code-auditor-mcp 3.4.17 → 3.5.0

package/dist/auditRouter.js

@@ -0,0 +1,185 @@
+/**
+ * Audit router — the single entry point for choosing between the two analysis
+ * paths: the tree-sitter TypeScript pipeline (`createAuditRunner`) and the Go
+ * subprocess orchestrator (`LanguageOrchestrator`).
+ *
+ * The CLI and the MCP `audit.run` tool both need the same decision — "are there
+ * Go files? route to the Go subprocess; otherwise use the TS pipeline" — and
+ * for months they did not share it: `handleAudit` checked for `.go` and routed
+ * to the orchestrator, while the CLI called `createAuditRunner` directly and
+ * fed Go ASTs to TypeScript-tuned analyzers (the 762-finding gin result). Two
+ * copies, one silently wrong — the same shape as the duplicate
+ * `getLanguageFromPath`, one layer up.
+ *
+ * This module is that decision, in exactly one place. Both surfaces call
+ * `runAuditDispatch`; a future refactor that unwires one of them can no longer
+ * silently break the other.
+ */
+import * as path from 'path';
+import { promises as fs } from 'fs';
+import { createAuditRunner } from './auditRunner.js';
+import { RuntimeManager } from './languages/RuntimeManager.js';
+import { LanguageOrchestrator } from './languages/LanguageOrchestrator.js';
+import { CodeIndexDB } from './codeIndexDB.js';
+import { makeVisitorStatus } from './pipeline.js';
+import { DEFAULT_EXCLUDED_ANY_DEPTH_DIRS } from './utils/fileDiscovery.js';
+/**
+ * True when `target` (a file or directory) is, or contains, a file with the
+ * given extension. Walked recursively for directories.
+ *
+ * The walk skips the same any-depth excluded dirs discovery skips
+ * (`node_modules`, `.git`, `dist`, …). Without that, a single `.go` file
+ * buried in a dependency's `node_modules` (e.g. `flatted`'s golang port) would
+ * route an otherwise pure-TS project through the Go subprocess — which drops
+ * every non-Go analyzer and collapses the audit to a fraction of its findings.
+ */
+export async function hasFilesWithExtension(target, ext) {
+    try {
+        const stats = await fs.stat(target);
+        if (stats.isFile()) {
+            return path.extname(target).toLowerCase() === ext;
+        }
+        const entries = await fs.readdir(target, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isFile()) {
+                if (path.extname(entry.name).toLowerCase() === ext)
+                    return true;
+            }
+            else if (entry.isDirectory()) {
+                if (DEFAULT_EXCLUDED_ANY_DEPTH_DIRS.has(entry.name))
+                    continue;
+                if (await hasFilesWithExtension(path.join(target, entry.name), ext))
+                    return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Convert a polyglot analysis result to the legacy `AuditResult` shape the
+ * reporting and CLI surfaces consume.
+ */
+export function convertPolyglotToAuditResult(polyglotResult, auditPath) {
+    const violations = polyglotResult.violations || [];
+    const criticalIssues = violations.filter((v) => v.severity === 'critical').length;
+    const warnings = violations.filter((v) => v.severity === 'warning').length;
+    const suggestions = violations.filter((v) => v.severity === 'suggestion').length;
+    const totalFiles = polyglotResult.metrics?.totalFiles || 0;
+    const executionTime = polyglotResult.metrics?.executionTime || 0;
+    // Bucket violations by their category for the summary. The Go subprocess
+    // labels findings with `category` (open-closed, import-style, …); the
+    // TypeScript pipeline uses `type` for the same purpose. Fall back to the
+    // analyzer label so a categoryless finding still lands in a real bucket
+    // rather than vanishing into an empty `violationsByCategory`.
+    const violationsByCategory = {};
+    for (const v of violations) {
+        const category = v.category || v.type || v.analyzer || 'unknown';
+        violationsByCategory[category] = (violationsByCategory[category] || 0) + 1;
+    }
+    const topIssues = Object.entries(violationsByCategory)
+        .sort(([, a], [, b]) => b - a)
+        .slice(0, 5)
+        .map(([type, count]) => ({ type, count }));
+    // Build analyzerResults dynamically from the actual analyzer labels on the
+    // violations. The Go subprocess labels findings with the analyzer that
+    // produced them (`solid`, and potentially `imports`/`errors`/`goroutines`/
+    // `channels`) — never `go`. A hardcoded `go` bucket filtering
+    // `v.analyzer === 'go'` was therefore structurally always zero.
+    const analyzerResults = {};
+    for (const v of violations) {
+        const key = v.analyzer || 'unknown';
+        if (!analyzerResults[key]) {
+            analyzerResults[key] = {
+                violations: [],
+                status: makeVisitorStatus(totalFiles),
+                executionTime,
+                analyzerName: key,
+            };
+        }
+        analyzerResults[key].violations.push(v);
+    }
+    // Surface languages discovered on disk but skipped (no runtime), plus any
+    // subprocess errors, as diagnostics — so "Go files present, Go toolchain
+    // not found" reaches the report instead of collapsing into a silent zero.
+    const diagnostics = [];
+    for (const na of polyglotResult.notApplicable || []) {
+        diagnostics.push({ analyzerName: na.language, kind: 'notApplicable', message: na.reason });
+    }
+    for (const err of polyglotResult.errors || []) {
+        diagnostics.push({
+            analyzerName: err.language || 'polyglot',
+            kind: err.type || 'error',
+            message: err.message,
+        });
+    }
+    return {
+        timestamp: new Date(),
+        summary: {
+            totalViolations: violations.length,
+            criticalIssues,
+            warnings,
+            suggestions,
+            totalFiles,
+            violationsByCategory,
+            topIssues,
+        },
+        analyzerResults,
+        recommendations: [],
+        metadata: {
+            auditDuration: executionTime,
+            filesAnalyzed: totalFiles,
+            analyzersRun: Object.keys(analyzerResults),
+            fileToFunctionsMap: polyglotResult.indexEntries
+                ? createFileToFunctionsMap(polyglotResult.indexEntries)
+                : {},
+            ...(diagnostics.length > 0 && { diagnostics }),
+        },
+    };
+}
+function createFileToFunctionsMap(indexEntries) {
+    const fileMap = {};
+    for (const entry of indexEntries) {
+        if (!fileMap[entry.file])
+            fileMap[entry.file] = [];
+        fileMap[entry.file].push(entry);
+    }
+    return fileMap;
+}
+/**
+ * Run an audit, routing to the Go subprocess when the target contains Go files
+ * and to the TypeScript tree-sitter pipeline otherwise. The single place both
+ * the CLI and MCP surfaces make that decision.
+ */
+export async function runAuditDispatch(options) {
+    // Resolve to an absolute path up front. The Go subprocess is spawned with a
+    // cwd of its own (dist/languages/go), so relative file paths produced by
+    // discovery (e.g. `bench/real/gin/auth.go`) would not resolve from its cwd —
+    // the subprocess errors "no such file or directory" and the whole audit
+    // collapses to zero findings. Absolute paths make discovery absolute, which
+    // works for both the in-process TS half and the Go subprocess.
+    const projectRoot = path.resolve(options.projectRoot || process.cwd());
+    const hasGo = await hasFilesWithExtension(projectRoot, '.go');
+    if (!hasGo) {
+        const runner = createAuditRunner(options);
+        return runner.run();
+    }
+    // Go present → the polyglot orchestrator, which runs the Go subprocess for
+    // `.go` files and the node runtime for any TypeScript/JavaScript alongside.
+    const runtimeManager = new RuntimeManager();
+    await runtimeManager.initialize();
+    const codeIndex = CodeIndexDB.getInstance();
+    await codeIndex.initialize();
+    const orchestrator = new LanguageOrchestrator(runtimeManager, codeIndex);
+    const polyglotResult = await orchestrator.analyzePolyglotProject(projectRoot, {
+        analyzers: options.enabledAnalyzers,
+        minSeverity: options.minSeverity,
+        updateIndex: options.indexFunctions,
+        enableCrossLanguageAnalysis: true,
+        buildCrossReferences: true,
+    });
+    return convertPolyglotToAuditResult(polyglotResult, projectRoot);
+}
+//# sourceMappingURL=auditRouter.js.map

package/dist/auditRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditRouter.js","sourceRoot":"","sources":["../src/auditRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAA2B,MAAM,qCAAqC,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAW;IACrE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,IAAI,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC9D,IAAI,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YACnF,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,cAAmB,EAAE,SAAiB;IACjF,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;IACnD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACvF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAChF,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;IACtF,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,CAAC;IAEjE,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,oBAAoB,GAA2B,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC;QACjE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC;SACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,gEAAgE;IAChE,MAAM,eAAe,GAAwB,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC;QACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,eAAe,CAAC,GAAG,CAAC,GAAG;gBACrB,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,iBAAiB,CAAC,UAAU,CAAC;gBACrC,aAAa;gBACb,YAAY,EAAE,GAAG;aAClB,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,WAAW,GAAmE,EAAE,CAAC;IACvF,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QACpD,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC9C,WAAW,CAAC,IAAI,CAAC;YACf,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,UAAU;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO;YACzB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,CAAC,MAAM;YAClC,cAAc;YACd,QAAQ;YACR,WAAW;YACX,UAAU;YACV,oBAAoB;YACpB,SAAS;SACV;QACD,eAAe;QACf,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE;YACR,aAAa,EAAE,aAAa;YAC5B,aAAa,EAAE,UAAU;YACzB,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1C,kBAAkB,EAAE,cAAc,CAAC,YAAY;gBAC7C,CAAC,CAAC,wBAAwB,CAAC,cAAc,CAAC,YAAY,CAAC;gBACvD,CAAC,CAAC,EAAE;YACN,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;SAC/C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,YAAmB;IACnD,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA2B;IAChE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAEzE,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,WAAW,EAAE;QAC5E,SAAS,EAAE,OAAO,CAAC,gBAAgB;QACnC,WAAW,EAAE,OAAO,CAAC,WAAqD;QAC1E,WAAW,EAAE,OAAO,CAAC,cAAc;QACnC,2BAA2B,EAAE,IAAI;QACjC,oBAAoB,EAAE,IAAI;KAC3B,CAAC,CAAC;IAEH,OAAO,4BAA4B,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AACnE,CAAC"}

package/dist/auditRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditRunner.d.ts","sourceRoot":"","sources":["../src/auditRunner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EAWf,MAAM,YAAY,CAAC;AA6DpB;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB;oCAiBnB,MAAM,KAAG,OAAO,CAAC,kBAAkB,CAAC;uBAQjD,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;6BA+/B1B,WAAW,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;EAS7F;AAkRD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,GAAG,YAAY,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAC/C,UAAU,CAAC,EAAE,MAAM,GAClB,iBAAiB,EAAE,CA0CrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAGjF;AAED,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"auditRunner.d.ts","sourceRoot":"","sources":["../src/auditRunner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EAWf,MAAM,YAAY,CAAC;AAmEpB;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB;oCAQnB,MAAM,KAAG,OAAO,CAAC,kBAAkB,CAAC;uBAQjD,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;6BAijC1B,WAAW,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;EAS7F;AAkRD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,GAAG,YAAY,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAC/C,UAAU,CAAC,EAAE,MAAM,GAClB,iBAAiB,EAAE,CA0CrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAGjF;AAED,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/auditRunner.js

@@ -11,9 +11,10 @@ import { randomUUID } from 'node:crypto';
 import { AuditAbortedError, AuditHandoffError, } from './types.js';
 import { discoverFiles, discoverFilesDetailed } from './utils/fileDiscovery.js';
 import { FileAccounting } from './services/fileAccounting.js';
-import { loadConfig } from './config/configLoader.js';
+import { loadConfig, findConfigFileUp } from './config/configLoader.js';
 import { mergePathProfiles } from './config/defaults.js';
 import { checkThresholdRationales } from './config/thresholdRationales.js';
+import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { applyPresets } from './presets/presets.js';
 import { generateReport } from './reporting/reportGenerator.js';
 import { extractFunctionsFromFile } from './functionScanner.js';
@@ -29,7 +30,7 @@ import { CodeIndexDB } from './codeIndexDB.js';
 import { writeAuditToLedger, detectRunInput } from './ledger.js';
 // Pipeline imports (Spec 25 — pipeline replaces hand-rolled analyzer loop)
 import { runPipeline, writeIndexFactsToDb, makeVisitorStatus, getFilesProcessed, isVisitorStatus, buildCoverageReport } from './pipeline.js';
-import { createSolidVisitor, createDryVisitor, createDataAccessVisitor, createDocumentationVisitor, createFunctionIndexVisitor, createStylesCssVisitor, createReactVisitor, createStylesReducer, createConventionsReducer, createCrossDomainReducer, createInvariantsReducer, createSchemaSqlVisitor, createSchemaCodeVisitor, createSchemaPrismaVisitor, createSchemaJsonVisitor, createSchemaReducer, } from './pipelineAdapters.js';
+import { createSolidVisitor, createDryVisitor, createDataAccessVisitor, createDocumentationVisitor, createFunctionIndexVisitor, createStylesCssVisitor, createStylesSourceVisitor, createReactVisitor, createStylesReducer, createConventionsReducer, createCrossDomainReducer, createInvariantsReducer, createSchemaSqlVisitor, createSchemaCodeVisitor, createSchemaPrismaVisitor, createSchemaJsonVisitor, createSchemaReducer, createCrossLanguageEntityVisitor, createSchemaValidatorReducer, createAPIContractReducer, createDependencyGraphReducer, } from './pipelineAdapters.js';
 // Package version — read once at module load
 const __auditRunnerDirname = path.dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(path.join(__auditRunnerDirname, '..', 'package.json'), 'utf-8'));
@@ -44,18 +45,7 @@ const SCHEMA_SUB_VISITORS = ['schema-sql', 'schema-code', 'schema-prisma', 'sche
  * Create an audit runner with the given options
  */
 export function createAuditRunner(options = {}) {
-    const analyzerRegistry = {
-        solid: { name: 'solid' },
-        dry: { name: 'dry' },
-        'data-access': { name: 'data-access' },
-        react: { name: 'react' },
-        documentation: { name: 'documentation' },
-        invariants: { name: 'invariants' },
-        schema: { name: 'schema' },
-        styles: { name: 'styles' },
-        conventions: { name: 'conventions' },
-        'cross-domain': { name: 'cross-domain' },
-    };
+    const analyzerRegistry = Object.fromEntries(ALL_ANALYZERS.map((name) => [name, { name }]));
     /**
      * Load configuration from file
      */
@@ -67,19 +57,16 @@ export function createAuditRunner(options = {}) {
      * Run the audit
      */
     async function run(runOptions) {
-        // Auto-load .codeauditor.json from project root so the programmatic API
-        // respects the same config the CLI surface reads. RunOptions (caller)
-        // override file config, and createAuditRunner options override both.
+        // Auto-load .codeauditor.json so the programmatic API respects the same
+        // config the CLI surface reads. Walk UP from the audit path so a scoped
+        // audit (`--path src`) still finds the project-root config rather than
+        // silently using defaults. RunOptions (caller) override file config, and
+        // createAuditRunner options override both.
         const rootForConfig = runOptions?.projectRoot || options.projectRoot || process.cwd();
-        let fileConfig = {};
-        try {
-            const configPath = path.join(rootForConfig, '.codeauditor.json');
-            await fs.access(configPath);
-            fileConfig = await loadConfig({ configPath });
-        }
-        catch {
-            // No config file — proceed with defaults
-        }
+        const configPath = await findConfigFileUp(rootForConfig);
+        const fileConfig = configPath
+            ? await loadConfig({ configPath })
+            : {};
         const mergedOptions = { ...fileConfig, ...options, ...runOptions };
         // Spec 36 R5 — a threshold change needs a written rationale. Check the
         // user-facing analyzerConfigs layer (project config + inline options)
@@ -316,12 +303,17 @@ export function createAuditRunner(options = {}) {
         // `.css`/`.scss`), so `consumedFiles` is the "any layer read it" evidence
         // for files dropped at stage 2 — threaded into the pipeline below.
         let styleConsumedFiles = [];
+        // In-scope files that contributed style data during the sync. Undefined when
+        // the sync did not run or failed — the styles reducer must not short-circuit
+        // on that (it falls back to full analysis), so we only assign on success.
+        let styleContributingFiles;
         if (enabledAnalyzers.includes('styles')) {
             try {
                 const styleDb = CodeIndexDB.getInstance(undefined, root);
                 await styleDb.initialize();
                 const styleSyncResult = await syncStyleIndex(styleDb.rawDb, files, root, { scoped: isScoped });
                 styleConsumedFiles = styleSyncResult.consumedFiles;
+                styleContributingFiles = styleSyncResult.contributingFiles;
                 logMcpInfo('style-index', 'style index sync complete', {
                     changed: styleSyncResult.changed,
                     skipped: styleSyncResult.skipped,
@@ -394,6 +386,7 @@ export function createAuditRunner(options = {}) {
                 exec: (sql) => auditIndex.rawDb.exec(sql),
                 getMeta: (key) => auditIndex.getMeta(key),
                 getUntestedTopDecile: (td) => auditIndex.getUntestedTopDecile(td),
+                rawDb: auditIndex.rawDb,
             };
         }
         // ── 1. Build pipeline adapters ───────────────────────────────────────
@@ -409,6 +402,10 @@ export function createAuditRunner(options = {}) {
         // styles-css visitor — AST-extracts .css files into style_* tables (Spec 26 Phase 2)
         if (enabledAnalyzers.includes('styles'))
             pipelineVisitors.push(createStylesCssVisitor());
+        // styles-source visitor — AST-extracts TS/JS CSS-in-JS into style_* tables,
+        // reusing the stage-1 parse (eliminates the style-index re-parse).
+        if (enabledAnalyzers.includes('styles'))
+            pipelineVisitors.push(createStylesSourceVisitor());
         if (enabledAnalyzers.includes('solid'))
             pipelineVisitors.push(createSolidVisitor());
         if (enabledAnalyzers.includes('dry')) {
@@ -438,6 +435,22 @@ export function createAuditRunner(options = {}) {
             pipelineVisitors.push(createSchemaJsonVisitor());
             pipelineReducers.push(createSchemaReducer());
         }
+        // Cross-language analyzers (SchemaValidator, APIContractAnalyzer,
+        // DependencyGraphBuilder) — three Stage-4 reducers fed by one shared
+        // entity-extraction visitor. The visitor is cheap (per-file) and runs
+        // whenever ANY cross-language analyzer is enabled; the corpus-wide reducers
+        // short-circuit on scoped/diff runs.
+        const crossLanguageEnabled = ['schema-validator', 'api-contract', 'dependency-graph']
+            .some((a) => enabledAnalyzers.includes(a));
+        if (crossLanguageEnabled) {
+            pipelineVisitors.push(createCrossLanguageEntityVisitor());
+        }
+        if (enabledAnalyzers.includes('schema-validator'))
+            pipelineDerivedReducers.push(createSchemaValidatorReducer());
+        if (enabledAnalyzers.includes('api-contract'))
+            pipelineDerivedReducers.push(createAPIContractReducer());
+        if (enabledAnalyzers.includes('dependency-graph'))
+            pipelineDerivedReducers.push(createDependencyGraphReducer());
         // ── 2. Safeguard warnings ────────────────────────────────────────────
         if (auditIndex) {
             if (enabledAnalyzers.includes('cross-domain')) {
@@ -530,6 +543,7 @@ export function createAuditRunner(options = {}) {
                 isScoped,
                 fileAccounting,
                 consumedFilePaths: styleConsumedFiles,
+                styleContributingFiles,
                 onStage2Complete: async (ctx) => {
                     // Post-stage-2 setup: rebuild function_calls from the functions table
                     // (populated by the function-index visitor), then mine conventions.
@@ -581,7 +595,10 @@ export function createAuditRunner(options = {}) {
                     try {
                         const reactResult = analyzerResults['react'];
                         if (reactResult) {
-                            const extraViolations = await reactBundle.finalizeCrossComponent(pipelineAnalyzerConfig);
+                            // Pass the react namespace (not the whole namespaced config) so
+                            // finalize reads `requireErrorBoundaries`/`rawElementCheck` at the
+                            // same level the visitor's `context.config` does.
+                            const extraViolations = await reactBundle.finalizeCrossComponent(pipelineAnalyzerConfig['react'] ?? {});
                             reactResult.violations.push(...extraViolations);
                         }
                     }
@@ -597,7 +614,7 @@ export function createAuditRunner(options = {}) {
                 // zero-violation rules promote from `unassessed` to `clean`/`notApplicable`.
                 pipelineCoverage = buildCoverageReport(analyzerResults, pipelineConfig, pipelineResult.metadata?.inputPresence, new Map((pipelineResult.metadata?.ruleApplicability ?? []).map((a) => [
                     a.ruleId,
-                    { applicable: a.applicable, reason: a.reason },
+                    { applicable: a.applicable, reason: a.reason, kind: a.kind },
                 ])));
                 // Spec 29: extract table catalog from pipeline metadata for audit report
                 pipelineTableCatalog = pipelineResult.metadata?.tableCatalog;
@@ -659,6 +676,22 @@ export function createAuditRunner(options = {}) {
                 }
             }
         }
+        // ── Normalize the analyzer field on every violation to its result key ──
+        // Violations are emitted by analyzers that don't always stamp `analyzer`
+        // correctly: the react analyzer omits it entirely, and the schema sub-visitor
+        // helpers (createSchemaViolation) hardcode `analyzer: 'schema'` for every
+        // sub-visitor, collapsing schema-code/schema-sql/schema-prisma/schema-json
+        // into the parent 'schema'. Both surface in the baseline metadata as
+        // `unknown: 338` / an over-broad `schema` bucket. The result key IS the
+        // analyzer that emitted the finding, so stamp it here as the single source
+        // of truth — a no-op for every analyzer that already labels itself, and it
+        // also fixes any future analyzer that forgets. Runs before baseline
+        // classification (Spec 18) so fingerprints and analyzerCounts are correct.
+        for (const [resultName, result] of Object.entries(orderedAnalyzerResults)) {
+            for (const v of result.violations) {
+                v.analyzer = resultName;
+            }
+        }
         // ── Spec 13 R5 Phase 1: Persist seeded DRY pairs ──────────────────
         // Store pairs from DRY analysis in dry_pair_history for divergence tracking.
         // Pair identity is fingerprint-based (file + nodeType + line),
@@ -687,36 +720,6 @@ export function createAuditRunner(options = {}) {
         catch {
             // dry_pair_history persistence is advisory — non-fatal
         }
-        // ── Baseline classification (Spec 18 R1) ────────────────────────────
-        const projectRoot = path.resolve(mergedOptions.projectRoot || process.cwd());
-        const baseline = loadBaseline(projectRoot);
-        let baselineMetadata;
-        if (baseline) {
-            const allViolations = Object.values(orderedAnalyzerResults).flatMap((r) => r.violations);
-            // For scoped runs, limit "fixed" to in-scope files
-            const scopedFiles = isScoped ? files : undefined;
-            const classified = matchFindings(allViolations, baseline, scopedFiles);
-            // Tag violations with their baseline status
-            for (const v of classified.new) {
-                v.new = true;
-            }
-            for (const v of classified.known) {
-                v.new = false;
-            }
-            baselineMetadata = {
-                present: true,
-                hash: hashBaseline(baseline),
-                newCount: classified.new.length,
-                fixedCount: classified.fixed.length,
-                knownCount: classified.known.length,
-                previousKnownCount: baseline.metadata.totalFindings,
-            };
-            logMcpInfo('baseline', 'baseline classification complete', {
-                new: classified.new.length,
-                fixed: classified.fixed.length,
-                known: classified.known.length,
-            });
-        }
         // ── Spec 36 R7 — suppression decay ──────────────────────────────────
         // Inline `code-audit-disable-*` directives suppress a finding only while
         // it fires, carry a required reason, and are themselves an error when
@@ -897,6 +900,42 @@ export function createAuditRunner(options = {}) {
         for (const ar of Object.values(orderedAnalyzerResults)) {
             validateHookContract(ar.violations);
         }
+        // ── Baseline classification (Spec 18 R1) ────────────────────────────
+        // Runs AFTER validateHookContract (and after divergence tracking) so it
+        // classifies exactly the violation set that reaches the report. Previously
+        // this ran before the hook-contract guard spliced out malformed violations
+        // (empty file / line 0 / missing line), so newCount+knownCount over-counted
+        // by the number of spliced findings and no longer reconciled with
+        // summary.totalViolations.
+        const projectRoot = path.resolve(mergedOptions.projectRoot || process.cwd());
+        const baseline = loadBaseline(projectRoot);
+        let baselineMetadata;
+        if (baseline) {
+            const allViolations = Object.values(orderedAnalyzerResults).flatMap((r) => r.violations);
+            // For scoped runs, limit "fixed" to in-scope files
+            const scopedFiles = isScoped ? files : undefined;
+            const classified = matchFindings(allViolations, baseline, scopedFiles);
+            // Tag violations with their baseline status
+            for (const v of classified.new) {
+                v.new = true;
+            }
+            for (const v of classified.known) {
+                v.new = false;
+            }
+            baselineMetadata = {
+                present: true,
+                hash: hashBaseline(baseline),
+                newCount: classified.new.length,
+                fixedCount: classified.fixed.length,
+                knownCount: classified.known.length,
+                previousKnownCount: baseline.metadata.totalFindings,
+            };
+            logMcpInfo('baseline', 'baseline classification complete', {
+                new: classified.new.length,
+                fixed: classified.fixed.length,
+                known: classified.known.length,
+            });
+        }
         // Generate summary
         const summary = generateSummary(orderedAnalyzerResults, files.length);
         // Create result