code-auditor-mcp 3.0.5 → 3.0.7

package/dist/hooks/codex.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/**
+ * Codex hook adapter — `code-audit codex-hook`.
+ *
+ * Reads Codex's PostToolUse stdin JSON and runs a diff-scoped audit.
+ *
+ * Phase 0 verification (2026-07-19):
+ *   - Source: learn.chatgpt.com/docs/hooks
+ *   - PostToolUse is BLOCKING: exit 2 replaces the tool result with feedback
+ *   - Matcher in hooks.json: "apply_patch" (Codex's file-editing tool)
+ *   - stdin shape: { session_id, tool_name, tool_use_id, tool_input, tool_response }
+ *   - tool_input.file_path contains the edited file
+ *
+ * Exit codes:
+ *   0 — no critical violations found
+ *   2 — critical violations found (blocking feedback loop)
+ *   1 — internal error (adapter crash, not violation-related)
+ */
+import { readStdin, runHookAudit } from './core.js';
+import chalk from 'chalk';
+async function main() {
+    const raw = await readStdin();
+    if (!raw) {
+        // No stdin data — nothing to audit
+        process.exit(0);
+    }
+    let event;
+    try {
+        event = JSON.parse(raw);
+    }
+    catch {
+        console.error(chalk.red('[code-auditor codex-hook] Failed to parse stdin JSON'));
+        process.exit(0); // Degrade gracefully
+    }
+    const filePath = event.tool_input?.file_path || event.tool_input?.path;
+    if (!filePath) {
+        // No file path — nothing to audit
+        process.exit(0);
+    }
+    const projectRoot = process.cwd();
+    try {
+        const output = await runHookAudit({
+            filePaths: [filePath],
+            projectRoot,
+            failOn: 'critical',
+        });
+        if (output.violations.length > 0) {
+            // Codex PostToolUse: exit 2 replaces tool result with feedback
+            // Write violations as JSON to stdout — Codex feeds this back to the agent
+            const criticals = output.violations.filter((v) => v.severity === 'critical');
+            if (criticals.length > 0) {
+                const feedback = {
+                    decision: 'block',
+                    reason: `code-auditor found ${criticals.length} critical violation(s)`,
+                    violations: output.violations.map((v) => ({
+                        severity: v.severity,
+                        message: v.message,
+                        file: v.file,
+                        line: v.line,
+                        rule: v.rule,
+                        suggestion: v.suggestion || null,
+                    })),
+                };
+                process.stdout.write(JSON.stringify(feedback, null, 2) + '\n');
+                process.exit(2);
+            }
+            // Non-critical violations: report but don't block
+            const warnings = output.violations.filter((v) => v.severity === 'warning');
+            if (warnings.length > 0) {
+                const advisory = {
+                    decision: 'allow',
+                    warnings: warnings.map((v) => ({
+                        message: v.message,
+                        file: v.file,
+                        line: v.line,
+                        suggestion: v.suggestion || null,
+                    })),
+                };
+                process.stdout.write(JSON.stringify(advisory, null, 2) + '\n');
+            }
+        }
+        process.exit(0);
+    }
+    catch (error) {
+        // Internal error — report and exit 0 (never wedge the agent loop on errors)
+        console.error(chalk.red(`[code-auditor codex-hook] Error: ${error instanceof Error ? error.message : String(error)}`));
+        process.exit(0);
+    }
+}
+main();
+//# sourceMappingURL=codex.js.map

package/dist/hooks/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/hooks/codex.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,MAAM,OAAO,CAAC;AAc1B,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAE9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,mCAAmC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,KAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,KAAM,CAAC,UAAU,EAAE,SAAS,IAAI,KAAM,CAAC,UAAU,EAAE,IAAI,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,kCAAkC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,WAAW;YACX,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,+DAA+D;YAC/D,0EAA0E;YAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;YAE7E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG;oBACf,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,sBAAsB,SAAS,CAAC,MAAM,wBAAwB;oBACtE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACxC,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;qBACjC,CAAC,CAAC;iBACJ,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,kDAAkD;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG;oBACf,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;qBACjC,CAAC,CAAC;iBACJ,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACvH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/hooks/core.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Shared hook adapter core — reads stdin, runs a diff-scoped audit, writes stdout.
+ *
+ * Each tool's hook adapter (cursor.ts, codex.ts) is a thin payload mapper that:
+ * 1. Reads the tool-specific stdin JSON
+ * 2. Extracts edited file paths
+ * 3. Calls runHookAudit() with those paths
+ * 4. Maps audit results back to the tool's stdout contract
+ *
+ * Phase 0 live-docs verification (2026-07-20):
+ *   - Cursor postToolUse (Write matcher): BLOCKING (exit 2, additional_context)
+ *     Verified: cursor.com/docs/hooks + cursor.com/docs/reference/third-party-hooks
+ *   - Cursor afterFileEdit: EXISTS but observation-only — NOT used for blocking
+ *   - Codex PostToolUse: blocking (exit 2 replaces tool result with feedback)
+ *     Verified: learn.chatgpt.com/docs/extend/hooks
+ *   - Claude Code PostToolUse: blocking (exit 2 blocks the edit)
+ *     Cursor reads .claude/settings.json natively via third-party hooks compat
+ */
+import type { Severity } from '../types.js';
+export interface HookAuditInput {
+    filePaths: string[];
+    projectRoot: string;
+    failOn: Severity;
+}
+export interface HookViolation {
+    analyzer: string;
+    rule: string;
+    severity: Severity;
+    message: string;
+    file: string;
+    line?: number;
+    column?: number;
+    endLine?: number;
+    endColumn?: number;
+    enclosingSymbol?: string;
+    suggestion?: string;
+    details?: string;
+}
+export interface HookAuditOutput {
+    violations: HookViolation[];
+    summary: {
+        total: number;
+        critical: number;
+        warning: number;
+        suggestion: number;
+    };
+    filesAnalyzed: number;
+}
+/**
+ * Read all of stdin as a string. Returns empty string on EOF/error.
+ */
+export declare function readStdin(): Promise<string>;
+/**
+ * Run a diff-scoped audit on the given file paths.
+ * This is the shared core — all hook adapters call this.
+ */
+export declare function runHookAudit(input: HookAuditInput): Promise<HookAuditOutput>;
+/**
+ * Check if violations at or above failOn severity exist.
+ */
+export declare function hasViolationsAtOrAbove(violations: HookViolation[], failOn: Severity): boolean;
+//# sourceMappingURL=core.d.ts.map

package/dist/hooks/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/hooks/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,aAAa,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CA+BjD;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA4DlF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,aAAa,EAAE,EAC3B,MAAM,EAAE,QAAQ,GACf,OAAO,CAOT"}

package/dist/hooks/core.js

@@ -0,0 +1,119 @@
+/**
+ * Shared hook adapter core — reads stdin, runs a diff-scoped audit, writes stdout.
+ *
+ * Each tool's hook adapter (cursor.ts, codex.ts) is a thin payload mapper that:
+ * 1. Reads the tool-specific stdin JSON
+ * 2. Extracts edited file paths
+ * 3. Calls runHookAudit() with those paths
+ * 4. Maps audit results back to the tool's stdout contract
+ *
+ * Phase 0 live-docs verification (2026-07-20):
+ *   - Cursor postToolUse (Write matcher): BLOCKING (exit 2, additional_context)
+ *     Verified: cursor.com/docs/hooks + cursor.com/docs/reference/third-party-hooks
+ *   - Cursor afterFileEdit: EXISTS but observation-only — NOT used for blocking
+ *   - Codex PostToolUse: blocking (exit 2 replaces tool result with feedback)
+ *     Verified: learn.chatgpt.com/docs/extend/hooks
+ *   - Claude Code PostToolUse: blocking (exit 2 blocks the edit)
+ *     Cursor reads .claude/settings.json natively via third-party hooks compat
+ */
+import { createInterface } from 'node:readline';
+import { resolve } from 'node:path';
+import { createAuditRunner } from '../auditRunner.js';
+import { initParsers } from '../languages/index.js';
+/**
+ * Read all of stdin as a string. Returns empty string on EOF/error.
+ */
+export async function readStdin() {
+    return new Promise((resolve) => {
+        // If stdin is a TTY, there's nothing to read
+        if (process.stdin.isTTY) {
+            resolve('');
+            return;
+        }
+        const rl = createInterface({
+            input: process.stdin,
+            output: undefined,
+            terminal: false,
+        });
+        const lines = [];
+        rl.on('line', (line) => {
+            lines.push(line);
+        });
+        rl.on('close', () => {
+            resolve(lines.join('\n'));
+        });
+        rl.on('error', () => {
+            resolve(lines.join('\n'));
+        });
+        // Timeout: if nothing arrives in 5s, assume no input
+        setTimeout(() => {
+            rl.close();
+            resolve(lines.join('\n'));
+        }, 5000).unref();
+    });
+}
+/**
+ * Run a diff-scoped audit on the given file paths.
+ * This is the shared core — all hook adapters call this.
+ */
+export async function runHookAudit(input) {
+    // Initialize parsers (idempotent once loaded)
+    await initParsers();
+    if (input.filePaths.length === 0) {
+        return {
+            violations: [],
+            summary: { total: 0, critical: 0, warning: 0, suggestion: 0 },
+            filesAnalyzed: 0,
+        };
+    }
+    // Convert to absolute paths
+    const resolvedPaths = [...new Set(input.filePaths.map((f) => resolve(input.projectRoot, f)))];
+    // Create runner with the resolved scope
+    const runner = createAuditRunner({
+        projectRoot: input.projectRoot,
+        scope: resolvedPaths,
+        analyzerConcurrency: 4,
+    });
+    const result = await runner.run();
+    // Collect all violations
+    const allViolations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+    const violations = allViolations.map((v) => ({
+        analyzer: v.analyzer || '',
+        rule: v.rule || v.type || '',
+        severity: v.severity,
+        message: v.message,
+        file: v.file || '',
+        line: v.line ?? v.start?.line,
+        column: v.column ?? v.start?.column ?? 1,
+        endLine: v.end?.line,
+        endColumn: v.end?.column,
+        enclosingSymbol: v.symbol || v.enclosingFunction || '',
+        suggestion: v.suggestion || '',
+        details: v.details || '',
+    }));
+    const criticalCount = violations.filter((v) => v.severity === 'critical').length;
+    const warningCount = violations.filter((v) => v.severity === 'warning').length;
+    const suggestionCount = violations.filter((v) => v.severity === 'suggestion').length;
+    return {
+        violations,
+        summary: {
+            total: violations.length,
+            critical: criticalCount,
+            warning: warningCount,
+            suggestion: suggestionCount,
+        },
+        filesAnalyzed: result.metadata.filesAnalyzed,
+    };
+}
+/**
+ * Check if violations at or above failOn severity exist.
+ */
+export function hasViolationsAtOrAbove(violations, failOn) {
+    const severityOrder = ['critical', 'warning', 'suggestion'];
+    const failIndex = severityOrder.indexOf(failOn);
+    return violations.some((v) => {
+        const vIndex = severityOrder.indexOf(v.severity);
+        return vIndex >= 0 && vIndex <= failIndex;
+    });
+}
+//# sourceMappingURL=core.js.map

package/dist/hooks/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/hooks/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAmCpD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,6CAA6C;QAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,SAAgB;YACxB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,qDAAqD;QACrD,UAAU,CAAC,GAAG,EAAE;YACd,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAqB;IACtD,8CAA8C;IAC9C,MAAM,WAAW,EAAE,CAAC;IAEpB,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;YAC7D,aAAa,EAAE,CAAC;SACjB,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1D,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAC9B,CAAC,CAAC,CAAC;IAEJ,wCAAwC;IACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,aAAsC;QAC7C,mBAAmB,EAAE,CAAC;KACvB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IAElC,yBAAyB;IACzB,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CACjE,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAC/B,CAAC;IAEF,MAAM,UAAU,GAAoB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;QACxC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM;QACxB,eAAe,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,iBAAiB,IAAI,EAAE;QACtD,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;KACzB,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACjF,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;IAErF,OAAO;QACL,UAAU;QACV,OAAO,EAAE;YACP,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,eAAe;SAC5B;QACD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA2B,EAC3B,MAAgB;IAEhB,MAAM,aAAa,GAAe,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,SAAS,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/hooks/cursor.d.ts

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * Cursor hook adapter — `code-audit cursor-hook`.
+ *
+ * Reads Cursor's postToolUse stdin JSON (native or Claude Code compat) and
+ * runs a scoped audit on edited files. Blocks edits with critical violations.
+ *
+ * Phase 0 verification (2026-07-20):
+ *   - Source: cursor.com/docs/hooks + cursor.com/docs/reference/third-party-hooks
+ *   - postToolUse with Write matcher IS BLOCKING: exit 2 blocks the action
+ *   - additional_context is injected into the conversation after the tool result
+ *   - afterFileEdit EXISTS but is observation-only ("No output fields defined")
+ *   - Cursor natively reads .claude/settings.json hooks (PostToolUse→postToolUse)
+ *   - Tool name mapping: Edit→Write, Bash→Shell
+ *   - Dual response format support: both Claude nested format and Cursor flat format
+ *
+ * Input formats (both accepted):
+ *   Cursor native: { tool_name, tool_input, tool_output, tool_use_id, cwd, ... }
+ *   Claude Code compat: { tool_name, tool_input, tool_output, session_id, cwd, ... }
+ *   (CLAUDE_PROJECT_DIR env var set in Claude Code compat mode)
+ *
+ * Exit codes:
+ *   0 — no critical violations found
+ *   2 — critical violations found (blocks the action, additional_context injected)
+ *   1 — internal error (adapter crash, not violation-related)
+ */
+import type { HookAuditOutput } from './core.js';
+export interface CursorPostToolUse {
+    tool_name?: string;
+    tool_input?: Record<string, unknown>;
+    tool_output?: unknown;
+    tool_use_id?: string;
+    toolName?: string;
+    toolInput?: Record<string, unknown>;
+    toolOutput?: unknown;
+    session_id?: string;
+    transcript_path?: string;
+    cwd?: string;
+}
+export interface CursorHookResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Detect whether this is a Write/Edit tool invocation we should audit.
+ */
+export declare function isWriteOrEdit(event: CursorPostToolUse): boolean;
+/**
+ * Extract the edited file path from tool_input.
+ * Cursor Write: tool_input.file_path
+ * Claude Code Edit: tool_input.file_path
+ */
+export declare function extractFilePath(event: CursorPostToolUse): string | null;
+/**
+ * Build the additional_context string for violations.
+ */
+export declare function formatViolationContext(output: HookAuditOutput): {
+    context: string;
+    isBlocking: boolean;
+};
+/**
+ * Process a Cursor postToolUse event and return the hook result.
+ * Extracted from main() for testability — tests inject a mock audit function.
+ */
+export declare function processCursorEvent(rawStdin: string, auditFn?: (filePaths: string[], projectRoot: string) => Promise<HookAuditOutput>): Promise<CursorHookResult>;
+/**
+ * CLI entry point — reads stdin, processes, writes result, exits.
+ * Exported so the CLI can call it explicitly after importing.
+ */
+export declare function main(): Promise<void>;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/hooks/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/hooks/cursor.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,MAAM,WAAW,iBAAiB;IAEhC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAK/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAQvE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB,CAgDA;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAChB,GAC7D,OAAO,CAAC,gBAAgB,CAAC,CAyD3B;AAED;;;GAGG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAW1C"}

package/dist/hooks/cursor.js

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+/**
+ * Cursor hook adapter — `code-audit cursor-hook`.
+ *
+ * Reads Cursor's postToolUse stdin JSON (native or Claude Code compat) and
+ * runs a scoped audit on edited files. Blocks edits with critical violations.
+ *
+ * Phase 0 verification (2026-07-20):
+ *   - Source: cursor.com/docs/hooks + cursor.com/docs/reference/third-party-hooks
+ *   - postToolUse with Write matcher IS BLOCKING: exit 2 blocks the action
+ *   - additional_context is injected into the conversation after the tool result
+ *   - afterFileEdit EXISTS but is observation-only ("No output fields defined")
+ *   - Cursor natively reads .claude/settings.json hooks (PostToolUse→postToolUse)
+ *   - Tool name mapping: Edit→Write, Bash→Shell
+ *   - Dual response format support: both Claude nested format and Cursor flat format
+ *
+ * Input formats (both accepted):
+ *   Cursor native: { tool_name, tool_input, tool_output, tool_use_id, cwd, ... }
+ *   Claude Code compat: { tool_name, tool_input, tool_output, session_id, cwd, ... }
+ *   (CLAUDE_PROJECT_DIR env var set in Claude Code compat mode)
+ *
+ * Exit codes:
+ *   0 — no critical violations found
+ *   2 — critical violations found (blocks the action, additional_context injected)
+ *   1 — internal error (adapter crash, not violation-related)
+ */
+import { readStdin, runHookAudit } from './core.js';
+import chalk from 'chalk';
+/**
+ * Detect whether this is a Write/Edit tool invocation we should audit.
+ */
+export function isWriteOrEdit(event) {
+    const toolName = (event.tool_name || event.toolName || '').toLowerCase();
+    // Cursor native: "Write" (camelCase mapped). Claude Code compat: "Edit".
+    // Also accept "edit", "write" for robustness.
+    return toolName === 'write' || toolName === 'edit';
+}
+/**
+ * Extract the edited file path from tool_input.
+ * Cursor Write: tool_input.file_path
+ * Claude Code Edit: tool_input.file_path
+ */
+export function extractFilePath(event) {
+    const input = event.tool_input || event.toolInput;
+    if (!input)
+        return null;
+    const filePath = input.file_path;
+    if (filePath && typeof filePath === 'string')
+        return filePath;
+    return null;
+}
+/**
+ * Build the additional_context string for violations.
+ */
+export function formatViolationContext(output) {
+    const criticals = output.violations.filter((v) => v.severity === 'critical');
+    const warnings = output.violations.filter((v) => v.severity === 'warning');
+    const suggestions = output.violations.filter((v) => v.severity === 'suggestion');
+    if (criticals.length > 0) {
+        const lines = [
+            `🚨 **Code Auditor found ${criticals.length} critical violation(s)**`,
+            '',
+            ...criticals.map((v) => `- **${v.file}${v.line ? `:${v.line}` : ''}** — ${v.message}` +
+                (v.suggestion ? `\n  Suggestion: ${v.suggestion}` : '')),
+        ];
+        if (warnings.length > 0 || suggestions.length > 0) {
+            lines.push('', `Also found: ${warnings.length} warning(s), ${suggestions.length} suggestion(s).`);
+        }
+        lines.push('', 'Fix the critical violations above and retry. The edit has been blocked.');
+        return { context: lines.join('\n'), isBlocking: true };
+    }
+    if (warnings.length > 0 || suggestions.length > 0) {
+        const notes = [];
+        if (warnings.length > 0) {
+            notes.push(`${warnings.length} warning(s):`);
+            warnings.forEach((v) => {
+                notes.push(`  - ${v.file}${v.line ? `:${v.line}` : ''} — ${v.message}`);
+            });
+        }
+        if (suggestions.length > 0) {
+            notes.push(`${suggestions.length} suggestion(s):`);
+            suggestions.forEach((v) => {
+                notes.push(`  - ${v.file}${v.line ? `:${v.line}` : ''} — ${v.message}`);
+            });
+        }
+        return {
+            context: `ℹ️ **Code Auditor notes:**\n${notes.join('\n')}`,
+            isBlocking: false,
+        };
+    }
+    return { context: '', isBlocking: false };
+}
+/**
+ * Process a Cursor postToolUse event and return the hook result.
+ * Extracted from main() for testability — tests inject a mock audit function.
+ */
+export async function processCursorEvent(rawStdin, auditFn = async (filePaths, projectRoot) => runHookAudit({ filePaths, projectRoot, failOn: 'critical' })) {
+    const result = { exitCode: 0, stdout: '', stderr: '' };
+    if (!rawStdin) {
+        return result;
+    }
+    let event;
+    try {
+        event = JSON.parse(rawStdin);
+    }
+    catch (err) {
+        result.stderr = chalk.red(`[code-auditor cursor-hook] Failed to parse stdin JSON: ${err instanceof Error ? err.message : String(err)}`);
+        // Degrade gracefully — never wedge the agent on parse errors
+        return result;
+    }
+    // Guard: only audit Write/Edit tool calls
+    if (!isWriteOrEdit(event)) {
+        return result;
+    }
+    const filePath = extractFilePath(event);
+    if (!filePath) {
+        return result;
+    }
+    // Determine project root:
+    // 1. cwd from the event (native Cursor)
+    // 2. CLAUDE_PROJECT_DIR env var (Claude Code compat mode)
+    // 3. process.cwd() fallback
+    const projectRoot = (event.cwd && event.cwd.trim()) ||
+        process.env.CLAUDE_PROJECT_DIR ||
+        process.cwd();
+    try {
+        const output = await auditFn([filePath], projectRoot);
+        const { context, isBlocking } = formatViolationContext(output);
+        if (context) {
+            const response = { additional_context: context };
+            result.stdout = JSON.stringify(response) + '\n';
+            if (isBlocking) {
+                result.exitCode = 2;
+            }
+        }
+    }
+    catch (error) {
+        result.stderr = chalk.red(`[code-auditor cursor-hook] Error: ${error instanceof Error ? error.message : String(error)}`);
+        // Internal error — never wedge the agent loop
+    }
+    return result;
+}
+/**
+ * CLI entry point — reads stdin, processes, writes result, exits.
+ * Exported so the CLI can call it explicitly after importing.
+ */
+export async function main() {
+    const raw = await readStdin();
+    const result = await processCursorEvent(raw);
+    if (result.stderr) {
+        console.error(result.stderr);
+    }
+    if (result.stdout) {
+        process.stdout.write(result.stdout);
+    }
+    process.exit(result.exitCode);
+}
+// Auto-run when executed as an entry point (not imported by tests)
+// vitest sets process.env.VITEST; when set, tests call processCursorEvent directly
+if (!process.env.VITEST) {
+    main();
+}
+//# sourceMappingURL=cursor.js.map

package/dist/hooks/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/hooks/cursor.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,KAAK,MAAM,OAAO,CAAC;AAwB1B;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAA+B,CAAC;IACvD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAI5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IAEjF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG;YACZ,2BAA2B,SAAS,CAAC,MAAM,0BAA0B;YACrE,EAAE;YACF,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAC7D,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD;SACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,eAAe,QAAQ,CAAC,MAAM,gBAAgB,WAAW,CAAC,MAAM,iBAAiB,CAClF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,yEAAyE,CAC1E,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;YAC7C,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACnD,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,OAAO,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1D,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAAO,GAA2E,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CACjH,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CACvB,0DAA0D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7G,CAAC;QACF,6DAA6D;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0BAA0B;IAC1B,wCAAwC;IACxC,0DAA0D;IAC1D,4BAA4B;IAC5B,MAAM,WAAW,GACf,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAEtD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAChD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CACvB,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACF,8CAA8C;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,mEAAmE;AACnE,mFAAmF;AACnF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/installer.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Installer — code-audit install subcommand logic.
+ *
+ * Copies the skill folder to agent-specific paths and optionally wires hooks.
+ * Phase 0 live-docs verification (2026-07-19):
+ *   - Cursor: project-only skills, ~/.cursor/skills/ does NOT exist
+ *   - Codex: both ~/.codex/skills/ (user) and .codex/skills/ (project)
+ *   - Cursor afterFileEdit is advisory only (cannot block retroactively)
+ *   - Codex PostToolUse is blocking (exit 2 replaces tool result)
+ */
+export interface InstallOptions {
+    agent: string;
+    scope: 'user' | 'project';
+    hooks: boolean;
+    list: boolean;
+}
+export interface InstallResult {
+    agent: string;
+    displayName: string;
+    skillPath: string;
+    installed: boolean;
+    hooksWired: boolean;
+    skipped: boolean;
+    skipReason?: string;
+}
+/**
+ * Main entry point for `code-audit install`.
+ */
+export declare function runInstall(options: InstallOptions): Promise<void>;
+//# sourceMappingURL=installer.d.ts.map

package/dist/installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqEH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CvE"}