@yawlabs/ctxlint 0.13.2 → 0.13.3

package/dist/index.js

@@ -42489,7 +42489,7 @@ async function checkPaths(file2, projectRoot) {
     const resolvedPath = path4.resolve(baseDir, ref.value);
     const normalizedRef = ref.value.replace(/\\/g, "/");
     if (normalizedRef.includes("*")) {
-      const matches = await Ze(normalizedRef, { cwd: baseDir, nodir: false });
+      const matches = path4.isAbsolute(normalizedRef) ? await Ze(normalizedRef, { absolute: true, nodir: false }) : await Ze(normalizedRef, { cwd: baseDir, nodir: false });
       if (matches.length === 0) {
         issues.push({
           severity: "error",
@@ -42871,7 +42871,7 @@ async function checkTokens(file2, _projectRoot, thresholds = DEFAULT_TOKEN_THRES
 }
 function checkAggregateTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const total = files.reduce((sum, f) => sum + f.tokens, 0);
-  if (total > thresholds.aggregate && files.length > 1) {
+  if (total >= thresholds.aggregate && files.length > 1) {
     return {
       severity: "warning",
       check: "tokens",
@@ -42950,14 +42950,20 @@ function computeSectionCosts(file2) {
     return { title: s.title, line: s.startLine, tokens: countTokens(body) };
   }).sort((a, b2) => b2.tokens - a.tokens);
 }
-function loadSettingsSources(projectRoot) {
-  if (settingsCache?.root === projectRoot) return settingsCache.data;
+function loadSettingsSources(projectRoot, includeGlobal) {
+  if (settingsCache?.root === projectRoot && settingsCache.includeGlobal === includeGlobal) {
+    return settingsCache.data;
+  }
   const sources = [];
   const candidates = [
     path7.join(projectRoot, ".claude", "settings.json"),
-    path7.join(projectRoot, ".claude", "settings.local.json"),
-    path7.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
+    path7.join(projectRoot, ".claude", "settings.local.json")
   ];
+  if (includeGlobal) {
+    candidates.push(
+      path7.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
+    );
+  }
   for (const p2 of candidates) {
     let content;
     try {
@@ -42971,7 +42977,7 @@ function loadSettingsSources(projectRoot) {
       console.warn(`ctxlint: could not parse ${p2}: ${err.message}`);
     }
   }
-  settingsCache = { root: projectRoot, data: sources };
+  settingsCache = { root: projectRoot, includeGlobal, data: sources };
   return sources;
 }
 function canonicalizeCommand(backticked) {
@@ -43023,7 +43029,7 @@ function checkHardEnforcement(file2, settings) {
   }
   return issues;
 }
-async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
+async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS, includeGlobal = false) {
   if (!isAlwaysLoaded(file2)) return [];
   const issues = [];
   const threshold = thresholds.tierBreakdown;
@@ -43045,7 +43051,7 @@ async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_TH
       });
     }
   }
-  const settings = loadSettingsSources(projectRoot);
+  const settings = loadSettingsSources(projectRoot, includeGlobal);
   issues.push(...checkHardEnforcement(file2, settings));
   return issues;
 }
@@ -44067,7 +44073,9 @@ async function checkMcpSecurity(config2, _projectRoot) {
       try {
         if (!isEnvVarRef(server2.url)) {
           const parsed = new URL(server2.url);
-          if (parsed.protocol === "http:" && parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.hostname !== "::1") {
+          const host = parsed.hostname.replace(/^\[|\]$/g, "");
+          const isLoopback = host === "localhost" || host === "::1" || host.startsWith("127.");
+          if (parsed.protocol === "http:" && !isLoopback) {
             issues.push({
               severity: "warning",
               check: "mcp-security",
@@ -44523,6 +44531,7 @@ function checkMissingFromClient(configs) {
 function collectServerNameKeys(content, rootKey) {
   const names = [];
   let i2 = 0;
+  let keyStart = -1;
   let depth = 0;
   let inString = false;
   let escape2 = false;
@@ -44548,6 +44557,7 @@ function collectServerNameKeys(content, rootKey) {
         inString = true;
         collectingKey = true;
         pendingKey = "";
+        keyStart = i2;
       } else {
         inString = false;
         let j3 = i2 + 1;
@@ -44556,7 +44566,11 @@ function collectServerNameKeys(content, rootKey) {
           if (pendingKey === rootKey && rootKeyDepth === -1) {
             rootKeyDepth = depth;
           } else if (rootKeyDepth !== -1 && depth === rootKeyDepth + 1) {
-            names.push(pendingKey);
+            let line = 1;
+            for (let k3 = 0; k3 < keyStart; k3++) {
+              if (content[k3] === "\n") line++;
+            }
+            names.push({ name: pendingKey, line });
           }
         }
         collectingKey = false;
@@ -44582,14 +44596,19 @@ function checkSingleFileIssues(configs) {
     if (!config2.actualRootKey) continue;
     const serverKeys = collectServerNameKeys(config2.content, config2.actualRootKey);
     const counts = /* @__PURE__ */ new Map();
-    for (const k3 of serverKeys) counts.set(k3, (counts.get(k3) ?? 0) + 1);
+    const secondLines = /* @__PURE__ */ new Map();
+    for (const { name, line } of serverKeys) {
+      const next = (counts.get(name) ?? 0) + 1;
+      counts.set(name, next);
+      if (next === 2) secondLines.set(name, line);
+    }
     for (const [name, count] of counts) {
       if (count > 1) {
         issues.push({
           severity: "warning",
           check: "mcp-consistency",
           ruleId: "mcp-consistency/duplicate-server-name",
-          line: 1,
+          line: secondLines.get(name) ?? 1,
           message: `Duplicate server name "${name}" in ${config2.relativePath} \u2014 only the last definition is used`
         });
       }
@@ -44748,6 +44767,17 @@ async function checkMcphApibase(config2, _projectRoot) {
     });
     return issues;
   }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    issues.push({
+      severity: "error",
+      check: "mcph-apibase",
+      ruleId: "mcph-apibase/invalid-apibase",
+      line: pos.line,
+      message: `"apiBase" must be an http(s) URL, got ${parsed.protocol.replace(/:$/, "")}`,
+      suggestion: `Use an absolute http(s) URL, e.g. "https://mcp.hosting".`
+    });
+    return issues;
+  }
   if (parsed.protocol === "http:" && !isPrivateHost(parsed.hostname)) {
     issues.push({
       severity: "warning",
@@ -44941,6 +44971,12 @@ function extractPathsClassified(content) {
       candidates.push(p2);
     }
   }
+  for (const match of content.matchAll(DRIVE_ABS_PATH)) {
+    const p2 = match[1].replace(/[)}\]]+$/, "");
+    if (p2.length > 2) {
+      candidates.push(p2);
+    }
+  }
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const value of candidates) {
@@ -44993,7 +45029,7 @@ async function parseMemoryFile(filePath, projectDir) {
     referencedPaths
   };
 }
-var WEB_FIRST_SEGMENTS, PATH_PATTERN2, BARE_FILE_PATH;
+var WEB_FIRST_SEGMENTS, PATH_PATTERN2, BARE_FILE_PATH, DRIVE_ABS_PATH;
 var init_session_parser = __esm({
   "src/core/session-parser.ts"() {
     "use strict";
@@ -45002,6 +45038,7 @@ var init_session_parser = __esm({
     WEB_FIRST_SEGMENTS = loadWebFirstSegments();
     PATH_PATTERN2 = /(?:^|\s|['"`(])([.~/][^\s'"`),;:!?]+)/g;
     BARE_FILE_PATH = /(?:^|[\s`"'(])([\w][\w-]*(?:\/[\w.-]+)+\.[a-zA-Z0-9]{1,8})\b/g;
+    DRIVE_ABS_PATH = /(?:^|[\s`"'(])([A-Za-z]:[\\/][^\s'"`),;!?]+)/g;
   }
 });
 
@@ -45201,7 +45238,12 @@ var init_session_scanner = __esm({
       },
       {
         provider: "goose",
-        dir: process.platform === "win32" ? join5(process.env.APPDATA || "", "Block", "goose") : join5(home, ".config", "goose")
+        // On win32 the goose dir lives under %APPDATA%. If APPDATA is unset,
+        // `join('', 'Block', 'goose')` yields the cwd-relative `Block/goose`,
+        // which the HOME guard in `detectProviders` does NOT catch (HOME/USERPROFILE
+        // may still be set). Leave the dir empty so `existsSync('')` is always false
+        // and we never match a cwd-relative `Block/goose`, mirroring the HOME-guard intent.
+        dir: process.platform === "win32" ? process.env.APPDATA ? join5(process.env.APPDATA, "Block", "goose") : "" : join5(home, ".config", "goose")
       },
       { provider: "continue", dir: join5(home, ".continue") },
       {
@@ -45217,15 +45259,45 @@ import { resolve as resolve6, basename as basename3 } from "node:path";
 function normalizePath2(p2) {
   return resolve6(p2).replace(/\\/g, "/").toLowerCase();
 }
+function extractSecretName(display) {
+  const prefixMatch = display.match(SECRET_SET_PREFIX);
+  if (!prefixMatch) return void 0;
+  const rest = display.slice(prefixMatch.index + prefixMatch[0].length);
+  const tokens = rest.split(/\s+/).filter((t2) => t2.length > 0);
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const tok = tokens[i2];
+    if (!tok.startsWith("-")) return tok;
+    if (VALUE_FLAGS.has(tok) && !tok.includes("=")) i2++;
+  }
+  return void 0;
+}
+function repoBasename(repoSpec) {
+  return (repoSpec.split("/").pop() || repoSpec).toLowerCase();
+}
+function repoMatchesSibling(repoSpec, sib) {
+  const slash = repoSpec.indexOf("/");
+  const sibBase = basename3(normalizePath2(sib.path));
+  if (slash === -1) {
+    return repoBasename(repoSpec) === sibBase;
+  }
+  const owner = repoSpec.slice(0, slash).toLowerCase();
+  const repoName = repoSpec.slice(slash + 1).toLowerCase();
+  if (repoName !== sibBase) return false;
+  if (sib.gitOrg) return sib.gitOrg.toLowerCase() === owner;
+  if (sib.gitRemoteUrl) {
+    return sib.gitRemoteUrl.toLowerCase().includes(`${owner}/${repoName}`);
+  }
+  return true;
+}
 async function checkMissingSecret(ctx) {
   const issues = [];
   const secrets = [];
   for (const entry of ctx.history) {
-    const match = entry.display.match(SECRET_SET_SIMPLE);
-    if (!match) continue;
+    const name = extractSecretName(entry.display);
+    if (!name) continue;
     const repoMatch = entry.display.match(REPO_FLAG_PATTERN);
     secrets.push({
-      name: match[1],
+      name,
       repo: repoMatch ? repoMatch[1] : void 0,
       project: entry.project
     });
@@ -45233,28 +45305,22 @@ async function checkMissingSecret(ctx) {
   if (secrets.length === 0) return issues;
   const byName = /* @__PURE__ */ new Map();
   for (const s of secrets) {
-    if (!byName.has(s.name)) byName.set(s.name, /* @__PURE__ */ new Set());
-    byName.get(s.name).add(s.project);
-    if (s.repo) byName.get(s.name).add(s.repo);
+    if (!byName.has(s.name)) byName.set(s.name, { projects: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set() });
+    const bucket = byName.get(s.name);
+    bucket.projects.add(s.project);
+    if (s.repo) bucket.repos.add(s.repo);
   }
   const currentNorm = normalizePath2(ctx.currentProject);
   const currentBase = basename3(currentNorm);
-  for (const [secretName, projects] of byName) {
+  for (const [secretName, { projects, repos }] of byName) {
     const normalizedProjects = [...projects].map(normalizePath2);
-    const currentHas = normalizedProjects.some((p2) => {
-      if (p2 === currentNorm) return true;
-      const lastSegment = p2.split("/").pop() || "";
-      return lastSegment === currentBase;
-    });
+    const repoSpecs = [...repos];
+    const currentHas = normalizedProjects.some((p2) => p2 === currentNorm) || repoSpecs.some((r2) => repoBasename(r2) === currentBase);
     if (currentHas) continue;
     const siblingMatches = ctx.siblings.filter((sib) => {
       const sibNorm = normalizePath2(sib.path);
-      const sibBase = basename3(sibNorm);
-      return normalizedProjects.some((p2) => {
-        if (p2 === sibNorm) return true;
-        const lastSegment = p2.split("/").pop() || "";
-        return lastSegment === sibBase;
-      });
+      if (normalizedProjects.some((p2) => p2 === sibNorm)) return true;
+      return repoSpecs.some((r2) => repoMatchesSibling(r2, sib));
     });
     if (siblingMatches.length >= 2) {
       const sibNames = siblingMatches.map((s) => s.name).join(", ");
@@ -45271,13 +45337,14 @@ async function checkMissingSecret(ctx) {
   }
   return issues;
 }
-var SECRET_SET_SIMPLE, REPO_FLAG_PATTERN;
+var SECRET_SET_PREFIX, REPO_FLAG_PATTERN, VALUE_FLAGS;
 var init_missing_secret = __esm({
   "src/core/checks/session/missing-secret.ts"() {
     "use strict";
     init_define_WEB_FIRST_SEGMENTS();
-    SECRET_SET_SIMPLE = /gh\s+secret\s+set\s+(\S+)/;
+    SECRET_SET_PREFIX = /gh\s+secret\s+set\s+/;
     REPO_FLAG_PATTERN = /--repo\s+(\S+)/;
+    VALUE_FLAGS = /* @__PURE__ */ new Set(["--repo", "-R", "-b", "--body", "--app", "--env"]);
   }
 });
 
@@ -45438,14 +45505,14 @@ var init_missing_workflow = __esm({
 
 // src/core/checks/session/stale-memory.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { resolve as resolve8, isAbsolute as isAbsolute2 } from "node:path";
+import { resolve as resolve8, isAbsolute as isAbsolute3 } from "node:path";
 function resolveRef2(ref, projectRoot) {
   if (ref.startsWith("~/") || ref === "~") {
     const home2 = process.env.HOME || process.env.USERPROFILE;
     if (!home2) return null;
     return ref === "~" ? home2 : resolve8(home2, ref.slice(2));
   }
-  if (isAbsolute2(ref)) return ref;
+  if (isAbsolute3(ref)) return ref;
   return resolve8(projectRoot, ref);
 }
 async function checkStaleMemory(ctx) {
@@ -45470,6 +45537,7 @@ async function checkStaleMemory(ctx) {
         ruleId: "session-stale-memory/stale-memory",
         line: 0,
         message: `Memory "${name}" references ${brokenPaths.length} path(s) that no longer exist: ${brokenPaths.join(", ")}`,
+        affectedPaths: brokenPaths,
         suggestion: `Update or remove the memory file: ${mem.filePath}`,
         detail: `Memory files with broken path references may cause the AI agent to follow stale instructions`
       });
@@ -45663,7 +45731,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session-memory-index-overflow/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/line-overflow",
       line: MAX_LINES + 1,
       message: `MEMORY.md has ${lineCount.toLocaleString()} lines \u2014 only the first ${MAX_LINES} are loaded. ${excess.toLocaleString()} line(s) are effectively invisible to the agent.`,
       detail: `File: ${memoryFile}`,
@@ -45675,7 +45743,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session-memory-index-overflow/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/byte-overflow",
       line: 0,
       message: `MEMORY.md is ${byteSize.toLocaleString()} bytes \u2014 only the first ${MAX_BYTES.toLocaleString()} bytes are loaded. ~${excess.toLocaleString()} bytes are effectively invisible.`,
       detail: `File: ${memoryFile}`,
@@ -46585,7 +46653,7 @@ function applyIgnoreRules(issues, rules) {
       if (rule.check !== issue2.check) continue;
       if (rule.pathPattern) {
         if (issue2.check !== "session-stale-memory") continue;
-        const paths = extractPathsFromMessage(issue2.message);
+        const paths = issue2.affectedPaths ?? extractPathsFromMessage(issue2.message);
         if (paths.length === 0) continue;
         const allMatch = paths.every((p2) => rule.pathPattern.test(p2));
         if (!allMatch) continue;
@@ -46643,7 +46711,7 @@ import { readFileSync as readFileSync7 } from "node:fs";
 import { resolve as resolve12, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function loadVersion() {
-  if (true) return "0.13.1";
+  if (true) return "0.13.2";
   const __dir = dirname6(fileURLToPath2(import.meta.url));
   const pkgPath = resolve12(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
@@ -46698,7 +46766,9 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       if (activeChecks.includes("tokens"))
         checkPromises.push(checkTokens(file2, projectRoot, thresholds));
       if (activeChecks.includes("tier-tokens"))
-        checkPromises.push(checkTierTokens(file2, projectRoot, thresholds));
+        checkPromises.push(
+          checkTierTokens(file2, projectRoot, thresholds, Boolean(options.hooksGlobal))
+        );
       if (activeChecks.includes("redundancy"))
         checkPromises.push(checkRedundancy(file2, projectRoot));
       if (activeChecks.includes("frontmatter"))
@@ -46973,8 +47043,9 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       if (typeof issue2.wastedTokens === "number") {
         estimatedWaste += issue2.wastedTokens;
       } else if (issue2.suggestion) {
-        const tokenMatch = issue2.suggestion.match(/~(\d+)\s+tokens/);
-        if (tokenMatch) estimatedWaste += parseInt(tokenMatch[1], 10);
+        for (const m of issue2.suggestion.matchAll(/~(\d+)\s+tokens/g)) {
+          estimatedWaste += parseInt(m[1], 10);
+        }
       }
     }
   }
@@ -47652,12 +47723,6 @@ function applyFixes(result, options = {}) {
   } : console.log.bind(console);
   const dryRun = options.dryRun ?? false;
   const skipSymlinks = options.skipSymlinks ?? true;
-  const symlinkFiles = /* @__PURE__ */ new Set();
-  if (skipSymlinks) {
-    for (const f of result.files) {
-      if (f.isSymlink) symlinkFiles.add(f.path);
-    }
-  }
   const fixesByFile = /* @__PURE__ */ new Map();
   const dedupeKeys = /* @__PURE__ */ new Map();
   const skippedSymlinks = /* @__PURE__ */ new Set();
@@ -48213,7 +48278,7 @@ var init_server3 = __esm({
         checks: external_exports3.array(mcphCheckEnum).optional().describe("Specific mcph checks to run (default: all mcph-* checks)."),
         includeGlobal: external_exports3.boolean().optional().describe("Also scan ~/.mcph.json (user-global config)."),
         strictEnvToken: external_exports3.boolean().optional().describe(
-          "Upgrade mcph-config/prefer-env-token from warning to error (env-var-only posture)."
+          "Upgrade mcph-token-security/prefer-env-token from warning to error (env-var-only posture)."
         )
       },
       {
@@ -54960,12 +55025,13 @@ function formatTokenReport(result) {
     source_default.dim("  (counts use GPT-4 cl100k_base tokenizer \u2014 Claude counts may vary slightly)")
   );
   lines.push("");
-  const maxPathLen = Math.max(...result.files.map((f) => f.path.length), 4);
+  const realFiles = result.files.filter((f) => !isSyntheticBucket(f.path));
+  const maxPathLen = Math.max(...realFiles.map((f) => f.path.length), 4);
   lines.push(
     `  ${source_default.dim("File".padEnd(maxPathLen))}  ${source_default.dim("Tokens".padStart(8))}  ${source_default.dim("Lines".padStart(6))}`
   );
   lines.push(`  ${"-".repeat(maxPathLen)}  ${"-".repeat(8)}  ${"-".repeat(6)}`);
-  for (const file2 of result.files) {
+  for (const file2 of realFiles) {
     const tokenStr = file2.tokens.toLocaleString().padStart(8);
     const lineStr = file2.lines.toString().padStart(6);
     lines.push(`  ${file2.path.padEnd(maxPathLen)}  ${tokenStr}  ${lineStr}`);
@@ -54986,7 +55052,7 @@ function formatTokenReport(result) {
   return lines.join("\n");
 }
 function isSyntheticPath(p2) {
-  return p2.startsWith("(") || p2.startsWith("~");
+  return isSyntheticBucket(p2) || p2.startsWith("~");
 }
 function formatSarif(result) {
   const severityToLevel = {
@@ -55308,7 +55374,7 @@ async function runCli() {
     new Option("--format <format>", "Output format: text, json, or sarif").choices(["text", "json", "sarif"]).default("text")
   ).option("--tokens", "Show token breakdown per file", false).option("--verbose", "Show passing checks too", false).option("--fix", "Auto-fix broken paths using git history and fuzzy matching", false).option("--fix-dry-run", "Preview --fix changes without writing", false).option("--yes", "Skip interactive confirmation prompts (required for --fix in TTY)", false).option("--follow-symlinks", "Allow --fix to write through symlinks (default: skip)", false).option("--ignore <checks>", "Comma-separated list of checks to ignore", "").option("--quiet", "Suppress all output except errors (exit code only)", false).option("--config <path>", "Path to config file (default: .ctxlintrc in project root)").option("--depth <n>", "Max subdirectory depth to scan (default: 2)", "2").option("--mcp", "Enable MCP config linting alongside context file checks", false).option("--mcp-only", "Run only MCP config checks, skip context file checks", false).option("--mcp-global", "Also scan user/global MCP config files (implies --mcp)", false).option("--mcp-server", "Start the MCP server (alias: `ctxlint serve`)").option("--mcph", "Enable .mcph.json (mcp.hosting CLI config) linting", false).option("--mcph-only", "Run only mcph config checks", false).option("--mcph-global", "Also scan ~/.mcph.json (implies --mcph)", false).option(
     "--mcph-strict-env-token",
-    "Upgrade mcph-config/prefer-env-token from warning to error (strict env-var-only posture)",
+    "Upgrade mcph-token-security/prefer-env-token from warning to error (strict env-var-only posture)",
     false
   ).option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--skills", "Run agent-skill checks (~/.claude/skills + ~/.claude/agents)", false).option("--skills-only", "Run only agent-skill checks, skip everything else", false).option(
     "--hooks-global",
@@ -55342,7 +55408,7 @@ async function runCli() {
       if (result.files.length === 0) {
         if (!options.quiet) {
           if (options.format === "json") {
-            console.log(JSON.stringify(result));
+            console.log(formatJson(result));
           } else if (options.format === "sarif") {
             console.log(formatSarif(result));
           } else {
@@ -55482,7 +55548,7 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
           let liveOptions = options;
           let liveActiveChecks = activeChecks;
           try {
-            const resolved = resolveSession(resolvedPath, opts);
+            const resolved = resolveSession(resolvedPath, opts, true);
             liveConfig = resolved.config;
             liveOptions = resolved.options;
             liveActiveChecks = resolved.activeChecks;
@@ -55604,9 +55670,9 @@ async function promptYesNo(question) {
     rl.close();
   }
 }
-function resolveSession(resolvedPath, opts) {
+function resolveSession(resolvedPath, opts, throwOnConfigError = false) {
   const configPath = opts.config ? path16.resolve(opts.config) : void 0;
-  const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
+  const config2 = configPath ? loadConfigFromPath(configPath, throwOnConfigError) : loadConfig(resolvedPath);
   const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
   const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
   const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
@@ -55683,10 +55749,11 @@ function resolveSession(resolvedPath, opts) {
   const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
   return { config: config2, options, activeChecks };
 }
-function loadConfigFromPath(configPath) {
+function loadConfigFromPath(configPath, throwOnError = false) {
   try {
     return loadConfigFromExplicitPath(configPath);
   } catch (err) {
+    if (throwOnError) throw err;
     const detail = err instanceof Error ? err.message : String(err);
     console.error(`Error: ${detail}`);
     process.exit(2);

package/mcph-config-lint-rules.json

@@ -35,7 +35,7 @@
   ],
   "rules": [
     {
-      "id": "mcph-config/token-in-project-scope",
+      "id": "mcph-token-security/token-in-project-scope",
       "category": "mcph-token-security",
       "severity": "error",
       "description": "A project-scope .mcph.json that is git-tracked contains a \"token\" field. The PAT will leak via git history.",
@@ -46,18 +46,18 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/local-file-not-gitignored",
+      "id": "mcph-gitignore/local-file-not-gitignored",
       "category": "mcph-gitignore",
       "severity": "error",
       "description": "A .mcph.local.json file exists but is not covered by .gitignore. The file exists precisely so machine-local overrides stay machine-local.",
       "trigger": "scope === 'project-local' && !isGitignored",
       "message": "{file} is not covered by .gitignore — machine-local overrides can leak via git",
-      "fixable": true,
+      "fixable": false,
       "fixDescription": "Append \".mcph.local.json\" to .gitignore in the project root.",
       "stability": "stable"
     },
     {
-      "id": "mcph-config/invalid-token-format",
+      "id": "mcph-token-security/invalid-token-format",
       "category": "mcph-token-security",
       "severity": "error",
       "description": "The \"token\" value doesn't match the mcp.hosting PAT format (^mcp_pat_[A-Za-z0-9_-]+$).",
@@ -68,7 +68,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/insecure-apibase",
+      "id": "mcph-apibase/insecure-apibase",
       "category": "mcph-apibase",
       "severity": "warning",
       "description": "The \"apiBase\" URL uses plaintext HTTP to a public (non-localhost, non-private) host. The MCPH_TOKEN would travel in the clear.",
@@ -79,7 +79,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/invalid-apibase",
+      "id": "mcph-apibase/invalid-apibase",
       "category": "mcph-apibase",
       "severity": "error",
       "description": "The \"apiBase\" field is not a valid absolute URL.",
@@ -90,7 +90,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/unknown-field",
+      "id": "mcph-schema-conformance/unknown-field",
       "category": "mcph-schema-conformance",
       "severity": "warning",
       "description": "A top-level field appears that is not in the mcph config schema. Usually a typo (tokens vs token, blockList vs blocked).",
@@ -101,7 +101,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/stale-version",
+      "id": "mcph-schema-conformance/stale-version",
       "category": "mcph-schema-conformance",
       "severity": "info",
       "description": "The \"version\" field is older than the current schema version.",
@@ -112,7 +112,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/allowlist-denylist-conflict",
+      "id": "mcph-lists/allowlist-denylist-conflict",
       "category": "mcph-lists",
       "severity": "warning",
       "description": "A server namespace appears in both the allow-list (\"servers\") and deny-list (\"blocked\"). Deny wins in practice, so the allow-list entry is dead weight.",
@@ -123,7 +123,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/duplicate-entries",
+      "id": "mcph-lists/duplicate-entries",
       "category": "mcph-lists",
       "severity": "info",
       "description": "The same value appears more than once in a servers or blocked array.",
@@ -134,7 +134,7 @@
       "stability": "stable"
     },
     {
-      "id": "mcph-config/prefer-env-token",
+      "id": "mcph-token-security/prefer-env-token",
       "category": "mcph-token-security",
       "severity": "warning",
       "configurable": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "mcpName": "io.github.YawLabs/ctxlint",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {