code-auditor-mcp 3.0.6 → 3.0.7

package/dist/hooks/cursor.js

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+/**
+ * Cursor hook adapter — `code-audit cursor-hook`.
+ *
+ * Reads Cursor's postToolUse stdin JSON (native or Claude Code compat) and
+ * runs a scoped audit on edited files. Blocks edits with critical violations.
+ *
+ * Phase 0 verification (2026-07-20):
+ *   - Source: cursor.com/docs/hooks + cursor.com/docs/reference/third-party-hooks
+ *   - postToolUse with Write matcher IS BLOCKING: exit 2 blocks the action
+ *   - additional_context is injected into the conversation after the tool result
+ *   - afterFileEdit EXISTS but is observation-only ("No output fields defined")
+ *   - Cursor natively reads .claude/settings.json hooks (PostToolUse→postToolUse)
+ *   - Tool name mapping: Edit→Write, Bash→Shell
+ *   - Dual response format support: both Claude nested format and Cursor flat format
+ *
+ * Input formats (both accepted):
+ *   Cursor native: { tool_name, tool_input, tool_output, tool_use_id, cwd, ... }
+ *   Claude Code compat: { tool_name, tool_input, tool_output, session_id, cwd, ... }
+ *   (CLAUDE_PROJECT_DIR env var set in Claude Code compat mode)
+ *
+ * Exit codes:
+ *   0 — no critical violations found
+ *   2 — critical violations found (blocks the action, additional_context injected)
+ *   1 — internal error (adapter crash, not violation-related)
+ */
+import { readStdin, runHookAudit } from './core.js';
+import chalk from 'chalk';
+/**
+ * Detect whether this is a Write/Edit tool invocation we should audit.
+ */
+export function isWriteOrEdit(event) {
+    const toolName = (event.tool_name || event.toolName || '').toLowerCase();
+    // Cursor native: "Write" (camelCase mapped). Claude Code compat: "Edit".
+    // Also accept "edit", "write" for robustness.
+    return toolName === 'write' || toolName === 'edit';
+}
+/**
+ * Extract the edited file path from tool_input.
+ * Cursor Write: tool_input.file_path
+ * Claude Code Edit: tool_input.file_path
+ */
+export function extractFilePath(event) {
+    const input = event.tool_input || event.toolInput;
+    if (!input)
+        return null;
+    const filePath = input.file_path;
+    if (filePath && typeof filePath === 'string')
+        return filePath;
+    return null;
+}
+/**
+ * Build the additional_context string for violations.
+ */
+export function formatViolationContext(output) {
+    const criticals = output.violations.filter((v) => v.severity === 'critical');
+    const warnings = output.violations.filter((v) => v.severity === 'warning');
+    const suggestions = output.violations.filter((v) => v.severity === 'suggestion');
+    if (criticals.length > 0) {
+        const lines = [
+            `🚨 **Code Auditor found ${criticals.length} critical violation(s)**`,
+            '',
+            ...criticals.map((v) => `- **${v.file}${v.line ? `:${v.line}` : ''}** — ${v.message}` +
+                (v.suggestion ? `\n  Suggestion: ${v.suggestion}` : '')),
+        ];
+        if (warnings.length > 0 || suggestions.length > 0) {
+            lines.push('', `Also found: ${warnings.length} warning(s), ${suggestions.length} suggestion(s).`);
+        }
+        lines.push('', 'Fix the critical violations above and retry. The edit has been blocked.');
+        return { context: lines.join('\n'), isBlocking: true };
+    }
+    if (warnings.length > 0 || suggestions.length > 0) {
+        const notes = [];
+        if (warnings.length > 0) {
+            notes.push(`${warnings.length} warning(s):`);
+            warnings.forEach((v) => {
+                notes.push(`  - ${v.file}${v.line ? `:${v.line}` : ''} — ${v.message}`);
+            });
+        }
+        if (suggestions.length > 0) {
+            notes.push(`${suggestions.length} suggestion(s):`);
+            suggestions.forEach((v) => {
+                notes.push(`  - ${v.file}${v.line ? `:${v.line}` : ''} — ${v.message}`);
+            });
+        }
+        return {
+            context: `ℹ️ **Code Auditor notes:**\n${notes.join('\n')}`,
+            isBlocking: false,
+        };
+    }
+    return { context: '', isBlocking: false };
+}
+/**
+ * Process a Cursor postToolUse event and return the hook result.
+ * Extracted from main() for testability — tests inject a mock audit function.
+ */
+export async function processCursorEvent(rawStdin, auditFn = async (filePaths, projectRoot) => runHookAudit({ filePaths, projectRoot, failOn: 'critical' })) {
+    const result = { exitCode: 0, stdout: '', stderr: '' };
+    if (!rawStdin) {
+        return result;
+    }
+    let event;
+    try {
+        event = JSON.parse(rawStdin);
+    }
+    catch (err) {
+        result.stderr = chalk.red(`[code-auditor cursor-hook] Failed to parse stdin JSON: ${err instanceof Error ? err.message : String(err)}`);
+        // Degrade gracefully — never wedge the agent on parse errors
+        return result;
+    }
+    // Guard: only audit Write/Edit tool calls
+    if (!isWriteOrEdit(event)) {
+        return result;
+    }
+    const filePath = extractFilePath(event);
+    if (!filePath) {
+        return result;
+    }
+    // Determine project root:
+    // 1. cwd from the event (native Cursor)
+    // 2. CLAUDE_PROJECT_DIR env var (Claude Code compat mode)
+    // 3. process.cwd() fallback
+    const projectRoot = (event.cwd && event.cwd.trim()) ||
+        process.env.CLAUDE_PROJECT_DIR ||
+        process.cwd();
+    try {
+        const output = await auditFn([filePath], projectRoot);
+        const { context, isBlocking } = formatViolationContext(output);
+        if (context) {
+            const response = { additional_context: context };
+            result.stdout = JSON.stringify(response) + '\n';
+            if (isBlocking) {
+                result.exitCode = 2;
+            }
+        }
+    }
+    catch (error) {
+        result.stderr = chalk.red(`[code-auditor cursor-hook] Error: ${error instanceof Error ? error.message : String(error)}`);
+        // Internal error — never wedge the agent loop
+    }
+    return result;
+}
+/**
+ * CLI entry point — reads stdin, processes, writes result, exits.
+ * Exported so the CLI can call it explicitly after importing.
+ */
+export async function main() {
+    const raw = await readStdin();
+    const result = await processCursorEvent(raw);
+    if (result.stderr) {
+        console.error(result.stderr);
+    }
+    if (result.stdout) {
+        process.stdout.write(result.stdout);
+    }
+    process.exit(result.exitCode);
+}
+// Auto-run when executed as an entry point (not imported by tests)
+// vitest sets process.env.VITEST; when set, tests call processCursorEvent directly
+if (!process.env.VITEST) {
+    main();
+}
+//# sourceMappingURL=cursor.js.map

package/dist/hooks/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/hooks/cursor.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,KAAK,MAAM,OAAO,CAAC;AAwB1B;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAA+B,CAAC;IACvD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAI5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IAEjF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG;YACZ,2BAA2B,SAAS,CAAC,MAAM,0BAA0B;YACrE,EAAE;YACF,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAC7D,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD;SACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,eAAe,QAAQ,CAAC,MAAM,gBAAgB,WAAW,CAAC,MAAM,iBAAiB,CAClF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,yEAAyE,CAC1E,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;YAC7C,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACnD,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,OAAO,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1D,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAAO,GAA2E,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CACjH,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CACvB,0DAA0D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7G,CAAC;QACF,6DAA6D;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0BAA0B;IAC1B,wCAAwC;IACxC,0DAA0D;IAC1D,4BAA4B;IAC5B,MAAM,WAAW,GACf,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAEtD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAChD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CACvB,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACF,8CAA8C;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,mEAAmE;AACnE,mFAAmF;AACnF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/installer.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Installer — code-audit install subcommand logic.
+ *
+ * Copies the skill folder to agent-specific paths and optionally wires hooks.
+ * Phase 0 live-docs verification (2026-07-19):
+ *   - Cursor: project-only skills, ~/.cursor/skills/ does NOT exist
+ *   - Codex: both ~/.codex/skills/ (user) and .codex/skills/ (project)
+ *   - Cursor afterFileEdit is advisory only (cannot block retroactively)
+ *   - Codex PostToolUse is blocking (exit 2 replaces tool result)
+ */
+export interface InstallOptions {
+    agent: string;
+    scope: 'user' | 'project';
+    hooks: boolean;
+    list: boolean;
+}
+export interface InstallResult {
+    agent: string;
+    displayName: string;
+    skillPath: string;
+    installed: boolean;
+    hooksWired: boolean;
+    skipped: boolean;
+    skipReason?: string;
+}
+/**
+ * Main entry point for `code-audit install`.
+ */
+export declare function runInstall(options: InstallOptions): Promise<void>;
+//# sourceMappingURL=installer.d.ts.map

package/dist/installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqEH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CvE"}

package/dist/installer.js

@@ -0,0 +1,355 @@
+/**
+ * Installer — code-audit install subcommand logic.
+ *
+ * Copies the skill folder to agent-specific paths and optionally wires hooks.
+ * Phase 0 live-docs verification (2026-07-19):
+ *   - Cursor: project-only skills, ~/.cursor/skills/ does NOT exist
+ *   - Codex: both ~/.codex/skills/ (user) and .codex/skills/ (project)
+ *   - Cursor afterFileEdit is advisory only (cannot block retroactively)
+ *   - Codex PostToolUse is blocking (exit 2 replaces tool result)
+ */
+import { promises as fs } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import chalk from 'chalk';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+// Source: the repo's skill folder (shipped in the npm package at dist/../plugin/skills/code-auditor)
+const SKILL_SOURCE = join(__dirname, '..', 'plugin', 'skills', 'code-auditor');
+// Version recorded in the copied skill folder for idempotent updates
+const PACKAGE_JSON_PATH = join(__dirname, '..', 'package.json');
+const AGENTS = [
+    {
+        name: 'claude',
+        displayName: 'Claude Code',
+        userPath: join(homedir(), '.claude', 'skills'),
+        projectPath: '.claude/skills',
+        hooksAvailable: true,
+        hookType: 'blocking',
+    },
+    {
+        name: 'cursor',
+        displayName: 'Cursor',
+        userPath: null, // Cursor skills are project-only (verified 2026-07-19)
+        projectPath: '.cursor/skills',
+        hooksAvailable: true,
+        hookType: 'advisory',
+    },
+    {
+        name: 'codex',
+        displayName: 'Codex',
+        userPath: join(homedir(), '.codex', 'skills'),
+        projectPath: '.codex/skills',
+        hooksAvailable: true,
+        hookType: 'blocking',
+    },
+    {
+        name: 'gemini',
+        displayName: 'Gemini CLI',
+        userPath: join(homedir(), '.gemini', 'skills'),
+        projectPath: '.gemini/skills',
+        hooksAvailable: false,
+        hookType: 'none',
+    },
+    {
+        name: 'agents',
+        displayName: 'Other SKILL.md agents',
+        userPath: join(homedir(), '.agents', 'skills'),
+        projectPath: '.agents/skills',
+        hooksAvailable: false,
+        hookType: 'none',
+    },
+];
+/**
+ * Main entry point for `code-audit install`.
+ */
+export async function runInstall(options) {
+    if (options.list) {
+        await printMatrix();
+        return;
+    }
+    const agentsToInstall = options.agent === 'all'
+        ? AGENTS
+        : AGENTS.filter(a => a.name === options.agent);
+    if (agentsToInstall.length === 0) {
+        console.error(chalk.red(`Unknown agent: "${options.agent}". Use --list to see available agents.`));
+        process.exit(1);
+    }
+    // Verify source skill folder exists
+    try {
+        await fs.access(join(SKILL_SOURCE, 'SKILL.md'));
+    }
+    catch {
+        console.error(chalk.red(`Skill source not found at ${SKILL_SOURCE}. Is the package installed correctly?`));
+        process.exit(1);
+    }
+    const results = [];
+    const packageVersion = await getPackageVersion();
+    for (const agent of agentsToInstall) {
+        const result = await installForAgent(agent, options.scope, options.hooks, packageVersion);
+        results.push(result);
+    }
+    // Print summary
+    console.log(chalk.blue('\n── Install summary ──'));
+    for (const r of results) {
+        if (r.skipped) {
+            console.log(`  ${chalk.yellow('⊘')} ${r.displayName}: ${chalk.dim(r.skipReason)}`);
+        }
+        else {
+            const parts = [`${chalk.green('✓')} ${r.displayName}: skill → ${r.skillPath}`];
+            if (r.hooksWired)
+                parts.push('hooks wired');
+            console.log(`  ${parts.join(', ')}`);
+        }
+    }
+    console.log('');
+}
+/**
+ * Print the support matrix (--list).
+ */
+async function printMatrix() {
+    const packageVersion = await getPackageVersion();
+    console.log(chalk.blue('\ncode-audit install — Support Matrix'));
+    console.log(chalk.gray(`Version: ${packageVersion}`));
+    console.log(chalk.gray(`Source: ${SKILL_SOURCE}`));
+    console.log(chalk.gray('Verified against docs: 2026-07-19\n'));
+    // Header
+    console.log(`${chalk.bold('Agent'.padEnd(18))} ${chalk.bold('Skill (user)'.padEnd(42))} ${chalk.bold('Skill (project)'.padEnd(22))} ${chalk.bold('Hooks'.padEnd(14))} ${chalk.bold('Installed')}`);
+    console.log(chalk.gray('─'.repeat(105)));
+    for (const agent of AGENTS) {
+        const userPath = agent.userPath
+            ? join(agent.userPath, 'code-auditor')
+            : chalk.dim('(project-only)');
+        const projectPath = join(agent.projectPath, 'code-auditor');
+        const hookInfo = agent.hooksAvailable
+            ? `yes (${agent.hookType})`
+            : 'no';
+        // Check if installed
+        const projectFull = resolve(process.cwd(), agent.projectPath, 'code-auditor');
+        let installed = 'no';
+        try {
+            await fs.access(join(projectFull, 'SKILL.md'));
+            installed = chalk.green('yes (project)');
+        }
+        catch {
+            if (agent.userPath) {
+                try {
+                    await fs.access(join(agent.userPath, 'code-auditor', 'SKILL.md'));
+                    installed = chalk.green('yes (user)');
+                }
+                catch {
+                    installed = chalk.red('no');
+                }
+            }
+            else {
+                installed = chalk.red('no');
+            }
+        }
+        console.log(`${agent.displayName.padEnd(18)} ${String(userPath).padEnd(42)} ${String(projectPath).padEnd(22)} ${hookInfo.padEnd(14)} ${installed}`);
+    }
+    console.log('');
+}
+/**
+ * Install the skill for one agent.
+ */
+async function installForAgent(agent, scope, offerHooks, version) {
+    const result = {
+        agent: agent.name,
+        displayName: agent.displayName,
+        skillPath: '',
+        installed: false,
+        hooksWired: false,
+        skipped: false,
+    };
+    // Determine the target path
+    let targetParent = null;
+    if (scope === 'user') {
+        if (!agent.userPath) {
+            result.skipped = true;
+            result.skipReason = `${agent.displayName} does not support user-scope skills (project-only). Use --scope project.`;
+            console.log(chalk.yellow(`⊘ ${agent.displayName}: user-scope not supported. Skills are project-only. Use --scope project.`));
+            return result;
+        }
+        targetParent = agent.userPath;
+    }
+    else {
+        targetParent = resolve(process.cwd(), agent.projectPath);
+    }
+    const targetDir = join(targetParent, 'code-auditor');
+    // Check if the parent tool directory exists (for --agent all, skip if tool not present)
+    if (scope === 'user' && agent.userPath) {
+        try {
+            await fs.access(agent.userPath);
+        }
+        catch {
+            result.skipped = true;
+            result.skipReason = `Parent directory ${agent.userPath} does not exist (${agent.displayName} not installed?).`;
+            console.log(chalk.yellow(`⊘ ${agent.displayName}: ${agent.userPath} not found — skipping (tool not installed?).`));
+            return result;
+        }
+    }
+    // Create the target directory
+    await fs.mkdir(targetDir, { recursive: true });
+    // Copy skill files
+    const skillFiles = ['SKILL.md', 'SKILL-SEARCH.md', 'SKILL-RULE-KINDS.md'];
+    for (const file of skillFiles) {
+        const src = join(SKILL_SOURCE, file);
+        try {
+            await fs.copyFile(src, join(targetDir, file));
+        }
+        catch (err) {
+            // Source file missing — skip (non-fatal: SKILL.md is required, companions are optional)
+            if (file === 'SKILL.md')
+                throw err;
+        }
+    }
+    // Write version marker
+    await fs.writeFile(join(targetDir, '.code-auditor-version'), `${version}\n`);
+    result.skillPath = targetDir;
+    result.installed = true;
+    console.log(chalk.green(`✓ ${agent.displayName}: skill installed to ${targetDir}`));
+    // Hook wiring (only for agents with hook support, and only with confirmation)
+    if (offerHooks && agent.hooksAvailable) {
+        const wired = await offerHookWiring(agent, scope);
+        result.hooksWired = wired;
+    }
+    return result;
+}
+/**
+ * Offer to wire hooks for an agent. Shows the exact JSON and requires confirmation.
+ * Returns true if hooks were wired, false if user declined.
+ */
+async function offerHookWiring(agent, scope) {
+    const hookConfig = getHookConfig(agent, scope);
+    if (!hookConfig)
+        return false;
+    const { configFile, json } = hookConfig;
+    // In non-interactive mode (--hooks or --no-hooks flag), we already got the answer
+    // For simplicity in CLI mode, always show the proposed change and ask via inquirer
+    console.log(chalk.cyan(`\n  Hook wiring for ${agent.displayName}:`));
+    console.log(chalk.gray(`  File: ${configFile}`));
+    console.log(chalk.gray(`  Will add:`));
+    console.log(chalk.dim(`  ${JSON.stringify(json, null, 2).replace(/\n/g, '\n  ')}`));
+    // Use inquirer for confirmation
+    try {
+        const inquirer = (await import('inquirer')).default;
+        const { confirmed } = await inquirer.prompt({
+            type: 'confirm',
+            name: 'confirmed',
+            message: `  Write this hook config to ${basename(configFile)}?`,
+            default: false,
+        });
+        if (!confirmed) {
+            console.log(chalk.yellow(`  ⊘ Hook wiring skipped for ${agent.displayName}`));
+            return false;
+        }
+        // Ensure directory exists
+        await fs.mkdir(dirname(configFile), { recursive: true });
+        // Check if config already exists; merge if so
+        let existing = {};
+        try {
+            const raw = await fs.readFile(configFile, 'utf-8');
+            existing = JSON.parse(raw);
+        }
+        catch {
+            // File doesn't exist or is invalid — start fresh
+        }
+        // Merge the hook entry
+        const merged = deepMerge(existing, json);
+        await fs.writeFile(configFile, JSON.stringify(merged, null, 2) + '\n');
+        console.log(chalk.green(`  ✓ Hook wired for ${agent.displayName}`));
+        return true;
+    }
+    catch {
+        // inquirer not available or user aborted — skip hook wiring
+        console.log(chalk.yellow(`  ⊘ Hook wiring skipped for ${agent.displayName} (non-interactive). Use --hooks to force.`));
+        return false;
+    }
+}
+/**
+ * Get the hook config snippet for a given agent.
+ */
+function getHookConfig(agent, scope) {
+    switch (agent.name) {
+        case 'claude': {
+            const configDir = scope === 'user'
+                ? join(homedir(), '.claude')
+                : resolve(process.cwd(), '.claude');
+            // Claude Code uses plugin.json, not per-project hooks.json
+            // For --agent claude, we tell the user to use the plugin instead
+            console.log(chalk.yellow(`  ⊘ Claude Code uses the code-auditor plugin for hooks, not direct hook wiring.`));
+            console.log(chalk.gray(`    Use: claude plugin install code-auditor`));
+            return null;
+        }
+        case 'cursor': {
+            const configFile = scope === 'user'
+                ? join(homedir(), '.cursor', 'hooks.json')
+                : resolve(process.cwd(), '.cursor', 'hooks.json');
+            return {
+                configFile,
+                json: {
+                    hooks: {
+                        afterFileEdit: [
+                            {
+                                command: 'npx -y code-auditor-mcp code-audit cursor-hook',
+                            },
+                        ],
+                    },
+                },
+            };
+        }
+        case 'codex': {
+            const configFile = scope === 'user'
+                ? join(homedir(), '.codex', 'hooks.json')
+                : resolve(process.cwd(), '.codex', 'hooks.json');
+            return {
+                configFile,
+                json: {
+                    hooks: {
+                        PostToolUse: [
+                            {
+                                matcher: 'apply_patch',
+                                hooks: [
+                                    {
+                                        type: 'command',
+                                        command: 'npx -y code-auditor-mcp code-audit codex-hook',
+                                    },
+                                ],
+                            },
+                        ],
+                    },
+                },
+            };
+        }
+        default:
+            return null;
+    }
+}
+/**
+ * Deep merge two objects. b's values take precedence over a's.
+ */
+function deepMerge(a, b) {
+    if (typeof a !== 'object' || a === null || Array.isArray(a))
+        return b ?? a;
+    if (typeof b !== 'object' || b === null || Array.isArray(b))
+        return b;
+    const result = { ...a };
+    for (const key of Object.keys(b)) {
+        result[key] = deepMerge(a[key], b[key]);
+    }
+    return result;
+}
+/**
+ * Get the package version from package.json.
+ */
+async function getPackageVersion() {
+    try {
+        const raw = await fs.readFile(PACKAGE_JSON_PATH, 'utf-8');
+        return JSON.parse(raw).version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=installer.js.map

package/dist/installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.js","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,qGAAqG;AACrG,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAE/E,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAWhE,MAAM,MAAM,GAAgB;IAC1B;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,aAAa;QAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC9C,WAAW,EAAE,gBAAgB;QAC7B,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,IAAI,EAAE,uDAAuD;QACvE,WAAW,EAAE,gBAAgB;QAC7B,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC7C,WAAW,EAAE,eAAe;QAC5B,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC9C,WAAW,EAAE,gBAAgB;QAC7B,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uBAAuB;QACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC9C,WAAW,EAAE,gBAAgB;QAC7B,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAmBF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAuB;IACtD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK;QAC7C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,KAAK,wCAAwC,CAAC,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,YAAY,uCAAuC,CAAC,CAAC,CAAC;QAC3G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW;IACxB,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,cAAc,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,YAAY,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAE/D,SAAS;IACT,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CACtL,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC;YACtC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc;YACnC,CAAC,CAAC,QAAQ,KAAK,CAAC,QAAQ,GAAG;YAC3B,CAAC,CAAC,IAAI,CAAC;QAET,qBAAqB;QACrB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC9E,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;YAC/C,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;oBAClE,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,SAAS,EAAE,CACvI,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,KAAgB,EAChB,KAAyB,EACzB,UAAmB,EACnB,OAAe;IAEf,MAAM,MAAM,GAAkB;QAC5B,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,KAAK;KACf,CAAC;IAEF,4BAA4B;IAC5B,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,UAAU,GAAG,GAAG,KAAK,CAAC,WAAW,0EAA0E,CAAC;YACnH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,WAAW,2EAA2E,CAAC,CAAC,CAAC;YAC7H,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAErD,wFAAwF;IACxF,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,UAAU,GAAG,oBAAoB,KAAK,CAAC,QAAQ,oBAAoB,KAAK,CAAC,WAAW,mBAAmB,CAAC;YAC/G,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,QAAQ,8CAA8C,CAAC,CAAC,CAAC;YACnH,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,mBAAmB;IACnB,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wFAAwF;YACxF,IAAI,IAAI,KAAK,UAAU;gBAAE,MAAM,GAAG,CAAC;QACrC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC;IAE7E,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,WAAW,wBAAwB,SAAS,EAAE,CAAC,CAAC,CAAC;IAEpF,8EAA8E;IAC9E,IAAI,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,KAAgB,EAAE,KAAyB;IACxE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAExC,kFAAkF;IAClF,mFAAmF;IACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpF,gCAAgC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,+BAA+B,QAAQ,CAAC,UAAU,CAAC,GAAG;YAC/D,OAAO,EAAE,KAAK;SACR,CAAC,CAAC;QAEV,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0BAA0B;QAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,8CAA8C;QAC9C,IAAI,QAAQ,GAAQ,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,KAAK,CAAC,WAAW,2CAA2C,CAAC,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAgB,EAAE,KAAyB;IAChE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM;gBAChC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;gBAC5B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;YACtC,2DAA2D;YAC3D,iEAAiE;YACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,iFAAiF,CAAC,CAAC,CAAC;YAC7G,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,KAAK,KAAK,MAAM;gBACjC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC;gBAC1C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACpD,OAAO;gBACL,UAAU;gBACV,IAAI,EAAE;oBACJ,KAAK,EAAE;wBACL,aAAa,EAAE;4BACb;gCACE,OAAO,EAAE,gDAAgD;6BAC1D;yBACF;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,KAAK,KAAK,MAAM;gBACjC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC;gBACzC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACnD,OAAO;gBACL,UAAU;gBACV,IAAI,EAAE;oBACJ,KAAK,EAAE;wBACL,WAAW,EAAE;4BACX;gCACE,OAAO,EAAE,aAAa;gCACtB,KAAK,EAAE;oCACL;wCACE,IAAI,EAAE,SAAS;wCACf,OAAO,EAAE,+CAA+C;qCACzD;iCACF;6BACF;yBACF;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAED;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,CAAM,EAAE,CAAM;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/mcp-tools/whitelistTools.d.ts

@@ -3,6 +3,7 @@
  */
 import { WhitelistType, WhitelistStatus } from '../types/whitelist.js';
 export declare function handleWhitelistGet(args: any): Promise<{
+    error?: undefined;
     success: boolean;
     count: number;
     entries: {
@@ -15,7 +16,6 @@ export declare function handleWhitelistGet(args: any): Promise<{
         addedBy: "auto-detect" | "llm" | "system" | "user";
         addedAt: Date;
     }[];
-    error?: undefined;
 } | {
     count?: undefined;
     entries?: undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-auditor-mcp",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "description": "Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,9 +11,10 @@
     "code-auditor-mcp": "dist/mcp.js"
   },
   "scripts": {
-    "build": "tsc && pnpm run build:grammars && pnpm run download:natives",
+    "build": "tsc && pnpm run build:grammars && pnpm run download:natives && pnpm run build:skills",
     "download:natives": "bash scripts/download-natives.sh",
     "build:grammars": "cp node_modules/tree-sitter-typescript/tree-sitter-typescript.wasm node_modules/tree-sitter-typescript/tree-sitter-tsx.wasm node_modules/tree-sitter-javascript/tree-sitter-javascript.wasm node_modules/tree-sitter-go/tree-sitter-go.wasm dist/grammars/",
+    "build:skills": "cp -r plugin/skills/* ../skills/",
     "watch": "tsc --watch",
     "dev": "tsx src/cli.ts",
     "dev:server": "tsx --watch src/cli.ts start --rest-api",

package/plugin/skills/code-auditor/SKILL.md

@@ -1,4 +1,5 @@
 ---
+name: code-auditor
 description: Audit code quality, search the codebase semantically, enforce invariants, and fix violations inline.
 ---
 
@@ -82,18 +83,17 @@ code-audit map -p .                                  # Generate a codebase map
 
 Use this for a high-level architecture overview. Useful when orienting in an unfamiliar codebase.
 
-### `code-audit generate-config` — generate AI tool integration configs
+### `code-audit generate-config` — create a default config
 
 ```bash
-code-audit generate-config                           # Generate MCP configs for AI coding tools
-code-audit generate-config --tool claude             # Claude-specific MCP config
+code-audit generate-config                           # Create .codeauditor.json from defaults
 ```
 
-Creates MCP server configuration files for AI coding assistants (Claude, Cursor, Continue, Copilot, etc.) so they can connect to code-auditor as an MCP server.
+Creates a `.codeauditor.json` configuration file with invariant rules for your project. Use the interactive mode (`--interactive`) to build rules step-by-step, or generate a scaffold with sensible defaults.
 
 ## Interpreting hook feedback
 
-When the PostToolUse hook blocks your edit with a violation message:
+When an edit hook blocks your edit with a violation message:
 
 1. **Read the violation** — it includes the invariant rule's `message` field explaining *why* the edit was blocked
 2. **Fix the violation** — change your approach to comply with the invariant
@@ -102,6 +102,14 @@ When the PostToolUse hook blocks your edit with a violation message:
 
 The hook auto-installs the package via npx on first use — no manual npm step needed. If the hook reports `[code-auditor] code-audit could not run`, the npx auto-install failed (network, unsupported platform). The agent should try again; if it persists, `npm install code-auditor-mcp` is the manual fix.
 
+## Host-specific notes
+
+- **Claude Code**: This skill is bundled in the `code-auditor` plugin (`claude plugin install code-auditor`). The plugin also ships a `PostToolUse` hook on `Write|Edit` that runs `code-audit changed --fail-on critical` automatically — the hook feedback section above describes that behavior. The MCP server is available as `mcp__code-auditor__*` tools for shell-less use.
+- **Cursor**: Skill install via `code-audit install --agent cursor`. Cursor's `afterFileEdit` hook is advisory (fires after the edit; cannot block retroactively) — violations are reported through the strongest available feedback channel.
+- **Codex**: Skill install via `code-audit install --agent codex`. Codex's `PostToolUse` hook provides blocking feedback via exit code 2, replacing the tool result with violation messages.
+- **Gemini CLI**: Skill install only (`code-audit install --agent gemini`). No hook system exists; MCP covers shell-less use.
+- **Other SKILL.md-compliant tools**: Install via `code-audit install --agent agents`. The skill teaches the `code-audit` CLI, which is identical everywhere. The MCP server is the shell-less side door.
+
 ## Quick reference
 
 | Task | Command |