code-auditor-mcp 4.1.1 → 5.0.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "4.1.1",
+      "version": "5.0.2",
       "author": {
         "name": "Ben Hammond"
       },

package/CHANGELOG.md

@@ -2,6 +2,387 @@
 
 All notable changes to the Code Auditor MCP project.
 
+## [5.0.2]
+
+### The plugin hooks self-locate — no `CLAUDE_PLUGIN_ROOT` env dependency
+
+The PostToolUse and SessionStart hooks read the plugin root from the
+`CLAUDE_PLUGIN_ROOT` environment variable, which the host does not guarantee, and
+an unset value made them bail. The hooks now derive the root from their own
+location — the grand-parent of `scripts/hook-common.sh` — so an unset or wrong
+`CLAUDE_PLUGIN_ROOT` is a non-event. The variable is honored only as a validated
+override: it must point at a plugin that actually contains
+`scripts/hook-common.sh`, so a stale value cannot redirect or disable a hook. The
+inline `${CLAUDE_PLUGIN_ROOT}` in `hooks.json` is Claude Code's load-time
+substitution, not an environment read, so it is unchanged. The build now fails if
+that layout invariant breaks — a moved or renamed `scripts/` would otherwise ship
+a hook that cannot find itself — and the resolution is verified against a real
+install.
+
+### One constructor derives the whole resolution environment
+
+The inputs that resolve imports, receivers, and SQL — tsconfig aliases, package
+entry points, declared type packages, the detected SQL dialect, and the
+virtual-module list — were derived twice: once in `auditRunner`, and again,
+piecemeal, in each measurement script. A script that forgot a field measured a
+thinner environment than the runner ships. `buildResolutionEnvironment(root)`
+now derives the complete set from a project root once, and both the runner and
+every measurement script consume it.
+
+### Data-access receiver resolution
+
+- Ambient interface-field receivers now resolve when SQL fails to parse, instead
+  of falling back to a name-only guess.
+- The evidence gate admits query-shaped receivers, and declared non-DB packages
+  are proven `not-handle` rather than left `unproven`.
+
+### Reporting, daemon, and distribution
+
+- Reporting headlines the unproven-site and held-out coverage counts.
+- The daemon guards its entry point by realpath so the npm `.bin` symlink boots
+  it correctly.
+- The server declares a remote streamable-http endpoint; the package description
+  is shortened to the registry's 100-character limit and synced, with expanded
+  keywords and a glama ownership manifest.
+
+## [5.0.1]
+
+### The hook is silent — never stderr, never a blocking exit
+
+The PostToolUse hook could write warnings to stderr and exit non-zero, which
+the host treats as a block on the edit itself. It now writes every diagnostic —
+info, warnings, and failures alike — to `hook.log` and never exits non-zero
+except to surface a gating finding (exit 2). The bootstrap guard for an unset
+`CLAUDE_PLUGIN_ROOT` no longer prints to stderr and exits 1; it is a silent
+no-op (exit 0) like the SessionStart warm hook. A broken install therefore
+surfaces on the next explicit audit (and in the log), never on the edit.
+
+Resolution also stopped paying a full `--version` round-trip per candidate on
+the per-edit hot path: the pinned install is version-guaranteed by its path and
+skips the re-check, and `plugin_version` is memoized so the manifest is read
+once instead of once per call site.
+
+### The daemon's project root is explicit, never re-derived
+
+The daemon re-derived its root by walking up for a marker file, which could pull
+in far more than the directory it was started for. It now uses exactly the path
+it was started for, passed explicitly, and refuses to read outside that root.
+File discovery also treats a nested git repository as a boundary, recomputing
+gitignore so a consumer's repo stops swallowing the surrounding tree.
+
+### A stale `dist` fails the chain — no gate is skipped
+
+`verify:close` was a single `&&` conjunction, so the first failing gate aborted
+the run and silently skipped every gate after it. It now runs every gate and
+reports the full set, so a stale `dist/cli.js` fails loudly through
+`verify:dist-fresh` without concealing a downstream failure behind a skip.
+
+## [5.0.0]
+
+About a third of the non-documentation findings the tool emitted on its own
+validation corpora turned out to be the tool's own precision defects rather
+than real signals — and the first triage of those defects was wrong about ten
+of them. The Spec 69 fix pass rebuilt the affected firing conditions (extractor
+consumers, cross-file receiver resolution, name-fallback deletion, algorithm
+placement) and re-measured every corpus; the before/after counts and the
+per-fix attribution are in `specs/spec69-fixes-corpus-effect.md`.
+
+### SQL is now a parsed format, not a regex (`node-sql-parser`)
+
+**SQL text was extracted and classified by regex alone; it is now parsed with
+`node-sql-parser` (5.4.0), a new runtime dependency.** `parseSql(text, dialect)`
+(`src/languages/sql/sqlAst.ts`) normalizes positional params, template
+substitutions, statement splitting, and transaction control, then parses each
+statement to an AST under the corpus's dialect. The grammar is CommonJS and
+synchronous, so the parse runs inline in the phase pipeline with no new async
+boundary. The regex residue the grammar did not absorb is enumerated in
+`specs/rule-evidence-audit.md` (next section), not silently retained.
+
+### `Dialect` narrowed — `sqlserver` and `oracle` removed
+
+**The SQL dialect enum previously accepted `sqlserver` and `oracle`; both are
+removed.** `Dialect` is now `'postgresql' | 'mysql' | 'sqlite'` only, and
+`normalizeDialect('sqlserver')` / `normalizeDialect('oracle')` return `null`
+(`discoveryQueries.ts:23`, `:200`; pinned by `discoveryQueries.spec.ts:37-38`).
+A caller naming an unsupported dialect gets a null (and the
+`cannot-fire`/`notApplicable` disposition), not a silently-wrong parse.
+
+### 62 approximations, classified
+
+**Every place a rule's truth rests on a regex over raw text or a
+hand-enumerated name — rather than a relation over located facts — is now
+enumerated.** `specs/rule-evidence-audit.md` classifies the full residue into
+Section A (17 source-region patterns) and Section B (45 name/suffix/receiver
+lists): 62 approximations total, each with its owning module, the pattern or
+list, the region scanned, and the rule(s) it decides. The count replaces the
+earlier under-count of 28 lists, which had omitted the concern-classifier and
+security-vocabulary rows.
+
+### 4.x baselines detected as incompatible
+
+**A baseline written by 4.x is detected and reported as incompatible, never
+silently matched.** `loadBaseline` rejects a baseline whose `schemaVersion` is
+≤ 3 (the 4.x format) and reports the regeneration command
+(`src/baseline.ts:76-87`), so a 4.x baseline cannot silently absorb a
+regression measured at a lower precision. Pinned by `baseline.test.ts:198-201`.
+
+### `CodeIndexDB` is decomposed into per-concern modules (breaking API change)
+
+**`CodeIndexDB` no longer exposes its 67 storage methods directly.** The inline
+methods — register/search, graph, coverage, schema, whitelist, audit results,
+analyzer config, code maps, project tasks, conventions, meta, provenance,
+inferred receivers, and raw SQL — all lived on the one class, which pushed
+`solid/class-size` over both thresholds. They now live on public per-concern
+fields, so call sites change from `db.<method>(…)` to `db.<field>.<method>(…)`.
+
+- `db.functionIndex` — `registerFunction`, `registerFunctions`, `findDefinition`,
+  `getAllFunctions`, `getFunctionCount`, `getStats`
+- `db.search` — `searchFunctions`
+- `db.graph` — `updateDependencyGraph`, `getTransitiveDependencies`,
+  `getTransitiveCallers`, `detectCircularDependencies`, `calculateDependencyDepths`,
+  `getGraphStats`
+- `db.coverage` — `clearCoverageData`, `importCoverageData`, `getCoverageByBasis`,
+  `getCoverageByRiskDecile`, `getUntestedTopDecile`, `isCoverageStale`
+- `db.meta` — `getMeta`, `setMeta`
+- `db.provenance` — `getFileProvenance`, `storeFileProvenance`
+- `db.inferredReceivers` — `getInferredReceivers`, `storeInferredReceivers`
+- `db.schema` — `getSchema`, `getAllSchemas`, `storeSchema`, `deleteSchema`,
+  `getSchemaStats`, `recordSchemaUsage`, `getSchemaUsage`, `clearSchemaUsageForFile`,
+  `findFunctionsUsingTable`
+- `db.whitelist` — `isWhitelisted`, `getWhitelist`, `addWhitelistEntry`,
+  `updateWhitelistStatus`, `detectWhitelistCandidates`
+- `db.auditResults` — `getAuditResults`, `getMostRecentAuditResults`,
+  `storeAuditResults`
+- `db.analyzerConfig` — `getAllAnalyzerConfigs`, `getAnalyzerConfig`,
+  `storeAnalyzerConfig`, `deleteAnalyzerConfig`, `resetAnalyzerConfigs`
+- `db.codeMap` — `listCodeMapSections`, `getCodeMapSection`, `storeCodeMapSection`,
+  `clearOldCodeMaps`, `deleteCodeMap`
+- `db.projectTasks` — `createProjectTask`, `getProjectTask`, `listProjectTasks`,
+  `listProjectTasksTree`, `listActionableProjectTasks`, `updateProjectTask`,
+  `completeProjectTask`, `deleteProjectTask`, `hasOpenTaskByFingerprint`
+- `db.conventions` — `mineAllConventions`
+- `db.rawSql` — `query`, `count`, `run`, `exec`, `tableHasRows`
+
+Five of those — `query`, `count`, `tableHasRows`, `run`, `exec` — plus `getMeta`
+and `getUntestedTopDecile` are also composed into a new read-only `db.indexHandle`
+field (with `rawDb`), the analyzer facade that replaces passing the whole
+`CodeIndexDB` to analyzers as an `IndexHandle`.
+
+**`functionIndex` is now a public field.** The function-index store — whose
+`functionToRow` / `rowToFunction` helpers were private to `CodeIndexDB`, and which
+surfaced during the decomposition under an underscore-private `_functionIndex` —
+is the public `db.functionIndex` field, so `db.functionIndex.functionToRow(…)` is a
+supported access path.
+
+**`searchWithSchemaContext` drops its dead first argument.** The method's first
+parameter (`query: string`) was never read — the body called `searchFunctions`
+with `options` alone — so it is removed. The signature is now
+`searchWithSchemaContext(options?)`.
+
+### Removed config key: `dbCallMethods`
+
+**`schema.dbCallMethods` / `data-access.dbCallMethods` was a dead config knob —
+declared, defaulted, and threaded through the pipeline into `buildProvenanceContext`,
+which never read it.** DB-call detection hardcodes `DB_CALL_METHODS` (the single
+method set in `provenance.ts`), so the key had no effect on which calls were
+treated as DB calls. It is removed from the config types, the defaults, and the
+threading; a `.codeauditor.json` that still sets it is now a no-op.
+
+### Legacy receiver-resolution path deleted — the phase model is the sole surface (Spec 70)
+
+**The Spec 69 §10 S5a legacy receiver-resolution enumerator (`collectUnprovenQueryReceivers`,
+fed by `resolveCorpusReceivers`) folded each query-shaped call site independently, so
+a handle verdict proven at one site never reached sibling sites sharing the same
+root.** `db.prepare('SELECT …').bind(x).first()` is several sites on one root `db`:
+`db.prepare('SELECT …')` proves `db` a handle via its SQL argument, but `db.first()` /
+`db.all()` carry no SQL, so their root stayed `unproven` — the largest `db`-rooted
+unproven population in the product, list-free. The phase model fixed this with the
+Spec 70 R3 propagation step (`applyR3FromSites`); the enumerator never did. Rather than
+mirror the fix into a second resolver, the legacy path is deleted: `resolveCorpusReceivers`,
+`collectUnprovenQueryReceivers`, their seven measurement scripts, and their parity tests
+are removed, leaving `runPhaseModel` → `computeReceiverProvenance` / `classifyBuildProvenance`
+as the sole receiver-resolution surface. The file-level R3 path (`applySqlArgumentInference`
+in `provenance.ts`) is unchanged.
+
+Six-corpus `db`-rooted unproven on the phase path:
+
+| corpus | db-rooted unproven |
+|---|---|
+| blitz | 101 |
+| knex | 14 |
+| recall-protocol | 21 |
+| hhra-org | 5 |
+| endless-guessing | 0 |
+| primer-css | 0 |
+| **total** | **141** |
+
+### LokiJS sniff no longer reads the whole index into memory
+
+**Every `CodeIndexDB.initialize()` in every 4.x release read the entire index
+file into memory as a UTF-8 string just to decide whether it was a legacy
+LokiJS file to migrate.** `migrateFromLokiJS` ran `readFileSync(dbPath, 'utf-8')`
+up front, then checked the first bytes for the LokiJS `{"filename":` prefix — a
+full-file read whose only purpose was a format sniff, on a path that
+almost always answers "not LokiJS" (the file is already SQLite). The cost scaled
+with index size: ~55 ms CPU and ~19.7 MB slurped into memory (roughly double that
+as a JS UTF-16 string) per process start on a 19.7 MB index, and it grew with the
+project.
+
+**The fix reads a 64 KiB header instead** (`openSync`/`readSync` of the leading
+`LOKIJS_SNIFF_BYTES`), which is enough to distinguish a LokiJS JSON export (whose
+`{"filename":` key sits at the very top) from a SQLite binary. The sniff matches
+only that prefix — deliberately *not* a `"collections":` substring, which a real
+SQLite index can legitimately contain inside a stored function body and which
+would false-positive the migration into firing on a healthy 4.x index. The
+full-file read now runs only when the sniff has already confirmed the file *is*
+LokiJS and a migration is actually about to happen — ~2 ms CPU, and no index-sized
+allocation on the common path. The prefix-only classification (`isLokiJSHeader`)
+and the upgrade path itself are pinned by `upgrade-path.spec.ts` against a real
+4.1.1-written SQLite index and a genuine `lokijs@1.5.12` export, so the
+"read, not rebuilt" transition is tested on the one surface a clean-install gate
+cannot exercise.
+
+### `changed` against a live daemon no longer crashes on a missing summary
+
+**The `changed` daemon fast-path returned a `result` with no `summary`, so
+`result.summary.dismissed` threw a `TypeError` on every `.ts` edit run against a
+ready daemon — an exit-1, which by the hook contract is a broken hook.** The
+fast-path had been built to serve diagnostics back without a summary, and nothing
+exercised the assembled object end to end, so the crash sat in the hook's primary
+path undetected.
+
+**The fix derives a real summary from the served diagnostics** (severity/rule/
+analyzer rollups, measured `dismissed`, with the non-derivable fields omitted) and
+guards the dismissed read (`result.summary?.dismissed ?? 0`) so a summary-less
+result can never throw again. The gap that let the crash through — no gate ran the
+shipped commands against a live daemon — is closed by the **14th release gate**,
+`verify:daemon-smoke`: it starts a daemon against a fixture project and runs every
+command the hook and skill invoke (`changed --json`, `changed` plain, `audit`, …),
+asserting exit codes and that a real summary comes back.
+
+### `verify:close` no longer short-circuits on the first failing gate
+
+**`verify:close` was a single `&&` conjunction of thirteen gates, and a `&&`
+chain stops at the first non-zero exit.** The first gate to fail aborted the run
+and every gate *after* it was silently skipped — a gate "passed" by not running.
+This is the recurring failure shape the project already documents twice (the
+broken-compiler-that-sat-green in 4.0.1, and the stale-`missing-org-filter` false
+clean in 4.1.0). It bit a third time here: `verify:dist-fresh` has failed since
+the Spec 69 R1/R2 commits (a stale `dist/cli.js`), so `verify:oracle-shortfalls` —
+which pins the Spec 69 completeness residuals — had not actually run in that
+window, and its baseline drift sat concealed behind a `verify:dist-fresh` failure
+for seven consecutive passes of the chain.
+
+**The fix is a run-all runner, not another reorder.** `verify:close` now runs
+`scripts/verify-close.mjs`, which executes every gate, records every outcome, and
+prints a full PASS/FAIL/SKIP summary before deciding the exit code — so no gate
+is ever skipped by an earlier failure. The one remaining skip is deliberate and
+loud: the gates that consume `dist/cli.js` (`test`, `test:integration`,
+`verify:gate-budget`, `verify:self`, `verify:dist`) are `SKIPPED (dist stale)`
+when `verify:dist-fresh` fails, because running them would validate a compiled
+CLI that is not the source — the exact trap `verify:dist-fresh` exists to catch.
+The drift gates (`bench`, `verify:recall-value-drift`,
+`verify:extraction-completeness`, `verify:oracle-shortfalls`) are `tsx` over
+`src/` and do not depend on dist, so they always run and surface their drift
+alongside the dist failure. The planner is pinned by
+`gate-liveness.test.ts` (a stale dist skips only the dist-consuming set and still
+runs every drift gate), the same machine form as Spec 62 R9.
+
+### Known issue — `verify:gate-budget` passes with a thin, flaky margin
+
+**`verify:gate-budget` is green on the 5.0.0 tree but not clean.** The warm-gate
+CPU time sits at 344 ms and 352 ms inside the `verify:close` chain, 348–383 ms
+standalone, with a tail out to 419 ms against the 400 ms budget. That margin is
+thin enough to flip on a cold cache or a one-off slow rule, so it is recorded
+here as a known issue rather than as a settled green. The durable fix is the
+double-parse collapse — the warm gate currently parses each file three times
+(`detectChangedFunctions` for the content-hash diff, the legacy pipeline's
+always-on index-population visitors, and the phase model's single
+`parseOne`). Collapsing those to one parse is the release's outstanding
+performance item, tracked against the phase-model migration's remaining
+board items (Spec 63 R1–R3, Spec 64 R1–R3/R5–R7, board §6.1/§6.2/§7/§8/§9).
+
+### `text(N)` DDL columns now normalize around the sqlite grammar gap
+
+**`node-sql-parser`'s sqlite grammar rejects `text(N)` column spellings — the
+shape Drizzle-sqlite emits for `text` columns — so DDL extraction reported
+`cannot-fire` on those tables rather than emitting their tables/columns.**
+`text(256)` / `text(2)` failed to parse while `text` and `varchar(255)`
+succeeded; the honest `cannot-fire` was correct for an unparseable statement,
+but the fix is input normalization, not a regex fallback:
+`normalizeSqliteTextLength` rewrites `text(N)` → `varchar(N)` before the parse —
+lossless for fact extraction, and it never re-introduces the hand-rolled parser
+this release removed.
+
+## [Unreleased]
+
+### Any repo with a Go file silently dropped eleven analyzers
+
+**v2.6.1 through v4.1.1 routed the *whole* repo through the polyglot
+orchestrator the moment a single `.go` file was present, and that path ran the
+TypeScript/JavaScript half with only four analyzers — `solid`, `dry`,
+`documentation`, `data-access` — dropping eleven analyzers' rules and
+`metadata.coverage` entirely.** Anyone who audited a mixed-language repo in that
+range got a clean-looking report for a fraction of its rules, with no coverage
+entry to say so. Re-running after upgrading surfaces findings the earlier run
+never looked for.
+
+- Dispatch now keys on the languages present, not on the presence of one
+  extension: TypeScript/JavaScript go through the full analyzer pipeline, Go
+  through the Go subprocess, and the two merge into one `AuditResult` whose
+  `metadata.coverage` accounts for every registry rule (Spec 66).
+- The `.go`-keyed routing shipped in v2.6.1 on the MCP audit surface and was
+  consolidated onto the CLI in v3.5.0; both carried the four-analyzer trim until
+  this fix.
+- A language group with no registered analyzer reads `notApplicable` in coverage
+  instead of silently analyzing nothing.
+- A mixed TS/Go corpus fixture pins the merged result end to end.
+
+### value-drift stops flagging length sprawl
+
+**`styles/value-drift` reported exact-value drift on any unit-bearing length —
+`width`/`font-size`/`margin`/`padding`/`gap` — as "rare drift", flagging a design
+system's legitimate scale as defects.** On the validation corpora that was 1,057
+false findings (recall 653, primer-css 397, hhra-org 5, blitz 2). value-drift now
+checks colors only; length-valued properties belong to `off-scale`, which judges
+them against the project's *declared* scale and reads `notApplicable` (with a
+reason that names the fix) when the project declares none. `detectExactValueDrift`
+was deleted.
+
+- `detectValueDrift` routes color properties to `detectColorDrift`; non-color
+  properties are left alone rather than histogrammed as exact-value drift.
+- `styles/off-scale` no longer guesses a scale when a project declares none —
+  it reports `notApplicable` with "no design tokens found; declare a scale and
+  this rule can check it".
+- `parameter-documentation`/`return-documentation` (opt-in strict mode) now read
+  as a named `off-by-default` coverage state, distinct from a rule the user
+  disabled, so a "ships off" rule is no longer mistaken for a broken one.
+
+### value-drift reworks its drift predicate to real ΔE76
+
+**`styles/value-drift` flagged *rare* colors, not *drifted* ones.** Its predicate
+was scarcity — a color used once (share < `outlierMaxShare`) fired regardless of
+whether it was near another color — and its `colorDeltaE` threshold was Euclidean
+RGB distance mislabeled "CIE76", so only *exact* matches ever clustered. Two
+near-identical colors used rarely never flagged as drift. Spec 67 reworks the rule
+around its name:
+
+- `deltaE` is now real CIELAB ΔE76 (sRGB → linear → XYZ(D65) → Lab), so the
+  `colorDeltaE` key (re-pinned to 2.5) means what it says.
+- The predicate is pairwise: distinct color values cluster by single-linkage at
+  ΔE76 < 2.5, and each non-canonical member of a ≥2-value cluster gets one finding
+  naming the most-used canonical. Scarcity plays no part — `outlierMaxShare` and
+  `modeMinCount` are gone.
+- `minCorpus` is dropped from the drift predicate; `off-scale`'s usage floor is
+  renamed to the named key `offScaleMinDeclarations` (default 20, unchanged).
+- Color keywords (`transparent`, `currentColor`, `inherit`, `initial`, `unset`,
+  `none`) no longer parse as colors, so `transparent → [0,0,0]` can no longer make
+  a keyword the dominant color against which every real color is flagged.
+- On recall-protocol this cut the 27 scarcity findings to 3 — all three genuine
+  near-identical pairs (ΔE 1.06/1.59/1.82) — and the bench fixture now pins the
+  boundary with two computed ΔE76 pairs (`#4e5568`↔`#4a5568` = 1.505 fires;
+  `#535568`↔`#4a5568` = 3.446 does not).
+
 ## [4.1.1] — 2026-09-23
 
 ### Report writes stop destroying files

package/README.md

@@ -114,7 +114,7 @@ Severity overrides apply globally (before per-directory path profile caps). Sett
 
 ### SQL Injection Detection
 
-The `sql-injection-risk` rule is **disabled by default** (`off`) after recalibration. On the self-audit corpus, it produced 0% precision — the analyzer misinterpreted TypeScript pattern-matching code (string constants like `'SELECT'`, `'FROM'`, `'WHERE'` used for the tool's own SQL detection) as database queries. On the Gin and Excalidraw corpora, precision was also near zero.
+The `sql-injection-risk` rule is **disabled by default** (`off`) after recalibration. On the self-audit corpus, it produced 0% precision — the rule misinterpreted TypeScript pattern-matching code (string constants like `'SELECT'`, `'FROM'`, `'WHERE'` used for the tool's own SQL detection) as database queries. On the Gin and Excalidraw corpora, precision was also near zero.
 
 **When to re-enable it**: your project's SQL is constructed via string concatenation or template literals in functions whose sole purpose is query assembly. The rule detects those patterns. For codebases using ORMs or parameterized queries exclusively, the rule produces noise.
 
@@ -150,7 +150,7 @@ It is **off by default** and turned on only by an explicit opt-in — the `telem
 
 ## Style Intelligence
 
-Code Auditor indexes every style declaration in your project — CSS, SCSS, Tailwind, inline styles, and CSS-in-JS. The styles analyzer reads global distributions and flags fragmentation that no single-file linter can see.
+Code Auditor indexes every style declaration in your project — CSS, SCSS, Tailwind, inline styles, and CSS-in-JS. The styles rules read global distributions and flag fragmentation that no single-file linter can see.
 
 **7 detectors, 10 rule IDs:**
 
@@ -164,7 +164,7 @@ Code Auditor indexes every style declaration in your project — CSS, SCSS, Tail
 | **Declaration-set similarity** | Two CSS rule blocks with > 90% identical declarations |
 | **Z-index sprawl** | Project-wide z-index inventory — too many distinct values or orphan singletons |
 
-The analyzer reads from a project-wide SQLite index, so scoped runs (changed files only) still compare against the full project baseline. A fresh `#273828` drift color in a scoped run is caught against the full corpus of `#1e2328` values.
+The styles rules read from a project-wide SQLite index, so scoped runs (changed files only) still compare against the full project baseline. A fresh `#273828` drift color in a scoped run is caught against the full corpus of `#1e2328` values.
 
 **Style invariant rules:**
 
@@ -195,7 +195,7 @@ code-audit search "mechanism:inline css:color"          # inline color declarati
 code-audit search "token:--color-primary"                # bypassing a design token
 ```
 
-**The React analyzer** also gains raw-element detection: if your project has a `Button` wrapper, raw `<button>` usages outside `Button`'s definition become severe findings.
+**The React rules** also gain raw-element detection: if your project has a `Button` wrapper, raw `<button>` usages outside `Button`'s definition become severe findings.
 
 ## License
 

package/configs/hhra-compat.json

@@ -23,14 +23,6 @@
     "code-auditor/**"
   ],
   
-  "enabledAnalyzers": [
-    "react",
-    "security",
-    "solid",
-    "dry",
-    "data-access"
-  ],
-  
   "analyzerConfig": {
     "security": {
       "authPatterns": [

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts

@@ -9,6 +9,6 @@ interface ItemRow {
     id: number;
     name: string;
 }
-export declare function renameAll(db: any, items: ItemRow[]): Promise<void>;
+export declare function renameAll(items: ItemRow[]): Promise<void>;
 export {};
 //# sourceMappingURL=item-03-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"item-03-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE"}
+{"version":3,"file":"item-03-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAQD,wBAAsB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js

@@ -5,7 +5,13 @@
  * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
  * skip must be surgical and leave eager member methods firing.
  */
-export async function renameAll(db, items) {
+import Database from 'better-sqlite3';
+// Spec 70 R4 — the handle is proven by the manifest-package import
+// (`better-sqlite3`), not a `D1Database` type annotation. `db.exec(sql)` with a
+// dynamic (interpolated) argument has no static SQL for R3, so the import is the
+// proof; the `D1Database` binding would read `unproven` (cannot-fire).
+const db = new Database(':memory:');
+export async function renameAll(items) {
     for (const item of items) {
         db.exec(`UPDATE items SET name = 'renamed' WHERE id = ${item.id}`);
     }

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"item-03-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAO,EAAE,KAAgB;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}
+{"version":3,"file":"item-03-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAOtC,mEAAmE;AACnE,gFAAgF;AAChF,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts

@@ -10,14 +10,8 @@ interface RankRow {
     rank: number;
 }
 export declare class Leaderboard {
-    private ctx;
-    constructor(ctx: {
-        storage: {
-            sql: {
-                exec: (query: string, ...bind: unknown[]) => void;
-            };
-        };
-    });
+    private sql;
+    constructor(sql: D1Database);
     applyRanks(rows: RankRow[]): Promise<void>;
 }
 export {};

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"item-04-storage-sql-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAA8E;gBAE7E,GAAG,EAAE;QAAE,OAAO,EAAE;YAAE,GAAG,EAAE;gBAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE;IAItF,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAKjD"}
+{"version":3,"file":"item-04-storage-sql-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAa;gBAEZ,GAAG,EAAE,UAAU;IAIrB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAKjD"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js

@@ -6,13 +6,13 @@
  * N+1 that must keep firing — the two-direction proof's positive arm.
  */
 export class Leaderboard {
-    ctx;
-    constructor(ctx) {
-        this.ctx = ctx;
+    sql;
+    constructor(sql) {
+        this.sql = sql;
     }
     async applyRanks(rows) {
         for (const row of rows) {
-            this.ctx.storage.sql.exec('UPDATE leaderboard SET rank = ? WHERE id = ?', row.rank, row.id);
+            this.sql.exec('UPDATE leaderboard SET rank = ? WHERE id = ?', row.rank, row.id);
         }
     }
 }

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"item-04-storage-sql-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,OAAO,WAAW;IACd,GAAG,CAA8E;IAEzF,YAAY,GAAgF;QAC1F,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"item-04-storage-sql-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,OAAO,WAAW;IACd,GAAG,CAAa;IAExB,YAAY,GAAe;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts

@@ -12,6 +12,6 @@ interface SyncJob {
     id: number;
     slug: string;
 }
-export declare function syncBuildsForHeroes(db: any, jobs: SyncJob[]): Promise<void>;
+export declare function syncBuildsForHeroes(db: D1Database, jobs: SyncJob[]): Promise<void>;
 export {};
 //# sourceMappingURL=item-06-chained-prepare-run-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"item-06-chained-prepare-run-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASjF"}
+{"version":3,"file":"item-06-chained-prepare-run-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASxF"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"item-06-chained-prepare-run-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAO,EAAE,IAAe;IAChE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE;aACL,OAAO,CACN,oFAAoF,CACrF;aACA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACZ,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"item-06-chained-prepare-run-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAc,EAAE,IAAe;IACvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE;aACL,OAAO,CACN,oFAAoF,CACrF;aACA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACZ,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.d.ts

@@ -16,10 +16,10 @@ interface Statement {
     all<T>(): T[];
     run(): unknown;
 }
-interface Db {
+interface D1Database {
     prepare(sql: string): Statement;
     batch(stmts: unknown[]): unknown;
 }
-export declare function fetchHeroById(db: Db, ids: number[]): Promise<HeroRow[]>;
+export declare function fetchHeroById(db: D1Database, ids: number[]): Promise<HeroRow[]>;
 export {};
 //# sourceMappingURL=item-07-chained-prepare-bind-first-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAID,UAAU,SAAS;IACjB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IACpC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACd,GAAG,IAAI,OAAO,CAAC;CAChB;AACD,UAAU,EAAE;IACV,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;CAClC;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAU7E"}
+{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAID,UAAU,SAAS;IACjB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IACpC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACd,GAAG,IAAI,OAAO,CAAC;CAChB;AACD,UAAU,UAAU;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;CAClC;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAUrF"}

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAM,EAAE,GAAa;IACvD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,OAAO,CAAC,0CAA0C,CAAC;aACnD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAW,CAAC;QACpB,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc,EAAE,GAAa;IAC/D,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,OAAO,CAAC,0CAA0C,CAAC;aACnD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAW,CAAC;QACpB,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.d.ts

@@ -10,6 +10,6 @@
 interface ItemRow {
     id: number;
 }
-export declare function fetchMapped(db: any, rows: ItemRow[]): Promise<unknown[]>;
+export declare function fetchMapped(db: D1Database, rows: ItemRow[]): Promise<unknown[]>;
 export {};
 //# sourceMappingURL=item-10-promise-all-map-of-eager-all-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAO9E"}
+{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAOrF"}

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,IAAe;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,IAAe;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}