@planu/cli 0.90.2 → 0.92.0

package/dist/engine/claude-config-auditor/claudemd-auditor.js

@@ -1,11 +1,16 @@
-// Planu — CLAUDE.md auditor for SPEC-092
-import { readFile } from 'node:fs/promises';
+// Planu — CLAUDE.md auditor for SPEC-092 / SPEC-255
+import { readFile, access } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 const DOCS_REF = 'https://code.claude.com/docs/en/memory';
 const MAX_LINES = 200;
 const CRITICAL_LINES = 400;
 const SECTION_THRESHOLD = 20;
+// SPEC-255: tighter thresholds
+const V2_WARN_LINES = 150;
+const V2_CRITICAL_LINES = 250;
+const REDUNDANT_PATTERN = /\b(write clean|be helpful|use best practices|make sure to|always be|follow good|ensure good)\b/i;
+const ACTIONABLE_VERBS = /\b(run|use|avoid|never|always|add|remove|prefer|require|must|do not|don't|check|enforce|ensure|execute|install|create|delete|update)\b/i;
 async function readFileLines(filePath) {
     try {
         const content = await readFile(filePath, 'utf-8');
@@ -15,28 +20,99 @@ async function readFileLines(filePath) {
         return null;
     }
 }
-function auditSingleClaudeMd(lines, label) {
-    const findings = [];
-    const lineCount = lines.length;
+async function pathExists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function auditLineCount(lineCount, label) {
+    if (lineCount > V2_CRITICAL_LINES) {
+        return {
+            area: 'CLAUDE.md',
+            severity: 'critical',
+            code: 'LINE_COUNT_CRITICAL',
+            message: `${label} has ${String(lineCount)} lines (limit: ${String(V2_CRITICAL_LINES)})`,
+            suggestion: 'Split into .claude/rules/ files with paths: frontmatter for scoped loading',
+            docsRef: DOCS_REF,
+        };
+    }
+    if (lineCount > V2_WARN_LINES) {
+        return {
+            area: 'CLAUDE.md',
+            severity: 'warn',
+            code: 'LINE_COUNT_WARN',
+            message: `${label} has ${String(lineCount)} lines (recommended: <${String(V2_WARN_LINES)})`,
+            suggestion: 'Move detailed sections to .claude/rules/ files to reduce context overhead',
+            docsRef: DOCS_REF,
+        };
+    }
+    /* v8 ignore start -- superseded by V2_CRITICAL_LINES check above */
     if (lineCount > CRITICAL_LINES) {
-        findings.push({
+        return {
             area: 'CLAUDE.md',
             severity: 'critical',
             message: `${label} has ${String(lineCount)} lines (limit: ${String(CRITICAL_LINES)})`,
             suggestion: 'Split into .claude/rules/ files with paths: frontmatter for scoped loading',
             docsRef: DOCS_REF,
-        });
+        };
     }
-    else if (lineCount > MAX_LINES) {
-        findings.push({
+    /* v8 ignore stop */
+    /* v8 ignore start -- superseded by V2_WARN_LINES check above */
+    if (lineCount > MAX_LINES) {
+        return {
             area: 'CLAUDE.md',
             severity: 'warn',
             message: `${label} has ${String(lineCount)} lines (recommended: <${String(MAX_LINES)})`,
             suggestion: 'Move detailed sections to .claude/rules/ files to reduce context overhead',
             docsRef: DOCS_REF,
-        });
+        };
     }
-    // Detect large sections that could be extracted to rules
+    /* v8 ignore stop */
+    return null;
+}
+function auditInstructionQuality(lines) {
+    const findings = [];
+    for (const line of lines) {
+        if (REDUNDANT_PATTERN.test(line)) {
+            findings.push({
+                area: 'CLAUDE.md',
+                severity: 'info',
+                code: 'REDUNDANT_INSTRUCTION',
+                message: `Redundant instruction detected: "${line.trim().slice(0, 80)}"`,
+                suggestion: 'Replace generic phrases with concrete, measurable instructions (e.g., "run pnpm lint" instead of "write clean code")',
+                docsRef: DOCS_REF,
+            });
+        }
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = (lines[i] ?? '').trim();
+        if (trimmed === '' ||
+            trimmed.startsWith('#') ||
+            trimmed.startsWith('```') ||
+            trimmed.startsWith('-') ||
+            trimmed.startsWith('*') ||
+            trimmed.startsWith('|')) {
+            continue;
+        }
+        if (trimmed.split(/\s+/).length > 10 && !ACTIONABLE_VERBS.test(trimmed)) {
+            findings.push({
+                area: 'CLAUDE.md',
+                severity: 'info',
+                code: 'AMBIGUOUS_INSTRUCTION',
+                message: `Ambiguous instruction on line ${String(i + 1)}: "${trimmed.slice(0, 80)}"`,
+                suggestion: 'Rewrite with a concrete action verb: run, use, avoid, never, always, add, remove, prefer, require',
+                docsRef: DOCS_REF,
+            });
+        }
+    }
+    return findings;
+}
+function auditSections(lines) {
+    const findings = [];
     let currentSectionStart = -1;
     let currentSectionLines = 0;
     for (let i = 0; i < lines.length; i++) {
@@ -59,7 +135,6 @@ function auditSingleClaudeMd(lines, label) {
             currentSectionLines++;
         }
     }
-    // Check last section
     if (currentSectionLines > SECTION_THRESHOLD && currentSectionStart >= 0) {
         const sectionName = lines[currentSectionStart]?.replace('## ', '') ?? 'unknown';
         findings.push({
@@ -72,9 +147,16 @@ function auditSingleClaudeMd(lines, label) {
     }
     return findings;
 }
-export async function auditClaudeMd(projectPath, includeGlobal) {
+function auditSingleClaudeMd(lines, label) {
+    const lineCountFinding = auditLineCount(lines.length, label);
+    return [
+        ...(lineCountFinding ? [lineCountFinding] : []),
+        ...auditInstructionQuality(lines),
+        ...auditSections(lines),
+    ];
+}
+async function auditProjectClaudeMds(projectPath) {
     const findings = [];
-    // Check project-level CLAUDE.md locations
     const projectPaths = [join(projectPath, 'CLAUDE.md'), join(projectPath, '.claude', 'CLAUDE.md')];
     let foundProject = false;
     for (const p of projectPaths) {
@@ -82,6 +164,15 @@ export async function auditClaudeMd(projectPath, includeGlobal) {
         if (lines) {
             foundProject = true;
             findings.push(...auditSingleClaudeMd(lines, `Project CLAUDE.md (${p})`));
+            if (!lines.some((l) => l.startsWith('@'))) {
+                findings.push({
+                    area: 'CLAUDE.md',
+                    severity: 'info',
+                    message: 'CLAUDE.md does not use @path imports (e.g. @README.md, @package.json)',
+                    suggestion: 'Use @path syntax to import key files so Claude always has fresh context',
+                    docsRef: DOCS_REF,
+                });
+            }
         }
     }
     if (!foundProject) {
@@ -93,9 +184,7 @@ export async function auditClaudeMd(projectPath, includeGlobal) {
             docsRef: DOCS_REF,
         });
     }
-    // Check for CLAUDE.local.md
-    const localMdLines = await readFileLines(join(projectPath, 'CLAUDE.local.md'));
-    if (!localMdLines) {
+    if (!(await readFileLines(join(projectPath, 'CLAUDE.local.md')))) {
         findings.push({
             area: 'CLAUDE.md',
             severity: 'info',
@@ -104,26 +193,45 @@ export async function auditClaudeMd(projectPath, includeGlobal) {
             docsRef: DOCS_REF,
         });
     }
-    // Check for @import syntax
+    return findings;
+}
+async function auditAgentsMdImport(projectPath) {
+    const projectPaths = [join(projectPath, 'CLAUDE.md'), join(projectPath, '.claude', 'CLAUDE.md')];
+    const agentsMdExists = await pathExists(join(projectPath, 'AGENTS.md'));
+    const cursorRulesExists = await pathExists(join(projectPath, '.cursor', 'rules'));
+    if (!agentsMdExists && !cursorRulesExists) {
+        return [];
+    }
+    const allLines = [];
     for (const p of projectPaths) {
         const lines = await readFileLines(p);
         if (lines) {
-            const hasImports = lines.some((l) => l.startsWith('@'));
-            if (!hasImports) {
-                findings.push({
-                    area: 'CLAUDE.md',
-                    severity: 'info',
-                    message: 'CLAUDE.md does not use @path imports (e.g. @README.md, @package.json)',
-                    suggestion: 'Use @path syntax to import key files so Claude always has fresh context',
-                    docsRef: DOCS_REF,
-                });
-            }
+            allLines.push(...lines);
         }
     }
-    // Global CLAUDE.md
+    if (allLines.some((l) => l.includes('@AGENTS.md'))) {
+        return [];
+    }
+    const detected = agentsMdExists ? 'AGENTS.md' : '.cursor/rules';
+    return [
+        {
+            area: 'CLAUDE.md',
+            severity: 'warn',
+            code: 'AGENTS_MD_NOT_IMPORTED',
+            message: `Project has ${detected} but CLAUDE.md does not import @AGENTS.md`,
+            suggestion: 'Add "@AGENTS.md" to CLAUDE.md so Claude Code loads cross-tool conventions',
+            docsRef: DOCS_REF,
+        },
+    ];
+}
+export async function auditClaudeMd(projectPath, includeGlobal) {
+    const [projectFindings, agentsFindings] = await Promise.all([
+        auditProjectClaudeMds(projectPath),
+        auditAgentsMdImport(projectPath),
+    ]);
+    const findings = [...projectFindings, ...agentsFindings];
     if (includeGlobal) {
-        const globalPath = join(homedir(), '.claude', 'CLAUDE.md');
-        const globalLines = await readFileLines(globalPath);
+        const globalLines = await readFileLines(join(homedir(), '.claude', 'CLAUDE.md'));
         if (globalLines) {
             findings.push(...auditSingleClaudeMd(globalLines, 'Global ~/.claude/CLAUDE.md'));
         }

package/dist/engine/claude-config-auditor/claudemd-auditor.js.map

@@ -1 +1 @@
-{"version":3,"file":"claudemd-auditor.js","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/claudemd-auditor.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,QAAQ,GAAG,wCAAwC,CAAC;AAC1D,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe,EAAE,KAAa;IACzD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAE/B,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,kBAAkB,MAAM,CAAC,cAAc,CAAC,GAAG;YACrF,UAAU,EAAE,4EAA4E;YACxF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,yBAAyB,MAAM,CAAC,SAAS,CAAC,GAAG;YACvF,UAAU,EAAE,2EAA2E;YACvF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,IAAI,mBAAmB,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,mBAAmB,GAAG,iBAAiB,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;gBACxE,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;gBAChF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,YAAY,WAAW,QAAQ,MAAM,CAAC,mBAAmB,CAAC,+BAA+B;oBAClG,UAAU,EAAE,yBAAyB,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK;oBACxF,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,mBAAmB,GAAG,CAAC,CAAC;YACxB,mBAAmB,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IACD,qBAAqB;IACrB,IAAI,mBAAmB,GAAG,iBAAiB,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,YAAY,WAAW,QAAQ,MAAM,CAAC,mBAAmB,CAAC,+BAA+B;YAClG,UAAU,EAAE,yBAAyB,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK;YACxF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,aAAsB;IAEtB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,0CAA0C;IAC1C,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAEjG,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,GAAG,IAAI,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,0DAA0D;YACnE,UAAU,EACR,kFAAkF;YACpF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,sEAAsE;YAC/E,UAAU,EACR,qFAAqF;YACvF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,uEAAuE;oBAChF,UAAU,EAAE,yEAAyE;oBACrF,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"claudemd-auditor.js","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/claudemd-auditor.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,QAAQ,GAAG,wCAAwC,CAAC;AAC1D,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,+BAA+B;AAC/B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,MAAM,iBAAiB,GACrB,iGAAiG,CAAC;AAEpG,MAAM,gBAAgB,GACpB,yIAAyI,CAAC;AAE5I,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,KAAa;IACtD,IAAI,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,kBAAkB,MAAM,CAAC,iBAAiB,CAAC,GAAG;YACxF,UAAU,EAAE,4EAA4E;YACxF,OAAO,EAAE,QAAQ;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,yBAAyB,MAAM,CAAC,aAAa,CAAC,GAAG;YAC3F,UAAU,EAAE,2EAA2E;YACvF,OAAO,EAAE,QAAQ;SAClB,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,kBAAkB,MAAM,CAAC,cAAc,CAAC,GAAG;YACrF,UAAU,EAAE,4EAA4E;YACxF,OAAO,EAAE,QAAQ;SAClB,CAAC;IACJ,CAAC;IACD,oBAAoB;IACpB,gEAAgE;IAChE,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,CAAC,SAAS,CAAC,yBAAyB,MAAM,CAAC,SAAS,CAAC,GAAG;YACvF,UAAU,EAAE,2EAA2E;YACvF,OAAO,EAAE,QAAQ;SAClB,CAAC;IACJ,CAAC;IACD,oBAAoB;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAe;IAC9C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,oCAAoC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;gBACxE,UAAU,EACR,sHAAsH;gBACxH,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IACE,OAAO,KAAK,EAAE;YACd,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YACzB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EACvB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,iCAAiC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;gBACpF,UAAU,EACR,mGAAmG;gBACrG,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,mBAAmB,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,mBAAmB,GAAG,iBAAiB,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;gBACxE,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;gBAChF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,YAAY,WAAW,QAAQ,MAAM,CAAC,mBAAmB,CAAC,+BAA+B;oBAClG,UAAU,EAAE,yBAAyB,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK;oBACxF,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,mBAAmB,GAAG,CAAC,CAAC;YACxB,mBAAmB,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,GAAG,iBAAiB,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,YAAY,WAAW,QAAQ,MAAM,CAAC,mBAAmB,CAAC,+BAA+B;YAClG,UAAU,EAAE,yBAAyB,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK;YACxF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe,EAAE,KAAa;IACzD,MAAM,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO;QACL,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,uBAAuB,CAAC,KAAK,CAAC;QACjC,GAAG,aAAa,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACjG,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,GAAG,IAAI,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,uEAAuE;oBAChF,UAAU,EAAE,yEAAyE;oBACrF,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,0DAA0D;YACnE,UAAU,EACR,kFAAkF;YACpF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,sEAAsE;YAC/E,UAAU,EACR,qFAAqF;YACvF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IACpD,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACjG,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IAChE,OAAO;QACL;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,eAAe,QAAQ,2CAA2C;YAC3E,UAAU,EAAE,2EAA2E;YACvF,OAAO,EAAE,QAAQ;SAClB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,aAAsB;IAEtB,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,qBAAqB,CAAC,WAAW,CAAC;QAClC,mBAAmB,CAAC,WAAW,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC,CAAC;IACzD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACjF,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engine/claude-config-auditor/rules-auditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-auditor.d.ts","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/rules-auditor.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAoE1D,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAc1B"}
+{"version":3,"file":"rules-auditor.d.ts","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/rules-auditor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA8G1D,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAkB1B"}

package/dist/engine/claude-config-auditor/rules-auditor.js

@@ -1,69 +1,107 @@
-// Planu — .claude/rules/ auditor for SPEC-092
+// Planu — .claude/rules/ auditor for SPEC-092 / SPEC-255
 import { readFile, readdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { glob } from 'glob';
 const DOCS_REF = 'https://code.claude.com/docs/en/memory#rules';
-async function auditRulesDir(rulesPath, label) {
+async function auditRuleFile(file, rulesPath, projectPath) {
     const findings = [];
+    try {
+        const content = await readFile(join(rulesPath, file), 'utf-8');
+        const firstLines = content.split('\n').slice(0, 5).join('\n');
+        const hasPaths = /^paths:/m.test(firstLines) || /^---[\s\S]*?paths:/m.test(firstLines);
+        if (!hasPaths) {
+            const lc = content.toLowerCase();
+            const isScoped = lc.includes('typescript') ||
+                lc.includes('.test.') ||
+                lc.includes('vitest') ||
+                lc.includes('jest') ||
+                lc.includes('.tsx') ||
+                lc.includes('.jsx');
+            findings.push(isScoped
+                ? {
+                    area: 'rules',
+                    severity: 'warn',
+                    message: `Rule "${file}" has language/test-specific content but no paths: frontmatter`,
+                    suggestion: `Add "paths: src/**/*.ts" or similar frontmatter so it only loads for matching files`,
+                    docsRef: DOCS_REF,
+                }
+                : {
+                    area: 'rules',
+                    severity: 'info',
+                    code: 'RULE_MISSING_PATHS',
+                    message: `Rule "${file}" has no paths: frontmatter — it loads for every file`,
+                    suggestion: 'Add paths: frontmatter (e.g., "paths: src/**/*.ts") to scope when this rule loads',
+                    docsRef: DOCS_REF,
+                });
+        }
+        else if (projectPath !== undefined) {
+            const pathsMatch = /^---[\s\S]*?^paths:\s*(.+)$/m.exec(content);
+            if (pathsMatch) {
+                const patterns = (pathsMatch[1]?.trim() ?? '')
+                    .split(',')
+                    .map((p) => p.trim())
+                    .filter((p) => p.length > 0);
+                for (const pattern of patterns) {
+                    try {
+                        const matches = await glob(pattern, { cwd: projectPath });
+                        if (matches.length === 0) {
+                            findings.push({
+                                area: 'rules',
+                                severity: 'info',
+                                code: 'RULE_DEAD_PATH',
+                                message: `Rule "${file}" has paths: "${pattern}" but no files match in project`,
+                                suggestion: 'Update the paths: pattern to match existing files, or remove the rule if obsolete',
+                                docsRef: DOCS_REF,
+                            });
+                        }
+                    }
+                    catch {
+                        /* invalid glob — skip */
+                    }
+                }
+            }
+        }
+    }
+    catch {
+        /* unreadable file — skip */
+    }
+    return findings;
+}
+async function auditRulesDir(rulesPath, label, projectPath) {
     let files;
     try {
         const entries = await readdir(rulesPath);
         files = entries.filter((f) => f.endsWith('.md'));
     }
     catch {
-        findings.push({
-            area: 'rules',
-            severity: 'info',
-            message: `${label} directory does not exist`,
-            suggestion: 'Create .claude/rules/ with scoped rule files to keep CLAUDE.md lean',
-            docsRef: DOCS_REF,
-        });
-        return findings;
+        return [
+            {
+                area: 'rules',
+                severity: 'info',
+                message: `${label} directory does not exist`,
+                suggestion: 'Create .claude/rules/ with scoped rule files to keep CLAUDE.md lean',
+                docsRef: DOCS_REF,
+            },
+        ];
     }
     if (files.length === 0) {
-        findings.push({
-            area: 'rules',
-            severity: 'info',
-            message: `${label} directory exists but has no .md files`,
-            suggestion: 'Add rule files with paths: frontmatter for context-aware loading',
-            docsRef: DOCS_REF,
-        });
-        return findings;
-    }
-    for (const file of files) {
-        try {
-            const content = await readFile(join(rulesPath, file), 'utf-8');
-            const firstLines = content.split('\n').slice(0, 5).join('\n');
-            const hasPaths = /^paths:/m.test(firstLines) || /^---[\s\S]*?paths:/m.test(firstLines);
-            if (!hasPaths) {
-                // Check if file has TypeScript/test-specific content that should be scoped
-                const lowerContent = content.toLowerCase();
-                const isScoped = lowerContent.includes('typescript') ||
-                    lowerContent.includes('.test.') ||
-                    lowerContent.includes('vitest') ||
-                    lowerContent.includes('jest') ||
-                    lowerContent.includes('.tsx') ||
-                    lowerContent.includes('.jsx');
-                if (isScoped) {
-                    findings.push({
-                        area: 'rules',
-                        severity: 'warn',
-                        message: `Rule "${file}" has language/test-specific content but no paths: frontmatter`,
-                        suggestion: `Add "paths: src/**/*.ts" or similar frontmatter so it only loads for matching files`,
-                        docsRef: DOCS_REF,
-                    });
-                }
-            }
-        }
-        catch {
-            // Skip unreadable files
-        }
+        return [
+            {
+                area: 'rules',
+                severity: 'info',
+                message: `${label} directory exists but has no .md files`,
+                suggestion: 'Add rule files with paths: frontmatter for context-aware loading',
+                docsRef: DOCS_REF,
+            },
+        ];
     }
-    return findings;
+    const results = await Promise.all(files.map((f) => auditRuleFile(f, rulesPath, projectPath)));
+    return results.flat();
 }
 export async function auditRules(projectPath, includeGlobal) {
     const findings = [];
-    findings.push(...(await auditRulesDir(join(projectPath, '.claude', 'rules'), 'Project .claude/rules/')));
+    findings.push(...(await auditRulesDir(join(projectPath, '.claude', 'rules'), 'Project .claude/rules/', projectPath)));
     if (includeGlobal) {
         findings.push(...(await auditRulesDir(join(homedir(), '.claude', 'rules'), 'Global ~/.claude/rules/')));
     }

package/dist/engine/claude-config-auditor/rules-auditor.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules-auditor.js","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/rules-auditor.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAEhE,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAa;IAC3D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,KAAK,2BAA2B;YAC5C,UAAU,EAAE,qEAAqE;YACjF,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,KAAK,wCAAwC;YACzD,UAAU,EAAE,kEAAkE;YAC9E,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEvF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,2EAA2E;gBAC3E,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GACZ,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACnC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC7B,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC7B,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAEhC,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,SAAS,IAAI,gEAAgE;wBACtF,UAAU,EAAE,qFAAqF;wBACjG,OAAO,EAAE,QAAQ;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,aAAsB;IAEtB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAC1F,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,yBAAyB,CAAC,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"rules-auditor.js","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/rules-auditor.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAEhE,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,SAAiB,EACjB,WAAoB;IAEpB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,QAAQ,GACZ,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACzB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtB,QAAQ,CAAC,IAAI,CACX,QAAQ;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,SAAS,IAAI,gEAAgE;oBACtF,UAAU,EAAE,qFAAqF;oBACjG,OAAO,EAAE,QAAQ;iBAClB;gBACH,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,SAAS,IAAI,uDAAuD;oBAC7E,UAAU,EACR,mFAAmF;oBACrF,OAAO,EAAE,QAAQ;iBAClB,CACN,CAAC;QACJ,CAAC;aAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;qBAC3C,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;wBAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;4BACzB,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,OAAO;gCACb,QAAQ,EAAE,MAAM;gCAChB,IAAI,EAAE,gBAAgB;gCACtB,OAAO,EAAE,SAAS,IAAI,iBAAiB,OAAO,iCAAiC;gCAC/E,UAAU,EACR,mFAAmF;gCACrF,OAAO,EAAE,QAAQ;6BAClB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,yBAAyB;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,SAAiB,EACjB,KAAa,EACb,WAAoB;IAEpB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,GAAG,KAAK,2BAA2B;gBAC5C,UAAU,EAAE,qEAAqE;gBACjF,OAAO,EAAE,QAAQ;aAClB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,GAAG,KAAK,wCAAwC;gBACzD,UAAU,EAAE,kEAAkE;gBAC9E,OAAO,EAAE,QAAQ;aAClB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,aAAsB;IAEtB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,aAAa,CACrB,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,EACrC,wBAAwB,EACxB,WAAW,CACZ,CAAC,CACH,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,yBAAyB,CAAC,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engine/claude-config-auditor/scoring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/scoring.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAQ1D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAuB1F;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAexE"}
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/scoring.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA2B1D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2C1F;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAexE"}

package/dist/engine/claude-config-auditor/scoring.js

@@ -3,10 +3,46 @@ const SEVERITY_PENALTY = {
     warn: 8,
     info: 2,
 };
+// SPEC-255: code-specific penalties (override severity penalty)
+const CODE_PENALTY = {
+    LINE_COUNT_CRITICAL: 25,
+    LINE_COUNT_WARN: 10,
+    AUTO_MODE_ENV_MISSING: 8,
+    BYPASS_PERMISSIONS_NO_ISOLATION: 20,
+};
+// SPEC-255: codes with per-finding deduction and total cap
+const CODE_PER_FINDING = {
+    REDUNDANT_INSTRUCTION: 3,
+    AMBIGUOUS_INSTRUCTION: 2,
+};
+const CODE_MAX_TOTAL = {
+    REDUNDANT_INSTRUCTION: 15,
+    AMBIGUOUS_INSTRUCTION: 10,
+};
 export function calculateScore(findings) {
     let score = 100;
+    // Track accumulated deductions for capped codes
+    const codeAccumulated = {};
     for (const f of findings) {
-        score -= SEVERITY_PENALTY[f.severity] ?? 0;
+        const code = f.code;
+        if (code !== undefined && CODE_PENALTY[code] !== undefined) {
+            // Use code-specific flat penalty instead of severity penalty
+            score -= CODE_PENALTY[code] ?? 0;
+        }
+        else if (code !== undefined && CODE_PER_FINDING[code] !== undefined) {
+            // Per-finding deduction with a total cap
+            const perFinding = CODE_PER_FINDING[code] ?? 0;
+            const maxTotal = CODE_MAX_TOTAL[code] ?? Infinity;
+            const accumulated = codeAccumulated[code] ?? 0;
+            const actual = Math.min(perFinding, maxTotal - accumulated);
+            if (actual > 0) {
+                score -= actual;
+                codeAccumulated[code] = accumulated + actual;
+            }
+        }
+        else {
+            score -= SEVERITY_PENALTY[f.severity] ?? 0;
+        }
     }
     score = Math.max(0, score);
     let grade;

package/dist/engine/claude-config-auditor/scoring.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/scoring.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAA2B;IAC/C,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,QAAyB;IACtD,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE3B,IAAI,KAAa,CAAC;IAClB,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE9F,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/scoring.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAA2B;IAC/C,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,gEAAgE;AAChE,MAAM,YAAY,GAA2B;IAC3C,mBAAmB,EAAE,EAAE;IACvB,eAAe,EAAE,EAAE;IACnB,qBAAqB,EAAE,CAAC;IACxB,+BAA+B,EAAE,EAAE;CACpC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,gBAAgB,GAA2B;IAC/C,qBAAqB,EAAE,CAAC;IACxB,qBAAqB,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,cAAc,GAA2B;IAC7C,qBAAqB,EAAE,EAAE;IACzB,qBAAqB,EAAE,EAAE;CAC1B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,QAAyB;IACtD,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,gDAAgD;IAChD,MAAM,eAAe,GAA2B,EAAE,CAAC;IAEnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAEpB,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3D,6DAA6D;YAC7D,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtE,yCAAyC;YACzC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAClD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;YAC5D,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,IAAI,MAAM,CAAC;gBAChB,eAAe,CAAC,IAAI,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC;YAC/C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE3B,IAAI,KAAa,CAAC;IAClB,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE9F,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC"}

package/dist/engine/claude-config-auditor/settings-auditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-auditor.d.ts","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/settings-auditor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,sBAAsB,CAAC;AAsBxE,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAyEjF"}
+{"version":3,"file":"settings-auditor.d.ts","sourceRoot":"","sources":["../../../src/engine/claude-config-auditor/settings-auditor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,sBAAsB,CAAC;AA2ExE,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAgCjF"}

package/dist/engine/claude-config-auditor/settings-auditor.js

@@ -20,50 +20,67 @@ async function pathExists(p) {
         return false;
     }
 }
-export async function auditSettings(projectPath) {
+function auditSingleSettings(data, label) {
     const findings = [];
-    const settingsPath = join(projectPath, '.claude', 'settings.json');
-    const localSettingsPath = join(projectPath, '.claude', 'settings.local.json');
-    // Check main settings
-    const settings = await readSettings(settingsPath);
-    const localSettings = await readSettings(localSettingsPath);
-    const allSettings = [
-        { data: settings, label: 'settings.json' },
-        { data: localSettings, label: 'settings.local.json' },
-    ];
-    for (const { data, label } of allSettings) {
-        if (!data) {
-            continue;
-        }
-        // Check for obsolete permission patterns
-        const allowList = data.permissions?.allow ?? [];
-        const obsoletePatterns = ['mcp__specforge__', 'mcp__sdd__'];
-        for (const pattern of obsoletePatterns) {
-            const obsolete = allowList.filter((p) => p.includes(pattern));
-            if (obsolete.length > 0) {
-                findings.push({
-                    area: 'settings',
-                    severity: 'warn',
-                    message: `${label} has ${String(obsolete.length)} obsolete permission(s) matching "${pattern}"`,
-                    suggestion: `Remove obsolete entries from permissions.allow: ${obsolete.join(', ')}`,
-                    docsRef: DOCS_REF,
-                });
-            }
-        }
-        // Check autoMemoryEnabled
-        if (data.autoMemoryEnabled === false) {
+    const allowList = data.permissions?.allow ?? [];
+    for (const pattern of ['mcp__specforge__', 'mcp__sdd__']) {
+        const obsolete = allowList.filter((p) => p.includes(pattern));
+        if (obsolete.length > 0) {
             findings.push({
                 area: 'settings',
-                severity: 'info',
-                message: `${label} has autoMemoryEnabled: false — auto-memory is disabled`,
-                suggestion: 'Consider enabling auto-memory for cross-session learning',
+                severity: 'warn',
+                message: `${label} has ${String(obsolete.length)} obsolete permission(s) matching "${pattern}"`,
+                suggestion: `Remove obsolete entries from permissions.allow: ${obsolete.join(', ')}`,
                 docsRef: DOCS_REF,
             });
         }
     }
-    // Check for skills directory
-    const skillsDir = join(projectPath, '.claude', 'skills');
-    if (!(await pathExists(skillsDir))) {
+    if (data.autoMemoryEnabled === false) {
+        findings.push({
+            area: 'settings',
+            severity: 'info',
+            message: `${label} has autoMemoryEnabled: false — auto-memory is disabled`,
+            suggestion: 'Consider enabling auto-memory for cross-session learning',
+            docsRef: DOCS_REF,
+        });
+    }
+    const defaultMode = data.permissions?.defaultMode;
+    if ((defaultMode === 'auto' || defaultMode === 'acceptEdits') &&
+        data.autoMode?.environment === undefined) {
+        findings.push({
+            area: 'settings',
+            severity: 'warn',
+            code: 'AUTO_MODE_ENV_MISSING',
+            message: `${label} has permissions.defaultMode="${defaultMode}" but no autoMode.environment configured`,
+            suggestion: 'Configure autoMode.environment (e.g., "docker", "vm") to define trusted repos/buckets for auto-mode',
+            docsRef: DOCS_REF,
+        });
+    }
+    if (defaultMode === 'bypassPermissions') {
+        findings.push({
+            area: 'settings',
+            severity: 'critical',
+            code: 'BYPASS_PERMISSIONS_NO_ISOLATION',
+            message: `${label} has permissions.defaultMode="bypassPermissions" — all permission checks are disabled`,
+            suggestion: 'Only use bypassPermissions inside isolated containers or VMs. Remove from developer workstations.',
+            docsRef: DOCS_REF,
+        });
+    }
+    return findings;
+}
+export async function auditSettings(projectPath) {
+    const findings = [];
+    const pairs = [
+        { path: join(projectPath, '.claude', 'settings.json'), label: 'settings.json' },
+        { path: join(projectPath, '.claude', 'settings.local.json'), label: 'settings.local.json' },
+    ];
+    for (const { path: p, label } of pairs) {
+        const data = await readSettings(p);
+        if (data) {
+            findings.push(...auditSingleSettings(data, label));
+        }
+    }
+    if (!(await pathExists(join(projectPath, '.claude', 'skills')))) {
         findings.push({
             area: 'settings',
             severity: 'info',
@@ -72,9 +89,7 @@ export async function auditSettings(projectPath) {
             docsRef: DOCS_REF,
         });
     }
-    // Check for hooks configuration
-    const hooksDir = join(projectPath, '.claude', 'hooks');
-    if (!(await pathExists(hooksDir))) {
+    if (!(await pathExists(join(projectPath, '.claude', 'hooks')))) {
         findings.push({
             area: 'settings',
             severity: 'info',