code-auditor-mcp 4.0.3 → 4.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-auditor-mcp",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "description": "Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -30,6 +30,7 @@
     "prepublishOnly": "pnpm run build",
     "test": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",
+    "bench": "tsx bench/verify.ts",
     "test:watch": "vitest watch",
     "verify:disk-space": "node scripts/verify-disk-space.mjs",
     "verify:types": "tsc --noEmit",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "code-auditor",
   "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "author": {
     "name": "Ben Hammond",
     "email": "ben@benhammond.tech"

package/plugin/scripts/hook-common.sh

@@ -32,23 +32,21 @@
 
 # resolve_code_audit — emit the CLI invocation to use.
 #
-# Resolution is version-aware: EVERY candidate — bundled sibling, project-local,
-# global — is used only when its `--version` matches this plugin's manifest
-# version. A stale candidate is warned about and skipped, so a mismatched binary
-# no longer turns the hook into a hard failure; the pinned install below resolves
-# the correct CLI on its own (and warn_stale tells the user to update so the fast
-# path comes back).
+# Resolution is version-aware: EVERY candidate — bundled sibling, pinned install,
+# project-local, global — is used only when its `--version` matches this plugin's
+# manifest version. A stale candidate is warned about and skipped, so a mismatched
+# binary no longer turns the hook into a hard failure.
 #
 # 1. The plugin's bundled CLI (`${CLAUDE_PLUGIN_ROOT}/../dist/cli.js` ships in the
 #    same npm package, so it usually matches) — but a marketplace checkout has no
 #    npm-paired dist/, and a locally built one can be stale, so it is
 #    version-checked like everything else.
-# 2. Project-local install (consumer project's own node_modules) — if compatible.
-# 3. Global install / PATH — if compatible.
-# 4. Pinned install, exact manifest version — never a range — the guaranteed-
-#    correct fallback when nothing compatible is installed. The package is
-#    installed to a deterministic dir and its bin invoked by absolute path; npx is
-#    deliberately NOT used for execution (see resolve_pinned_bin).
+# 2. Pinned install, exact manifest version — never a range — tried before the
+#    project-local and PATH candidates so a version-matched pin wins over a stale
+#    project-local/global shim (the shadowing that resolve_pinned_bin's
+#    install-to-known-dir approach exists to avoid).
+# 3. Project-local install (consumer project's own node_modules) — if compatible.
+# 4. Global install / PATH — if compatible.
 resolve_code_audit() {
   local candidate
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "${CLAUDE_PLUGIN_ROOT}/../dist/cli.js" ]; then
@@ -59,6 +57,18 @@ resolve_code_audit() {
     fi
     warn_stale "${candidate}"
   fi
+
+  # Pin to the plugin's exact version, not a range: `@^3.0.0` could resolve a
+  # cached older CLI and silently drive this plugin with the wrong analyzer code.
+  local pv bin
+  pv="$(plugin_version)"
+  if [ -n "${pv}" ]; then
+    if bin="$(resolve_pinned_bin)"; then
+      echo "${bin}"
+      return
+    fi
+  fi
+
   if [ -n "${CLAUDE_PROJECT_DIR:-}" ] && [ -x "${CLAUDE_PROJECT_DIR}/node_modules/.bin/code-audit" ]; then
     candidate="${CLAUDE_PROJECT_DIR}/node_modules/.bin/code-audit"
     if cli_is_compatible "${candidate}"; then
@@ -75,23 +85,13 @@ resolve_code_audit() {
     fi
     warn_stale "${candidate}"
   fi
-  # Pin to the plugin's exact version, not a range: `@^3.0.0` could resolve a
-  # cached older CLI and silently drive this plugin with the wrong analyzer code.
-  local pv bin
-  pv="$(plugin_version)"
+
+  # Pinned install failed (offline, registry error, npm missing), or the manifest
+  # is unreadable. Emit the npx form as a last-ditch command so the hook still has
+  # something to run; assert_compatible rejects it loudly if it cannot be verified.
   if [ -n "${pv}" ]; then
-    if bin="$(resolve_pinned_bin)"; then
-      echo "${bin}"
-    else
-      # Install failed (offline, registry error, npm missing). Emit the npx form
-      # as a last-ditch command so the hook still has something to run;
-      # assert_compatible rejects it loudly if it cannot be verified — the same
-      # treatment as the unreadable-manifest case below.
-      echo "npx -y -p code-auditor-mcp@${pv} code-audit"
-    fi
+    echo "npx -y -p code-auditor-mcp@${pv} code-audit"
   else
-    # Manifest unreadable — assert_compatible will reject whatever this fetches,
-    # so `@latest` is only a last-ditch command that never survives the pin.
     echo "npx -y -p code-auditor-mcp@latest code-audit"
   fi
 }

package/plugin/skills/code-auditor/SKILL.md

@@ -5,7 +5,7 @@ description: Audit code quality, search the codebase semantically, enforce invar
 
 # Code Auditor Skill
 
-> **Version 4.0.3** • Run `code-audit --version` to check your installed version.
+> **Version 4.1.0** • Run `code-audit --version` to check your installed version.
 > If versions differ, the CLI is authoritative — use `code-audit <command> --help` to see what your install actually supports.
 
 You have the `code-audit` CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.

package/server.json

@@ -6,13 +6,13 @@
     "url": "https://github.com/BenAHammond/code-auditor-mcp",
     "source": "github"
   },
-  "version": "4.0.3",
+  "version": "4.1.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "code-auditor-mcp",
-      "version": "4.0.3",
+      "version": "4.1.0",
       "transport": {
         "type": "stdio"
       }