code-auditor-mcp 4.0.2 → 4.0.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "4.0.2",
+      "version": "4.0.4",
       "author": {
         "name": "Ben Hammond"
       },

package/CHANGELOG.md

@@ -2,7 +2,81 @@
 
 All notable changes to the Code Auditor MCP project.
 
-## [4.0.2] — 2026-09-19
+## [4.0.4] — 2026-09-20
+
+### Go analysis now works everywhere, not just Intel Macs
+
+Go analysis silently returned zero findings on every platform but Intel Macs.
+The shipped Go analyzer was a single `darwin/amd64` binary, so Apple Silicon,
+Linux, and Windows (including all Linux/Windows CI) skipped Go entirely and
+reported a clean tree. That silent-skip is fixed:
+
+- **Per-platform binaries** — five static `CGO_ENABLED=0` binaries ship in the
+  package (`analyzer-darwin-arm64`, `analyzer-darwin-amd64`,
+  `analyzer-linux-amd64`, `analyzer-linux-arm64`, `analyzer-windows-amd64.exe`),
+  cross-compiled from one machine. The runtime picks the binary from **Node's**
+  platform/arch (Node spawns the process), not the Go toolchain's — a subtlety
+  that matters under Rosetta, where `go env` reports `amd64` while Node reports
+  `arm64`.
+- **Cache-dir rebuild fallback** — when no native binary is present, the
+  analyzer now builds into the OS cache dir (`~/Library/Caches/code-auditor`,
+  `~/.cache/code-auditor`, `%LOCALAPPDATA%\code-auditor`) instead of writing into
+  the read-only shipped tree and overwriting the artifact.
+- **Silent failure now says so** — a missing toolchain, wrong-arch binary, or
+  failed build surfaces as a named `Skipped analyzers` diagnostic in the text
+  CLI (`go-toolchain-missing`, `go-analyzer-wrong-arch`,
+  `go-analyzer-build-failed`) instead of a silent zero.
+- **Guard 8** now asserts all five shipped binaries are present *and* that the
+  running platform's binary executes — a build where one cross-compile failed
+  can no longer pass on one machine and ship broken for another.
+
+## [4.0.3] — 2026-09-20
+
+### SQL injection: parameterized-query false positives fixed
+
+Two parameterized-query idioms were misread as `sql-injection-risk` at every
+prior count. The safety analysis now proves them safe instead of flagging them:
+
+- **Placeholder list** — `filePaths.map(() => '?').join(', ')` is a constant
+  list of `?` placeholders regardless of the source array's contents; the values
+  are bound out-of-band, so the interpolated text is never raw data.
+- **Literal clause template** — `['run_id = ?', 'rule = ?'].join(' AND ')` is a
+  join over literal `col = ?` fragments with values bound out-of-band. A new
+  `isSafeJoin` proves the receiver and every `.push()`ed element are safe, so a
+  `.push(userInput)` before the join is still flagged.
+
+The two patterns were clearing real findings in `codeIndexDB`, `blastRadius`,
+and `ledger`. Both are now correctly recognized as safe; the remaining
+`sql-injection-risk` findings are genuine dynamic SQL (table/column identifier
+interpolation, escaped name lists, reassigned `let` clauses) rather than
+parameterized queries. Guard coverage is pinned by new fixtures
+(`placeholder-list.ts`, `clause-template.ts`) asserting exact zero counts.
+
+This also fixed a latent scope-resolution bug: `findEnclosingScope` fell back to
+file-level first-match when a wrapped node was detached from its parent chain,
+so `const where: string[] = [...]` in one function could resolve against a
+different function's `let where` of the same name. The enclosing scope is now
+resolved through the raw parent chain.
+
+### SARIF: version-control provenance and schema validity
+
+SARIF 2.1.0 output now carries GitHub Code Scanning metadata and emits only
+schema-valid fields:
+
+- `versionControlProvenance` (`repositoryUri` + `revisionId`) is read
+  best-effort from the project's git remote and HEAD, so uploaded alerts are
+  tied to a commit.
+- `automationDetails.id` is set to `<tool>/<version>`, giving this tool's
+  uploads a distinct analysis category alongside CodeQL and others.
+- Suggestions are emitted as `properties.resolution` (and a `help` string per
+  rule) instead of a bare `fixes` array — a SARIF fix requires `artifactChanges`,
+  which this tool does not produce, so the old output was schema-invalid.
+- `startColumn` is omitted rather than clamped for 0-based/unknown columns
+  (SARIF requires a minimum of 1).
+- Partial fingerprints are computed from the repo-relative path so GitHub alert
+  identity is stable across checkouts and machines.
+
+
 
 ### Severity vocabulary restored: `advisory` → `high`
 
@@ -14,15 +88,16 @@ tool results. The three non-severity meanings of "advisory" are unchanged: hook
 mode (`hookType: 'blocking' | 'advisory' | 'none'`), the non-invariant
 "advisory findings" report channel, and consultative "advisory" (= non-fatal).
 
-### Fifteen rules restored from `severe` to `high`
+### Sixteen rules restored from `severe` to `high`
 
-The same recalibration escalated fifteen rules to `severe` that Spec 54 had
+The same recalibration escalated sixteen rules to `severe` that Spec 54 had
 deliberately placed at `high`. They return to `high`:
 
 `solid/class-size`, `solid/method-complexity`, `solid/dependency-inversion`,
 `interface-size`, `parameter-count`, `function-length`, `function-size`,
 `struct-size`, `switch-size`, `dry/duplicate`, `complex-query`,
-`unfiltered-query`, `imports/import-style`, `tight-coupling`, `hub-nodes`.
+`unfiltered-query`, `react/performance`, `imports/import-style`, `tight-coupling`,
+`hub-nodes`.
 
 ### Severity-ledger conformance guard
 

package/dist/cli.js

@@ -175,6 +175,25 @@ program
                 `${covUnassessed} unassessed · ${covNotApplicable} not-applicable · ` +
                 `${covCannotFire} cannot-fire`));
         }
+        // ── Skipped analyzers (Spec 61) ──────────────────────────────
+        // A language present on disk but never analyzed is a stated gap, not a
+        // silent zero. The Go path surfaces a named runtime failure (missing
+        // toolchain, wrong-arch prebuilt binary, failed rebuild) as a
+        // metadata.diagnostics entry; before this section those kinds were
+        // invisible outside --json, so a polyglot repo with .go files and no Go
+        // toolchain printed zero Go findings and exited clean — the silent-zero
+        // failure mode. These lead above coverage gaps: a skipped analyzer is a
+        // whole language unmeasured, more severe than a per-file visibility gap.
+        const skippedAnalyzers = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'go-toolchain-missing' ||
+            d.kind === 'go-analyzer-wrong-arch' ||
+            d.kind === 'go-analyzer-build-failed');
+        if (skippedAnalyzers.length > 0) {
+            console.log(chalk.yellow(`── Skipped analyzers ── ${skippedAnalyzers.length}`));
+            for (const d of skippedAnalyzers) {
+                const name = d.analyzerName || 'go';
+                console.log(chalk.yellow(`  ${name} [${d.kind}] — ${d.message}`));
+            }
+        }
         // ── Coverage gaps (Spec 58 follow-up) ─────────────────────────
         // Coverage diagnostics are the analyzer saying "my visibility ends here",
         // not "the code is wrong". They lead with counts, then per-occurrence
@@ -419,7 +438,12 @@ program
                 process.exit(1);
             }
             const { generateReport } = await import('./reporting/reportGenerator.js');
-            const report = generateReport(result, options.format);
+            const { readVersionControlProvenance } = await import('./reporting/sarifReportGenerator.js');
+            const rootDir = resolve(options.path || process.cwd());
+            const config = options.format === 'sarif'
+                ? { rootDir, ...readVersionControlProvenance(rootDir) }
+                : { rootDir };
+            const report = generateReport(result, options.format, config);
             const outputDir = options.output || process.cwd();
             const ext = options.format === 'sarif' ? 'sarif' : options.format;
             const reportPath = join(outputDir, `audit-report.${ext}`);
@@ -573,8 +597,9 @@ program
         const { blocking, resolutionGaps } = computeGatingDecision(violations, BLOCKING_SEVERITIES);
         // JSON output
         if (options.format === 'sarif') {
-            const { generateSARIFReport } = await import('./reporting/sarifReportGenerator.js');
-            const sarifOutput = generateSARIFReport(result);
+            const { generateSARIFReport, readVersionControlProvenance } = await import('./reporting/sarifReportGenerator.js');
+            const projectDir = resolve(options.path || process.cwd());
+            const sarifOutput = generateSARIFReport(result, { rootDir: projectDir, ...readVersionControlProvenance(projectDir) });
             process.stdout.write(sarifOutput + '\n');
         }
         else if (options.json) {