code-auditor-mcp 5.0.1 → 5.0.2

package/plugin/.claude-plugin/manifest.json

@@ -1,16 +1,16 @@
 {
-  "version": "5.0.1",
+  "version": "5.0.2",
   "files": {
-    ".claude-plugin/plugin.json": "3703d82b6985618b4d93577d72542790d36b38bf9ffd84a8a84c5f200ab5add9",
+    ".claude-plugin/plugin.json": "1b950b987f07b25990f29959dc696fd1323dc4dfdda367e2c21fb32638e083be",
     "README.md": "6e51516ead6c7d0b4e77629e071e139b899d30a47838e8721c0d534eb733ad45",
-    "hooks/hooks.json": "4480d9d4fe80dbeb8fc8dacb0a6c67a46f45bf4610b42718876ed4a01935e7b1",
-    "scripts/hook-audit.sh": "5286ee058a73ce9cf3a2fdbb325b8835ae70d85436365d691e95ad6c52bcb84c",
-    "scripts/hook-common.sh": "e6a7b8da6a5e5d528c297c9ab381c77a1d360a6813775ef85342ff200d07a020",
-    "scripts/hook-drift-check.sh": "6fcb897fc5fe6814e9a4cae3138532e6783bb44044c549f89fbfe8eb44580e44",
-    "scripts/hook-self-audit.sh": "4b218f754ca466052da16b0578e2889bdff1abf16d7cbc27a259f71e332af392",
-    "scripts/hook-warm.sh": "9923fe1434e5579abebae868772aba1e53d25d7392b4181ccd4a41dc3692dd55",
+    "hooks/hooks.json": "28c4d7e87f1bb0daae8d9c714a196c39809039509568cf89a67c0377090f7211",
+    "scripts/hook-audit.sh": "25353d88a020d71586bb52ec6800438ab1f500e987c639837be52529fe2dc5fe",
+    "scripts/hook-common.sh": "85fd91c7a3817c01557383aadeff578696a9400698806d2d310ffd1caa954e06",
+    "scripts/hook-drift-check.sh": "fdf1f8098d9dda8911daedfd4b038c310c8383da57938a6737131cd33cb9492e",
+    "scripts/hook-self-audit.sh": "1a19f4ddec4cf66d9feb97999e70eb664817b0d6dd811f498d3cdef2f26d63b2",
+    "scripts/hook-warm.sh": "3d0fa8d811a26eda29c1a4dcbd88e6861eef93425355c87d6fe72356b3e7b5b3",
     "skills/code-auditor/SKILL-RULE-KINDS.md": "be1bbe1b56b19dc112c2657c1f5984f6f704b2ac9c1c0f78a561a58b110d508a",
     "skills/code-auditor/SKILL-SEARCH.md": "95d2df4474995bc5b18e14cc55ac55fb828024541463f109239567e2aa5ab7b0",
-    "skills/code-auditor/SKILL.md": "f120c4b45fe38deeeb2f76ea74df763e87269a15defa6c0508413a41972447ec"
+    "skills/code-auditor/SKILL.md": "a66b4849ffa98adac0817e6ef0712e6b5e1fa292ceaa094717795aeb7299b9a6"
   }
 }

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "code-auditor",
   "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "author": {
     "name": "Ben Hammond",
     "email": "ben@benhammond.tech"

package/plugin/hooks/hooks.json

@@ -6,11 +6,11 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-warm.sh"
+            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-warm.sh"
           },
           {
             "type": "command",
-            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-drift-check.sh"
+            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-drift-check.sh"
           }
         ]
       }
@@ -21,11 +21,11 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-audit.sh"
+            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-audit.sh"
           },
           {
             "type": "command",
-            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-self-audit.sh"
+            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-self-audit.sh"
           }
         ]
       }

package/plugin/scripts/hook-audit.sh

@@ -16,8 +16,11 @@
 #   failure surfaces on the next explicit audit, never on the edit.
 set -euo pipefail
 
-# Shared resolver + compatibility pinning (see hook-common.sh).
-. "${CLAUDE_PLUGIN_ROOT}/scripts/hook-common.sh"
+# Shared resolver + compatibility pinning (see hook-common.sh). Source it from
+# this script's own directory — the plugin's scripts/ — never from a host
+# environment variable.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+. "${SCRIPT_DIR}/hook-common.sh"
 
 # Read event JSON from stdin
 event="$(cat)"

package/plugin/scripts/hook-common.sh

@@ -1,9 +1,12 @@
 #!/usr/bin/env bash
 # Shared helpers for the code-auditor PostToolUse hooks.
 #
-# Sourced by hook-audit.sh and hook-self-audit.sh. CLAUDE_PLUGIN_ROOT is
-# guaranteed set before either hook runs (the hooks.json guard exits 1 when it
-# is unset).
+# Sourced by hook-audit.sh, hook-self-audit.sh, hook-warm.sh, and
+# hook-drift-check.sh. The plugin root is derived from where THIS file lives —
+# `<plugin>/scripts/hook-common.sh`, so the root is its grand-parent — never
+# from a host environment variable. `CLAUDE_PLUGIN_ROOT` is honored only as a
+# validated override (see plugin_root below), so an unset or wrong value can
+# never decide whether the tool runs.
 #
 # Two rules enforced here are the fix for "the hook died quietly" (three times:
 # unset CLAUDE_PLUGIN_ROOT, a stale global binary, a removed CLI flag):
@@ -30,6 +33,26 @@
 #
 # The sourcing hook runs with `set -euo pipefail`.
 
+# plugin_root — the plugin's install root.
+#
+# This file ships at `<plugin>/scripts/hook-common.sh`, so the plugin root is the
+# grand-parent of its own location. That fixed, known-at-build-time offset is the
+# single source of truth: every path a hook needs (the manifest, the bundled CLI
+# sibling) is derived from here, not read from a host variable that may be unset.
+# `CLAUDE_PLUGIN_ROOT` is honored only when it actually points at a plugin — it
+# must contain this same `scripts/hook-common.sh` — so a stale or wrong value
+# never shadows the real location, and an absent one is a non-event.
+plugin_root() {
+  local here root
+  here="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+  root="$(dirname "${here}")"
+  if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "${CLAUDE_PLUGIN_ROOT}/scripts/hook-common.sh" ]; then
+    printf '%s' "${CLAUDE_PLUGIN_ROOT}"
+    return
+  fi
+  printf '%s' "${root}"
+}
+
 # hook_log_dir / hook_log_file / hook_log — the hook's diagnostic log.
 #
 # The PostToolUse hook must never write stderr: the host may block on stderr
@@ -55,7 +78,7 @@ hook_log() {
 # manifest version. A stale candidate is warned about and skipped, so a mismatched
 # binary no longer turns the hook into a hard failure.
 #
-# 1. The plugin's bundled CLI (`${CLAUDE_PLUGIN_ROOT}/../dist/cli.js` ships in the
+# 1. The plugin's bundled CLI (`$(plugin_root)/../dist/cli.js` ships in the
 #    same npm package, so it usually matches) — but a marketplace checkout has no
 #    npm-paired dist/, and a locally built one can be stale, so it is
 #    version-checked like everything else.
@@ -66,9 +89,10 @@ hook_log() {
 # 3. Project-local install (consumer project's own node_modules) — if compatible.
 # 4. Global install / PATH — if compatible.
 resolve_code_audit() {
-  local candidate
-  if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "${CLAUDE_PLUGIN_ROOT}/../dist/cli.js" ]; then
-    candidate="${CLAUDE_PLUGIN_ROOT}/../dist/cli.js"
+  local candidate root
+  root="$(plugin_root)"
+  if [ -f "${root}/../dist/cli.js" ]; then
+    candidate="${root}/../dist/cli.js"
     if cli_is_compatible "${candidate}"; then
       echo "${candidate}"
       return
@@ -165,7 +189,7 @@ plugin_version() {
     return
   fi
   __CODE_AUDITOR_PLUGIN_VERSION="$(
-    node -e "const fs=require('fs');const p=process.env.CLAUDE_PLUGIN_ROOT;for(const f of [p+'/.claude-plugin/plugin.json', p+'/plugin.json']){try{const v=JSON.parse(fs.readFileSync(f,'utf8')).version;if(v){process.stdout.write(v);break}}catch(e){}}" 2>/dev/null
+    node -e 'const fs=require("fs");const p=process.argv[1];for(const f of [p+"/.claude-plugin/plugin.json", p+"/plugin.json"]){try{const v=JSON.parse(fs.readFileSync(f,"utf8")).version;if(v){process.stdout.write(v);break}}catch(e){}}' "$(plugin_root)" 2>/dev/null
   )"
   __CODE_AUDITOR_PLUGIN_VERSION_RESOLVED=1
   printf '%s' "${__CODE_AUDITOR_PLUGIN_VERSION}"
@@ -220,7 +244,7 @@ assert_compatible() {
   # bundled sibling, a project-local install, a global on PATH) are NOT
   # path-guaranteed — the resolver's `cli_is_compatible` already version-checked
   # them, and the full check below remains the loud backstop for any of them.
-  if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ "${bin}" = "$(pin_dir)/node_modules/.bin/code-audit" ]; then
+  if [ "${bin}" = "$(pin_dir)/node_modules/.bin/code-audit" ]; then
     return 0
   fi
   pv="$(plugin_version)"

package/plugin/scripts/hook-drift-check.sh

@@ -18,20 +18,24 @@
 # single source of truth; the fix is to reinstall (or restore the file).
 set -uo pipefail
 
-# The hooks.json command already guards an unset CLAUDE_PLUGIN_ROOT, but keep
-# this a no-op if it is somehow absent here.
-[ -n "${CLAUDE_PLUGIN_ROOT:-}" ] || exit 0
+# Source the shared resolver from this script's own directory — the plugin's
+# scripts/ — never from a host environment variable. plugin_root() self-locates
+# the plugin root, so an unset or wrong CLAUDE_PLUGIN_ROOT is a non-event.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+. "${SCRIPT_DIR}/hook-common.sh"
+
+ROOT="$(plugin_root)"
 
 # The manifest ships at .claude-plugin/manifest.json; a few installs flatten the
 # plugin.json to the plugin root, so check both locations (mirrors
 # hook-common.sh's plugin_version).
 manifest=""
-for f in "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/manifest.json" "${CLAUDE_PLUGIN_ROOT}/manifest.json"; do
+for f in "${ROOT}/.claude-plugin/manifest.json" "${ROOT}/manifest.json"; do
   if [ -f "$f" ]; then manifest="$f"; break; fi
 done
 [ -n "${manifest}" ] || exit 0
 
-MANIFEST_PATH="${manifest}" PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT}" node <<'NODE'
+MANIFEST_PATH="${manifest}" PLUGIN_ROOT="${ROOT}" node <<'NODE'
 const fs = require('fs');
 const crypto = require('crypto');
 const path = require('path');

package/plugin/scripts/hook-self-audit.sh

@@ -20,8 +20,11 @@
 #   the log file, not stderr, and still exits 0 (Spec 68 §hook-contract).
 set -euo pipefail
 
-# Shared resolver + compatibility pinning (see hook-common.sh).
-. "${CLAUDE_PLUGIN_ROOT}/scripts/hook-common.sh"
+# Shared resolver + compatibility pinning (see hook-common.sh). Source it from
+# this script's own directory — the plugin's scripts/ — never from a host
+# environment variable.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+. "${SCRIPT_DIR}/hook-common.sh"
 
 # Read event JSON from stdin
 event="$(cat)"

package/plugin/scripts/hook-warm.sh

@@ -17,12 +17,11 @@
 # at all — a warm session must not re-check on every launch.
 set -uo pipefail
 
-# Belt-and-suspenders: the hooks.json command already guards an unset
-# CLAUDE_PLUGIN_ROOT, but keep the warm a no-op if it is somehow absent here.
-[ -n "${CLAUDE_PLUGIN_ROOT:-}" ] || exit 0
-
-# Shared version lookup (plugin_version / semver_of / pin_dir).
-. "${CLAUDE_PLUGIN_ROOT}/scripts/hook-common.sh"
+# Source the shared resolver from this script's own directory — the plugin's
+# scripts/ — never from a host environment variable. plugin_root() self-locates
+# the plugin root, so an unset or wrong CLAUDE_PLUGIN_ROOT is a non-event.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+. "${SCRIPT_DIR}/hook-common.sh"
 
 # Nothing safe to warm if the manifest version can't be read: warming @latest
 # could pin a different version than resolve_code_audit's fallback would fetch.

package/plugin/skills/code-auditor/SKILL.md

@@ -5,7 +5,7 @@ description: Audit code quality, search the codebase semantically, enforce invar
 
 # Code Auditor Skill
 
-> **Version 5.0.1** • Run `code-audit --version` to check your installed version.
+> **Version 5.0.2** • Run `code-audit --version` to check your installed version.
 > If versions differ, the CLI is authoritative — use `code-audit <command> --help` to see what your install actually supports.
 
 You have the `code-audit` CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.

package/server.json

@@ -1,21 +1,27 @@
 {
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.BenAHammond/code-auditor-mcp",
-  "description": "Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.",
+  "description": "Enforces architectural invariants and code quality rules inside your AI agent's edit loop.",
   "repository": {
     "url": "https://github.com/BenAHammond/code-auditor-mcp",
     "source": "github"
   },
-  "version": "5.0.1",
+  "version": "5.0.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "code-auditor-mcp",
-      "version": "5.0.1",
+      "version": "5.0.2",
       "transport": {
         "type": "stdio"
       }
     }
+  ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://www.codeauditormcp.com/api/mcp"
+    }
   ]
 }