code-auditor-mcp 5.0.2 → 5.2.0

package/examples/node-api.auditrc.json

@@ -1,7 +1,4 @@
 {
-  "projectRoot": ".",
-  "reportTitle": "Node.js API Audit",
-  
   "includePaths": [
     "src/**/*.{ts,js}",
     "lib/**/*.{ts,js}",
@@ -11,7 +8,7 @@
     "services/**/*.{ts,js}",
     "models/**/*.{ts,js}"
   ],
-  
+
   "excludePaths": [
     "**/node_modules/**",
     "**/dist/**",
@@ -21,55 +18,18 @@
     "**/__tests__/**",
     "**/coverage/**"
   ],
-  
-  "analyzerConfig": {
-    "security": {
-      "authPatterns": ["authenticate", "authorize", "requireAuth", "passport"],
-      "rateLimitPatterns": ["rateLimit", "throttle", "limiter"],
-      "securityHeaders": [
-        "helmet",
-        "cors",
-        "Content-Security-Policy"
-      ]
-    },
-    "data-access": {
-      "databasePatterns": {
-        "postgres": ["pg", "postgres"],
-        "mysql": ["mysql", "mysql2"],
-        "mongodb": ["mongodb", "mongoose"]
-      },
-      "securityPatterns": {
-        "parameterized": ["?", "$1", ":id"],
-        "sanitized": ["sanitize", "escape", "validator"]
-      },
-      "performanceThresholds": {
-        "maxJoins": 4,
-        "warnOnSelectStar": true
-      }
-    },
+
+  "analyzerConfigs": {
     "solid": {
       "maxMethodsPerClass": 12,
       "maxLinesPerMethod": 60,
       "maxParametersPerMethod": 5
     }
   },
-  
-  "outputFormats": ["json", "html"],
-  "outputDirectory": "./audit-reports",
-  
+
   "minSeverity": "severe",
-  "failOnCritical": true,
-  
+
   "thresholds": {
-    "maxCritical": 0,
-    "maxWarnings": 10,
     "minHealthScore": 90
-  },
-  
-  "integrations": {
-    "ci": {
-      "provider": "github",
-      "failOnThreshold": true
-    }
   }
-}
+}

package/examples/react.auditrc.json

@@ -1,11 +1,8 @@
 {
-  "projectRoot": ".",
-  "reportTitle": "React Project Audit",
-  
   "includePaths": [
     "src/**/*.{ts,tsx,js,jsx}"
   ],
-  
+
   "excludePaths": [
     "**/node_modules/**",
     "**/build/**",
@@ -16,18 +13,10 @@
     "**/coverage/**",
     "**/*.stories.{ts,tsx,js,jsx}"
   ],
-  
-  "analyzerConfig": {
-    "component": {
-      "checkErrorBoundaries": true,
-      "checkPropTypes": true,
-      "maxComplexity": 12,
-      "frameworkPatterns": {
-        "react": {
-          "hooks": ["use*"],
-          "context": ["*Context", "*Provider"]
-        }
-      }
+
+  "analyzerConfigs": {
+    "react": {
+      "maxComponentComplexity": 12
     },
     "solid": {
       "maxMethodsPerClass": 8,
@@ -38,16 +27,10 @@
       "checkImports": true
     }
   },
-  
-  "outputFormats": ["html", "json"],
-  "outputDirectory": "./audit-reports",
-  
+
   "minSeverity": "severe",
-  "showProgress": true,
-  
+
   "thresholds": {
-    "maxCritical": 0,
-    "maxWarnings": 30,
     "minHealthScore": 75
   }
-}
+}

package/examples/tolerant-solid.auditrc.json

@@ -1,11 +1,8 @@
 {
-  "projectRoot": ".",
-  "reportTitle": "Project Audit with Relaxed SOLID Tolerances",
-  
   "includePaths": [
     "src/**/*.{ts,tsx,js,jsx}"
   ],
-  
+
   "excludePaths": [
     "**/node_modules/**",
     "**/build/**",
@@ -13,53 +10,24 @@
     "**/*.test.{ts,tsx,js,jsx}",
     "**/*.spec.{ts,tsx,js,jsx}"
   ],
-  
+
   "analyzerConfigs": {
     "solid": {
-      "componentResponsibilityThresholds": {
-        "default": 2,
-        "layout": 2,      
-        "dashboard": 4,   
-        "table": 3,      
-        "form": 3        
-      },
-      
-      "classResponsibilityThresholds": {
-        "default": 2,
-        "repository": 2,  
-        "service": 3,     
-        "controller": 3,  
-        "model": 3        
-      },
-      
-      "ifElseChainThreshold": 5,         
-      "switchCaseThreshold": 7,          
-      "classMethodThreshold": 12,        
-      "interfaceMemberThreshold": 20,    
-      "dependencyInjectionLimit": 6      
+      "classMethodsThreshold": 40,
+      "maxInterfaceMembers": 50,
+      "maxMethodComplexity": 100
     },
-    
+
     "dry": {
-      "minLineThreshold": 15,            
-      "similarityThreshold": 0.85,       
-      "checkImports": true,
-      "unusedImportsConfig": {
-        "checkLevel": "function",
-        "includeTypeOnlyImports": false,
-        "ignorePatterns": ["React", "^_", "test.*"]
-      }
+      "minLineThreshold": 15,
+      "similarityThreshold": 0.85,
+      "checkImports": true
     }
   },
-  
-  "outputFormats": ["html", "json"],
-  "outputDirectory": "./audit-reports",
-  
+
   "minSeverity": "severe",
-  "showProgress": true,
-  
+
   "thresholds": {
-    "maxCritical": 5,
-    "maxWarnings": 50,
     "minHealthScore": 70
   }
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-auditor-mcp",
-  "version": "5.0.2",
+  "version": "5.2.0",
   "description": "Enforces architectural invariants and code quality rules inside your AI agent's edit loop.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,9 +12,9 @@
     "code-auditor-daemon": "dist/daemon/main.js"
   },
   "scripts": {
-    "build": "pnpm run build:version && tsc && pnpm run build:grammars && pnpm run download:natives && pnpm run build:skills && pnpm run build:manifest",
+    "build": "pnpm run build:version && pnpm run build:hooklog && tsc && pnpm run build:grammars && pnpm run build:skills && pnpm run build:manifest",
     "build:version": "node scripts/write-version.mjs",
-    "download:natives": "bash scripts/download-natives.sh",
+    "build:hooklog": "node scripts/write-hook-log-path.mjs",
     "build:grammars": "mkdir -p dist/grammars && cp node_modules/tree-sitter-typescript/tree-sitter-typescript.wasm node_modules/tree-sitter-typescript/tree-sitter-tsx.wasm node_modules/tree-sitter-go/tree-sitter-go.wasm node_modules/tree-sitter-css/tree-sitter-css.wasm grammars/tree-sitter-scss.wasm dist/grammars/",
     "build:skills": "node scripts/build-skills.mjs",
     "build:manifest": "node scripts/build-manifest.mjs",
@@ -36,6 +36,8 @@
     "verify:disk-space": "node scripts/verify-disk-space.mjs",
     "verify:types": "tsc --noEmit",
     "verify:dist-fresh": "node scripts/verify-dist-fresh.mjs",
+    "verify:hook-log-path": "node scripts/verify-hook-log-path.mjs",
+    "verify:version-fresh": "node scripts/verify-version-fresh.mjs",
     "verify:clean-install": "bash scripts/verify-clean-install.sh",
     "verify:dist": "npm pack --silent && bash scripts/verify-dist.sh && rm -f code-auditor-mcp-*.tgz",
     "verify:self": "node scripts/verify-self.mjs && node scripts/verify-languages.mjs",
@@ -45,7 +47,7 @@
     "verify:gate-budget": "node scripts/verify-gate-budget.mjs",
     "verify:recall-value-drift": "tsx scripts/verify-recall-value-drift.ts",
     "verify:extraction-completeness": "tsx scripts/verify-extraction-completeness.ts",
-    "verify:oracle-shortfalls": "tsx scripts/verify-oracle-shortfalls.ts",
+    "verify:recall-cases": "tsx scripts/verify-recall-cases.ts",
     "verify:close": "node scripts/verify-close.mjs"
   },
   "keywords": [
@@ -122,7 +124,6 @@
   "files": [
     "dist/**/*",
     "dist/grammars/",
-    "dist/native/",
     "plugin/**/*",
     ".claude-plugin/**/*",
     "examples/**/*",

package/plugin/.claude-plugin/manifest.json

@@ -1,16 +1,17 @@
 {
-  "version": "5.0.2",
+  "version": "5.2.0",
   "files": {
-    ".claude-plugin/plugin.json": "1b950b987f07b25990f29959dc696fd1323dc4dfdda367e2c21fb32638e083be",
+    ".claude-plugin/plugin.json": "b492a180519f2991d0aa18211c3c9e45e6569c4715339e79d2032bbeec6ff44d",
     "README.md": "6e51516ead6c7d0b4e77629e071e139b899d30a47838e8721c0d534eb733ad45",
-    "hooks/hooks.json": "28c4d7e87f1bb0daae8d9c714a196c39809039509568cf89a67c0377090f7211",
-    "scripts/hook-audit.sh": "25353d88a020d71586bb52ec6800438ab1f500e987c639837be52529fe2dc5fe",
-    "scripts/hook-common.sh": "85fd91c7a3817c01557383aadeff578696a9400698806d2d310ffd1caa954e06",
-    "scripts/hook-drift-check.sh": "fdf1f8098d9dda8911daedfd4b038c310c8383da57938a6737131cd33cb9492e",
-    "scripts/hook-self-audit.sh": "1a19f4ddec4cf66d9feb97999e70eb664817b0d6dd811f498d3cdef2f26d63b2",
-    "scripts/hook-warm.sh": "3d0fa8d811a26eda29c1a4dcbd88e6861eef93425355c87d6fe72356b3e7b5b3",
+    "hooks/hooks.json": "f9817f337d147bbd0e175741e57c6bd0718c64352ddbff15b5ba9357272b6725",
+    "scripts/hook-audit.sh": "3fa178a87c8ac4d4d49d0cac16df308a37ccc89d778a5eda614799fc69e3e6c8",
+    "scripts/hook-common.sh": "0f29ac77e94ca7ba3f6ffe23bc91f9ce0c77f1568d9f13e29288d0cf5eef6bd8",
+    "scripts/hook-drift-check.sh": "4e6ed8e4e33d0765a5ed6adfda6fb3ecec5750d836632aa4ee6d7a6acce69665",
+    "scripts/hook-log-path.sh": "4ac27ac22dcb29fd82cbd9a936b3da7115c5182386a0e3290ed5ac9e529bc132",
+    "scripts/hook-self-audit.sh": "593926cd4714c653269791ed53675b46fbc92310074bff9194772e25665b0257",
+    "scripts/hook-warm.sh": "22d750e8e36164920515c8370f02dd48f9f09f26bfe4a21e67de91f45b5ffef9",
     "skills/code-auditor/SKILL-RULE-KINDS.md": "be1bbe1b56b19dc112c2657c1f5984f6f704b2ac9c1c0f78a561a58b110d508a",
     "skills/code-auditor/SKILL-SEARCH.md": "95d2df4474995bc5b18e14cc55ac55fb828024541463f109239567e2aa5ab7b0",
-    "skills/code-auditor/SKILL.md": "a66b4849ffa98adac0817e6ef0712e6b5e1fa292ceaa094717795aeb7299b9a6"
+    "skills/code-auditor/SKILL.md": "0f88508c4549f4b53fdfee431e43a27c7eba2ac99e0eaad64ba55492429be41b"
   }
 }

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "code-auditor",
   "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-  "version": "5.0.2",
+  "version": "5.2.0",
   "author": {
     "name": "Ben Hammond",
     "email": "ben@benhammond.tech"

package/plugin/hooks/hooks.json

@@ -6,11 +6,11 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-warm.sh"
+            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then dir=\"${XDG_CACHE_HOME:-$HOME/.cache}/code-auditor/logs\"; mkdir -p \"$dir\" 2>/dev/null || true; echo \"[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [code-auditor] HOOK NOT RUNNING: CLAUDE_PLUGIN_ROOT is unset — could not locate the plugin; the warm-up is not running.\" >> \"$dir/hook.log\" 2>/dev/null || true; exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-warm.sh"
           },
           {
             "type": "command",
-            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-drift-check.sh"
+            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then dir=\"${XDG_CACHE_HOME:-$HOME/.cache}/code-auditor/logs\"; mkdir -p \"$dir\" 2>/dev/null || true; echo \"[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [code-auditor] HOOK NOT RUNNING: CLAUDE_PLUGIN_ROOT is unset — could not locate the plugin; the drift check is not running.\" >> \"$dir/hook.log\" 2>/dev/null || true; exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-drift-check.sh"
           }
         ]
       }
@@ -21,11 +21,11 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-audit.sh"
+            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then dir=\"${XDG_CACHE_HOME:-$HOME/.cache}/code-auditor/logs\"; mkdir -p \"$dir\" 2>/dev/null || true; echo \"[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [code-auditor] HOOK NOT RUNNING: CLAUDE_PLUGIN_ROOT is unset — could not locate the plugin; the audit is not running.\" >> \"$dir/hook.log\" 2>/dev/null || true; exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-audit.sh"
           },
           {
             "type": "command",
-            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-self-audit.sh"
+            "command": "if [ -z \"${CLAUDE_PLUGIN_ROOT}\" ]; then dir=\"${XDG_CACHE_HOME:-$HOME/.cache}/code-auditor/logs\"; mkdir -p \"$dir\" 2>/dev/null || true; echo \"[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [code-auditor] HOOK NOT RUNNING: CLAUDE_PLUGIN_ROOT is unset — could not locate the plugin; the self-audit is not running.\" >> \"$dir/hook.log\" 2>/dev/null || true; exit 0; fi; \"${CLAUDE_PLUGIN_ROOT}\"/scripts/hook-self-audit.sh"
           }
         ]
       }

package/plugin/scripts/hook-audit.sh

@@ -92,6 +92,15 @@ fi
 exit_code=$?
 set -e
 
+# A completed run — clean (0) or finding (2) — is the positive "the hook is
+# alive and enqueueing" signal. Write it so the explicit-audit reader
+# (src/hookLog.ts) can clear a prior HOOK NOT RUNNING condition: the reader
+# resolves a condition by newest-record order, and without this line a hook that
+# recovered would leave the stale condition live forever.
+if [ "${exit_code}" -eq 0 ] || [ "${exit_code}" -eq 2 ]; then
+  hook_log "[code-auditor] HOOK RAN"
+fi
+
 # Exit 2 = a finding read from the daemon cache; propagate so Claude Code feeds
 # stdout back.
 if [ ${exit_code} -eq 2 ]; then

package/plugin/scripts/hook-common.sh

@@ -53,6 +53,12 @@ plugin_root() {
   printf '%s' "${root}"
 }
 
+# The hook-log path tail + file name are single-sourced in hook-log-path.sh,
+# generated by scripts/write-hook-log-path.mjs from the same source as
+# src/hookLogPath.generated.ts (the reader's copy). Sourced here so the write
+# half and the read half (src/hookLog.ts) can never drift apart.
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)/hook-log-path.sh"
+
 # hook_log_dir / hook_log_file / hook_log — the hook's diagnostic log.
 #
 # The PostToolUse hook must never write stderr: the host may block on stderr
@@ -61,10 +67,10 @@ plugin_root() {
 # still exits 0. A broken install therefore surfaces on the next explicit audit
 # (and in this log), never on the edit itself.
 hook_log_dir() {
-  printf '%s' "${XDG_CACHE_HOME:-$HOME/.cache}/code-auditor/logs"
+  printf '%s' "${XDG_CACHE_HOME:-$HOME/.cache}/${HOOK_LOG_DIR_TAIL}"
 }
 hook_log_file() {
-  printf '%s' "$(hook_log_dir)/hook.log"
+  printf '%s' "$(hook_log_dir)/${HOOK_LOG_FILE}"
 }
 hook_log() {
   mkdir -p "$(hook_log_dir)" 2>/dev/null || return 0

package/plugin/scripts/hook-drift-check.sh

@@ -33,7 +33,13 @@ manifest=""
 for f in "${ROOT}/.claude-plugin/manifest.json" "${ROOT}/manifest.json"; do
   if [ -f "$f" ]; then manifest="$f"; break; fi
 done
-[ -n "${manifest}" ] || exit 0
+if [ -z "${manifest}" ]; then
+  # No manifest to compare against is still a completed run — the drift check
+  # never exits non-zero, so write the success record that resolves a prior
+  # HOOK NOT RUNNING condition before the no-op exit.
+  hook_log "[code-auditor] HOOK RAN"
+  exit 0
+fi
 
 MANIFEST_PATH="${manifest}" PLUGIN_ROOT="${ROOT}" node <<'NODE'
 const fs = require('fs');
@@ -73,4 +79,7 @@ if (problems.length > 0) {
 }
 NODE
 
+# A completed run (drift found or not) resolves a prior HOOK NOT RUNNING
+# condition — the drift check never exits non-zero.
+hook_log "[code-auditor] HOOK RAN"
 exit 0

package/plugin/scripts/hook-log-path.sh

@@ -0,0 +1,7 @@
+# @generated — do not edit. Written by `scripts/write-hook-log-path.mjs`.
+#
+# Single source of truth for the hook-log path, shared by the TS reader
+# (src/hookLog.ts) and the bash writer (plugin/scripts/hook-common.sh).
+# Regenerate with `npm run build:hooklog`.
+HOOK_LOG_DIR_TAIL='code-auditor/logs'
+HOOK_LOG_FILE='hook.log'

package/plugin/scripts/hook-self-audit.sh

@@ -92,6 +92,15 @@ fi
 exit_code=$?
 set -e
 
+# A completed run — clean (0) or finding (2) — is the positive "the hook is
+# alive" signal, mirroring hook-audit.sh. Write it so the reader (src/hookLog.ts)
+# can clear a prior HOOK NOT RUNNING condition: the reader resolves by
+# newest-record order, and without this line a recovered hook would leave the
+# stale condition live forever.
+if [ "${exit_code}" -eq 0 ] || [ "${exit_code}" -eq 2 ]; then
+  hook_log "[code-auditor] HOOK RAN"
+fi
+
 # Exit 2 = a blocking self-audit finding; propagate so Claude Code feeds it back.
 if [ ${exit_code} -eq 2 ]; then
   exit 2

package/plugin/scripts/hook-warm.sh

@@ -26,18 +26,24 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
 # Nothing safe to warm if the manifest version can't be read: warming @latest
 # could pin a different version than resolve_code_audit's fallback would fetch.
 pv="$(plugin_version)"
-[ -n "${pv}" ] || exit 0
 
-dir="$(pin_dir)"
-bin="${dir}/node_modules/.bin/code-audit"
+if [ -n "${pv}" ]; then
+  dir="$(pin_dir)"
+  bin="${dir}/node_modules/.bin/code-audit"
 
-# Already installed — nothing to warm. Re-running npm install here would re-check
-# the registry on every session, which is exactly the cost this hook exists to avoid.
-[ -x "${bin}" ] && exit 0
+  # Already installed — nothing to warm. Re-running npm install here would re-check
+  # the registry on every session, which is exactly the cost this hook exists to avoid.
+  if [ ! -x "${bin}" ]; then
+    # Background the exact install the hook's last-resort path runs. Output to
+    # /dev/null (silent), stdin from /dev/null (don't hold the hook's stdin open),
+    # nohup so the install survives this hook's exit.
+    nohup npm install --prefer-offline --prefix "${dir}" "code-auditor-mcp@${pv}" \
+      --no-audit --no-fund --ignore-scripts --silent >/dev/null 2>&1 </dev/null &
+  fi
+fi
 
-# Background the exact install the hook's last-resort path runs. Output to
-# /dev/null (silent), stdin from /dev/null (don't hold the hook's stdin open),
-# nohup so the install survives this hook's exit.
-nohup npm install --prefer-offline --prefix "${dir}" "code-auditor-mcp@${pv}" \
-  --no-audit --no-fund --ignore-scripts --silent >/dev/null 2>&1 </dev/null &
+# A completed run — the warm hook never exits non-zero, so every path through it
+# is a success — writes the positive record that resolves a prior HOOK NOT RUNNING
+# condition (CLAUDE_PLUGIN_ROOT unset) in the reader (src/hookLog.ts).
+hook_log "[code-auditor] HOOK RAN"
 exit 0

package/plugin/skills/code-auditor/SKILL.md

@@ -5,7 +5,7 @@ description: Audit code quality, search the codebase semantically, enforce invar
 
 # Code Auditor Skill
 
-> **Version 5.0.2** • Run `code-audit --version` to check your installed version.
+> **Version 5.2.0** • Run `code-audit --version` to check your installed version.
 > If versions differ, the CLI is authoritative — use `code-audit <command> --help` to see what your install actually supports.
 
 You have the `code-audit` CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.
@@ -82,10 +82,31 @@ A dismissal is for *this finding is not relevant*, not for *I don't want to fix
 
 The tool can send dismissed findings to an anonymous feedback service that collects them. It is **off by default** and is turned on only by an explicit opt-in:
 
-- `mcp__code-auditor__telemetry` `status` / `enable` / `disable` manage the opt-in. `enable` needs no arguments — it opts in against the built-in service endpoint and generates the anonymous install ID.
+- `code-audit telemetry status` / `enable` / `disable` manage the opt-in (the `mcp__code-auditor__telemetry` tool mirrors the same toggle). `enable` needs no arguments — it opts in against the built-in service endpoint and generates the anonymous install ID.
 - When opted in, each dismissal sends only the reason plus a structural shape — **no code, identifiers, or file paths**.
 
-Before enabling, tell the user the privacy facts: **data is anonymous, and the ID is generated locally to avoid tracking anything personal.** Only the reason and enough shape to reproduce the finding are sent; nothing derived from their code or environment.
+On first contact, run `code-audit telemetry status` and read its `decided` field:
+
+- **`decided` is false** — the user has never been asked. Tell them the privacy facts (below), then ask **once** whether to opt in. Run `code-audit telemetry enable` on yes and `code-audit telemetry disable` on no — either records the decision so the question is never repeated.
+- **`decided` is true** — the user has already chosen. Never ask again; leave the setting exactly as it is.
+
+The privacy facts: each submission contains the tool version, the rule ID, the urgency level, the dismissal reason exactly as typed, a structural AST signature (grammar node types only, never their contents), a coarse language hint, a timestamp, and an anonymous install ID generated locally on your machine. Source code, identifiers, literals, file paths, and environment details are never sent, unless the user types them into the reason.
+
+### `code-audit request-rule` — request a rule for an unflagged defect
+
+When you find a *class* of defect the audit did not flag, request a new rule instead of silently working around it:
+
+```bash
+code-audit request-rule \
+  --title "Flag unbounded loops" \
+  --symptom "A loop with no exit condition hangs the process at runtime." \
+  --signal "A for-loop over a dynamic collection with no bound check." \
+  --language typescript \
+  --fires bad.ts \
+  --clean fixed.ts
+```
+
+Call `lookup_rule` or `explain_symptom` first to confirm no existing rule covers it. Provide a minimal example that *should* be flagged (`--fires`) and a corrected example that *should not* (`--clean`), each reduced to the smallest code that shows the difference, with secrets and proprietary identifiers removed. The CLI prints a receipt id so the request can be tracked.
 
 ### `code-audit config` — know the project's laws
 
@@ -235,6 +256,8 @@ The hook auto-installs the package to a cache dir on first use — no manual npm
 | Resolve file profiles | `code-audit config profiles --file <path>` |
 | Next file to fix | `code-audit next-file` |
 | Dismiss a false positive | `code-audit dismiss <fingerprint> --reason "…"` |
+| Telemetry opt-in | `code-audit telemetry status` / `enable` / `disable` |
+| Request a new rule | `code-audit request-rule` |
 | Sync index | `code-audit index sync --path .` |
 | Codebase map | `code-audit map -p .` |
 | Mine conventions | `code-audit conventions list` |

package/dist/__tests__/fixtures/spec-20/scripts/tool.d.ts

@@ -1,6 +0,0 @@
-/**
- * Scripts-tree module with an undocumented exported function.
- * Same code as src/demo-module.ts — the profile controls what fires.
- */
-export declare function calculateTotal(items: number[]): number;
-//# sourceMappingURL=tool.d.ts.map

package/dist/__tests__/fixtures/spec-20/scripts/tool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/scripts/tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD"}

package/dist/__tests__/fixtures/spec-20/scripts/tool.js

@@ -1,12 +0,0 @@
-/**
- * Scripts-tree module with an undocumented exported function.
- * Same code as src/demo-module.ts — the profile controls what fires.
- */
-export function calculateTotal(items) {
-    let total = 0;
-    for (const item of items) {
-        total += item * 1.1;
-    }
-    return total;
-}
-//# sourceMappingURL=tool.js.map

package/dist/__tests__/fixtures/spec-20/scripts/tool.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool.js","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/scripts/tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/__tests__/fixtures/spec-20/src/demo-module.d.ts

@@ -1,7 +0,0 @@
-/**
- * Source-tree module with an undocumented exported function.
- * When requireFunctionDocs is true (default), the documentation analyzer
- * flags this. When a profile sets requireFunctionDocs=false, skip entirely.
- */
-export declare function calculateTotal(items: number[]): number;
-//# sourceMappingURL=demo-module.d.ts.map

package/dist/__tests__/fixtures/spec-20/src/demo-module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"demo-module.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/src/demo-module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD"}

package/dist/__tests__/fixtures/spec-20/src/demo-module.js

@@ -1,13 +0,0 @@
-/**
- * Source-tree module with an undocumented exported function.
- * When requireFunctionDocs is true (default), the documentation analyzer
- * flags this. When a profile sets requireFunctionDocs=false, skip entirely.
- */
-export function calculateTotal(items) {
-    let total = 0;
-    for (const item of items) {
-        total += item * 1.1;
-    }
-    return total;
-}
-//# sourceMappingURL=demo-module.js.map

package/dist/__tests__/fixtures/spec-20/src/demo-module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"demo-module.js","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/src/demo-module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
- *
- * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
- * The statements are accumulated and executed once by a single `.batch()` after
- * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
- */
-interface Row {
-    id: number;
-    name: string;
-}
-export declare function insertMany(db: any, rows: Row[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-01-prepare-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-01-prepare-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpE"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js

@@ -1,16 +0,0 @@
-/**
- * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
- *
- * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
- * The statements are accumulated and executed once by a single `.batch()` after
- * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
- */
-export async function insertMany(db, rows) {
-    const stmts = [];
-    for (const row of rows) {
-        const stmt = db.prepare('INSERT INTO items (id, name) VALUES (?, ?)');
-        stmts.push(stmt);
-    }
-    await db.batch(stmts);
-}
-//# sourceMappingURL=item-01-prepare-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-01-prepare-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAO,EAAE,IAAW;IACnD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts

@@ -1,15 +0,0 @@
-/**
- * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
- *
- * The explicit accumulate-then-batch shape: each loop iteration prepares and
- * binds a statement (statement construction — no I/O), pushes it to an array,
- * and a single `.batch()` after the loop executes them all. The eager call sits
- * outside the loop, so this is not an N+1.
- */
-interface ScoreRow {
-    id: number;
-    score: number;
-}
-export declare function rescoreMany(db: any, items: ScoreRow[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-02-prepare-bind-accumulate-batch.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E"}