
254
|
-
code-audit changed --quiet && echo "clean"
|
|
255
|
-
```
|
|
256
|
-
|
|
257
|
-
| Flag | Description |
|
|
258
|
-
|------|-------------|
|
|
259
|
-
| `--json` | Machine-readable violation array to stdout |
|
|
260
|
-
| `--quiet` | Suppress output when zero violations |
|
|
261
|
-
| `--fail-on <severity>` | Nonzero exit (code 2) when violations at or above severity exist. Default: `critical` |
|
|
262
|
-
| `--stdin` | Read file paths from stdin, one per line |
|
|
263
|
-
|
|
264
|
-
### Claude Code hook recipe
|
|
265
|
-
|
|
266
|
-
In `.claude/settings.json`:
|
|
267
|
-
|
|
268
|
-
```json
|
|
269
|
-
{
|
|
270
|
-
"hooks": {
|
|
271
|
-
"PostToolUse": [
|
|
272
|
-
{
|
|
273
|
-
"matcher": "Write|Edit",
|
|
274
|
-
"command": "cat - | code-audit changed --stdin --json --fail-on critical"
|
|
275
|
-
}
|
|
276
|
-
]
|
|
277
|
-
}
|
|
278
|
-
}
|
|
279
|
-
```
|
|
280
|
-
|
|
281
|
-
## Code intelligence
|
|
282
|
-
|
|
283
|
-
A searchable index of every function, component, struct, and dependency is maintained as supporting infrastructure for AI assistants. It is built during audits and synced on file changes.
|
|
284
|
-
|
|
285
|
-
### Search operators
|
|
286
|
-
|
|
287
|
-
| What you want | Query |
|
|
288
|
-
|--------------|-------|
|
|
289
|
-
| Complex functions | `complexity:>10` |
|
|
290
|
-
| Go functions only | `lang:go` |
|
|
291
|
-
| React components | `component:functional` |
|
|
292
|
-
| Functions calling a specific function | `calls:validateUser` |
|
|
293
|
-
| Exported but undocumented | `exported:true jsdoc:false` |
|
|
294
|
-
| Find by name | `name:validateEmail` |
|
|
295
|
-
| Unused imports | `unused-imports file:src` |
|
|
296
|
-
| Go structs | `lang:go entity:struct` |
|
|
297
|
-
| Functions with a specific dependency | `dep:lodash` |
|
|
298
|
-
|
|
299
|
-
### Code maps
|
|
300
|
-
|
|
301
|
-
`code-audit map` generates a human-readable file tree with function annotations, complexity scores, and dependency arrows. In the MCP server, `code_map.get` returns this as structured data.
|
|
302
|
-
|
|
303
|
-
### Task queue
|
|
304
|
-
|
|
305
|
-
The `tasks` MCP tool maintains a per-project task list in the local database (titles, status, priorities, due dates, blockers, related files/symbols). `tasks from_audit` populates the task queue from audit violations — each critical issue becomes a task with file locations and fix suggestions. Tasks survive `index reset`: clearing the analysis index does not delete your task list.
|
|
306
|
-
|
|
307
|
-
## CI and SARIF
|
|
308
|
-
|
|
309
|
-
Upload audit results to GitHub Code Scanning so violations appear as PR annotations:
|
|
310
|
-
|
|
311
|
-
```yaml
|
|
312
|
-
# .github/workflows/code-audit.yml
|
|
313
|
-
name: Code Audit
|
|
314
|
-
|
|
315
|
-
on:
|
|
316
|
-
push:
|
|
317
|
-
branches: [main]
|
|
318
|
-
pull_request:
|
|
319
|
-
branches: [main]
|
|
320
|
-
|
|
321
|
-
jobs:
|
|
322
|
-
audit:
|
|
323
|
-
runs-on: ubuntu-latest
|
|
324
|
-
steps:
|
|
325
|
-
- uses: actions/checkout@v4
|
|
326
|
-
|
|
327
|
-
- uses: actions/setup-node@v4
|
|
328
|
-
with:
|
|
329
|
-
node-version: '20'
|
|
330
|
-
|
|
331
|
-
- name: Run code audit
|
|
332
|
-
run: npx code-auditor-mcp -f sarif -o results.sarif
|
|
333
|
-
|
|
334
|
-
- name: Upload SARIF to GitHub
|
|
335
|
-
uses: github/codeql-action/upload-sarif@v3
|
|
336
|
-
with:
|
|
337
|
-
sarif_file: results.sarif
|
|
338
|
-
```
|
|
339
|
-
|
|
340
|
-
For diff-scoped PR runs, use `changed --scope git:origin/main -f sarif` and pass `--sarif-category` to the upload action so scoped results don't overwrite full-branch results.
|
|
341
|
-
|
|
342
|
-
## Configuration
|
|
343
|
-
|
|
344
|
-
### Persistent analyzer settings
|
|
345
|
-
|
|
346
|
-
Set custom thresholds via the MCP `config` tool:
|
|
347
|
-
|
|
348
|
-
```
|
|
349
|
-
config.set analyzerName="solid" config={"maxMethodsPerClass":12}
|
|
350
|
-
```
|
|
351
|
-
|
|
352
|
-
Settings persist across audits and survive index resets.
|
|
353
|
-
|
|
354
|
-
### Data directory
|
|
355
|
-
|
|
356
|
-
The index file defaults to `<cwd>/.code-index/index.db`. Point at a dedicated location with the `CODE_AUDITOR_DATA_DIR` environment variable:
|
|
357
|
-
|
|
358
|
-
```bash
|
|
359
|
-
# Environment variable
|
|
360
|
-
CODE_AUDITOR_DATA_DIR=/path/to/data code-audit
|
|
361
|
-
|
|
362
|
-
# CLI
|
|
363
|
-
code-auditor-mcp --data-dir /path/to/data
|
|
364
|
-
```
|
|
365
|
-
|
|
366
|
-
Cursor `.cursor/mcp.json` example:
|
|
367
|
-
|
|
368
|
-
```json
|
|
369
|
-
{
|
|
370
|
-
"mcpServers": {
|
|
371
|
-
"code-auditor": {
|
|
372
|
-
"command": "npx",
|
|
373
|
-
"args": ["code-auditor-mcp", "--stdio"],
|
|
374
|
-
"env": {
|
|
375
|
-
"CODE_AUDITOR_DATA_DIR": "/Users/you/Library/Application Support/code-auditor"
|
|
376
|
-
}
|
|
377
|
-
}
|
|
378
|
-
}
|
|
379
|
-
}
|
|
380
|
-
```
|
|
29
|
+
## Rule kinds
|
|
381
30
|
|
|
382
|
-
|
|
31
|
+
Five kinds. The agent writes them to `.codeauditor.json`. Bad configs fail the audit, not silently.
|
|
383
32
|
|
|
384
|
-
|
|
33
|
+
| Kind | What it blocks |
|
|
34
|
+
|------|---------------|
|
|
35
|
+
| `import-ban` | Banned module imports |
|
|
36
|
+
| `call-constraint` | Function calls from unauthorized files |
|
|
37
|
+
| `module-boundary` | Imports across module boundaries |
|
|
38
|
+
| `naming` | Exported symbols not matching a pattern |
|
|
39
|
+
| `ast-pattern` | AST nodes matching an ast-grep pattern |
|
|
385
40
|
|
|
386
41
|
## License
|
|
387
42
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fileDiscovery.d.ts","sourceRoot":"","sources":["../../src/utils/fileDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,eAAO,MAAM,qBAAqB,UAcjC,CAAC;AAGF,eAAO,MAAM,qBAAqB,UAAkB,CAAC;AACrD,eAAO,MAAM,qBAAqB,UAAkB,CAAC;AACrD,eAAO,MAAM,eAAe,UAAY,CAAC;AACzC,eAAO,MAAM,aAAa,UAAU,CAAC;AACrC,eAAO,MAAM,cAAc,UAA6F,CAAC;AAEzH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;
|
|
1
|
+
{"version":3,"file":"fileDiscovery.d.ts","sourceRoot":"","sources":["../../src/utils/fileDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,eAAO,MAAM,qBAAqB,UAcjC,CAAC;AAGF,eAAO,MAAM,qBAAqB,UAAkB,CAAC;AACrD,eAAO,MAAM,qBAAqB,UAAkB,CAAC;AACrD,eAAO,MAAM,eAAe,UAAY,CAAC;AACzC,eAAO,MAAM,aAAa,UAAU,CAAC;AACrC,eAAO,MAAM,cAAc,UAA6F,CAAC;AAEzH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA8DD;;GAEG;AACH,wBAAsB,SAAS,CAC7B,OAAO,GAAE,MAAsB,EAC/B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,MAAsB,EAC/B,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAM,GACrD,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,MAAsB,EAC/B,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAM,GACrD,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,GAAE,MAAsB,EAC/B,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAM,GACrD,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,YAAgB,EAC/B,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAuBnB;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GACL,MAAM,EAAE,CA0BV;AAaD;;GAEG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,IAAI,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAiBD;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvE;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,kBAAY,CAAC"}
|
|
@@ -30,10 +30,17 @@ export const JSON_EXTENSIONS = ['.json'];
|
|
|
30
30
|
export const GO_EXTENSIONS = ['.go'];
|
|
31
31
|
export const ALL_EXTENSIONS = [...TYPESCRIPT_EXTENSIONS, ...JAVASCRIPT_EXTENSIONS, ...JSON_EXTENSIONS, ...GO_EXTENSIONS];
|
|
32
32
|
/**
|
|
33
|
-
* Check if a path should be excluded based on directory names
|
|
33
|
+
* Check if a path should be excluded based on directory names.
|
|
34
|
+
* Only checks directory components *below* the scan root to avoid
|
|
35
|
+
* false matches against filesystem roots like /tmp or /temp.
|
|
34
36
|
*/
|
|
35
|
-
function shouldExcludeDir(filePath, excludeDirs) {
|
|
36
|
-
|
|
37
|
+
function shouldExcludeDir(filePath, excludeDirs, scanRoot) {
|
|
38
|
+
// Get the relative path below scanRoot
|
|
39
|
+
const relPath = path.relative(scanRoot, filePath);
|
|
40
|
+
// If the path is outside scanRoot (shouldn't happen), don't exclude
|
|
41
|
+
if (relPath.startsWith('..'))
|
|
42
|
+
return false;
|
|
43
|
+
const parts = relPath.split(path.sep);
|
|
37
44
|
return parts.some(part => excludeDirs.includes(part));
|
|
38
45
|
}
|
|
39
46
|
/**
|
|
@@ -45,7 +52,7 @@ async function findFilesRecursive(dir, options) {
|
|
|
45
52
|
const entries = await fs.readdir(dir, { withFileTypes: true });
|
|
46
53
|
for (const entry of entries) {
|
|
47
54
|
const fullPath = path.join(dir, entry.name);
|
|
48
|
-
if (shouldExcludeDir(fullPath, options.excludeDirs)) {
|
|
55
|
+
if (shouldExcludeDir(fullPath, options.excludeDirs, options.scanRoot)) {
|
|
49
56
|
continue;
|
|
50
57
|
}
|
|
51
58
|
if (entry.isDirectory()) {
|
|
@@ -78,7 +85,8 @@ export async function findFiles(rootDir = process.cwd(), options = {}) {
|
|
|
78
85
|
const excludeDirs = options.excludeDirs || DEFAULT_EXCLUDED_DIRS;
|
|
79
86
|
const files = await findFilesRecursive(rootDir, {
|
|
80
87
|
extensions,
|
|
81
|
-
excludeDirs
|
|
88
|
+
excludeDirs,
|
|
89
|
+
scanRoot: rootDir
|
|
82
90
|
});
|
|
83
91
|
// Apply additional filtering
|
|
84
92
|
let filtered = filterFiles(files, {
|
|
@@ -128,7 +136,8 @@ export async function findFilesByPattern(rootDir = process.cwd(), pattern, optio
|
|
|
128
136
|
const files = await findFilesRecursive(rootDir, {
|
|
129
137
|
extensions,
|
|
130
138
|
excludeDirs,
|
|
131
|
-
pattern: regex
|
|
139
|
+
pattern: regex,
|
|
140
|
+
scanRoot: rootDir
|
|
132
141
|
});
|
|
133
142
|
// Apply additional filtering
|
|
134
143
|
let filtered = filterFiles(files, {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fileDiscovery.js","sourceRoot":"","sources":["../../src/utils/fileDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,+CAA+C;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,cAAc;IACd,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC;AAEF,4BAA4B;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,qBAAqB,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,CAAC;AAUzH
|
|
1
|
+
{"version":3,"file":"fileDiscovery.js","sourceRoot":"","sources":["../../src/utils/fileDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,+CAA+C;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,cAAc;IACd,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC;AAEF,4BAA4B;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,qBAAqB,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,CAAC;AAUzH;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,WAAqB,EAAE,QAAgB;IACjF,uCAAuC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,oEAAoE;IACpE,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAW,EACX,OAKC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtE,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0CAA0C;QAC1C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAO,GAAW,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAO,GAAyB,EAAE;IAElC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE;QAC9C,UAAU;QACV,WAAW;QACX,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IAEH,6BAA6B;IAC7B,IAAI,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAO,GAAW,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAO,GAA6C,EAAE;IAEtD,OAAO,SAAS,CAAC,OAAO,EAAE;QACxB,GAAG,OAAO;QACV,UAAU,EAAE,qBAAqB;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAO,GAAW,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAO,GAA6C,EAAE;IAEtD,OAAO,SAAS,CAAC,OAAO,EAAE;QACxB,GAAG,OAAO;QACV,UAAU,EAAE,qBAAqB;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAO,GAAW,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAO,GAA6C,EAAE;IAEtD,OAAO,SAAS,CAAC,OAAO,EAAE;QACxB,GAAG,OAAO;QACV,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAO,GAAW,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAwB,EACxB,OAAO,GAAyB,EAAE;IAElC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAEjE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ;QACvC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE;QAC9C,UAAU;QACV,WAAW;QACX,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IAEH,6BAA6B;IAC7B,IAAI,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,KAAe,EACf,OAAO,GAGH,EAAE;IAEN,IAAI,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAE1B,yBAAyB;IACzB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAChC,OAAO,OAAO,CAAC,YAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBAC1C,iCAAiC;gBACjC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;gBACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAChC,OAAO,CAAC,OAAO,CAAC,YAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBAC3C,iCAAiC;gBACjC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;gBACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,iDAAiD;IACjD,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACzD,kCAAkC;IAClC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IAKjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEtC,6BAA6B;IAC7B,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,KAAK;QACrB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "code-auditor-mcp",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.1",
|
|
4
4
|
"description": "Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|