code-auditor-mcp 3.4.9 → 3.4.11

package/.claude-plugin/marketplace.json

@@ -10,11 +10,18 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "3.4.9",
+      "version": "3.4.11",
       "author": {
         "name": "Ben Hammond"
       },
-      "keywords": ["code-quality", "audit", "solid", "linting", "invariants"]
+      "keywords": [
+        "code-quality",
+        "audit",
+        "solid",
+        "linting",
+        "invariants"
+      ]
     }
-  ]
+  ],
+  "version": "3.4.11"
 }

package/CHANGELOG.md

@@ -2,6 +2,87 @@
 
 All notable changes to the Code Auditor MCP project.
 
+## [3.4.11] — unreleased
+
+### Spec 26: Consume the ASTs We Already Produce
+
+Stage 1 parses every `.css` file into a tree-sitter AST, but all CSS analysis
+operated via regex on raw source text. Spec 26 converts CSS extraction and
+several TypeScript subsystems to walk the AST via adapter methods — the regex
+only classifies tokens; the AST discovers structure.
+
+#### Phase 2 — CSS AST extraction (`cssAstExtractor.ts`)
+
+CSS declarations, class names, and custom-property tokens are now extracted from
+tree-sitter-css ASTs via three pure functions: `extractDeclarationsFromCSSAst`,
+`extractClassUsageFromCSSAst`, `extractTokensFromCSSAst`. `.scss` files stay on
+the regex path (tree-sitter-css is not an SCSS grammar).
+
+Five parser bugs in the retired regex path are eliminated by AST structure:
+
+- **Bug 1** (whitespace before `@`-rules): `at_rule` nodes are always correct
+- **Bug 2** (`@apply` in rule sets): handled via ERROR/postcss_statement/at_rule children
+- **Bug 3** (nested `@`-rule brace): tree-sitter handles brace matching
+- **Bug 4** (backward-scan boundary): no backward scanning — selectors from `selectors` child
+- **Bug 5** (CSS comments as class names): comment nodes are typed, naturally excluded
+
+The `;` stripping fix in `getPropertyAndValue()` (tree-sitter-css includes the
+trailing semicolon in declaration node text) uncovered 53 legitimate
+cross-mechanism violations previously hidden: 14 token-bypass + 39
+mechanism-fragmentation. Styles total: 119 (was 66).
+
+Also fixed: `extractClassUsageFromCSSAst` filters by parent type `class_selector`
+to exclude pseudo-classes (`:hover`, `:focus`) and pseudo-elements.
+
+#### Phase 1 — TypeScript subsystems
+
+- **Invariants** (`ruleEngine.ts`): `extractImports()` and `extractExportedSymbols()`
+  regex functions deleted. `function-index` visitor now emits `imports`,
+  `dynamicImports`, and `exports` facts per file — invariants reducer consumes
+  them via `fileData` instead of re-extracting from source.
+- **Conventions** (`conventionMiner.ts`): `detectExportForm()` now accepts
+  `ExportInfo[]` from `extractExports(ast)` instead of 6 regexes on raw source.
+  Export-shape detection found one additional legitimate violation
+  (`AdminModerationShell`) the regex path missed.
+- **Documentation** (`documentationAnalyzer.ts`): `getJSDocText()` and
+  `getPrecedingJSDocComments()` replaced by `adapter.getDocumentation()`.
+
+### SQL injection parameterization detection
+
+Four new methods in `UniversalDataAccessAnalyzer.ts` detect safe parameterized
+SQL patterns before the keyword/dynamic-part check:
+
+- `isInPrepareBindChain`: detects `.prepare().bind()` chains including the
+  two-statement pattern (`const stmt = db.prepare(sql); stmt.bind(x).all()`)
+- `isInExecChain`: detects safe DO `.exec()` with spread binds
+- `isD1ConvenienceCall`: detects D1 convenience methods (`.all()`, `.first()`,
+  `.run()`) with bind parameters
+
+18 legitimate `sql-injection-risk` violations remain (down from ~55 false
+positives): 3 DO `.exec()` calls without detectable parameterization, 15
+`prepare()` calls where the bind chain cannot be verified (dynamic table/column
+names not bind-able).
+
+### unknown-table = 8 (all generation_queue)
+
+The DO DDL visitor correctly identifies 8 references to the `generation_queue`
+table in `src/pages/api/admin/generation/queue.ts`. The table was dropped in
+migration 0198 — a dead admin page referencing a removed table.
+
+## [3.4.10] — 2026-07-31
+
+### Accuracy fix: Phantom cross-domain lifecycle violations from over-broad DB detection defaults
+
+`dbReceiverNames` and `dbCallMethods` defaults existed in three (actually seven) copies across the codebase, and they disagreed: the type annotations at `UniversalSchemaAnalyzer.ts` described a narrow 4-entry / 6-entry list, but `DEFAULT_SCHEMA_CONFIG` itself held a wider 7-entry / 9-entry list (`connection`, `pool`, `client`, `query`, `get`, `each`), `pipelineAdapters.ts` hardcoded the narrow list (correct by accident), `UniversalDataAccessAnalyzer.ts` had its own 7-entry / 11-entry copy via `...DB_CALL_METHODS`, and `config/defaults.ts` held the wide list for user-facing help.
+
+The wide lists matched non-DB code: `env.VECTORIZE.query()` (Vectorize binding, not a DB client), `Map.get()`, jQuery `.each()`, WebSocket `connection.status`, generic `pool.length`, and `client.` appearing only in comments. Every match was a phantom — the extended entries produced zero signal across the entire recall-protocol corpus.
+
+**Breaking ground-truth change:** `DEFAULT_SCHEMA_CONFIG.dbReceiverNames` and `.dbCallMethods` are now the narrow lists (`db, database, sql, stmt` / `exec, prepare, batch, run, all, first`). All inline fallbacks in `passesFileGate`, `findTableReferences`, and `buildProvenanceContext` reference `DEFAULT_SCHEMA_CONFIG` as the single source of truth. `config/defaults.ts` matches. `pipelineAdapters.ts` reads `DEFAULT_SCHEMA_CONFIG` instead of hardcoding.
+
+This is not an internal cleanup — any user with a variable named `pool`, `client`, or `connection` was receiving phantom cross-domain `written-never-read` / `read-never-written` / `transaction-boundary` findings, and phantom data-access violations on generic `.query()` / `.get()` / `.each()` calls. The fix removes these false positives.
+
+Cross-domain: 37 (was 43). Data-access: 1826 (was 1827). All 803 tests pass.
+
 ## [3.4.8] — 2026-07-28
 
 ### Fix: React Analyzer Bench F1 — Config Merge + Heuristic Fix

package/dist/analyzers/analyzerUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzerUtils.d.ts","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAUrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,GAAG,EACX,UAAU,CAAC,EAAE,MAAM,KAChB,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEtF;;;GAGG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,oBAAoB,EACjC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,GAAQ,EAChB,gBAAgB,CAAC,EAAE,gBAAgB,GAClC,OAAO,CAAC,cAAc,CAAC,CA8CzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,GACd,SAAS,CAEX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGlC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GACpC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GACpC,OAAO,EAAE,CAMX;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAC/B,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,WAAW,CAAC,EAAE,aAAa,GAC1B,SAAS,EAAE,CAWb;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAcnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,oBAAoB,EAClC,aAAa,GAAE,GAAQ,WAEF,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,6BAWnG"}
+{"version":3,"file":"analyzerUtils.d.ts","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAWrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,GAAG,EACX,UAAU,CAAC,EAAE,MAAM,KAChB,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEtF;;;GAGG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,oBAAoB,EACjC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,GAAQ,EAChB,gBAAgB,CAAC,EAAE,gBAAgB,GAClC,OAAO,CAAC,cAAc,CAAC,CA8CzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,GACd,SAAS,CAEX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGlC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GACpC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GACpC,OAAO,EAAE,CAMX;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAC/B,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,WAAW,CAAC,EAAE,aAAa,GAC1B,SAAS,EAAE,CAWb;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAcnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,oBAAoB,EAClC,aAAa,GAAE,GAAQ,WAEF,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,6BAWnG"}

package/dist/analyzers/analyzerUtils.js

@@ -3,6 +3,7 @@
  * These replace the BaseAnalyzer class with composable functions
  */
 import * as fs from 'fs/promises';
+import { makeVisitorStatus } from '../pipeline.js';
 import { walkAST, isExported, getNodeName as bridgeGetNodeName, calculateComplexity as bridgeCalculateComplexity, getLineAndColumn as bridgeGetLineAndColumn, } from '../languages/adapterBridge.js';
 // Re-export utilities from other modules
 export { parseTypeScriptFile } from '../utils/astParser.js';
@@ -42,7 +43,7 @@ export async function processFiles(files, analyzeFile, analyzerName, config = {}
     }
     const result = {
         violations,
-        filesProcessed: processedFiles,
+        status: makeVisitorStatus(processedFiles),
         executionTime: Date.now() - startTime,
         analyzerName
     };

package/dist/analyzers/analyzerUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyzerUtils.js","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,IAAI,iBAAiB,EAChC,mBAAmB,IAAI,yBAAyB,EAChD,gBAAgB,IAAI,sBAAsB,GAC3C,MAAM,+BAA+B,CAAC;AAEvC,yCAAyC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAiB9B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAe,EACf,WAAiC,EACjC,YAAoB,EACpB,MAAM,GAAQ,EAAE,EAChB,gBAAmC;IAEnC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gBAAgB,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,CAAC;YAED,sBAAsB;YACtB,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,qEAAqE;YACrE,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACrE,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAEnC,cAAc,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB;QAC7B,UAAU;QACV,cAAc,EAAE,cAAc;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACrC,YAAY;KACb,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa;IAEb,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,SAAqC;IAErC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa,EACb,SAAqC;IAErC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAuB,EACvB,WAA2B;IAE3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEjD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC3B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB;IACpD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,yBAAyB;QACzB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACzE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAE5C,eAAe;QACf,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEpC,eAAe;QACf,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,YAAkC,EAClC,aAAa,GAAQ,EAAE;IAEvB,OAAO,KAAK,EAAE,KAAe,EAAE,MAA+B,EAAE,OAAkC,EAAE,EAAE;QACpG,MAAM,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAE3E,8BAA8B;QAC9B,MAAM,CAAC,UAAU,GAAG,cAAc,CAChC,0BAA0B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,WAAwC,CAAC,CACjG,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"analyzerUtils.js","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,IAAI,iBAAiB,EAChC,mBAAmB,IAAI,yBAAyB,EAChD,gBAAgB,IAAI,sBAAsB,GAC3C,MAAM,+BAA+B,CAAC;AAEvC,yCAAyC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAiB9B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAe,EACf,WAAiC,EACjC,YAAoB,EACpB,MAAM,GAAQ,EAAE,EAChB,gBAAmC;IAEnC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gBAAgB,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,CAAC;YAED,sBAAsB;YACtB,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,qEAAqE;YACrE,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACrE,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAEnC,cAAc,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB;QAC7B,UAAU;QACV,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC;QACzC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACrC,YAAY;KACb,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa;IAEb,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,SAAqC;IAErC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa,EACb,SAAqC;IAErC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAuB,EACvB,WAA2B;IAE3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEjD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC3B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB;IACpD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,yBAAyB;QACzB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACzE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAE5C,eAAe;QACf,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEpC,eAAe;QACf,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,YAAkC,EAClC,aAAa,GAAQ,EAAE;IAEvB,OAAO,KAAK,EAAE,KAAe,EAAE,MAA+B,EAAE,OAAkC,EAAE,EAAE;QACpG,MAAM,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAE3E,8BAA8B;QAC9B,MAAM,CAAC,UAAU,GAAG,cAAc,CAChC,0BAA0B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,WAAwC,CAAC,CACjG,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/analyzers/crossDomain/CrossDomainAnalyzer.d.ts

@@ -25,8 +25,6 @@ export declare class CrossDomainAnalyzer extends UniversalAnalyzer {
     readonly name = "cross-domain";
     readonly description = "Detects cross-domain issues (schema lifecycle, validation bypass, coverage gaps)";
     readonly category = "architecture";
-    /** Project root for DB scoping (Bug #4 / Item 1). */
-    private projectRoot;
     /**
      * Full override: query the code index DB for cross-domain findings.
      * The base-class per-file AST loop is bypassed — all detection is

package/dist/analyzers/crossDomain/CrossDomainAnalyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CrossDomainAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/crossDomain/CrossDomainAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAoD,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AA0BzE,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,WAAW,sFACiE;IACrF,QAAQ,CAAC,QAAQ,kBAAkB;IAEnC,qDAAqD;IACrD,OAAO,CAAC,WAAW,CAAqB;IAExC;;;;OAIG;IACG,OAAO,CACX,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,GAAE,GAAQ,EAChB,OAAO,GAAE,GAAQ,GAChB,OAAO,CAAC,cAAc,CAAC,CAuFzB;IAED,yCAAyC;IACnC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAEjC;IAID;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA0C9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAyC9B;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAuJrC;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IAwL9B;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAwL3B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;CA2C5B"}
+{"version":3,"file":"CrossDomainAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/crossDomain/CrossDomainAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAoD,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AA2BzE,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,WAAW,sFACiE;IACrF,QAAQ,CAAC,QAAQ,kBAAkB;IAEnC;;;;OAIG;IACG,OAAO,CACX,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,GAAE,GAAQ,EAChB,OAAO,GAAE,GAAQ,GAChB,OAAO,CAAC,cAAc,CAAC,CAgFzB;IAED,yCAAyC;IACnC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAEjC;IAID;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAuC9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAyIrC;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IA6K9B;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IA+K3B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;CAwC5B"}

package/dist/analyzers/crossDomain/CrossDomainAnalyzer.js

@@ -21,8 +21,8 @@
  */
 import * as path from 'node:path';
 import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
-import { CodeIndexDB } from '../../codeIndexDB.js';
 import { VALIDATOR_PACKAGES } from '../provenance.js';
+import { makeVisitorStatus } from '../../pipeline.js';
 // ---------------------------------------------------------------------------
 // Analyzer
 // ---------------------------------------------------------------------------
@@ -30,8 +30,6 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
     name = 'cross-domain';
     description = 'Detects cross-domain issues (schema lifecycle, validation bypass, coverage gaps)';
     category = 'architecture';
-    /** Project root for DB scoping (Bug #4 / Item 1). */
-    projectRoot;
     /**
      * Full override: query the code index DB for cross-domain findings.
      * The base-class per-file AST loop is bypassed — all detection is
@@ -40,29 +38,24 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
     async analyze(files, config = {}, options = {}) {
         const startTime = Date.now();
         const violations = [];
-        // Store projectRoot for scoped DB access in private methods (Bug #4 / Item 1)
-        this.projectRoot = config.projectRoot;
-        let rawDb = null;
-        try {
-            const db = CodeIndexDB.getInstance(undefined, this.projectRoot);
-            await db.initialize();
-            rawDb = db.rawDb;
-        }
-        catch {
+        const indexHandle = config.indexHandle;
+        if (!indexHandle) {
             return {
                 violations: [],
                 errors: [{ file: '', error: 'Failed to open code index database' }],
-                filesProcessed: 0,
+                status: makeVisitorStatus(0),
                 executionTime: Date.now() - startTime,
+                analyzerName: 'cross-domain',
                 metrics: { filesAnalyzed: 0, totalViolations: 0, executionTime: Date.now() - startTime },
             };
         }
-        if (!rawDb) {
+        if (!indexHandle) {
             return {
                 violations: [],
                 errors: [],
-                filesProcessed: files.length,
+                status: makeVisitorStatus(files.length),
                 executionTime: Date.now() - startTime,
+                analyzerName: 'cross-domain',
                 metrics: { filesAnalyzed: files.length, totalViolations: 0, executionTime: Date.now() - startTime },
             };
         }
@@ -77,37 +70,37 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         // R1 — Schema lifecycle detectors
         const lifecycle = config.schemaLifecycle ?? {};
         if (lifecycle.enableWrittenNeverRead !== false) {
-            violations.push(...this.detectWrittenNeverRead(rawDb, filePathClause));
+            violations.push(...this.detectWrittenNeverRead(indexHandle, filePathClause));
         }
         if (lifecycle.enableReadNeverWritten !== false) {
-            violations.push(...this.detectReadNeverWritten(rawDb, filePathClause));
+            violations.push(...this.detectReadNeverWritten(indexHandle, filePathClause));
         }
         if (lifecycle.enableTransactionBoundaryRisk !== false) {
             const txnTableMax = lifecycle.txnTableMax ?? 4;
-            violations.push(...this.detectTransactionBoundaryRisk(rawDb, txnTableMax, filePathClause));
+            violations.push(...this.detectTransactionBoundaryRisk(indexHandle, txnTableMax, filePathClause));
         }
         // R3 — Validation-bypass detection
         const bypass = config.validatorBypass;
         if (bypass) {
-            violations.push(...this.detectValidationBypass(rawDb, bypass, filePathClause));
+            violations.push(...this.detectValidationBypass(indexHandle, bypass, filePathClause));
         }
         // R4 — Coverage by importance
         const coverage = config.coverage;
         if (coverage) {
-            violations.push(...this.detectUncoveredRisk(rawDb, coverage, filePathClause));
+            violations.push(...this.detectUncoveredRisk(indexHandle, coverage, filePathClause));
         }
         // Count distinct files with schema_usage entries
-        const fileRows = rawDb
-            .prepare(filePathClause
+        const fileRows = indexHandle
+            .query(filePathClause
             ? `SELECT COUNT(DISTINCT file_path) as cnt FROM schema_usage WHERE 1=1 ${filePathClause.clause}`
-            : 'SELECT COUNT(DISTINCT file_path) as cnt FROM schema_usage')
-            .all(...(filePathClause ? [filePathClause.param] : []));
+            : 'SELECT COUNT(DISTINCT file_path) as cnt FROM schema_usage', (filePathClause ? [filePathClause.param] : []));
         const uniqueFiles = fileRows[0]?.cnt ?? 0;
         return {
             violations,
             errors: [],
-            filesProcessed: uniqueFiles || files.length,
+            status: makeVisitorStatus(uniqueFiles || files.length),
             executionTime: Date.now() - startTime,
+            analyzerName: 'cross-domain',
             metrics: {
                 filesAnalyzed: uniqueFiles || files.length,
                 totalViolations: violations.length,
@@ -124,19 +117,18 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
      * Detect tables that are written to (INSERT/UPDATE/DELETE/CREATE) but
      * never read from (SELECT). These might be dead writes or missed read paths.
      */
-    detectWrittenNeverRead(rawDb, filePath) {
+    detectWrittenNeverRead(indexHandle, filePath) {
         const violations = [];
         const fpWhere = filePath ? filePath.clause : '';
-        const rows = rawDb
-            .prepare(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
+        const rows = indexHandle
+            .query(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
          FROM schema_usage
          WHERE usage_type IN ('insert', 'update', 'delete', 'create')
            ${fpWhere}
            AND table_name NOT IN (
              SELECT DISTINCT table_name FROM schema_usage WHERE usage_type = 'select' ${fpWhere}
            )
-         ORDER BY table_name, file_path`)
-            .all(...(filePath ? [filePath.param, filePath.param] : []));
+         ORDER BY table_name, file_path`, (filePath ? [filePath.param, filePath.param] : []));
         // Deduplicate by table_name — one violation per table, anchored to
         // the first writing file encountered.
         const seen = new Set();
@@ -163,11 +155,11 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
      * (INSERT/UPDATE/DELETE/CREATE). These may be external/managed tables
      * or indicate missing write coverage.
      */
-    detectReadNeverWritten(rawDb, filePath) {
+    detectReadNeverWritten(indexHandle, filePath) {
         const violations = [];
         const fpWhere = filePath ? filePath.clause : '';
-        const rows = rawDb
-            .prepare(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
+        const rows = indexHandle
+            .query(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
          FROM schema_usage
          WHERE usage_type = 'select'
            ${fpWhere}
@@ -175,8 +167,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
              SELECT DISTINCT table_name FROM schema_usage
              WHERE usage_type IN ('insert', 'update', 'delete', 'create') ${fpWhere}
            )
-         ORDER BY table_name, file_path`)
-            .all(...(filePath ? [filePath.param, filePath.param] : []));
+         ORDER BY table_name, file_path`, (filePath ? [filePath.param, filePath.param] : []));
         const seen = new Set();
         for (const row of rows) {
             if (seen.has(row.table_name))
@@ -204,7 +195,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
      * writing to too many tables in a single logical operation can lead to
      * long-running transactions, lock contention, and partial-failure complexity.
      */
-    detectTransactionBoundaryRisk(rawDb, txnTableMax, filePath) {
+    detectTransactionBoundaryRisk(indexHandle, txnTableMax, filePath) {
         const violations = [];
         const fpWhere = filePath ? filePath.clause : '';
         const fpParams = filePath ? [filePath.param] : [];
@@ -212,14 +203,13 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         //    The functions table is only populated during deepSync (code-audit index
         //    sync), not during normal audit. We query schema_usage directly so this
         //    detector works in both modes.
-        const writerRows = rawDb
-            .prepare(`SELECT su.function_name, su.file_path, su.table_name, MIN(su.line) as line
+        const writerRows = indexHandle
+            .query(`SELECT su.function_name, su.file_path, su.table_name, MIN(su.line) as line
          FROM schema_usage su
          WHERE su.usage_type IN ('insert', 'update', 'delete', 'create')
          ${fpWhere}
          GROUP BY su.function_name, su.file_path, su.table_name
-         ORDER BY su.function_name, su.file_path`)
-            .all(...fpParams);
+         ORDER BY su.function_name, su.file_path`, fpParams);
         if (writerRows.length === 0)
             return violations;
         const funcWrites = new Map();
@@ -244,7 +234,8 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         //    call-graph context.
         const hasGraphData = (() => {
             try {
-                const cnt = rawDb.prepare("SELECT COUNT(*) AS n FROM graph_cache WHERE graph_type = 'call'").get();
+                const row = indexHandle.query("SELECT COUNT(*) AS n FROM graph_cache WHERE graph_type = 'call'");
+                const cnt = row[0];
                 return (cnt?.n ?? 0) > 0;
             }
             catch {
@@ -256,7 +247,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         let fnIdLookup = null;
         if (hasGraphData) {
             try {
-                const fnRows = rawDb.prepare('SELECT id, name, file_path FROM functions').all();
+                const fnRows = indexHandle.query('SELECT id, name, file_path FROM functions');
                 if (fnRows.length > 0) {
                     fnIdLookup = new Map();
                     for (const r of fnRows) {
@@ -275,20 +266,17 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
             if (fnIdLookup && hasGraphData) {
                 const funcId = fnIdLookup.get(key);
                 if (funcId !== undefined) {
-                    const calleeRows = rawDb
-                        .prepare(`SELECT neighbor_key FROM graph_cache
-               WHERE graph_type = 'call' AND node_key = ?`)
-                        .all(String(funcId));
+                    const calleeRows = indexHandle
+                        .query(`SELECT neighbor_key FROM graph_cache
+               WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
                     for (const callee of calleeRows) {
-                        const calleeFuncs = rawDb
-                            .prepare(`SELECT name, file_path FROM functions WHERE id = ?`)
-                            .all(parseInt(callee.neighbor_key, 10));
+                        const calleeFuncs = indexHandle
+                            .query(`SELECT name, file_path FROM functions WHERE id = ?`, [parseInt(callee.neighbor_key, 10)]);
                         for (const cf of calleeFuncs) {
-                            const calleeTables = rawDb
-                                .prepare(`SELECT DISTINCT table_name FROM schema_usage
+                            const calleeTables = indexHandle
+                                .query(`SELECT DISTINCT table_name FROM schema_usage
                    WHERE usage_type IN ('insert', 'update', 'delete', 'create')
-                     AND function_name = ? AND file_path = ?`)
-                                .all(cf.name, cf.file_path);
+                     AND function_name = ? AND file_path = ?`, [cf.name, cf.file_path]);
                             for (const ct of calleeTables) {
                                 allTables.add(ct.table_name);
                             }
@@ -323,7 +311,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
      *   3. Heuristic fallback: name GLOB 'validate*' OR 'assert*' (when both
      *      above are silent)
      */
-    detectValidationBypass(rawDb, config, filePath) {
+    detectValidationBypass(indexHandle, config, filePath) {
         const violations = [];
         const { validators: userValidators = [], modeShare = 0.8, minCorpus = 20, depth = 3, } = config;
         // ── 1. Build the validator function ID set ─────────────────────────────
@@ -334,16 +322,14 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
             if (hashIdx >= 0) {
                 const vPath = v.substring(0, hashIdx);
                 const vName = v.substring(hashIdx + 1);
-                const rows = rawDb
-                    .prepare('SELECT id FROM functions WHERE name = ? AND file_path = ?')
-                    .all(vName, vPath);
+                const rows = indexHandle
+                    .query('SELECT id FROM functions WHERE name = ? AND file_path = ?', [vName, vPath]);
                 for (const r of rows)
                     validatorIds.add(r.id);
             }
             else {
-                const rows = rawDb
-                    .prepare('SELECT id FROM functions WHERE name = ?')
-                    .all(v);
+                const rows = indexHandle
+                    .query('SELECT id FROM functions WHERE name = ?', [v]);
                 for (const r of rows)
                     validatorIds.add(r.id);
             }
@@ -355,23 +341,21 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         if (validatorIds.size === 0) {
             const likeClauses = [...VALIDATOR_PACKAGES].map(() => 'used_imports LIKE ?');
             const likeParams = [...VALIDATOR_PACKAGES].map((pkg) => `%"${pkg}"%`);
-            const validatorFuncs = rawDb
-                .prepare(`SELECT id FROM functions
+            const validatorFuncs = indexHandle
+                .query(`SELECT id FROM functions
            WHERE used_imports IS NOT NULL
              AND (${likeClauses.join(' OR ')})
-             AND is_exported = 1`)
-                .all(...likeParams);
+             AND is_exported = 1`, likeParams);
             for (const f of validatorFuncs)
                 validatorIds.add(f.id);
         }
         // 1c. Heuristic fallback: name-based matching (only when provenance
         //     found nothing AND no user-configured validators exist).
         if (validatorIds.size === 0 && userValidators.length === 0) {
-            const heuristicFuncs = rawDb
-                .prepare(`SELECT id FROM functions
+            const heuristicFuncs = indexHandle
+                .query(`SELECT id FROM functions
            WHERE (name GLOB 'validate*' OR name GLOB 'assert*')
-             AND is_exported = 1`)
-                .all();
+             AND is_exported = 1`);
             for (const f of heuristicFuncs)
                 validatorIds.add(f.id);
         }
@@ -381,15 +365,14 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         const fpAliasWhere = filePath
             ? `AND su.${filePath.clause.slice(4)}`
             : '';
-        const writers = rawDb
-            .prepare(`SELECT DISTINCT su.function_name, su.file_path, su.line, f.id as function_id
+        const writers = indexHandle
+            .query(`SELECT DISTINCT su.function_name, su.file_path, su.line, f.id as function_id
          FROM schema_usage su
          JOIN functions f ON f.name = su.function_name
                           AND f.file_path = su.file_path
          WHERE su.usage_type IN ('insert', 'update', 'delete', 'create')
          ${fpAliasWhere}
-         ORDER BY su.file_path, su.function_name`)
-            .all(...(filePath ? [filePath.param] : []));
+         ORDER BY su.file_path, su.function_name`, (filePath ? [filePath.param] : []));
         if (writers.length === 0)
             return violations;
         const writerCoverage = new Map();
@@ -397,7 +380,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
             const key = `${w.file_path}::${w.function_name}`;
             if (writerCoverage.has(key))
                 continue; // deduplicate
-            const covered = this.bfsReachesValidator(rawDb, w.function_id, validatorIds, depth);
+            const covered = this.bfsReachesValidator(indexHandle, w.function_id, validatorIds, depth);
             writerCoverage.set(key, {
                 covered,
                 line: w.line,
@@ -464,27 +447,24 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
      * to static reach analysis from test files (BFS from test-file functions
      * into the call graph).
      */
-    detectUncoveredRisk(rawDb, coverage, filePath) {
+    detectUncoveredRisk(indexHandle, coverage, filePath) {
         const violations = [];
-        const db = CodeIndexDB.getInstance(undefined, this.projectRoot);
         const topRiskDecile = coverage.topRiskDecile ?? 0.1;
         // Check if any measured coverage exists
-        const measuredCount = rawDb
-            .prepare("SELECT COUNT(*) AS cnt FROM coverage_data WHERE basis = 'measured'")
-            .get().cnt;
+        const measuredCount = indexHandle
+            .query("SELECT COUNT(*) AS cnt FROM coverage_data WHERE basis = 'measured'")[0].cnt;
         if (measuredCount > 0) {
             // Use measured coverage data from lcov/istanbul imports
-            const untested = db.getUntestedTopDecile(topRiskDecile);
+            const untested = indexHandle.getUntestedTopDecile(topRiskDecile);
             // Determine source format from existing coverage entries
-            const sourceRow = rawDb
-                .prepare("SELECT source, imported_at FROM coverage_data WHERE basis = 'measured' LIMIT 1")
-                .get();
+            const sourceRow = indexHandle
+                .query("SELECT source, imported_at FROM coverage_data WHERE basis = 'measured' LIMIT 1")[0];
             const sourceFormat = sourceRow?.source ?? 'unknown';
             const importedAt = sourceRow?.imported_at ?? null;
             // Stale-import detection: measured coverage predates last full index sync
             let staleWarning = null;
             if (importedAt) {
-                const lastSync = db.getMeta?.('last_full_sync_timestamp') ?? null;
+                const lastSync = indexHandle.getMeta?.('last_full_sync_timestamp') ?? null;
                 if (lastSync && importedAt < lastSync) {
                     staleWarning =
                         ` — WARNING: this coverage data may be stale (imported ${importedAt}, ` +
@@ -517,8 +497,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
             const params = [topRiskDecile];
             if (filePath)
                 params.push(filePath.param);
-            const highRiskFns = rawDb
-                .prepare(`WITH ranked AS (
+            const highRiskFns = indexHandle.query(`WITH ranked AS (
             SELECT
               f.name,
               f.file_path,
@@ -535,8 +514,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
           SELECT id, name, file_path, line_number, risk_score
           FROM ranked
           WHERE pct <= ?
-          ORDER BY risk_score DESC`)
-                .all(...params);
+          ORDER BY risk_score DESC`, params);
             if (highRiskFns.length === 0)
                 return violations;
             // Find test-file functions to use as BFS starting points.
@@ -553,9 +531,8 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
             }
             const testFuncIds = new Set();
             if (testFileClause) {
-                const testFunctions = rawDb
-                    .prepare(`SELECT id FROM functions WHERE ${testFileClause}`)
-                    .all(...testFileParams);
+                const testFunctions = indexHandle
+                    .query(`SELECT id FROM functions WHERE ${testFileClause}`, testFileParams);
                 for (const tf of testFunctions)
                     testFuncIds.add(tf.id);
             }
@@ -575,10 +552,9 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
                                 continue;
                             visited.add(funcId);
                             reachableIds.add(funcId);
-                            const callees = rawDb
-                                .prepare(`SELECT neighbor_key FROM graph_cache
-                   WHERE graph_type = 'call' AND node_key = ?`)
-                                .all(String(funcId));
+                            const callees = indexHandle
+                                .query(`SELECT neighbor_key FROM graph_cache
+                   WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
                             for (const callee of callees) {
                                 const calleeId = parseInt(callee.neighbor_key, 10);
                                 if (!isNaN(calleeId) && !visited.has(calleeId)) {
@@ -619,7 +595,7 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
      * BFS through the call graph (graph_cache) up to maxDepth to check if
      * any path from startFuncId reaches a validator function ID.
      */
-    bfsReachesValidator(rawDb, startFuncId, validatorIds, maxDepth) {
+    bfsReachesValidator(indexHandle, startFuncId, validatorIds, maxDepth) {
         const visited = new Set();
         let currentLevel = [startFuncId];
         for (let d = 0; d < maxDepth; d++) {
@@ -631,10 +607,9 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
                     continue;
                 visited.add(funcId);
                 // Get callees from graph_cache call edges
-                const callees = rawDb
-                    .prepare(`SELECT neighbor_key FROM graph_cache
-             WHERE graph_type = 'call' AND node_key = ?`)
-                    .all(String(funcId));
+                const callees = indexHandle
+                    .query(`SELECT neighbor_key FROM graph_cache
+             WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
                 for (const callee of callees) {
                     const calleeId = parseInt(callee.neighbor_key, 10);
                     if (!isNaN(calleeId) && !visited.has(calleeId)) {