code-auditor-mcp 3.8.1 → 3.9.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "3.8.1",
+      "version": "3.9.0",
       "author": {
         "name": "Ben Hammond"
       },

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to the Code Auditor MCP project.
 
+## [3.9.0] — 2026-09-09
+
+### SQLite without a native install (Spec 51)
+`better-sqlite3` is no longer a hard dependency. The tool now selects its SQLite
+backend at runtime: the built-in `node:sqlite` (`DatabaseSync`/`StatementSync`)
+is the primary backend on Node 23.4+ and needs no native install or prebuilt
+binary, so a fresh `npm install` on npm 11.2+/12 (which block install scripts by
+default) just works. `better-sqlite3` remains as an `optionalDependencies`
+fallback for Node 18–23.3.
+
+- Backend selection is a runtime capability check, not a version-string match
+  (`CODE_AUDITOR_SQLITE_BACKEND=node-sqlite|better-sqlite3` forces one for the
+  parity suite). The active backend is reported in `code-audit --version`.
+- `node:sqlite`'s missing `.transaction()`/`.pragma()` and its stricter
+  named-parameter binding are shimmed behind the same interface; error codes are
+  normalized to better-sqlite3's `SqliteError` shape so callers branching on
+  `SQLITE_BUSY` etc. behave identically.
+- Full-suite and corpus parity verified: both backends produce byte-identical
+  results (recall-protocol corpus: 4,351 advisory findings under both).
+- **Node floor:** `>=18` to run, `>=23.4` for the zero-native-install path.
+
 ## [3.8.1] — 2026-09-08
 
 ### Fresh-install fix — better-sqlite3 prebuild gap

package/README.md

@@ -26,6 +26,17 @@ claude plugin install code-auditor
 
 The hook auto-installs the auditor on first use via npx.
 
+## Requirements
+
+- **Node 18+** to run. **Node 23.4+** gets the zero-native-install path: Code
+  Auditor uses the built-in `node:sqlite` module, so nothing needs to compile or
+  download a prebuilt binary on install.
+- On older Node (18–23.3), Code Auditor falls back to `better-sqlite3`, an
+  *optional* dependency whose install script must be approved once on npm
+  11.2+/12 (they block dependency install scripts by default):
+  `npm install-scripts approve better-sqlite3 && npm rebuild better-sqlite3`
+  (with pnpm: `pnpm approve-builds`, then select `better-sqlite3`).
+
 ## Prompt examples
 
 **"Index the codebase and run a full audit, then walk the violations file-by-file with `code-audit next-file`."**

package/dist/cli.js

@@ -26,6 +26,7 @@ import { computeGatingDecision } from './enforcement/gate.js';
 import { DEFAULT_BLOCKING_SEVERITIES } from './config/defaults.js';
 import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
+import { describeSqliteBackend } from './sqlite/driver.js';
 // Get package.json for version info
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -82,7 +83,7 @@ function printFileAccounting(result, explainSkipped) {
 program
     .name('code-auditor')
     .description('TypeScript/JavaScript code quality auditor with AI tool integration')
-    .version(packageJson.version);
+    .version(`${packageJson.version} (sqlite: ${describeSqliteBackend()})`);
 // Legacy audit command (default behavior)
 program
     .command('audit', { isDefault: true })