code-auditor-mcp 3.4.12 → 3.4.14

package/plugin/scripts/hook-audit.sh

@@ -2,11 +2,11 @@
 # code-auditor PostToolUse hook — audit changed files after Write/Edit.
 #
 # Reads the PostToolUse event JSON from stdin, extracts the edited file path,
-# and runs `code-audit changed --stdin --json --fail-on critical` against it.
+# and runs `code-audit changed --stdin --json` against it.
 #
 # Exit codes:
-#   0 — all clear or degraded (binary not found, no index, non-critical findings)
-#   2 — critical violations found (Claude Code feeds stdout back to the agent)
+#   0 — all clear or degraded (binary not found, no index, no gating findings)
+#   2 — a new gating-rule finding was introduced (Claude Code feeds stdout back)
 set -euo pipefail
 
 # Read event JSON from stdin
@@ -25,6 +25,24 @@ if [ -z "${file}" ]; then
   exit 0
 fi
 
+# Out-of-repo edit no-op (Spec 35 item 9): an edit outside the audited project
+# must not error the hook. Resolve both paths to absolute form and exit 0 when
+# the edited file is not inside CLAUDE_PROJECT_DIR.
+if [ -n "${CLAUDE_PROJECT_DIR:-}" ] && [ -n "${file}" ]; then
+  # Normalize the project dir (strip any trailing slash).
+  project_abs="$(cd "${CLAUDE_PROJECT_DIR}" 2>/dev/null && pwd)" || project_abs="${CLAUDE_PROJECT_DIR%/}"
+  # Normalize the edited file: absolute paths pass through; relative paths
+  # resolve against the current working directory.
+  case "${file}" in
+    /*) file_abs="${file}" ;;
+    *)  file_abs="$(cd "$(dirname "${file}")" 2>/dev/null && pwd)/$(basename "${file}")" ;;
+  esac
+  case "${file_abs}" in
+    "${project_abs}"/*) : ;;   # inside the project — continue to audit
+    *) exit 0 ;;                # outside — nothing to audit
+  esac
+fi
+
 # Resolve the code-audit binary: project-local → PATH → npx auto-install
 resolve_code_audit() {
   # 1. Project-local install (plugin project's own node_modules)
@@ -48,15 +66,15 @@ CODE_AUDIT_BIN="$(resolve_code_audit)"
 # stdout/stderr are fed back to the agent by Claude Code
 set +e
 if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
-	  echo "${file}" | ${CODE_AUDIT_BIN} changed --stdin --json --fail-on critical -p "${CLAUDE_PROJECT_DIR}"
+	  echo "${file}" | ${CODE_AUDIT_BIN} changed --stdin --json -p "${CLAUDE_PROJECT_DIR}"
 	else
-	  echo "${file}" | ${CODE_AUDIT_BIN} changed --stdin --json --fail-on critical
+	  echo "${file}" | ${CODE_AUDIT_BIN} changed --stdin --json
 	fi
 exit_code=$?
 set -e
 
-# Exit code 2 = --fail-on triggered (critical violations found)
-# Let it propagate so Claude Code feeds violations back to the agent
+# Exit code 2 = binary gate triggered (a new gating-rule finding)
+# Let it propagate so Claude Code feeds the finding back to the agent
 if [ ${exit_code} -eq 2 ]; then
   exit 2
 fi

package/plugin/skills/code-auditor/SKILL.md

@@ -60,22 +60,22 @@ These are the codebase's declared constraints — "no importing X from Y," "modu
 
 ### Path Profiles — "my scripts directory is noisy"
 
-When an audit produces too many findings in scripts, tests, or fixtures, use **path profiles** in `.codeauditor.json` to cap severity per directory:
+When an audit produces too many findings in scripts, tests, or fixtures, use **path profiles** in `.codeauditor.json` to exclude a directory from the blocking gate:
 
 ```json
 {
   "pathProfiles": [
     { "name": "source-strict", "paths": ["src/**"], "overrides": { "requireFunctionDocs": true } },
-    { "name": "scripts-lenient", "paths": ["scripts/**"], "overrides": { "severityCap": "suggestion" } }
+    { "name": "scripts-lenient", "paths": ["scripts/**"], "overrides": { "excludeFromGate": true } }
   ]
 }
 ```
 
-Path profiles are an ordered array — files matching multiple profiles merge overrides (later wins). The `severityCap` key caps all violations in matching files at that severity. Caps are applied **after** global `severityOverrides`, so a path-level "this zone is lenient" always beats a global per-rule promotion.
+Path profiles are an ordered array — files matching multiple profiles merge overrides (later wins). The `excludeFromGate: true` key excludes all findings in matching files from the blocking gate. Findings still report at their real severity — a path profile excludes a file from the gate, it never softens a finding within it.
 
-A **built-in** `scripts-and-tests` profile ships with every install — it caps `scripts/**`, `tests/**`, `__tests__/**`, `fixtures/**`, and `*.test.*`/`*.spec.*` files at `suggestion`. Disable it with `"builtin": false` in `.codeauditor.json`.
+A **built-in** `scripts-and-tests` profile ships with every install — it excludes `scripts/**`, `tests/**`, `__tests__/**`, `fixtures/**`, and `*.test.*`/`*.spec.*` files from the gate. Disable it with `"builtin": false` in `.codeauditor.json`.
 
-Invariant violations are **immune** to path profile caps — invariants enforce declared laws and their severity is absolute.
+Invariant violations are **immune** to path profile gate exclusion — invariants enforce declared laws and always block.
 
 ### `code-audit tasks` — queue remediation work