code-auditor-mcp 4.0.4 → 4.1.0

package/dist/analyzers/orgFilterTiers.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Tenant-scoping tier resolution (Spec 62 Amendment B).
+ *
+ * The single source of truth for "does a table require an org/tenant filter?"
+ * and "is the missing-org-filter rule applicable to this corpus?". Both the
+ * firing predicate (the Stage-4 missing-org-filter reducer) and the
+ * applicability predicate (pipeline.ts → applicability.ts) are derived from
+ * this one function, so the two can never drift to different tier sets.
+ *
+ * Three tiers, all read through {@link buildOrgFilterTierSet}:
+ *
+ *   Tier 1 (config-primary) — `orgFilterTables`: the user's explicit list of
+ *     multi-tenant tables. Tenancy is policy; this is the declaration of record.
+ *
+ *   Tier 2 (schema-inference) — a configured `schemas` table that carries a
+ *     column matching `orgFilterColumns` (default org_id/tenant_id/
+ *     organization_id/workspace_id). Makes non-English table names detectable
+ *     with zero explicit declaration.
+ *
+ *   Tier 3 (DDL-discovery) — a table whose columns, extracted from SQL DDL
+ *     (CREATE TABLE / ALTER TABLE … ADD COLUMN), carry a tenant-scoping column.
+ *     This is the tier that was missing from the old firing predicate, which is
+ *     what made `missing-org-filter` report a DDL-declared multi-tenant codebase
+ *     `clean` (applicability un-suppressed the rule via Tier 3, but firing only
+ *     read Tiers 1–2, so nothing fired).
+ *
+ * The firing predicate and the applicability predicate are NOT separate
+ * implementations that "agree by inspection" — they are two consumers of the
+ * same {@link OrgFilterTierSet}:
+ *
+ *   - firing:       `tableRequiresOrgFilter(queryTables, tierSet)`
+ *   - applicability: `hasDeclaredTenancy(tierSet)`
+ *
+ * This module is deliberately free of analyzer and pipeline imports: it is
+ * imported statically by applicability.ts (which pipeline.ts imports
+ * statically) AND by the Stage-4 reducer in pipelineAdapters.ts (which reaches
+ * analyzers only through dynamic import()). Neither import path may pull in
+ * pipeline.js or an analyzer class.
+ */
+/** Default tenant-scoping column names (lowercased by the consumer). */
+export declare const DEFAULT_ORG_FILTER_COLUMNS: string[];
+/** The loose config shape the tier resolver reads. Compatible with the
+ *  data-access analyzer's `DataAccessAnalyzerConfig` and with the bare
+ *  `Record<string, unknown>` the pipeline passes to applicability. */
+export interface OrgFilterConfig {
+    orgFilterTables?: string[];
+    orgFilterColumns?: string[];
+    schemas?: Array<{
+        name?: string;
+        tables?: Array<{
+            name?: string;
+            columns?: Array<{
+                name?: unknown;
+                type?: unknown;
+            }>;
+        }>;
+    }>;
+}
+/** The resolved tenant-scoping picture across all three tiers. */
+export interface OrgFilterTierSet {
+    /** Tier 1 — explicit tenant table names, lowercased. */
+    orgFilterTables: Set<string>;
+    /** Tier 2 — configured-schema tables carrying a tenant column, lowercased. */
+    schemaOrgTables: Set<string>;
+    /** Tier 3 — DDL-discovered tables carrying a tenant column, lowercased. */
+    ddlOrgTables: Set<string>;
+    /** The tenant-scoping column names this config treats as evidence, lowercased. */
+    tenantColumns: string[];
+}
+/**
+ * Build the full tenant-scoping tier set from config + DDL-discovered
+ * per-table columns. `ddlTableColumns` is the corpus-wide `Record<table,
+ * string[]>` folded by the schema reducer; it is undefined when the schema
+ * analyzer was not part of the run (Tier 3 is then empty — the rule can still
+ * fire on Tiers 1–2, which come from config alone).
+ */
+export declare function buildOrgFilterTierSet(config: OrgFilterConfig | undefined, ddlTableColumns: Record<string, string[]> | undefined): OrgFilterTierSet;
+/**
+ * Firing predicate — true when any of the query's referenced tables requires an
+ * org/tenant filter, across all three tiers.
+ */
+export declare function tableRequiresOrgFilter(tables: string[], tierSet: OrgFilterTierSet): boolean;
+/**
+ * Applicability predicate — true when any tier declares tenancy. When false,
+ * the rule is `notApplicable` (this corpus has no tenant-scoping input), never
+ * `clean` (the strongest claim the tool makes).
+ */
+export declare function hasDeclaredTenancy(tierSet: OrgFilterTierSet): boolean;
+//# sourceMappingURL=orgFilterTiers.d.ts.map

package/dist/analyzers/orgFilterTiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgFilterTiers.d.ts","sourceRoot":"","sources":["../../src/analyzers/orgFilterTiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,UAKtC,CAAC;AAEF;;sEAEsE;AACtE,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,KAAK,CAAC;gBAAE,IAAI,CAAC,EAAE,OAAO,CAAC;gBAAC,IAAI,CAAC,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SACrD,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,GACpD,gBAAgB,CA6BlB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAST;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAMrE"}

package/dist/analyzers/orgFilterTiers.js

@@ -0,0 +1,96 @@
+/**
+ * Tenant-scoping tier resolution (Spec 62 Amendment B).
+ *
+ * The single source of truth for "does a table require an org/tenant filter?"
+ * and "is the missing-org-filter rule applicable to this corpus?". Both the
+ * firing predicate (the Stage-4 missing-org-filter reducer) and the
+ * applicability predicate (pipeline.ts → applicability.ts) are derived from
+ * this one function, so the two can never drift to different tier sets.
+ *
+ * Three tiers, all read through {@link buildOrgFilterTierSet}:
+ *
+ *   Tier 1 (config-primary) — `orgFilterTables`: the user's explicit list of
+ *     multi-tenant tables. Tenancy is policy; this is the declaration of record.
+ *
+ *   Tier 2 (schema-inference) — a configured `schemas` table that carries a
+ *     column matching `orgFilterColumns` (default org_id/tenant_id/
+ *     organization_id/workspace_id). Makes non-English table names detectable
+ *     with zero explicit declaration.
+ *
+ *   Tier 3 (DDL-discovery) — a table whose columns, extracted from SQL DDL
+ *     (CREATE TABLE / ALTER TABLE … ADD COLUMN), carry a tenant-scoping column.
+ *     This is the tier that was missing from the old firing predicate, which is
+ *     what made `missing-org-filter` report a DDL-declared multi-tenant codebase
+ *     `clean` (applicability un-suppressed the rule via Tier 3, but firing only
+ *     read Tiers 1–2, so nothing fired).
+ *
+ * The firing predicate and the applicability predicate are NOT separate
+ * implementations that "agree by inspection" — they are two consumers of the
+ * same {@link OrgFilterTierSet}:
+ *
+ *   - firing:       `tableRequiresOrgFilter(queryTables, tierSet)`
+ *   - applicability: `hasDeclaredTenancy(tierSet)`
+ *
+ * This module is deliberately free of analyzer and pipeline imports: it is
+ * imported statically by applicability.ts (which pipeline.ts imports
+ * statically) AND by the Stage-4 reducer in pipelineAdapters.ts (which reaches
+ * analyzers only through dynamic import()). Neither import path may pull in
+ * pipeline.js or an analyzer class.
+ */
+/** Default tenant-scoping column names (lowercased by the consumer). */
+export const DEFAULT_ORG_FILTER_COLUMNS = [
+    'org_id',
+    'tenant_id',
+    'organization_id',
+    'workspace_id',
+];
+/**
+ * Build the full tenant-scoping tier set from config + DDL-discovered
+ * per-table columns. `ddlTableColumns` is the corpus-wide `Record<table,
+ * string[]>` folded by the schema reducer; it is undefined when the schema
+ * analyzer was not part of the run (Tier 3 is then empty — the rule can still
+ * fire on Tiers 1–2, which come from config alone).
+ */
+export function buildOrgFilterTierSet(config, ddlTableColumns) {
+    const tenantColumns = (config?.orgFilterColumns ?? DEFAULT_ORG_FILTER_COLUMNS).map((c) => String(c).toLowerCase());
+    const tenantSet = new Set(tenantColumns);
+    const orgFilterTables = new Set((config?.orgFilterTables ?? []).map((t) => String(t).toLowerCase()));
+    const schemaOrgTables = new Set();
+    for (const schema of config?.schemas ?? []) {
+        for (const table of schema.tables ?? []) {
+            if ((table.columns ?? []).some((c) => tenantSet.has(String(c.name).toLowerCase()))) {
+                schemaOrgTables.add(String(table.name).toLowerCase());
+            }
+        }
+    }
+    const ddlOrgTables = new Set();
+    for (const [table, columns] of Object.entries(ddlTableColumns ?? {})) {
+        if ((columns ?? []).some((c) => tenantSet.has(String(c).toLowerCase()))) {
+            ddlOrgTables.add(String(table).toLowerCase());
+        }
+    }
+    return { orgFilterTables, schemaOrgTables, ddlOrgTables, tenantColumns };
+}
+/**
+ * Firing predicate — true when any of the query's referenced tables requires an
+ * org/tenant filter, across all three tiers.
+ */
+export function tableRequiresOrgFilter(tables, tierSet) {
+    return tables.some((t) => {
+        const lt = String(t).toLowerCase();
+        return (tierSet.orgFilterTables.has(lt) ||
+            tierSet.schemaOrgTables.has(lt) ||
+            tierSet.ddlOrgTables.has(lt));
+    });
+}
+/**
+ * Applicability predicate — true when any tier declares tenancy. When false,
+ * the rule is `notApplicable` (this corpus has no tenant-scoping input), never
+ * `clean` (the strongest claim the tool makes).
+ */
+export function hasDeclaredTenancy(tierSet) {
+    return (tierSet.orgFilterTables.size > 0 ||
+        tierSet.schemaOrgTables.size > 0 ||
+        tierSet.ddlOrgTables.size > 0);
+}
+//# sourceMappingURL=orgFilterTiers.js.map

package/dist/analyzers/orgFilterTiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgFilterTiers.js","sourceRoot":"","sources":["../../src/analyzers/orgFilterTiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,cAAc;CACf,CAAC;AA6BF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmC,EACnC,eAAqD;IAErD,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvF,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CACxB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAEzC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACpE,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAC9E,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACxE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgB,EAChB,OAAyB;IAEzB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,CACL,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,OAAO,CACL,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QAChC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QAChC,OAAO,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAC9B,CAAC;AACJ,CAAC"}

package/dist/analyzers/ruleRegistry.d.ts

@@ -155,6 +155,21 @@ export declare const ALL_ANALYZERS: readonly string[];
  * Referenced here so mcp.ts and mcp-tools-shared.ts don't each re-type the list.
  */
 export declare const MCP_DEFAULT_ANALYZERS: readonly string[];
+/**
+ * Analyzers the pipeline can run that emit *no* registry rule. Their rules come
+ * from a runtime source other than {@link RULE_REGISTRY}: `invariants` reads its
+ * rules from the `.codeauditor.json` `rules` array (the seven invariant rule
+ * kinds), not from registry rows, so it is absent from {@link ALL_ANALYZERS}.
+ */
+export declare const PIPELINE_ONLY_ANALYZERS: readonly string[];
+/**
+ * Every analyzer `enabledAnalyzers` may legitimately name — {@link ALL_ANALYZERS}
+ * (registry rule emitters) plus {@link PIPELINE_ONLY_ANALYZERS}. This is the
+ * single source of truth for "can this analyzer actually run?" — used by config
+ * validation, which must not reject `invariants` (a valid pipeline analyzer that
+ * happens to carry no registry rule).
+ */
+export declare const RUNNABLE_ANALYZERS: readonly string[];
 /**
  * A violation in the loose shape the gate and baseline code handle (a Violation
  * with the transitional analyzer/type/violationType/etc. fields still present).

package/dist/analyzers/ruleRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleRegistry.d.ts","sourceRoot":"","sources":["../../src/analyzers/ruleRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC/F;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CA4+DrE,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAEnC,CAAC;AAET;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAMlD,CAAC;AAEF;;;GAGG;AACH,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAQ/F"}
+{"version":3,"file":"ruleRegistry.d.ts","sourceRoot":"","sources":["../../src/analyzers/ruleRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC/F;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CA26DrE,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAEnC,CAAC;AAET;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAOlD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAExC,CAAC;AAET;;;GAGG;AACH,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAQ/F"}

package/dist/analyzers/ruleRegistry.js

@@ -43,7 +43,7 @@ export const RULE_REGISTRY = {
                 { code: 'function simple(x) {\n  if (x > 0) return x;\n  return -x;\n}', nearMiss: true },
             ],
             invalid: [
-                { code: 'function complex(x) {\n  if (a && b) { if (c) { while (d) { if (e) return 1; } } }\n  if (f || g) { for (;;) { if (h) break; } }\n  return 0;\n}' },
+                { code: 'function complex(x) {\n  if (x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x && x) return 1;\n  return 0;\n}' },
             ],
         },
     },
@@ -142,7 +142,7 @@ export const RULE_REGISTRY = {
                 { code: 'interface Printer {\n  print(doc) { return doc; }\n}', nearMiss: true },
             ],
             invalid: [
-                { code: 'interface Machine {\n  op1() {}\n  op2() {}\n  op3() {}\n  op4() {}\n  op5() {}\n  op6() {}\n  op7() {}\n  op8() {}\n  op9() {}\n  op10() {}\n  op11() {}\n  op12() {}\n  op13() {}\n  op14() {}\n  op15() {}\n  op16() {}\n  op17() {}\n  op18() {}\n  op19() {}\n  op20() {}\n  op21() {}\n  op22() {}\n  op23() {}\n  op24() {}\n  op25() {}\n  op26() {}\n}' },
+                { code: 'interface Machine {\n  op1(): void;\n  op2(): void;\n  op3(): void;\n  op4(): void;\n  op5(): void;\n  op6(): void;\n  op7(): void;\n  op8(): void;\n  op9(): void;\n  op10(): void;\n  op11(): void;\n  op12(): void;\n  op13(): void;\n  op14(): void;\n  op15(): void;\n  op16(): void;\n  op17(): void;\n  op18(): void;\n  op19(): void;\n  op20(): void;\n  op21(): void;\n  op22(): void;\n  op23(): void;\n  op24(): void;\n  op25(): void;\n  op26(): void;\n}' },
             ],
         },
     },
@@ -395,8 +395,13 @@ export const RULE_REGISTRY = {
             ],
             invalid: [
                 {
-                    code: 'function a() {\n  const x = compute(1);\n  const y = compute(2);\n  return x + y;\n}\nfunction b() {\n  const x = compute(1);\n  const y = compute(2);\n  return x + y;\n}',
-                    resolution: { action: 'extract-shared', summary: 'Extract the duplicated block into a shared helper and call it from both sites.', symbols: ['a', 'b'] },
+                    // Two IDENTICAL ≥15-line for-loops — `dry/duplicate` is an *exact*
+                    // token match (normalizeCode keeps identifiers), so the two blocks must
+                    // be byte-identical, not merely same-shape. The old sample (`function a`
+                    // / `function b` with identical bodies) was doubly dead: its names differ
+                    // (no exact hash match) and it was under minLineThreshold.
+                    code: 'function process(rows) {\n  for (const row of rows) {\n    const id = row.id;\n    const name = row.name;\n    const value = row.value;\n    const category = row.category;\n    const tags = row.tags;\n    const meta = row.meta;\n    const score = computeScore(row);\n    const rank = computeRank(score);\n    const label = formatLabel(name);\n    const bucket = assignBucket(rank);\n    const flags = extractFlags(row);\n    const audit = buildAudit(flags);\n    const record = { id, name, value, category, tags, meta, score, rank, label, bucket, audit };\n    push(record);\n    notify(record.id);\n  }\n  for (const row of rows) {\n    const id = row.id;\n    const name = row.name;\n    const value = row.value;\n    const category = row.category;\n    const tags = row.tags;\n    const meta = row.meta;\n    const score = computeScore(row);\n    const rank = computeRank(score);\n    const label = formatLabel(name);\n    const bucket = assignBucket(rank);\n    const flags = extractFlags(row);\n    const audit = buildAudit(flags);\n    const record = { id, name, value, category, tags, meta, score, rank, label, bucket, audit };\n    push(record);\n    notify(record.id);\n  }\n}',
+                    resolution: { action: 'extract-shared', summary: 'Extract the duplicated block into a shared helper and call it from both sites.', symbols: ['process'] },
                 },
             ],
         },
@@ -415,7 +420,14 @@ export const RULE_REGISTRY = {
                 { code: 'function a(x) {\n  return x + 1;\n}\nfunction b(x) {\n  return x * 2;\n}', nearMiss: true },
             ],
             invalid: [
-                { code: 'function a(x) {\n  return fetch(x).then((r) => r.json());\n}\nfunction b(y) {\n  return fetch(y).then((r) => r.json());\n}' },
+                {
+                    // Two structurally-identical ≥15-line functions with different
+                    // identifiers/literals. `dry/structural-similarity` compares the
+                    // token-kind skeleton (normalizeCodeForStructure), so the two must share
+                    // structure but differ in names — the old two-line `fetch().then()`
+                    // pair was under minLineThreshold and never emitted.
+                    code: 'function computeA(rows) {\n  for (const item of rows) {\n    const id = item.id;\n    const name = item.name;\n    const value = item.value;\n    const category = item.category;\n    const tags = item.tags;\n    const meta = item.meta;\n    const score = scoreA(item);\n    const rank = rankA(score);\n    const label = labelA(name);\n    const bucket = bucketA(rank);\n    const flags = flagsA(item);\n    const audit = auditA(flags);\n    const record = { id, name, value, category, tags, meta, score, rank, label, bucket, audit };\n    appendA(record);\n    emitA(record.id);\n  }\n}\nfunction computeB(rows) {\n  for (const entry of rows) {\n    const id = entry.id;\n    const name = entry.name;\n    const value = entry.value;\n    const category = entry.category;\n    const tags = entry.tags;\n    const meta = entry.meta;\n    const score = scoreB(entry);\n    const rank = rankB(score);\n    const label = labelB(name);\n    const bucket = bucketB(rank);\n    const flags = flagsB(entry);\n    const audit = auditB(flags);\n    const record = { id, name, value, category, tags, meta, score, rank, label, bucket, audit };\n    appendB(record);\n    emitB(record.id);\n  }\n}',
+                },
             ],
         },
     },
@@ -536,11 +548,16 @@ export const RULE_REGISTRY = {
         },
     },
     'missing-org-filter': {
-        analyzer: 'data-access',
+        analyzer: 'data-access-org-filter',
         field: 'rule',
-        input: ['schema'],
-        resolvable: false,
-        message: 'Query on {tables} is missing an organization/tenant filter.',
+        input: ['data-access', 'schema'],
+        resolvable: true,
+        // The claim is "no organization/tenant *predicate*", NOT "no filter". A
+        // query scoped by primary key (`WHERE id = $1`) still fires, because it is
+        // scoped by id but not by tenant — an IDOR surface if the id is
+        // request-reachable. The fix is to add the tenant column to the predicate,
+        // not to add a filter (one already exists in the PK-scoped case).
+        message: 'Query on {tables} has no organization/tenant predicate.',
         docs: 'missing-org-filter',
         thresholds: [],
         samples: {
@@ -548,7 +565,14 @@ export const RULE_REGISTRY = {
                 { code: 'db.query("SELECT * FROM projects WHERE org_id = ?", [orgId])', nearMiss: true },
             ],
             invalid: [
-                { code: 'db.query("SELECT * FROM projects WHERE id = ?", [id])' },
+                {
+                    code: 'db.query("SELECT * FROM projects WHERE id = ?", [id])',
+                    resolution: {
+                        action: 'add-tenant-predicate',
+                        summary: 'Add the tenant column (organization_id / org_id) to the WHERE predicate so the query is scoped to the current organization, not just by primary key.',
+                        symbols: ['db', 'query'],
+                    },
+                },
             ],
         },
     },
@@ -575,7 +599,7 @@ export const RULE_REGISTRY = {
         field: 'rule',
         input: ['files'],
         resolvable: false,
-        message: 'Unfiltered write on {tables} has no WHERE/HAVING/LIMIT.',
+        message: 'Unfiltered write or tenant-scoped read on {tables} has no WHERE/HAVING/LIMIT.',
         docs: 'unfiltered-query',
         thresholds: [],
         samples: {
@@ -720,10 +744,21 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: '/**\n * Computes.\n * @returns the result\n */\nfunction compute() {}', nearMiss: true },
+                {
+                    // return-documentation only applies to a typed, non-void return
+                    // (`func.returnType && !== 'void'`). The old sample returned nothing,
+                    // so the guard was vacuous; this one returns `number` and documents it.
+                    code: '/**\n * Computes the result.\n * @returns the result.\n */\nfunction compute(): number { return 1; }',
+                    nearMiss: true,
+                },
             ],
             invalid: [
-                { code: '/** Computes. */\nfunction compute() {}' },
+                {
+                    // Missing @returns on a typed, non-void function. The old sample
+                    // (`function compute() {}`) had no return type, so the return-doc guard
+                    // never applied.
+                    code: '/** Computes the result. */\nfunction compute(): number { return 1; }',
+                },
             ],
         },
     },
@@ -848,23 +883,6 @@ export const RULE_REGISTRY = {
             ],
         },
     },
-    'file-error': {
-        analyzer: 'schema',
-        field: 'rule',
-        input: ['schema-json'],
-        resolvable: false,
-        message: 'Error processing schema file: {error}.',
-        docs: 'file-error',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: '{"valid": true}', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'not a readable schema' },
-            ],
-        },
-    },
     'type-mismatch': {
         analyzer: 'schema',
         field: 'rule',
@@ -1214,7 +1232,13 @@ export const RULE_REGISTRY = {
                 { code: 'function Simple({ x }) {\n  return <div>{x}</div>;\n}', nearMiss: true },
             ],
             invalid: [
-                { code: 'function Complex(props) {\n  if (a) { if (b) { if (c) { if (d) { return <X/>; } } } }\n  if (e) { if (f) { return <Y/>; } }\n  return <Z/>;\n}' },
+                {
+                    // 22 `if` statements — component complexity (base 1 + one per branch)
+                    // must exceed maxComponentComplexity (20). The old sample had 6
+                    // branches (complexity 7), under the recalibrated ceiling, so it never
+                    // fired.
+                    code: 'function Complex(props) {\n  if (props.x === 1) return <C1 />;\n  if (props.x === 2) return <C2 />;\n  if (props.x === 3) return <C3 />;\n  if (props.x === 4) return <C4 />;\n  if (props.x === 5) return <C5 />;\n  if (props.x === 6) return <C6 />;\n  if (props.x === 7) return <C7 />;\n  if (props.x === 8) return <C8 />;\n  if (props.x === 9) return <C9 />;\n  if (props.x === 10) return <C10 />;\n  if (props.x === 11) return <C11 />;\n  if (props.x === 12) return <C12 />;\n  if (props.x === 13) return <C13 />;\n  if (props.x === 14) return <C14 />;\n  if (props.x === 15) return <C15 />;\n  if (props.x === 16) return <C16 />;\n  if (props.x === 17) return <C17 />;\n  if (props.x === 18) return <C18 />;\n  if (props.x === 19) return <C19 />;\n  if (props.x === 20) return <C20 />;\n  if (props.x === 21) return <C21 />;\n  if (props.x === 22) return <C22 />;\n  return <Z />;\n}',
+                },
             ],
         },
     },
@@ -1318,23 +1342,6 @@ export const RULE_REGISTRY = {
     // `clean` (which would assert the tool checked something it no longer checks
     // as a finding).
     // ── schema-validator (SchemaValidator) ──────────────────────────────────
-    'field-mismatch': {
-        analyzer: 'schema-validator',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Field mismatch: {detail}.',
-        docs: 'field-mismatch',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'model User { id Int @id }', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'model User { id String @id }' },
-            ],
-        },
-    },
     'schema-field-mismatch': {
         analyzer: 'schema-validator',
         field: 'rule',
@@ -1386,143 +1393,6 @@ export const RULE_REGISTRY = {
             ],
         },
     },
-    'constraint-mismatch': {
-        analyzer: 'schema-validator',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Constraint mismatch: {detail}.',
-        docs: 'constraint-mismatch',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'model User { id Int @id @default(autoincrement()) }', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'model User { id Int @id }' },
-            ],
-        },
-    },
-    'version-mismatch': {
-        analyzer: 'schema-validator',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Version mismatch: {detail}.',
-        docs: 'version-mismatch',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'export const version = "1.2.3";', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'export const version = "0.0.1";' },
-            ],
-        },
-    },
-    // ── api-contract (APIContractAnalyzer) ──────────────────────────────────
-    'api-type-mismatch': {
-        analyzer: 'api-contract',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'API type mismatch: {detail}.',
-        docs: 'api-type-mismatch',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'function getUser(id: number): User { return {} as User; }', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'function getUser(id: number): string { return ""; }' },
-            ],
-        },
-    },
-    'missing-endpoint': {
-        analyzer: 'api-contract',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Missing API endpoint: {endpoint}.',
-        docs: 'missing-endpoint',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'app.get("/users", handler);', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'app.get("/unlisted", handler);' },
-            ],
-        },
-    },
-    'api-extra-field': {
-        analyzer: 'api-contract',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Extra field in API response: {field}.',
-        docs: 'api-extra-field',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'return res.json({ id, name });', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'return res.json({ id, name, internal });' },
-            ],
-        },
-    },
-    'api-missing-field': {
-        analyzer: 'api-contract',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Missing field in API response: {field}.',
-        docs: 'api-missing-field',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'return res.json({ id, name });', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'return res.json({ id });' },
-            ],
-        },
-    },
-    'method-mismatch': {
-        analyzer: 'api-contract',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'HTTP method mismatch: {detail}.',
-        docs: 'method-mismatch',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'app.post("/users", createUser);', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'app.get("/users", createUser);' },
-            ],
-        },
-    },
-    'auth-mismatch': {
-        analyzer: 'api-contract',
-        field: 'rule',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Authentication mismatch: {detail}.',
-        docs: 'auth-mismatch',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'app.get("/users", auth, handler);', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'app.get("/users", handler);' },
-            ],
-        },
-    },
     // ── dependency-graph (DependencyGraphBuilder) ───────────────────────────
     'circular-dependency': {
         analyzer: 'dependency-graph',
@@ -2021,6 +1891,72 @@ export const RULE_REGISTRY = {
             ],
         },
     },
+    // ── security (UniversalSecurityAnalyzer) — Spec 61 R6 ─────────────────────
+    'command-injection-risk': {
+        analyzer: 'security',
+        field: 'rule',
+        input: ['files'],
+        resolvable: true,
+        message: 'Unsafe process invocation: {method} is passed a command built by interpolation/concatenation.',
+        docs: 'command-injection-risk',
+        thresholds: [],
+        samples: {
+            valid: [
+                { code: "execFileSync('git', ['diff', '--name-only', ref])", nearMiss: true },
+            ],
+            invalid: [
+                { code: "execSync(`git diff --name-only ${ref}`)", resolution: { action: 'use-argv-array', summary: 'Replace execSync with execFileSync/spawn whose command is a string literal and whose arguments are separate array elements, so no shell interprets them.', symbols: ['execSync'] } },
+            ],
+        },
+    },
+    'dynamic-require-of-project-path': {
+        analyzer: 'security',
+        field: 'rule',
+        input: ['files'],
+        resolvable: true,
+        message: 'Dynamic require/import of a project config path: {path}.',
+        docs: 'dynamic-require-of-project-path',
+        thresholds: [],
+        samples: {
+            valid: [
+                { code: "import('./builtin-helper.js')", nearMiss: true },
+                { code: "require('tailwindcss')", nearMiss: true },
+            ],
+            invalid: [
+                { code: "require(configPath)", resolution: { action: 'static-config-extraction', summary: 'Read the config without executing it (static extraction) rather than require()/import() a path discovered from the project tree.', symbols: ['require'] } },
+            ],
+        },
+    },
+    'unescaped-html-interpolation': {
+        analyzer: 'security',
+        field: 'rule',
+        input: ['files'],
+        resolvable: true,
+        message: 'Unescaped HTML interpolation: {field} is inserted into an HTML template without an escaping call.',
+        docs: 'unescaped-html-interpolation',
+        thresholds: [],
+        samples: {
+            valid: [
+                {
+                    // Same sink (`.innerHTML`) + same member-access interpolation, but the
+                    // value is escape-wrapped — the fix, not the finding. The old near-miss
+                    // (`const html = ...` with no sink) "passed" only because there was no
+                    // sink to read.
+                    code: 'el.innerHTML = `<p>${escapeHtml(user.name)}</p>`;',
+                    nearMiss: true,
+                },
+            ],
+            invalid: [
+                {
+                    // Needs BOTH a sink (`.innerHTML` assignment) and a member-expression
+                    // interpolation (`user.name`, not a bare identifier). The old sample
+                    // (`const html = `${userName}``) had neither, so it never emitted.
+                    code: 'el.innerHTML = `<p>${user.name}</p>`;',
+                    resolution: { action: 'escape-html-interpolation', summary: 'Wrap the interpolation in an escaping call (e.g. ${escapeHtml(user.name)}) before it reaches the HTML template.', symbols: ['user.name'] },
+                },
+            ],
+        },
+    },
 };
 /**
  * Canonical set of every analyzer ID that emits at least one rule in
@@ -2050,7 +1986,25 @@ export const MCP_DEFAULT_ANALYZERS = [
     'documentation',
     'react',
     'data-access',
+    'data-access-org-filter',
 ];
+/**
+ * Analyzers the pipeline can run that emit *no* registry rule. Their rules come
+ * from a runtime source other than {@link RULE_REGISTRY}: `invariants` reads its
+ * rules from the `.codeauditor.json` `rules` array (the seven invariant rule
+ * kinds), not from registry rows, so it is absent from {@link ALL_ANALYZERS}.
+ */
+export const PIPELINE_ONLY_ANALYZERS = ['invariants'];
+/**
+ * Every analyzer `enabledAnalyzers` may legitimately name — {@link ALL_ANALYZERS}
+ * (registry rule emitters) plus {@link PIPELINE_ONLY_ANALYZERS}. This is the
+ * single source of truth for "can this analyzer actually run?" — used by config
+ * validation, which must not reject `invariants` (a valid pipeline analyzer that
+ * happens to carry no registry rule).
+ */
+export const RUNNABLE_ANALYZERS = [
+    ...new Set([...ALL_ANALYZERS, ...PIPELINE_ONLY_ANALYZERS]),
+].sort();
 /**
  * Resolve a violation to its canonical {@link RuleRegistryEntry}, if any.
  *