@praneeth_54/agentdoctor 0.3.0-beta → 1.0.0

package/dist/cli/program.js

@@ -1,15 +1,16 @@
-import { Command } from "commander";
+import { Command, InvalidArgumentError } from "commander";
 import { PACKAGE_VERSION } from "../constants.js";
+import { parseFailOnRules, parseSeverityGate } from "../core/policy/evaluate.js";
+import { EXIT_CODES } from "../types/index.js";
 import { runDoctorCommand } from "./commands/doctor.js";
 import { runExplainCommand } from "./commands/explain.js";
 import { runFixCommand } from "./commands/fix.js";
 import { resolveTargetArgument, runScanCommand } from "./commands/scan.js";
 import { runVerifyCommand } from "./commands/verify.js";
-import { EXIT_CODES } from "../types/index.js";
 function parseMinScore(value) {
     const parsed = Number(value);
     if (!Number.isFinite(parsed) || parsed < 0 || parsed > 100) {
-        throw new Error("--min-score must be a number between 0 and 100");
+        throw new InvalidArgumentError("--min-score must be a number between 0 and 100");
     }
     return parsed;
 }
@@ -22,6 +23,24 @@ function readMinScore(options) {
     }
     return undefined;
 }
+function collectFailOnRules(value, previous) {
+    return [...previous, ...parseFailOnRules(value)];
+}
+function readFailOnSeverity(options) {
+    if (typeof options.failOnSeverity !== "string" || options.failOnSeverity.length === 0) {
+        return undefined;
+    }
+    return parseSeverityGate(options.failOnSeverity);
+}
+function readFailOnRules(options) {
+    if (Array.isArray(options.failOnRule)) {
+        return options.failOnRule.filter((item) => typeof item === "string");
+    }
+    if (typeof options.failOnRule === "string") {
+        return parseFailOnRules(options.failOnRule);
+    }
+    return [];
+}
 /**
  * Scan flags are declared on both the root program and the `scan` subcommand
  * so `--help` stays accurate. Commander stores overlapping flags on the parent
@@ -30,19 +49,29 @@ function readMinScore(options) {
 function addScanOptions(command) {
     return command
         .option("--json", "Emit machine-readable JSON (no decorative output)", false)
-        .option("--ci", "CI mode (non-interactive; report-only unless --min-score is set)", false)
+        .option("--ci", "CI mode: exit 1 when any critical finding exists (override with --fail-on-severity)", false)
         .option("--verbose", "Show timing and extra diagnostics", false)
-        .option("--min-score <number>", "Exit 1 when overall readiness score is below this (0-100)", parseMinScore);
+        .option("--min-score <number>", "Exit 1 when overall readiness score is below this (0-100)", parseMinScore)
+        .option("--fail-on-severity <level>", "Exit 1 when any finding has this severity or higher (critical|warning|info)", parseSeverityGate)
+        .option("--fail-on-rule <id>", "Exit 1 when a finding matches this rule id (repeatable or comma-separated)", collectFailOnRules, [])
+        .option("--summary", "Write a GitHub Actions step summary when GITHUB_STEP_SUMMARY is set", false)
+        .option("--annotations", "Emit GitHub Actions annotations for findings (stderr)", false);
 }
 async function runScanFromCli(pathArg, command) {
     const options = command.optsWithGlobals();
     const minScore = readMinScore(options);
+    const failOnSeverity = readFailOnSeverity(options);
+    const failOnRules = readFailOnRules(options);
     const code = await runScanCommand({
         targetPath: resolveTargetArgument(pathArg),
         json: Boolean(options.json),
         ci: Boolean(options.ci),
         verbose: Boolean(options.verbose),
+        summary: Boolean(options.summary),
+        annotations: Boolean(options.annotations),
         ...(minScore !== undefined ? { minScore } : {}),
+        ...(failOnSeverity !== undefined ? { failOnSeverity } : {}),
+        ...(failOnRules.length > 0 ? { failOnRules } : {}),
     });
     process.exitCode = code;
 }
@@ -63,7 +92,7 @@ export function createProgram() {
     });
     program
         .command("fix")
-        .description("Apply safe automatic fixes (Cursor .cursorignore for safe context findings)")
+        .description("Apply safe automatic fixes (Cursor .cursorignore, Claude Code Read deny, and Codex filesystem deny for safe context findings)")
         .argument("[path]", "Repository path (default: current directory)")
         .option("--dry-run", "Show proposed fixes without writing files", false)
         .option("-y, --yes", "Skip confirmation prompts", false)
@@ -80,20 +109,32 @@ export function createProgram() {
         .description("Re-scan and compare against a prior scan JSON baseline (Scan → Fix → Verify)")
         .argument("[path]", "Repository path (default: current directory)")
         .option("--json", "Emit machine-readable JSON", false)
-        .option("--ci", "CI mode: exit 1 when new findings appear (also honors --min-score)", false)
+        .option("--ci", "CI mode: exit 1 when new findings appear (also honors other policy flags)", false)
+        .option("--fail-on-new", "Exit 1 when new findings appear relative to the baseline", false)
         .option("--verbose", "Show timing and extra diagnostics", false)
         .option("--baseline <file>", "Prior scan JSON report (default: agentdoctor-report.json or .agentdoctor-baseline.json)")
         .option("--min-score <number>", "Exit 1 when overall readiness score is below this (0-100)", parseMinScore)
+        .option("--fail-on-severity <level>", "Exit 1 when any finding has this severity or higher (critical|warning|info)", parseSeverityGate)
+        .option("--fail-on-rule <id>", "Exit 1 when a finding matches this rule id (repeatable or comma-separated)", collectFailOnRules, [])
+        .option("--summary", "Write a GitHub Actions step summary when GITHUB_STEP_SUMMARY is set", false)
+        .option("--annotations", "Emit GitHub Actions annotations for findings (stderr)", false)
         .action(async (pathArg, _options, command) => {
         const options = command.optsWithGlobals();
         const minScore = readMinScore(options);
+        const failOnSeverity = readFailOnSeverity(options);
+        const failOnRules = readFailOnRules(options);
         const code = await runVerifyCommand({
             targetPath: resolveTargetArgument(pathArg),
             json: Boolean(options.json),
             ci: Boolean(options.ci),
+            failOnNew: Boolean(options.failOnNew),
             verbose: Boolean(options.verbose),
+            summary: Boolean(options.summary),
+            annotations: Boolean(options.annotations),
             ...(typeof options.baseline === "string" ? { baselinePath: options.baseline } : {}),
             ...(minScore !== undefined ? { minScore } : {}),
+            ...(failOnSeverity !== undefined ? { failOnSeverity } : {}),
+            ...(failOnRules.length > 0 ? { failOnRules } : {}),
         });
         process.exitCode = code;
     });

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const PACKAGE_VERSION = "0.3.0-beta";
+export declare const PACKAGE_VERSION = "1.0.0";
 export declare const DEFAULT_MAX_FILE_SIZE_BYTES: number;
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export declare const DEFAULT_IGNORE_DIRECTORIES: Set<string>;

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const PACKAGE_VERSION = "0.3.0-beta";
+export const PACKAGE_VERSION = "1.0.0";
 export const DEFAULT_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // 2 MiB
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export const DEFAULT_IGNORE_DIRECTORIES = new Set([

package/dist/core/fix/apply.d.ts

@@ -1,10 +1,14 @@
 import type { FixApplyResult, FixPlan } from "./types.js";
+import { previewClaudeSettingsActions, readClaudeSettings } from "./writers/claude-settings.js";
+import { previewCodexConfigActions, readCodexConfig } from "./writers/codex-config.js";
 import { previewCursorignoreActions, readCursorignore } from "./writers/cursorignore.js";
 /**
  * Apply (or dry-run) a fix plan.
- * Week 1: only `.cursorignore` mutations are supported.
+ * Safe writers: `.cursorignore`, Claude settings deny, Codex config.toml deny.
  */
 export declare function applyFixPlan(plan: FixPlan, options: {
     dryRun: boolean;
 }): Promise<FixApplyResult>;
 export { previewCursorignoreActions, readCursorignore };
+export { previewClaudeSettingsActions, readClaudeSettings };
+export { previewCodexConfigActions, readCodexConfig };

package/dist/core/fix/apply.js

@@ -1,27 +1,47 @@
+import { previewClaudeSettingsActions, readClaudeSettings, writeClaudeSettings, } from "./writers/claude-settings.js";
+import { previewCodexConfigActions, readCodexConfig, writeCodexConfig, } from "./writers/codex-config.js";
 import { previewCursorignoreActions, readCursorignore, writeCursorignore, } from "./writers/cursorignore.js";
 /**
  * Apply (or dry-run) a fix plan.
- * Week 1: only `.cursorignore` mutations are supported.
+ * Safe writers: `.cursorignore`, Claude settings deny, Codex config.toml deny.
  */
 export async function applyFixPlan(plan, options) {
-    const current = await readCursorignore(plan.root);
-    const preview = previewCursorignoreActions(current, plan.actions);
-    if (!preview) {
-        return {
-            plan,
-            dryRun: options.dryRun,
-            writtenFiles: [],
-            changedFiles: [],
-        };
+    const cursorContent = await readCursorignore(plan.root);
+    const claudeContent = await readClaudeSettings(plan.root);
+    const codexContent = await readCodexConfig(plan.root);
+    const cursorPreview = previewCursorignoreActions(cursorContent, plan.actions);
+    const claudePreview = previewClaudeSettingsActions(claudeContent, plan.actions);
+    const codexPreview = previewCodexConfigActions(codexContent, plan.actions);
+    const writtenFiles = [];
+    const changedFiles = [];
+    if (cursorPreview) {
+        changedFiles.push(cursorPreview.targetRelativePath);
+        if (!options.dryRun) {
+            await writeCursorignore(plan.root, cursorPreview.after);
+            writtenFiles.push(cursorPreview.targetRelativePath);
+        }
     }
-    if (!options.dryRun) {
-        await writeCursorignore(plan.root, preview.after);
+    if (claudePreview) {
+        changedFiles.push(claudePreview.targetRelativePath);
+        if (!options.dryRun) {
+            await writeClaudeSettings(plan.root, claudePreview.after);
+            writtenFiles.push(claudePreview.targetRelativePath);
+        }
+    }
+    if (codexPreview) {
+        changedFiles.push(codexPreview.targetRelativePath);
+        if (!options.dryRun) {
+            await writeCodexConfig(plan.root, codexPreview.after);
+            writtenFiles.push(codexPreview.targetRelativePath);
+        }
     }
     return {
         plan,
         dryRun: options.dryRun,
-        writtenFiles: options.dryRun ? [] : [preview.targetRelativePath],
-        changedFiles: [preview.targetRelativePath],
+        writtenFiles,
+        changedFiles,
     };
 }
 export { previewCursorignoreActions, readCursorignore };
+export { previewClaudeSettingsActions, readClaudeSettings };
+export { previewCodexConfigActions, readCodexConfig };

package/dist/core/fix/plan.d.ts

@@ -2,7 +2,7 @@ import type { ScanResult } from "../../types/index.js";
 import type { FixPlan } from "./types.js";
 /**
  * Build a fix plan from a scan result.
- * Week 1: Cursor `.cursorignore` appends for safe context findings only.
+ * Safe context exclusions: Cursor `.cursorignore`, Claude Code Read deny, Codex filesystem deny.
  */
 export declare function buildFixPlan(result: ScanResult): Promise<FixPlan>;
 /** Patterns that would be newly appended given current file contents. */

package/dist/core/fix/plan.js

@@ -1,11 +1,21 @@
 import path from "node:path";
 import { readTextFile } from "../../utils/fs.js";
+import { settingsTextDeniesPath } from "../rules/claude-deny.js";
+import { configTextDeniesPath } from "../rules/codex-deny.js";
 import { createIgnoreIndex, parseIgnoreFile, pathMatchesAny } from "../rules/ignore.js";
 import { isSafeContextFixRule, patternForFinding } from "./patterns.js";
+import { denyRuleForFixPattern } from "./writers/claude-settings.js";
+import { assertWritableCodexConfig, denyKeyForFixPattern } from "./writers/codex-config.js";
 const DEFAULT_MAX_IGNORE_BYTES = 512 * 1024;
 function cursorConfigured(result) {
     return result.agents.some((a) => a.id === "cursor" && (a.detected || a.configured));
 }
+function claudeConfigured(result) {
+    return result.agents.some((a) => a.id === "claude-code" && (a.detected || a.configured));
+}
+function codexConfigured(result) {
+    return result.agents.some((a) => a.id === "codex" && (a.detected || a.configured));
+}
 async function loadCursorignorePatterns(root) {
     const filePath = path.join(root, ".cursorignore");
     const text = await readTextFile(filePath, DEFAULT_MAX_IGNORE_BYTES);
@@ -14,9 +24,15 @@ async function loadCursorignorePatterns(root) {
     }
     return parseIgnoreFile(text);
 }
+async function loadClaudeSettingsText(root) {
+    return readTextFile(path.join(root, ".claude/settings.json"), DEFAULT_MAX_IGNORE_BYTES);
+}
+async function loadCodexConfigText(root) {
+    return readTextFile(path.join(root, ".codex/config.toml"), DEFAULT_MAX_IGNORE_BYTES);
+}
 /**
  * Build a fix plan from a scan result.
- * Week 1: Cursor `.cursorignore` appends for safe context findings only.
+ * Safe context exclusions: Cursor `.cursorignore`, Claude Code Read deny, Codex filesystem deny.
  */
 export async function buildFixPlan(result) {
     const root = result.repository.root;
@@ -27,7 +43,11 @@ export async function buildFixPlan(result) {
         gitignorePatterns: [],
         cursorignorePatterns: existingCursorPatterns,
     });
+    const claudeSettingsText = await loadClaudeSettingsText(root);
+    const codexConfigText = await loadCodexConfigText(root);
     const hasCursor = cursorConfigured(result);
+    const hasClaude = claudeConfigured(result);
+    const hasCodex = codexConfigured(result);
     for (const finding of result.findings) {
         if (finding.fixability !== "safe") {
             skipped.push({
@@ -60,6 +80,8 @@ export async function buildFixPlan(result) {
             continue;
         }
         const wantsCursor = finding.affectedAgents.includes("cursor");
+        const wantsClaude = finding.affectedAgents.includes("claude-code");
+        const wantsCodex = finding.affectedAgents.includes("codex");
         if (wantsCursor && hasCursor) {
             if (cursorIndex.matchesCursorignore(evidencePath) ||
                 cursorIndex.matchesCursorignore(pattern)) {
@@ -80,8 +102,54 @@ export async function buildFixPlan(result) {
                 reason: "Cursor not detected; skipping .cursorignore fix",
             });
         }
+        if (wantsClaude && hasClaude) {
+            const denyRule = denyRuleForFixPattern(pattern, evidencePath);
+            if (claudeSettingsText && settingsTextDeniesPath(claudeSettingsText, evidencePath)) {
+                skipped.push({
+                    findingId: finding.id,
+                    ruleId: finding.ruleId,
+                    reason: "Already excluded by Claude Code Read deny",
+                });
+            }
+            else {
+                mergeClaudeAction(actionsByKey, finding, pattern, evidencePath, denyRule);
+            }
+        }
+        else if (wantsClaude && !hasClaude) {
+            skipped.push({
+                findingId: finding.id,
+                ruleId: finding.ruleId,
+                reason: "Claude Code not detected; skipping settings deny fix",
+            });
+        }
+        if (wantsCodex && hasCodex) {
+            const denyKey = denyKeyForFixPattern(pattern, evidencePath);
+            if (codexConfigText && configTextDeniesPath(codexConfigText, evidencePath)) {
+                skipped.push({
+                    findingId: finding.id,
+                    ruleId: finding.ruleId,
+                    reason: "Already excluded by Codex filesystem deny",
+                });
+            }
+            else if (codexConfigText) {
+                // Refuse unwritable/invalid config the same way Claude Fix refuses bad JSON —
+                // do not silently skip and leave Codex findings uncleared after a partial Cursor write.
+                assertWritableCodexConfig(codexConfigText);
+                mergeCodexAction(actionsByKey, finding, pattern, evidencePath, denyKey);
+            }
+            else {
+                mergeCodexAction(actionsByKey, finding, pattern, evidencePath, denyKey);
+            }
+        }
+        else if (wantsCodex && !hasCodex) {
+            skipped.push({
+                findingId: finding.id,
+                ruleId: finding.ruleId,
+                reason: "Codex not detected; skipping config.toml deny fix",
+            });
+        }
         for (const agent of finding.affectedAgents) {
-            if (agent === "cursor") {
+            if (agent === "cursor" || agent === "claude-code" || agent === "codex") {
                 continue;
             }
             skipped.push({
@@ -117,6 +185,46 @@ function mergeCursorAction(actionsByKey, finding, pattern, evidencePath) {
         description: `Exclude ${evidencePath} from Cursor agent context via .cursorignore`,
     });
 }
+function mergeClaudeAction(actionsByKey, finding, pattern, evidencePath, denyRule) {
+    const key = `claude-code:.claude/settings.json:${denyRule}`;
+    const existing = actionsByKey.get(key);
+    if (existing) {
+        if (!existing.findingIds.includes(finding.id)) {
+            existing.findingIds.push(finding.id);
+        }
+        return;
+    }
+    actionsByKey.set(key, {
+        id: key,
+        kind: "append-ignore-pattern",
+        agent: "claude-code",
+        targetRelativePath: ".claude/settings.json",
+        pattern,
+        evidencePath,
+        findingIds: [finding.id],
+        description: `Exclude ${evidencePath} from Claude Code via permissions.deny ${denyRule}`,
+    });
+}
+function mergeCodexAction(actionsByKey, finding, pattern, evidencePath, denyKey) {
+    const key = `codex:.codex/config.toml:${denyKey}`;
+    const existing = actionsByKey.get(key);
+    if (existing) {
+        if (!existing.findingIds.includes(finding.id)) {
+            existing.findingIds.push(finding.id);
+        }
+        return;
+    }
+    actionsByKey.set(key, {
+        id: key,
+        kind: "append-ignore-pattern",
+        agent: "codex",
+        targetRelativePath: ".codex/config.toml",
+        pattern,
+        evidencePath,
+        findingIds: [finding.id],
+        description: `Exclude ${evidencePath} from Codex via filesystem deny "${denyKey}"`,
+    });
+}
 /** Patterns that would be newly appended given current file contents. */
 export function missingPatternsForCursorignore(currentContent, patterns) {
     const existing = currentContent === null ? [] : parseIgnoreFile(currentContent);
@@ -129,7 +237,6 @@ export function missingPatternsForCursorignore(currentContent, patterns) {
             existing.some((p) => p === pattern)) {
             continue;
         }
-        // Also skip if an existing pattern already excludes this path
         const evidenceGuess = pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;
         if (pathMatchesAny(evidenceGuess, existing) || pathMatchesAny(pattern, existing)) {
             continue;

package/dist/core/fix/render.d.ts

@@ -2,5 +2,7 @@ import type { FixApplyResult, FixPlan } from "./types.js";
 export declare function renderFixPlanTerminal(plan: FixPlan, options: {
     dryRun: boolean;
     cursorContent: string | null;
+    claudeSettingsContent?: string | null;
+    codexConfigContent?: string | null;
     applyResult?: FixApplyResult;
 }): string;

package/dist/core/fix/render.js

@@ -1,3 +1,5 @@
+import { previewClaudeSettingsActions } from "./writers/claude-settings.js";
+import { previewCodexConfigActions } from "./writers/codex-config.js";
 import { previewCursorignoreActions } from "./writers/cursorignore.js";
 export function renderFixPlanTerminal(plan, options) {
     const lines = [];
@@ -14,10 +16,16 @@ export function renderFixPlanTerminal(plan, options) {
                 lines.push(`    - ${reason} (${count})`);
             }
             lines.push("");
-            lines.push("  Next: address remaining findings, then run `agentdoctor verify`.");
+            lines.push("Next");
+            lines.push("  Inspect a finding: agentdoctor explain <rule-id>  (ids in scan --json)");
+            lines.push("  Confirm with verify: agentdoctor verify --baseline agentdoctor-report.json");
+            lines.push("  No baseline yet? agentdoctor scan --json > agentdoctor-report.json");
         }
         else {
             lines.push("  Scan found nothing that Fix can change.");
+            lines.push("");
+            lines.push("Next");
+            lines.push("  Re-scan: agentdoctor scan");
         }
         lines.push("");
         return lines.join("\n");
@@ -28,14 +36,41 @@ export function renderFixPlanTerminal(plan, options) {
         lines.push(`      pattern: ${action.pattern}`);
         lines.push(`      findings: ${action.findingIds.length}`);
     }
-    const preview = previewCursorignoreActions(options.cursorContent, plan.actions);
-    if (preview) {
+    const cursorPreview = previewCursorignoreActions(options.cursorContent, plan.actions);
+    const claudePreview = previewClaudeSettingsActions(options.claudeSettingsContent ?? null, plan.actions);
+    const codexPreview = previewCodexConfigActions(options.codexConfigContent ?? null, plan.actions);
+    if (cursorPreview || claudePreview || codexPreview) {
         lines.push("");
         lines.push("  File changes:");
-        lines.push(`    ${preview.targetRelativePath} (+${preview.patternsToAdd.length} pattern(s))`);
-        lines.push("");
-        for (const previewLine of preview.preview.split("\n")) {
-            lines.push(`  ${previewLine}`);
+        let shown = false;
+        if (cursorPreview) {
+            lines.push(`    ${cursorPreview.targetRelativePath} (+${cursorPreview.patternsToAdd.length} pattern(s))`);
+            lines.push("");
+            for (const previewLine of cursorPreview.preview.split("\n")) {
+                lines.push(`  ${previewLine}`);
+            }
+            shown = true;
+        }
+        if (claudePreview) {
+            if (shown) {
+                lines.push("");
+            }
+            lines.push(`    ${claudePreview.targetRelativePath} (+${claudePreview.denyRulesToAdd.length} deny rule(s))`);
+            lines.push("");
+            for (const previewLine of claudePreview.preview.split("\n")) {
+                lines.push(`  ${previewLine}`);
+            }
+            shown = true;
+        }
+        if (codexPreview) {
+            if (shown) {
+                lines.push("");
+            }
+            lines.push(`    ${codexPreview.targetRelativePath} (+${codexPreview.denyKeysToAdd.length} deny key(s))`);
+            lines.push("");
+            for (const previewLine of codexPreview.preview.split("\n")) {
+                lines.push(`  ${previewLine}`);
+            }
         }
     }
     if (options.applyResult && !options.dryRun) {
@@ -50,12 +85,25 @@ export function renderFixPlanTerminal(plan, options) {
     else if (options.dryRun) {
         lines.push("");
         lines.push("  No files were modified (dry-run).");
-        lines.push("  Re-run without --dry-run to apply.");
     }
     if (plan.skipped.length > 0) {
         lines.push("");
-        lines.push(`  Skipped: ${plan.skipped.length} finding(s) (writers pending or already fixed)`);
+        lines.push(`  Skipped: ${plan.skipped.length} finding(s):`);
+        const reasons = summarizeSkipReasons(plan.skipped.map((s) => s.reason));
+        for (const [reason, count] of reasons) {
+            lines.push(`    - ${reason} (${count})`);
+        }
+    }
+    lines.push("");
+    lines.push("Next");
+    if (options.dryRun && plan.actions.length > 0) {
+        lines.push("  Apply these changes: agentdoctor fix -y");
+    }
+    if (plan.skipped.length > 0) {
+        lines.push("  Review/manual findings stay open — inspect with: agentdoctor explain <rule-id>");
     }
+    lines.push("  Confirm with verify: agentdoctor verify --baseline agentdoctor-report.json");
+    lines.push("  No baseline yet? agentdoctor scan --json > agentdoctor-report.json");
     lines.push("");
     return lines.join("\n");
 }

package/dist/core/fix/run.js

@@ -1,7 +1,7 @@
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { scan } from "../scanner/scan.js";
-import { applyFixPlan, readCursorignore } from "./apply.js";
+import { applyFixPlan, readClaudeSettings, readCodexConfig, readCursorignore } from "./apply.js";
 import { buildFixPlan } from "./plan.js";
 import { renderFixPlanTerminal } from "./render.js";
 /**
@@ -11,6 +11,8 @@ export async function runFix(options) {
     const result = await scan({ cwd: options.cwd });
     const plan = await buildFixPlan(result);
     const cursorContent = await readCursorignore(plan.root);
+    const claudeSettingsContent = await readClaudeSettings(plan.root);
+    const codexConfigContent = await readCodexConfig(plan.root);
     if (plan.actions.length === 0 || options.dryRun) {
         const applyResult = await applyFixPlan(plan, { dryRun: true });
         return { plan, applyResult, cancelled: false };
@@ -19,6 +21,8 @@ export async function runFix(options) {
         const previewText = renderFixPlanTerminal(plan, {
             dryRun: true,
             cursorContent,
+            claudeSettingsContent,
+            codexConfigContent,
         });
         process.stdout.write(previewText);
         const confirmed = await confirm("Apply these changes?");

package/dist/core/fix/types.d.ts

@@ -1,7 +1,7 @@
 import type { AgentId } from "../../types/index.js";
 export type FixKind = "append-ignore-pattern";
 /** Allowlisted relative paths fix may create or modify. */
-export declare const FIX_PATH_ALLOWLIST: readonly [".cursorignore"];
+export declare const FIX_PATH_ALLOWLIST: readonly [".cursorignore", ".claude/settings.json", ".codex/config.toml"];
 export type FixAllowlistedPath = (typeof FIX_PATH_ALLOWLIST)[number];
 export interface FixAction {
     id: string;

package/dist/core/fix/types.js

@@ -1,2 +1,6 @@
 /** Allowlisted relative paths fix may create or modify. */
-export const FIX_PATH_ALLOWLIST = [".cursorignore"];
+export const FIX_PATH_ALLOWLIST = [
+    ".cursorignore",
+    ".claude/settings.json",
+    ".codex/config.toml",
+];

package/dist/core/fix/writers/claude-settings.d.ts

@@ -0,0 +1,16 @@
+import type { FixAction } from "../types.js";
+declare const SETTINGS_RELATIVE = ".claude/settings.json";
+export interface ClaudeSettingsWritePreview {
+    targetRelativePath: typeof SETTINGS_RELATIVE;
+    denyRulesToAdd: string[];
+    before: string;
+    after: string;
+    preview: string;
+}
+export declare function denyRuleForFixPattern(pattern: string, evidencePath: string): string;
+export declare function missingClaudeDenyRules(currentContent: string | null, denyRules: string[]): string[];
+export declare function buildClaudeSettingsContent(currentContent: string | null, denyRulesToAdd: string[]): string;
+export declare function previewClaudeSettingsActions(currentContent: string | null, actions: FixAction[]): ClaudeSettingsWritePreview | null;
+export declare function readClaudeSettings(root: string): Promise<string | null>;
+export declare function writeClaudeSettings(root: string, content: string): Promise<void>;
+export {};