code-auditor-mcp 5.0.2 → 5.3.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "5.0.2",
+      "version": "5.3.3",
       "author": {
         "name": "Ben Hammond"
       },

package/CHANGELOG.md

@@ -2,6 +2,331 @@
 
 All notable changes to the Code Auditor MCP project.
 
+## [5.3.3] — 2026-10-18
+
+### Changed
+
+- **`dry/structural-similarity` now runs unconditionally in every path — the
+  dead `checkStructuralSimilarity` key is gone, not just unread.** The migrated
+  phase rule has ignored the key since the phase migration, but the legacy
+  `UniversalDRYAnalyzer` still read it and defaulted it off, so a config that
+  never mentioned it silently skipped the structural arm on that path. The key
+  (default, interface field, and reader) is deleted entirely, and both paths now
+  run the structural comparison unconditionally — the surviving, correct
+  behaviour. This is a **behaviour change, not a dead-key cleanup**: every user
+  whose config didn't explicitly enable structural similarity now sees
+  `dry/structural-similarity` findings they didn't before. At the default
+  `similarityThreshold: 0.85` that is 416 findings across the seven bench
+  corpora, concentrated in generated/repetitive code rather than hand-written
+  duplication. The threshold is unchanged: dropping it to catch the
+  `mergeClusters`/`splitCluster` near-twin in `endless-guessing` (31 lines each,
+  0.6494 bigram-Jaccard — well under 0.85) would add ~226 findings (a ~54%
+  increase) without meaningfully separating real duplication from template
+  repetition, so 0.85 stays.
+
+## [5.3.2] — 2026-10-18
+
+### Fixed
+
+- **`function-documentation`'s `docsMinLines` floor was removed entirely in
+  5.3.1 instead of scoped.** The floor is restored and applies to non-exported
+  functions only: an exported function with no doc comment is flagged at any
+  length (a one-line exported predicate is still part of the surface callers
+  import), while an unexported helper under the floor is below the bar. This keeps
+  the 5.3.1 intent — short exports like `hasRejectedTerm` are no longer swallowed —
+  without turning internal one-line helpers into documentation findings.
+- **`react` inline-function-prop gated only the `onClick` arm and missed
+  hyphenated custom elements.** The `isIntrinsicElement` discriminant now lives in
+  the shared inline-handler classifier so every `on*` handler prop goes through it,
+  and the tag predicate accepts hyphenated custom-element names (`<my-widget>`) as
+  intrinsic host elements.
+- **`BUILTIN_PATH_PROFILES` was left as an empty list instead of removed.** An
+  empty list invites the neighbouring reading "there are built-ins, there just
+  happen to be zero today"; the built-in merge and name-replacement machinery is
+  now deleted entirely, and the project-config path-profile mechanism is unchanged.
+- **`dry/structural-similarity` lacked an end-to-end pin.** Added an e2e check that
+  two functions sharing the same five-step transactional body report a
+  structural-similarity finding. The rule seeds unconditionally — `checkStructuralSimilarity`
+  defaults to `false` but is no longer read by the migrated rule, so the zero a
+  bare-config run produces comes from `minLineThreshold` / `similarityThreshold`,
+  not a default-off switch.
+- **The cache GC deleted directories silently.** The prune of superseded CLI copies
+  and abandoned project indexes ran fire-and-forget with its result discarded, so a
+  user whose index vanished could not see that the tool collected it. The audit
+  output now reports what the GC collected on that run.
+
+## [5.3.1] — 2026-10-17
+
+### Fixed
+
+- **`react` inline-function-prop fired on intrinsic DOM elements.** The rule
+  reports an inline `onClick={() => …}` only because a fresh reference each render
+  defeats a *memoized* component's memoization. An intrinsic element (`<button>`,
+  `<div>`) is never memoized, so the old check — which fired on any inline prop
+  regardless of receiver — was 12/12 false on the fixture. It now keys on the
+  receiver's tag name and skips intrinsic elements.
+- **`duplicate-import` flagged a type-only import as a duplicate of a value
+  import.** `import type { X } from 'm'` beside `import { Y } from 'm'` is a
+  separate declaration kind (erases at compile time, emits no runtime binding), so
+  the two never collide. The import fact now carries `isTypeOnly`, and the rule
+  groups on `source` + import kind instead of `source` alone.
+- **`sql-injection-risk` missed two declaration shapes.** A `for (const t of
+  ['a', 'b'])` inline-literal iterable is now resolved as a static value (every
+  loop value is a compile-time constant), and a bare `if (!/regex/.test(x)) throw`
+  whitelist guard is now recognised as the inline analogue of a `validateX(x)`
+  guard call — both previously left a substitution reading as attacker-controlled.
+- **`duplicate-string-literal` flagged repeated markup attribute values.** An
+  SVG/JSX attribute value (`fill="var(--fleece)"`) is markup, not a factorable
+  code literal; the producer now marks it `isMarkupAttribute` from the node's
+  `jsx_attribute` parent, and the rule skips it.
+- **`conventions/error-handling` reported an opaque confidence percentage.** The
+  message named `N%` without naming the population the percentage was over. It now
+  states the raw counts (`X of Y error-handling functions in this directory`), so
+  the reader can size the population instead of an unreproducible figure.
+- **A compiled-in "scripts-and-tests" profile silently excluded scripts, tests,
+  and fixtures from the blocking gate.** That is a hand-maintained exemption list
+  baked into the binary — the same defect as a suppression file, just shipped.
+  `BUILTIN_PATH_PROFILES` is now empty; scripts/tests/fixtures gate like any other
+  file unless a team declares an explicit opt-out in its own `.codeauditor.json`.
+- **`dry/structural-similarity` pairs were only seeded behind
+  `checkStructuralSimilarity`.** §10 made config *tune* similarity, never *select*
+  which pairs the divergence tracker sees, so the migrated rule runs unconditionally
+  but the seed still gated — leaving `dry/diverging-clone` with no sub-1.0 rows to
+  observe a decline from. Structural pairs now seed unconditionally.
+- **`function-documentation` skipped short exported functions via a
+  `docsMinLines` size floor.** The floor answered "is this function long enough to
+  matter?" instead of the rule's own "is this function undocumented?", swallowing
+  short-but-real exports like `hasRejectedTerm`. The size gate is removed (it
+  survives only in the param/return *tag* completeness check).
+- **The `schema` unproven-site total surfaced nowhere as per-rule risk.** 465 raw
+  `cannot-fire` sites reported as a single analyzer total, hiding which rule may
+  have under-reported. Each site now carries its `affectedRules` and `cause`, and
+  `summary.unprovenSitesByRule` plus a CLI breakdown surface them per rule.
+- **The tool's own cache grew without bound.** Superseded pinned-CLI copies
+  (`cli/<version>`) and abandoned project indexes (`projects/<hash>`) accumulated
+  under the fallback OS cache with no reaping. A two-layer GC now prunes pinned-CLI
+  copies whose version differs from the running one and project indexes older than
+  30 days — process-scoped, fire-and-forget, and never touching a user
+  `CODE_AUDITOR_DATA_DIR` or the consuming repo.
+
+## [5.3.0] — 2026-10-17
+
+### Changed
+
+- **`verify:gate-budget` now asserts deterministic work, not CPU time.** The
+  blocking gate's budget was a CPU-time figure that jittered with machine load
+  under `verify:close`'s own sustained load. It now asserts a receiver-resolution
+  count, single-sourced in `src/config/defaults.ts` and read by both the CLI and the
+  verifier, so they can never drift. The wall/CPU-time measurement moved to
+  `bench/gate-timing.mjs` as a measurement (always exits 0), not a gate.
+- **The CLI's displayed budget reads the single source.** The `cli.ts` display
+  literal now reads `gateBudgetResolutions()` instead of a hard-coded number.
+- **The gate budget's env knob is single-sourced and liveness-pinned.**
+  `CODE_AUDITOR_GATE_BUDGET_RESOLUTIONS` (with `0` as a valid "always fail"
+  override) is in the env-tunable single-source test and drives the gate-liveness
+  test, so a re-expressed gate that stopped tripping is caught, not silently
+  skipped.
+
+### Fixed
+
+**A clean install of 5.2.0 did not run 5.2.0 — the shipped manifests pinned a
+stale CLI version.** `server.json` (the MCP-server manifest) declared
+`code-auditor-mcp@5.0.2` while `package.json` and the rest of the release were
+5.2.0, so a clean install resolved the 5.0.2 package and the plugin hook's
+`resolve_pinned_bin` installed exactly that stale version. The three shipped JSON
+manifests that carry the CLI version as published data — `plugin/.claude-plugin/plugin.json`
+(the plugin manifest `hook-common.sh`'s `plugin_version()` reads),
+`server.json` (the MCP-server manifest), and `.claude-plugin/marketplace.json`
+(the marketplace listing) — now derive their `version` from `package.json` at
+build time via `scripts/write-manifest-version.mjs` (run as
+`build:manifest-version`), the same generated-file pattern as
+`src/version.generated.ts`. `verify:version-fresh` now asserts every one of them
+equals `package.json`, so a release that forgets to re-stamp the manifests fails
+the gate instead of shipping a stale pin.
+
+## [5.2.0] — 2026-10-15
+
+### Action may be required
+
+Four changes may require action from consumers of 5.0.x. The most prominent is
+the stricter config loading below; the remaining three are narrow.
+
+**Config files that loaded before now throw on unrecognized keys at any depth.**
+`sanitizeProjectFileConfig` throws on an unknown top-level key, naming the key
+and its live replacement where one exists (`analyzerConfig` → `analyzerConfigs`);
+`validateAnalyzerConfigs` descends every `analyzerConfigs` key against the
+runtime defaults and rejects a key absent at its path by full dotted location,
+naming its live equivalent (`solid.classMethodThreshold` →
+`solid.classMethodsThreshold`, `solid.interfaceMemberThreshold` →
+`solid.maxInterfaceMembers`, `data-access.performanceThresholds.maxJoins` →
+`data-access.performanceThresholds.joinedTableCount`), and a phantom namespace
+(`component`, `security`) is rejected outright. *What a consumer must do:* a
+`.codeauditor.json` that silently loaded under 5.0.x may now fail the audit —
+rename or remove each key the error names, using the replacement it suggests.
+
+**`getAvailableAnalyzers()` is removed from the public API.** The function, its
+default-export entry, and its test pin are deleted (`src/index.ts`). Analyzer
+selection no longer asks which analyzers exist; the analyzer list is derived
+from the runtime config namespaces, and the MCP `config.get` / `config.set` /
+`config.reset` tools validate `analyzerName` against that set (a phantom
+namespace is rejected, not persisted). *What a consumer must do:* drop the
+import and any call — there is no replacement export.
+
+**Around twenty-five config keys are removed — every key declared in a type and
+given a default but never read at runtime.** A user who set one previously got
+silence; it is gone. Removed with no replacement: the top-level `outputFormats`,
+`failOnCritical`, `showProgress`, `parallel`; the severity-gate thresholds
+`maxSevere`, `maxCritical`, `maxHigh`, `maxWarnings`, `maxDuplication` (with
+`maxComplexity` moving to `analyzerConfigs.solid.maxMethodComplexity`, and
+`minHealthScore` surviving); SOLID `maxImportsPerFile`, `maxComplexity`,
+`maxClassComplexity`; DRY `divergence.minPairSimilarity`; data-access
+`databasePatterns`, `performanceThresholds.{maxJoins, warnOnSelectStar,
+complexQueryCount, unfilteredQueryCount}`, `checkOrgFilters`,
+`tablePatterns.queryBuilder`, `securityPatterns.sqlInjectionRisks`; schema
+`detectUnusedTables`, `allowAdditionalProperties` (with `validatorPackageList`
+moving to `analyzerConfigs.crossDomain.validatorBypass.validatorPackageList`);
+react `detectFunctionalComponents`, `detectClassComponents`,
+`detectMemoComponents`, `preventDirectDOMAccess`. The env tunable
+`CODE_AUDIT_RULE_TIMING` is renamed `CODE_AUDITOR_RULE_TIMING` (no alias), and
+the `loadFromEnvironment` / `environmentPrefix` mapping mechanism is deleted.
+*What a consumer must do:* remove any of these keys from `.codeauditor.json` and
+rename the env var — combined with the strict-throw change, a leftover key now
+names itself at load instead of being silently ignored.
+
+**The colour metric moved to CIEDE2000 (ΔE00), changing which findings a user
+sees.** `styles/value-drift` now clusters with `ciede2000` (ΔE00) instead of
+ΔE76, and the `styles.colorDeltaE` threshold re-derives from 2.5 to 1.0 (the
+CIEDE2000 just-noticeable difference, Sharma–Wu–Dalal 2005); the ΔE76 value does
+not transfer. Value-drift findings move 3 → 1 (recall-protocol only). *What a
+consumer must do:* if you tuned `styles.colorDeltaE` or relied on value-drift
+findings, re-derive against ΔE00 — a threshold chosen for ΔE76 means something
+different now, and near-identical pairs that fired at ΔE76 may clear (or the
+reverse).
+
+### The code-index database now keys on project identity, not the working directory
+
+The index database path was derived from `process.cwd()`, so a single project
+audited from two different directories (a repo root and a nested folder, or a
+symlinked path and its real path) produced two separate databases, and each new
+invocation directory created yet another. The path now derives from the project's
+own identity — its git root, `package.json`, or `go.mod` directory — so every
+invocation inside one project lands on the same database.
+
+**Earlier 5.0.x versions keyed on the working directory, and those databases are
+still on disk under your OS cache directory.** Upgrading stops the growth but does
+not remove what accumulated. They are a cache, never source data, so any stale
+per-directory databases can be deleted safely. The directory is:
+
+- macOS: `~/Library/Caches/code-auditor/projects/<hash>/index.db`
+- Linux: `$XDG_CACHE_HOME/code-auditor/projects/<hash>/index.db` (or `~/.cache/code-auditor/...`)
+- Windows: `%LOCALAPPDATA%\code-auditor\Cache\projects\<hash>\index.db`
+
+(`<hash>` is the first 16 hex characters of `sha256` of the real project root;
+the stale 5.0.x entries use the same directory but hashed the working directory.)
+
+### `changed` reports an uncomputable diff instead of a false clean
+
+`code-audit changed` against an index with no baseline — an empty `functions`
+table, whether the index was never built or was discarded after corruption —
+used to diff against nothing and report "nothing changed" (zero findings). The
+empty diff and the no-baseline case are now distinguished at the source:
+`detectModifiedFiles` returns `undefined` for "no baseline" and `[]` only for
+"baseline present, nothing modified". A `changed` run in that state now reports
+that it cannot determine what changed and names why (no index yet, or the index
+was discarded), rather than a clean result. The corrupt-recovery path also now
+logs one line stating the database was corrupt and rebuilt.
+
+### `hardcoded-secret` reports on evidence, not suppression
+
+The hardcoded-secret rule carried a set of suppression filters — a minimum value
+length, a placeholder-word list, email/URL/camelCase shape tests, and a
+test/fixture file skip — each of which made a finding vanish without establishing
+anything about the site. A real credential in a test file, or a short token, or
+an email-shaped secret was silently passed. Those filters are removed: a
+candidate is now a secret on positive evidence only (a known token prefix, or
+character entropy — a digit, an uppercase letter, or a hard symbol). The result
+is more `hardcoded-secret` findings in exactly the places the old filters hid
+them (predominantly test/fixture files and short placeholder-adjacent values).
+
+### Verification fails closed instead of reporting green
+
+Three corpus-comparison gates returned exit 0 having measured nothing when their
+corpus directory was absent — a green result from a check that did not run. They
+now fail closed (exit 2, naming the missing corpus), and four history-asserting
+comparisons (a stored expected count, a stored pair list, a stored gap count, a
+stored case list) are retired in favour of tests that assert the detectors
+reject the pinned corpus sites directly. A check that was not run is reported as
+not run.
+
+### The hook log gets a reader
+
+The PostToolUse and SessionStart hooks have written status records to `hook.log`
+since 5.0.1, but nothing read them — a hook that stopped enqueueing (e.g.
+`CLAUDE_PLUGIN_ROOT` unset) was invisible to the explicit audit, the exact
+silent-disable the 4.1.0 guard was removed to escape. A write-only log is the
+same silent disable with extra steps.
+
+Both the CLI `audit` command and the MCP `audit.run` tool now read that log and,
+when a hook-not-running condition is live, report a top-level notice that the
+hook is not enqueueing and cached findings may be stale. The notice appears when
+the newest `HOOK NOT RUNNING` record is newer than the newest `HOOK RAN` record
+(or no `HOOK RAN` record exists), and it clears when a `HOOK RAN` record is
+written at least as new as the condition — every hook script writes `HOOK RAN` on
+a completed run (hook-audit.sh and hook-self-audit.sh on exit 0 or 2;
+hook-warm.sh and hook-drift-check.sh on every path, since they never exit
+non-zero), so a recovered hook resolves its own condition. The read is fail-open —
+an absent, unreadable, or malformed log yields no notice and never changes the
+audit exit code.
+
+### Keyframe percentages no longer pollute the defined-class catalog
+
+Every writer of the defined-class catalog scraped class names from a
+declaration's selector context with `/\.([a-zA-Z0-9_-]+)/g`, which admitted a
+keyframe percentage (`15.8%` → `8`) or a decimal attribute selector
+(`[data-ratio="1.5"]` → `5`) as a class name — a class name can never start with
+a digit. The catalog now derives from one shared harvest: CSS/SCSS use the
+parser's class-selector walk, markup parses each embedded `<style>` block body
+with the CSS parser (`harvestMarkupStyleClasses`), and TS/JS source parses each
+CSS-in-JS template body with the same parser (`harvestCssInJsStyleClasses`).
+Keyframes are excluded parser-structurally on all three paths — the parser's
+`class_name`-under-`class_selector` walk never sees a keyframe's `from`/`to`/
+percentage selectors. `isKeyframeVariant` survives only on the migration
+backfill, which replays legacy `style_declarations` rows. The retired regex no
+longer appears anywhere in `src/`. On recall-protocol this drops catalog
+pollution from 2 (`5`/`8`) to 0 with `styles/undefined-class` unchanged.
+
+### Anonymous telemetry opt-in is offered exactly once
+
+The opt-in for anonymous dismissal feedback now records *whether a decision has
+been made*, separately from what that decision is. `telemetry status` (and the
+mirroring MCP tool) returns a new `decided` flag — false only until the user has
+run `telemetry enable` or `telemetry disable`. The installer prints a one-line
+nudge after a real install when `decided` is false, and the `code-auditor` SKILL
+instructs the agent to surface the privacy facts and ask once, then run
+`enable`/`disable` to record the choice. A user who has already decided is never
+asked again.
+
+### `code-audit request-rule` and the rule-request intake
+
+New `request-rule` command submits a rule request (title, symptom, signal, plus a
+firing and clean example) to the feedback service's bearer-guarded `/rule-requests`
+endpoint, for defects no existing rule flags. The service dedupes by content hash,
+caps the body size, and rate-limits per IP and globally.
+
+### Bundled natives and the Go subprocess are gone from the package
+
+The package no longer ships a bundled native binding. `@ast-grep/napi` loads its
+binding from the seven per-platform `@ast-grep/napi-*@0.44.1` packages in
+`optionalDependencies` — the same packages its `requireNative()` already
+resolved — and they are now the only copy. There is no download step, no
+`native-bootstrap`, and no bundled `.node` binary in `dist/`.
+
+The dead Go subprocess path is also removed: the shipped Go binaries, `main.go`,
+`go.mod`, and the `analyzer-src/` source (deleted in Spec 68 §11) are gone from
+the package. Go analysis is unchanged — it runs through the TypeScript
+`GoAdapter` — and compiled tests are excluded from `dist` so no `src/__tests__`
+artifacts ship.
+
 ## [5.0.2]
 
 ### The plugin hooks self-locate — no `CLAUDE_PLUGIN_ROOT` env dependency
@@ -55,7 +380,7 @@ info, warnings, and failures alike — to `hook.log` and never exits non-zero
 except to surface a gating finding (exit 2). The bootstrap guard for an unset
 `CLAUDE_PLUGIN_ROOT` no longer prints to stderr and exits 1; it is a silent
 no-op (exit 0) like the SessionStart warm hook. A broken install therefore
-surfaces on the next explicit audit (and in the log), never on the edit.
+surfaces in the log, never on the edit.
 
 Resolution also stopped paying a full `--version` round-trip per candidate on
 the per-edit hot path: the pinned install is version-guaranteed by its path and
@@ -314,8 +639,6 @@ but the fix is input normalization, not a regex fallback:
 lossless for fact extraction, and it never re-introduces the hand-rolled parser
 this release removed.
 
-## [Unreleased]
-
 ### Any repo with a Go file silently dropped eleven analyzers
 
 **v2.6.1 through v4.1.1 routed the *whole* repo through the polyglot

package/README.md

@@ -37,6 +37,26 @@ The hook auto-installs the auditor on first use via npx.
   `npm install-scripts approve better-sqlite3 && npm rebuild better-sqlite3`
   (with pnpm: `pnpm approve-builds`, then select `better-sqlite3`).
 
+## Configuration
+
+Project-level settings live in `.codeauditor.json` (invariant rules, analyzer settings, and thresholds). Eleven environment variables additionally tune process-scoped behavior — worker pool size, daemon and job-queue timeouts, the index location, the SQLite backend, and the UI port.
+
+| Variable | Purpose | Accepted values | Default |
+|----------|---------|-----------------|---------|
+| `CODE_AUDITOR_WORKERS` | Phase-model worker pool size for per-file fan-out. `1` forces the serial path for byte-identical reports. | Positive integer | `max(1, cpus − 1)` |
+| `CODE_AUDITOR_RULE_TIMING` | Per-rule wall-time accounting (one accumulated timer per rule ID, surfaced in the report). | `1` enables; unset disables | Off |
+| `CODE_AUDITOR_DAEMON_IDLE_MS` | Idle timeout before the daemon shuts down. | Positive finite ms; invalid → default | `300000` (5 min) |
+| `CODE_AUDITOR_DAEMON_LEASE_TTL_MS` | Daemon heartbeat lease TTL. | Finite ms; blank/`0` → default | `60000` (60 s) |
+| `CODE_AUDITOR_DATA_DIR` | Overrides the code-index database directory. | Directory path (trimmed; blank → default) | user-level OS cache |
+| `CODE_AUDITOR_EXIT_ON_FATAL` | Exit the MCP server on an uncaught exception / unhandled rejection. | `1` or `true` | Off |
+| `CODE_AUDITOR_JOB_TIMEOUT_MS` | Per-job timeout for queued audits. | Finite ms, clamped to `60s`–`4h`; below the floor → default | `1800000` (30 min) |
+| `CODE_AUDITOR_JOB_LEASE_TTL_MS` | Heartbeat lease TTL for reclaiming stale `running` job rows. | Strictly positive finite ms; invalid → default | `30000` (30 s) |
+| `CODE_AUDITOR_MAX_RUNNING_JOBS` | Max concurrently running queued audit jobs. | Integer ≥ 1; invalid → default | `1` |
+| `CODE_AUDITOR_SQLITE_BACKEND` | Forces a SQLite backend. An invalid value is reported as invalid and rejected — never silently probed past. | `node-sqlite` \| `better-sqlite3` | Auto (probe) |
+| `MCP_UI_PORT` | HTTP UI server port (`--ui`). | Port number; invalid → default | `3001` |
+
+When `CODE_AUDITOR_DATA_DIR` is set, the index is scoped per project (`<dir>/projects/<sha256(root)[:16]>/index.db`) so projects can't leak data into each other. When unset, the index lives in a user-level OS cache (`<os_cache>/code-auditor/projects/<hash>/index.db`) so it never lands inside the audited repo.
+
 ## Prompt examples
 
 **"Index the codebase and run a full audit, then walk the violations file-by-file with `code-audit next-file`."**
@@ -81,6 +101,8 @@ One skill, one CLI, one MCP server. Every agent gets the same audit engine — t
 | Other SKILL.md tools | `code-audit install --agent agents` | No | Yes | 2026-07-19 |
 | ZCode | `code-audit install --agent zcode` | No (plugin-scoped) | Yes | 2026-09-10 |
 
+**MCP config generation covers a wider set than skill install.** The MCP server's `generate` tool writes a client config file for any of `claude`, `codex`, `cursor`, `gemini`, `copilot`, `continue`, `awsq` (AWS Q Developer), `codeium` (Codeium/Windsurf), `vscode`, `cline`, and `zcode`. Four of those — **Continue**, **AWS Q Developer**, **Codeium/Windsurf**, and **Cline** — are MCP-only: they have no file-based skill or hook path, so they connect through the `generate` tool rather than `code-audit install`.
+
 Hook behavior: **Blocking** means the diff-scoped `changed` gate is tripped — an invariant rule that declares `gating: true` (a binary, per-rule flag, independent of severity) blocks the edit from landing (the agent sees the violation and fixes inline). **Advisory** means violations are reported through the strongest available feedback channel but the edit has already occurred. Cursor's `afterFileEdit` hook is fire-and-forget with no output consumption. MCP is available everywhere for shell-less use.
 
 ## Findings: Deterministic vs Advisory
@@ -144,9 +166,9 @@ The `<fingerprint>` comes from the JSON report (every violation carries a `finge
 
 The reason an agent gives for dismissing a finding is the most useful signal for improving the rules. Code Auditor can send dismissed findings to an anonymous feedback service that collects them.
 
-It is **off by default** and turned on only by an explicit opt-in — the `telemetry` MCP tool (`status` / `enable` / `disable`), which records the choice in your user config dir. `enable` needs no arguments: it opts in against the built-in service endpoint (overridable for self-hosting). Opting in generates an **anonymous install ID**: a random value generated locally, never derived from your machine, user, or project, used only to group submissions by source.
+It is **off by default** and turned on only by an explicit opt-in — `code-audit telemetry status|enable|disable` (or the `telemetry` MCP tool), which records the choice in your user config dir. `enable` needs no arguments: it opts in against the built-in service endpoint (overridable for self-hosting). Opting in generates an **anonymous install ID**: a random value generated locally, never derived from your machine, user, or project, used only to group submissions by source.
 
-**What is sent** — the reason (verbatim) plus a structural AST signature (grammar kinds only, built from a node's `type` — never its text) and a coarse language hint. **What is never sent** — source code, identifiers, literals, file paths, or anything derived from your code or environment. Sending is best-effort: offline or an unreachable endpoint is silent and never blocks an edit or fails a gate.
+**What is sent** — the tool version, the rule ID, the urgency level, the dismissal reason exactly as typed, a structural AST signature (grammar kinds only, never their contents), a coarse language hint, a timestamp, and the anonymous install ID. **What is never sent** — source code, identifiers, literals, file paths, or anything derived from your code or environment. Sending is best-effort: offline or an unreachable endpoint is silent and never blocks an edit or fails a gate.
 
 ## Style Intelligence
 

package/configs/hhra-compat.json

@@ -1,13 +1,10 @@
 {
-  "projectRoot": "../..",
-  "reportTitle": "HHRA Architecture & Code Quality Audit",
-  
   "includePaths": [
     "app/**/*.{ts,tsx}",
     "src/**/*.{ts,tsx}",
     "scripts/**/*.ts"
   ],
-  
+
   "excludePaths": [
     "**/node_modules/**",
     "**/.next/**",
@@ -22,73 +19,19 @@
     "**/public/**",
     "code-auditor/**"
   ],
-  
-  "analyzerConfig": {
-    "security": {
-      "authPatterns": [
-        "withAuth",
-        "withAdminAuth",
-        "requireAuth",
-        "SessionAuth",
-        "useSession"
-      ],
-      "adminPatterns": [
-        "withAdminAuth",
-        "requireAdmin",
-        "adminOnly"
-      ],
-      "rateLimitPatterns": [
-        "rateLimit",
-        "withRateLimit",
-        "rateLimitGuard"
-      ],
-      "publicPatterns": [
-        "public",
-        "noAuth",
-        "skipAuth"
-      ]
-    },
-    
-    "component": {
-      "frameworkPatterns": {
-        "react": {
-          "components": ["*.tsx", "*.jsx"],
-          "hooks": ["use*"],
-          "context": ["*Context", "*Provider"]
-        }
-      },
-      "checkErrorBoundaries": true,
-      "checkPropTypes": false,
-      "maxComplexity": 15,
-      "maxNesting": 4
-    },
-    
-    "data-access": {
-      "databasePatterns": {
-        "postgres": ["app-db", "org-tracker-db", "@neondatabase", "neon"],
-        "drizzle": ["drizzle-orm", "db.query", "db.select", "db.insert", "db.update", "db.delete"]
-      },
-      "ormPatterns": {
-        "drizzle": ["drizzle-orm", "drizzle", "schema"]
-      },
-      "securityPatterns": {
-        "parameterized": ["?", "$1", ":param", "prepared"],
-        "sanitized": ["sanitize", "escape", "clean", "safe"]
-      },
-      "performanceThresholds": {
-        "maxJoins": 5,
-        "warnOnSelectStar": true
-      }
+
+  "analyzerConfigs": {
+    "react": {
+      "maxComponentComplexity": 15
     },
-    
+
     "solid": {
       "maxMethodsPerClass": 10,
       "maxLinesPerMethod": 50,
       "maxParametersPerMethod": 4,
-      "maxImportsPerFile": 20,
-      "maxComplexity": 10
+      "maxMethodComplexity": 10
     },
-    
+
     "dry": {
       "minLineThreshold": 5,
       "similarityThreshold": 0.85,
@@ -102,59 +45,10 @@
       "checkStrings": true
     }
   },
-  
-  "customPatterns": {
-    "components": [
-      "**/app/**/page.{ts,tsx}",
-      "**/app/**/layout.{ts,tsx}",
-      "**/app/**/error.{ts,tsx}",
-      "**/app/**/loading.{ts,tsx}",
-      "**/app/**/not-found.{ts,tsx}",
-      "**/components/**/*.{ts,tsx}",
-      "**/app/components/**/*.{ts,tsx}"
-    ],
-    "endpoints": [
-      "**/app/api/**/route.{ts,tsx}",
-      "**/pages/api/**/*.{ts,tsx}",
-      "**/api/**/*.{ts,tsx}"
-    ],
-    "tests": [
-      "**/*.test.{ts,tsx}",
-      "**/*.spec.{ts,tsx}",
-      "**/tests/**",
-      "**/e2e/**",
-      "**/__tests__/**"
-    ]
-  },
-  
-  "outputFormats": ["html", "json"],
-  "outputDirectory": "./audit-reports",
-  
+
   "minSeverity": "high",
-  "failOnCritical": false,
-  "verbose": false,
-  "showProgress": true,
-  
+
   "thresholds": {
-    "maxCritical": 0,
-    "maxWarnings": 100,
-    "minHealthScore": 75,
-    "maxComplexity": 10,
-    "maxDuplication": 10
-  },
-  
-  "reportTheme": {
-    "primaryColor": "#0070f3",
-    "criticalColor": "#e00",
-    "warningColor": "#f5a623",
-    "suggestionColor": "#0070f3"
-  },
-  
-  "integrations": {
-    "ci": {
-      "provider": "github",
-      "failOnThreshold": true,
-      "commentOnPR": false
-    }
+    "minHealthScore": 75
   }
-}
+}

package/dist/analyzers/cross-language/DependencyGraphBuilder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DependencyGraphBuilder.d.ts","sourceRoot":"","sources":["../../../src/analyzers/cross-language/DependencyGraphBuilder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACf,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAMD,cAAM,0BAA0B;IAC9B,SAAS,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAM;IAC/C,SAAS,CAAC,UAAU,EAAE,cAAc,EAAE,CAAM;IAC5C,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAE3B,OAAO,GAAE,mBAAwB;IAW7C;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;IAc9F;;OAEG;IACH,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM;IAqBlE;;OAEG;IACH,SAAS,CAAC,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAuB5E;;OAEG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAa5E;;OAEG;IACH,SAAS,CAAC,gCAAgC,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAa/F;;;;;;;;OAQG;IACH,SAAS,CAAC,iBAAiB,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC9B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM;IAwBT;;;;;;;;;OASG;IACH,SAAS,CAAC,gCAAgC,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,MAAM;IA0CpG;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,0BAA0B,CAAC,KAAK,EAAE,eAAe,GAAG,qBAAqB,EAAE;IA+DrF;;;;;;;;;;OAUG;IACH,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,cAAc,EAAE;IAoC5F;;OAEG;IACH,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM;IA6BzF;;OAEG;IACH,SAAS,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM;IAU/D;;OAEG;IACH,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAUhD;AAMD,cAAM,+BAAgC,SAAQ,0BAA0B;IACtE;;OAEG;IACH,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,EAAE;IAoBhF;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,cAAc,EAAE;IAcxE;;OAEG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM;IAO/D;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,eAAe,EAAE;IA8D3F;;OAEG;IACH,SAAS,CAAC,gBAAgB,CACxB,KAAK,EAAE,cAAc,EAAE,EACvB,KAAK,EAAE,cAAc,EAAE,EACvB,MAAM,EAAE,eAAe,EAAE,GACxB,iBAAiB;IAiBpB;;OAEG;IACH,SAAS,CAAC,qBAAqB,CAC7B,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,cAAc,EAAE,EAC5B,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE;IAyBxB;;OAEG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI;CAOhE;AAMD;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,+BAA+B;IACzE;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,cAAc,EAAE,GAC3B,OAAO,CAAC,eAAe,CAAC;IAkC3B;;;;;;;OAOG;IACG,aAAa,CACjB,eAAe,EAAE,MAAM,EAAE,EACzB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,cAAc,EAAE,EAC5B,KAAK,GAAE,MAAU,GAChB,OAAO,CAAC,eAAe,CAAC;IAW3B;;;;OAIG;IACG,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,eAAe,EAAE,CAAC;QAC1B,WAAW,EAAE,oBAAoB,EAAE,CAAC;KACrC,CAAC;IAiBF,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAcxB,sFAAsF;IACtF,OAAO,CAAC,kBAAkB;IAe1B;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IA+B7B,sCAAsC;IACtC,OAAO,CAAC,iBAAiB;IAczB,8DAA8D;IAC9D,OAAO,CAAC,WAAW;CAkBpB;AAsCD,gFAAgF;AAChF,UAAU,cAAc;IACtB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACvC;AAED,0GAA0G;AAC1G,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAClE,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAClC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5D,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"DependencyGraphBuilder.d.ts","sourceRoot":"","sources":["../../../src/analyzers/cross-language/DependencyGraphBuilder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACf,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAMD,cAAM,0BAA0B;IAC9B,SAAS,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAM;IAC/C,SAAS,CAAC,UAAU,EAAE,cAAc,EAAE,CAAM;IAC5C,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAE3B,OAAO,GAAE,mBAAwB;IAW7C;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;IAc9F;;OAEG;IACH,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM;IAqBlE;;OAEG;IACH,SAAS,CAAC,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAuB5E;;OAEG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAa5E;;OAEG;IACH,SAAS,CAAC,gCAAgC,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAa/F;;;;;;;;OAQG;IACH,SAAS,CAAC,iBAAiB,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC9B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM;IAwBT;;;;;;;;;OASG;IACH,SAAS,CAAC,gCAAgC,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,MAAM;IA0CpG;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,0BAA0B,CAAC,KAAK,EAAE,eAAe,GAAG,qBAAqB,EAAE;IA+DrF;;;;;;;;;;OAUG;IACH,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,cAAc,EAAE;IA4C5F;;OAEG;IACH,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM;IA6BzF;;OAEG;IACH,SAAS,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM;IAU/D;;OAEG;IACH,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAUhD;AAMD,cAAM,+BAAgC,SAAQ,0BAA0B;IACtE;;OAEG;IACH,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,EAAE;IAoBhF;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,cAAc,EAAE;IAexE;;OAEG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM;IAO/D;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,eAAe,EAAE;IA8D3F;;OAEG;IACH,SAAS,CAAC,gBAAgB,CACxB,KAAK,EAAE,cAAc,EAAE,EACvB,KAAK,EAAE,cAAc,EAAE,EACvB,MAAM,EAAE,eAAe,EAAE,GACxB,iBAAiB;IAiBpB;;OAEG;IACH,SAAS,CAAC,qBAAqB,CAC7B,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,cAAc,EAAE,EAC5B,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE;IAyBxB;;OAEG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI;CAOhE;AAMD;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,+BAA+B;IACzE;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,cAAc,EAAE,GAC3B,OAAO,CAAC,eAAe,CAAC;IAkC3B;;;;;;;OAOG;IACG,aAAa,CACjB,eAAe,EAAE,MAAM,EAAE,EACzB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,cAAc,EAAE,EAC5B,KAAK,GAAE,MAAU,GAChB,OAAO,CAAC,eAAe,CAAC;IAW3B;;;;OAIG;IACG,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,eAAe,EAAE,CAAC;QAC1B,WAAW,EAAE,oBAAoB,EAAE,CAAC;KACrC,CAAC;IAiBF,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAcxB,sFAAsF;IACtF,OAAO,CAAC,kBAAkB;IAe1B;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IA+B7B,sCAAsC;IACtC,OAAO,CAAC,iBAAiB;IAczB,8DAA8D;IAC9D,OAAO,CAAC,WAAW;CAkBpB;AAsCD,gFAAgF;AAChF,UAAU,cAAc;IACtB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACvC;AAED,0GAA0G;AAC1G,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAClE,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAClC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5D,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}

package/dist/analyzers/cross-language/DependencyGraphBuilder.js

@@ -318,6 +318,15 @@ class DependencyGraphBuilderCore {
             // treating it as such produced 857 false orphans on knex alone (97% of 885).
             if (node.isMethod || node.name.includes('.'))
                 return false;
+            // A nested function (a closure) is lexically scoped inside its enclosing
+            // function, not a module top-level symbol. Its liveness is a lexical-scope
+            // question the flat name-based call graph cannot answer — a closure is
+            // reached through forms the graph does not model (`return closure`, passing
+            // it as a value, `closure.call`/`.apply`, …) — so "no edges" is not
+            // evidence of dead code. "Defined and used inside its enclosing function"
+            // must never read as "orphaned".
+            if (node.isNested)
+                return false;
             if (connectedNodes.has(node.id))
                 return false;
             if (node.exported)
@@ -414,7 +423,8 @@ class DependencyGraphBuilderTraversal extends DependencyGraphBuilderCore {
             weight: this.calculateNodeWeight(entity),
             cluster: this.determineCluster(entity),
             exported: entity.visibility === 'public' || entity.metadata?.isExported === true,
-            isMethod: entity.metadata?.isMethod === true
+            isMethod: entity.metadata?.isMethod === true,
+            isNested: entity.metadata?.isNested === true
         }));
     }
     /**