@yawlabs/ctxlint 0.14.0 → 0.15.0

package/README.md

@@ -32,7 +32,7 @@ ctxlint is a linter purpose-built for this. It reads your context files, cross-r
 - **Token-aware** — shows how much context window your files consume and flags redundant content
 - **Every AI tool** — supports Claude Code, Cursor, Copilot, Windsurf, Gemini, Cline, Aider, and 9 more
 - **Multiple outputs** — text, JSON, and SARIF (GitHub Code Scanning)
-- **MCP server** — 6 tools for IDE/agent integration with tool annotations for auto-approval
+- **MCP server** — 7 tools for IDE/agent integration with tool annotations for auto-approval
 - **Watch mode** — `--watch` re-lints automatically when context files change
 
 ## Install
@@ -82,6 +82,7 @@ Useful if you want `ctxlint` available in every project without per-project setu
 | **Frontmatter**       | Invalid or missing YAML frontmatter in Cursor .mdc, Copilot instructions, and Windsurf rules                                                                                                                                                                                     |
 | **CI coverage**       | Release/deploy workflows in `.github/workflows/` not documented in any context file                                                                                                                                                                                              |
 | **CI secrets**        | Secrets used in CI workflows (`${{ secrets.X }}`) not mentioned in context files                                                                                                                                                                                                 |
+| **Inline secrets**    | Real secrets pasted into context files — private-key headers, AWS/GitHub/Anthropic/OpenAI/npm/Slack/Google/Stripe token shapes. Messages never echo the secret (6-char redacted prefix only)                                                                                     |
 | **Dead hooks**        | PreToolUse hooks / permissions entries in `.claude/settings.json` pointing at scripts that no longer exist (a dead gate silently no-ops). Scans project `.claude/settings.json[.local]` by default; pass `--hooks-global` to also scan the user-global `~/.claude/settings.json` |
 | **Missing secrets**   | GitHub secrets set on sibling repos but missing from current project                                                                                                                                                                                                             |
 | **Diverged configs**  | Canonical config files (CI, tsconfig, etc.) drifting across sibling projects                                                                                                                                                                                                     |
@@ -89,6 +90,7 @@ Useful if you want `ctxlint` available in every project without per-project setu
 | **Stale memory**      | Claude Code memory entries referencing paths that no longer exist                                                                                                                                                                                                                |
 | **Duplicate memory**  | Near-duplicate memories across projects (>60% content overlap)                                                                                                                                                                                                                   |
 | **Loop detection**    | Agent stuck in loops — repeated commands or cyclic patterns in session history                                                                                                                                                                                                   |
+| **Memory overflow**   | `MEMORY.md` past Claude Code's 200-line / 25KB session-load cap — entries beyond it are invisible to the agent                                                                                                                                                                   |
 
 ## Supported Context Files
 
@@ -215,7 +217,7 @@ Session checks are **opt-in** because they access files outside the project dire
 
 ### Session Linting Specification
 
-- **[`AGENT_SESSION_LINT_SPEC.md`](./AGENT_SESSION_LINT_SPEC.md)** — 8 lint rules, the agent session data landscape across 8 agents, sibling detection strategy, and implementation guidance.
+- **[`AGENT_SESSION_LINT_SPEC.md`](./AGENT_SESSION_LINT_SPEC.md)** — the full lint-rule set (rule count in the [Specifications](#specifications) family table), the agent session data landscape across 8 agents, sibling detection strategy, and implementation guidance.
 - **[`agent-session-lint-rules.json`](./agent-session-lint-rules.json)** — Machine-readable rule catalog.
 
 ## Example Output
@@ -269,6 +271,10 @@ Options:
   --mcp-global              Also scan user/global MCP config files (implies --mcp)
   --session                 Enable session audit checks (cross-project consistency)
   --session-only            Run only session checks, skip context and MCP checks
+  --skills                  Run agent-skill checks (~/.claude/skills + ~/.claude/agents)
+  --skills-only             Run only agent-skill checks, skip everything else
+  --hooks-global            Also scan the user-global ~/.claude/settings.json in the
+                            dead-hook check (default scans project .claude/ only)
   --mcp-server              Start the MCP server (alias: `serve` subcommand)
   --watch                   Re-lint on context file changes
   -V, --version             Output the version number
@@ -278,9 +284,9 @@ Commands:
   init                 Set up a git pre-commit hook
 ```
 
-**Available checks:** `paths`, `commands`, `staleness`, `tokens`, `tier-tokens`, `redundancy`, `contradictions`, `frontmatter`, `ci-coverage`, `ci-secrets`, `mcp-schema`, `mcp-security`, `mcp-commands`, `mcp-deprecated`, `mcp-env`, `mcp-urls`, `mcp-consistency`, `mcp-redundancy`, `session-missing-secret`, `session-diverged-file`, `session-missing-workflow`, `session-stale-memory`, `session-duplicate-memory`, `session-loop-detection`, `session-memory-index-overflow`
+**Available checks:** `paths`, `commands`, `staleness`, `tokens`, `tier-tokens`, `redundancy`, `contradictions`, `frontmatter`, `ci-coverage`, `ci-secrets`, `content-secrets`, `hook-coverage`, `mcp-schema`, `mcp-security`, `mcp-commands`, `mcp-deprecated`, `mcp-env`, `mcp-urls`, `mcp-consistency`, `mcp-redundancy`, `session-missing-secret`, `session-diverged-file`, `session-missing-workflow`, `session-stale-memory`, `session-duplicate-memory`, `session-loop-detection`, `session-memory-index-overflow`, `skill-frontmatter`, `skill-broken-ref`, `skill-trigger-collision`, `skill-orphaned`, `skill-dead-tool-restriction`
 
-Passing any `mcp-*` check name implies `--mcp`. Passing any `session-*` check name implies `--session`.
+Passing any `mcp-*` check name implies `--mcp`. Passing any `session-*` check name implies `--session`. Passing any `skill-*` check name implies `--skills`.
 
 ## Watch Mode
 
@@ -392,7 +398,7 @@ The `contextFiles` array adds custom file patterns to scan alongside the built-i
 
 | Field                           | Type       | Default    | Meaning                                                                                                                                                                                                   |
 | ------------------------------- | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `checks`                        | `string[]` | all checks | Checks to run. Check names include `paths`, `commands`, `tokens`, `tier-tokens`, `redundancy`, `contradictions`, `frontmatter`, `staleness`, `ci-coverage`, `ci-secrets`, plus any `mcp-*` / `session-*`. |
+| `checks`                        | `string[]` | all checks | Checks to run. Check names include `paths`, `commands`, `tokens`, `tier-tokens`, `redundancy`, `contradictions`, `frontmatter`, `staleness`, `ci-coverage`, `ci-secrets`, `content-secrets`, `hook-coverage`, plus any `mcp-*` / `session-*` / `skill-*`. |
 | `ignore`                        | `string[]` | `[]`       | Checks to skip, evaluated after `checks`.                                                                                                                                                                 |
 | `strict`                        | `boolean`  | `false`    | Exit non-zero on any warning or error.                                                                                                                                                                    |
 | `tokenThresholds`               | `object`   | see below  | Per-file and cross-file token thresholds.                                                                                                                                                                 |
@@ -408,6 +414,8 @@ The `contextFiles` array adds custom file patterns to scan alongside the built-i
 | `mcpGlobal`                     | `boolean`  | `false`    | Also scan user/global MCP configs (same as `--mcp-global`).                                                                                                                                               |
 | `session`                       | `boolean`  | `false`    | Enable session audit checks (cross-project consistency); same as `--session`.                                                                                                                             |
 | `sessionOnly`                   | `boolean`  | `false`    | Run only session checks, skip context and MCP checks (same as `--session-only`).                                                                                                                          |
+| `skills`                        | `boolean`  | `false`    | Enable agent-skill checks (`~/.claude/skills` + `~/.claude/agents`); same as `--skills`.                                                                                                                  |
+| `skillsOnly`                    | `boolean`  | `false`    | Run only agent-skill checks, skip everything else (same as `--skills-only`).                                                                                                                              |
 
 Config file resolution order: `.ctxlintrc` → `.ctxlintrc.json` in the project root. Use `--config <path>` to point elsewhere. CLI flags override config fields.
 
@@ -415,7 +423,7 @@ CLI flags override config file settings. Use `--config <path>` to load a config
 
 ## Use as MCP Server
 
-ctxlint ships with an MCP server that exposes six tools (`ctxlint_audit`, `ctxlint_mcp_audit`, `ctxlint_session_audit`, `ctxlint_validate_path`, `ctxlint_token_report`, `ctxlint_fix`). All read-only tools declare annotations so MCP clients can skip confirmation dialogs.
+ctxlint ships with an MCP server that exposes seven tools (`ctxlint_audit`, `ctxlint_mcp_audit`, `ctxlint_session_audit`, `ctxlint_skill_audit`, `ctxlint_validate_path`, `ctxlint_token_report`, `ctxlint_fix`). All read-only tools declare annotations so MCP clients can skip confirmation dialogs.
 
 Launch it with the `serve` subcommand (or the equivalent `--mcp-server` flag, kept for back-compat):
 
@@ -505,8 +513,8 @@ ctxlint is the reference implementation of four open specifications for linting
 
 | Spec                                                           | What it covers                                                                                                                                                                                                                            |
 | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[AI Context File Linting Spec](./CONTEXT_LINT_SPEC.md)**     | 28 rules for validating context files (CLAUDE.md, .cursorrules, AGENTS.md, etc.) across 17 clients. Covers file formats, frontmatter schemas, path/command validation, staleness, token budgets, redundancy, and contradictions.          |
-| **[MCP Config Linting Spec](./MCP_CONFIG_LINT_SPEC.md)**       | 27 rules for validating MCP server configs (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, etc.) across 8 clients. Covers schema validation, hardcoded secrets, env var syntax, deprecated transports, and cross-file consistency.        |
+| **[AI Context File Linting Spec](./CONTEXT_LINT_SPEC.md)**     | 39 rules for validating context files (CLAUDE.md, .cursorrules, AGENTS.md, etc.) across 16 clients. Covers file formats, frontmatter schemas, path/command validation, staleness, token budgets, redundancy, and contradictions.          |
+| **[MCP Config Linting Spec](./MCP_CONFIG_LINT_SPEC.md)**       | 28 rules for validating MCP server configs (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, etc.) across 8 clients. Covers schema validation, hardcoded secrets, env var syntax, deprecated transports, and cross-file consistency.        |
 | **[Agent Session Linting Spec](./AGENT_SESSION_LINT_SPEC.md)** | 8 rules for auditing agent session data (history, memory) across 8 agents. Covers cross-project secret consistency, config drift, stale memory, and loop detection.                                                                       |
 | **[Agent Skill Linting Spec](./AGENT_SKILL_LINT_SPEC.md)**     | 5 rules for auditing Claude Code skill (`SKILL.md`) and agent (`.md`) definitions under `~/.claude`. Covers frontmatter presence, broken refs, trigger-phrase collisions, orphaned skills, and dead tool restrictions. (v1, experimental) |
 

package/action.yml

@@ -24,4 +24,14 @@ runs:
 
     - name: Run ctxlint
       shell: bash
-      run: npx -y @yawlabs/ctxlint@${{ inputs.version }} ${{ inputs.args }}
+      # Inputs flow through env vars, never interpolated inline into the
+      # script body: expression interpolation pastes the raw input into the
+      # shell script before it runs, so a consumer workflow that wires
+      # attacker-influenceable data (issue title, branch name) into `with:`
+      # would hand that data command execution on their runner.
+      # CTXLINT_ARGS is expanded unquoted on purpose -- it carries multiple
+      # whitespace-separated CLI flags that must word-split.
+      env:
+        CTXLINT_VERSION: ${{ inputs.version }}
+        CTXLINT_ARGS: ${{ inputs.args }}
+      run: npx -y "@yawlabs/ctxlint@${CTXLINT_VERSION}" ${CTXLINT_ARGS}

package/agent-session-lint-rules.json

@@ -69,7 +69,7 @@
       "category": "session",
       "severity": "info",
       "description": "Near-duplicate memory entries across projects.",
-      "trigger": "Two memory files from different projects have >60% line overlap.",
+      "trigger": "Two memory files from different projects have >60% line overlap, and at least one of the pair belongs to the current project (otherwise every lint run from any repo would resurface the same unrelated cross-project duplicates).",
       "message": "\"{file1}\" and \"{file2}\" have {overlap}% content overlap",
       "fixable": false,
       "stability": "stable"
@@ -79,7 +79,7 @@
       "category": "session",
       "severity": "warning",
       "description": "Same command run 3+ times consecutively in agent history.",
-      "trigger": "Agent history for the current project shows the same display string 3+ times in a row.",
+      "trigger": "Agent history for the current project (entries lacking a project path or timestamp are excluded), grouped into sessions (by provider + session ID, split at >30-minute timestamp gaps), shows the same display string 3+ times in a row within a single session segment. Single-command sessions are additionally merged per provider into one stream (split at the same gaps) so rapid one-shot respawn loops are caught.",
       "message": "Command run {count} times consecutively: \"{command}\"",
       "fixable": false,
       "stability": "experimental"
@@ -89,7 +89,7 @@
       "category": "session",
       "severity": "warning",
       "description": "Cyclic command pattern detected in agent history.",
-      "trigger": "Agent history shows a repeating sequence of 2-3 commands (e.g. A,B,A,B) repeated 2+ times.",
+      "trigger": "Within a single session segment (same provider + session ID, split at >30-minute gaps; entries lacking a project path or timestamp are excluded), agent history shows a repeating sequence of 2-3 commands (e.g. A,B,A,B) repeated 2+ times. Spans already reported by session/consecutive-repeat are not re-reported. The merged one-shot stream is not scanned for cycles.",
       "message": "Cyclic pattern repeated {count} times: {cycle}",
       "fixable": false,
       "stability": "experimental"

package/agent-skill-lint-rules.json

@@ -19,7 +19,7 @@
       "category": "skill",
       "severity": "warning",
       "description": "A SKILL.md or agent .md file is missing required YAML frontmatter, or a required field within it. Skills and agents key off `name` + `description`; the description drives selection, so a missing one means the skill/agent is never invoked.",
-      "trigger": "The file has no `---`-delimited frontmatter, has unclosed frontmatter, or is missing a required field (name, description). A missing file body altogether is reported as error; a missing single field as warning.",
+      "trigger": "The file has no `---`-delimited frontmatter, has unclosed frontmatter, or is missing a required field (name, description). Absent or unclosed frontmatter is reported as error; a missing single field as warning.",
       "message": "{file}: missing required frontmatter field \"{field}\"",
       "fixable": false,
       "stability": "experimental"
@@ -58,8 +58,8 @@
       "id": "skill/dead-tool-restriction",
       "category": "skill",
       "severity": "warning",
-      "description": "An agent definition's tool restriction (tools / allowed-tools frontmatter) lists a tool name that is not a known Claude Code built-in tool. A dead restriction silently fails to grant/deny the intended tool. MCP-namespaced tools (mcp__server__tool) and wildcards are not validated (their existence depends on loaded MCP servers).",
-      "trigger": "A non-MCP, non-wildcard entry in an agent's tools/allowed-tools list does not match a known built-in Claude Code tool name (Bash, Read, Edit, Glob, Grep, Write, Task, WebFetch, WebSearch, etc.).",
+      "description": "An agent definition's tool restriction (tools / allowed-tools frontmatter) lists a tool name that is not a known Claude Code built-in tool. A dead restriction silently fails to grant/deny the intended tool. MCP-namespaced tools (mcp__server__tool) and wildcards are not validated (their existence depends on loaded MCP servers). Severity is split by name shape: an unknown PascalCase name is reported as info (it may be a built-in newer than the linter's known-tool list, which drifts across Claude Code versions); anything else (lowercase, separators) doesn't match Claude Code's naming and is reported as warning (far more likely a typo).",
+      "trigger": "A non-MCP, non-wildcard entry in an agent's tools/allowed-tools list does not match a known built-in Claude Code tool name (Bash, Read, Edit, Glob, Grep, Write, Task, WebFetch, WebSearch, etc.). Unknown PascalCase names downgrade to info; other shapes keep the warning.",
       "message": "{file}: tool restriction lists \"{tool}\" which is not a known Claude Code tool",
       "fixable": false,
       "stability": "experimental"

package/context-lint-rules.json

@@ -70,6 +70,12 @@
       "name": "Hook Enforcement Coverage",
       "description": "Validates that PreToolUse hooks and permissions entries in .claude/settings.json reference scripts that exist on disk. The inverse of tier-tokens/hard-enforcement-missing.",
       "scope": "cross-file"
+    },
+    {
+      "id": "content-secrets",
+      "name": "Inline Secret Detection",
+      "description": "Detects inline-pasted secrets (API keys, tokens, private-key headers) in context files. Complements mcp-security, which covers MCP config files; this covers the context-file paste surface (CLAUDE.md, AGENTS.md, .cursorrules, etc.).",
+      "scope": "per-file"
     }
   ],
   "rules": [
@@ -154,6 +160,16 @@
       "fixable": false,
       "stability": "stable"
     },
+    {
+      "id": "commands/package-json-missing",
+      "category": "commands",
+      "severity": "info",
+      "description": "package.json is missing or unparseable, so all script/npx/tool command validation silently skips. Emitted once per context file that contains at least one command reference that would otherwise have been validated, so the skip isn't invisible.",
+      "trigger": "package.json cannot be loaded AND the context file references at least one npm-run/shorthand/npx/tool command.",
+      "message": "package.json missing or unparseable — command checks skipped",
+      "fixable": false,
+      "stability": "stable"
+    },
     {
       "id": "staleness/stale",
       "category": "staleness",
@@ -227,7 +243,7 @@
       "category": "tier-tokens",
       "severity": "info",
       "description": "Reports the heaviest top-level sections in an always-loaded context file and suggests demoting the largest to an on-demand tier (skill, subagent, or memory).",
-      "trigger": "An always-loaded context file (CLAUDE.md, AGENTS.md, .cursorrules, etc. — excluding path-scoped rules files) exceeds the tierBreakdown threshold (default 1000 tokens) and contains H1 or H2 sections.",
+      "trigger": "An always-loaded context file (CLAUDE.md, AGENTS.md, .cursorrules, etc. — excluding path-scoped rules files) reaches or exceeds the tierBreakdown threshold (default 1000 tokens; the boundary is inclusive) and contains H1 or H2 sections.",
       "message": "{N} tokens loaded every session — heaviest top-level section(s): ...",
       "fixable": false,
       "configurable": true,
@@ -240,7 +256,7 @@
       "category": "tier-tokens",
       "severity": "warning",
       "description": "Combined token cost of always-loaded context files exceeds the recommended budget.",
-      "trigger": "Two or more always-loaded files total more than the tierAggregate threshold (default 4000 tokens).",
+      "trigger": "Two or more always-loaded files total the tierAggregate threshold (default 4000 tokens) or more; the boundary is inclusive.",
       "message": "{count} always-loaded files total {N} tokens — loaded every session",
       "fixable": false,
       "configurable": true,
@@ -252,8 +268,8 @@
       "id": "tier-tokens/hard-enforcement-missing",
       "category": "tier-tokens",
       "severity": "info",
-      "description": "An always-loaded file uses inviolable framing (NEVER / ALWAYS / DO NOT / MUST NOT) paired with a concrete command, but no corresponding PreToolUse hook or permissions.deny entry exists in settings.json. Rules in always-loaded files are advisory — without a hook the agent may still run the command.",
-      "trigger": "Line in an always-loaded file matches NEVER|ALWAYS|DO NOT|MUST NOT with a backticked command, and .claude/settings.json / ~/.claude/settings.json does not contain a matching PreToolUse hook or permissions.deny entry.",
+      "description": "An always-loaded file uses inviolable framing (NEVER / ALWAYS / DO NOT / MUST NOT) paired with a concrete command, but no corresponding PreToolUse or Stop hook, permissions.deny entry, or permissions.ask entry exists in settings.json. Rules in always-loaded files are advisory — without a hook the agent may still run the command.",
+      "trigger": "Line in an always-loaded file matches NEVER|ALWAYS|DO NOT|MUST NOT with a backticked command, and the project's .claude/settings.json / .claude/settings.local.json does not contain a matching PreToolUse or Stop hook, permissions.deny entry, or permissions.ask entry (ask gates the command behind a human prompt, so it counts as enforcement). The user-global ~/.claude/settings.json is consulted only on explicit opt-in (the same gate as hook-coverage's --hooks-global).",
       "message": "Inviolable framing without a hook to back it up",
       "fixable": false,
       "source": "code.claude.com/docs/en/hooks-guide",
@@ -313,7 +329,7 @@
       "id": "frontmatter/missing",
       "category": "frontmatter",
       "severity": "warning",
-      "description": "File format requires frontmatter but none is present.",
+      "description": "File format requires or recommends frontmatter but none is present. Severity is per-format: warning for Cursor .mdc (frontmatter is required), info for Copilot instructions and Windsurf rules (frontmatter is optional/recommended).",
       "trigger": "Cursor .mdc, Copilot instruction, or Windsurf rule file has no --- frontmatter block.",
       "message": "{format} file is missing frontmatter",
       "fixable": false,
@@ -322,6 +338,11 @@
         "copilot-instructions",
         "windsurf-rules"
       ],
+      "severityByFormat": {
+        "cursor-mdc": "warning",
+        "copilot-instructions": "info",
+        "windsurf-rules": "info"
+      },
       "stability": "stable"
     },
     {
@@ -343,8 +364,8 @@
       "id": "frontmatter/invalid-value",
       "category": "frontmatter",
       "severity": "error",
-      "description": "A frontmatter field has an invalid value.",
-      "trigger": "alwaysApply is not true/false, trigger is not a valid enum value, globs doesn't look like a pattern.",
+      "description": "A frontmatter field has an invalid value. The error severity applies to the unambiguous branches (alwaysApply not a boolean, Windsurf trigger outside the enum); a possibly-malformed globs value (unbalanced brackets or quotes) is reported at warning severity because Cursor accepts bare directory/extension globs.",
+      "trigger": "alwaysApply is not true/false (error), trigger is not a valid enum value (error), or globs has unbalanced brackets/quotes (warning).",
       "message": "Invalid {field} value: \"{value}\"",
       "fixable": false,
       "appliesTo": [
@@ -353,6 +374,21 @@
       ],
       "stability": "stable"
     },
+    {
+      "id": "frontmatter/unclosed",
+      "category": "frontmatter",
+      "severity": "error",
+      "description": "Frontmatter opens with --- but is never closed, so the host loads the file with no frontmatter at all and every parsed field is suspect. Reported instead of frontmatter/missing because the user clearly tried to write frontmatter.",
+      "trigger": "File opens with a --- line but no matching closing --- line follows (typical cause: the closing fence typo'd as -- or ___, or indented).",
+      "message": "Frontmatter opens with `---` but is never closed",
+      "fixable": false,
+      "appliesTo": [
+        "cursor-mdc",
+        "copilot-instructions",
+        "windsurf-rules"
+      ],
+      "stability": "stable"
+    },
     {
       "id": "frontmatter/no-activation",
       "category": "frontmatter",
@@ -391,10 +427,100 @@
       "category": "hook-coverage",
       "severity": "warning",
       "description": "A PreToolUse (or other) hook command, or a permissions entry, in .claude/settings.json references a script/path that does not exist on disk. The gate silently no-ops -- Claude Code cannot run a missing script, so the protection the user believes is in place does nothing.",
-      "trigger": "A hooks.<Event>[].hooks[].command or permissions.{allow,deny,ask}[] entry contains a path-shaped token (resolved through ~, $CLAUDE_PROJECT_DIR, $CLAUDE_CONFIG_DIR, $HOME) that does not exist on disk. Entries with unresolvable env vars are skipped (cannot be verified). Scans project .claude/settings.json + settings.local.json and user ~/.claude/settings.json.",
+      "trigger": "A hooks.<Event>[].hooks[].command or permissions.{allow,deny,ask}[] entry contains a path-shaped token (resolved through ~, $CLAUDE_PROJECT_DIR, $CLAUDE_CONFIG_DIR, $HOME) that does not exist on disk. Entries with unresolvable env vars are skipped (cannot be verified). Scans project .claude/settings.json + settings.local.json; the user-global ~/.claude/settings.json is scanned only on explicit opt-in (--hooks-global).",
       "message": "{origin} references \"{path}\" which does not exist on disk -- the gate silently no-ops",
       "fixable": false,
       "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/private-key-header",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "A PEM private-key header is pasted into a context file. Context files usually end up committed to git, so an inline private key is a leak.",
+      "trigger": "A line contains -----BEGIN [RSA |EC |DSA |OPENSSH |PGP ]PRIVATE KEY-----. Lines containing placeholder tokens (example, redacted, xxxx, ...), commented fake/example lines, and explicitly illustrative code fences (text, txt, example, pseudocode, none) are suppressed.",
+      "message": "Private key header detected in {file}",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/aws-access-key",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "An AWS access key ID is pasted into a context file. Emitted messages never include the full secret — only a 6-char redacted prefix.",
+      "trigger": "AKIA (long-lived) or ASIA (STS temporary) prefix followed by 16 uppercase alphanumeric characters, outside placeholder/illustrative contexts.",
+      "message": "AWS access key detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/github-pat",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "A GitHub token is pasted into a context file. Covers classic PATs (ghp_), fine-grained PATs (github_pat_), and server-to-server / OAuth / user / refresh tokens (ghs_ / gho_ / ghu_ / ghr_); the non-PAT variants are emitted with the label \"GitHub token\".",
+      "trigger": "ghp_{36,}, github_pat_{82,}, or gh[soru]_{36,} token shapes, outside placeholder/illustrative contexts.",
+      "message": "GitHub personal access token detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/anthropic-key",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "An Anthropic API key is pasted into a context file.",
+      "trigger": "sk-ant- prefix followed by 20+ key characters, outside placeholder/illustrative contexts. Checked before the OpenAI sk- pattern so the same substring isn't flagged twice.",
+      "message": "Anthropic API key detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/openai-key",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "An OpenAI API key is pasted into a context file.",
+      "trigger": "sk- or sk-proj- prefix followed by 20+ key characters (the length floor avoids flagging sk-... ellipses in docs), outside placeholder/illustrative contexts.",
+      "message": "OpenAI API key detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/npm-token",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "An npm automation token is pasted into a context file.",
+      "trigger": "npm_ prefix followed by 36+ alphanumeric characters, outside placeholder/illustrative contexts.",
+      "message": "npm token detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/slack-token",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "A Slack token is pasted into a context file (bot, user, app, admin, or refresh token).",
+      "trigger": "xox[bpoasr]- prefix followed by 10+ token characters, outside placeholder/illustrative contexts.",
+      "message": "Slack token detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/google-api-key",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "A Google API key is pasted into a context file.",
+      "trigger": "AIza prefix followed by exactly 35 key characters, outside placeholder/illustrative contexts.",
+      "message": "Google API key detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
+    },
+    {
+      "id": "content-secrets/stripe-secret",
+      "category": "content-secrets",
+      "severity": "error",
+      "description": "A Stripe live secret key is pasted into a context file.",
+      "trigger": "sk_live_ prefix followed by 24+ alphanumeric characters, outside placeholder/illustrative contexts.",
+      "message": "Stripe live secret key detected in {file} ({redacted-prefix}...)",
+      "fixable": false,
+      "stability": "experimental"
     }
   ],
   "formats": [
@@ -484,7 +610,8 @@
             "always_on",
             "glob",
             "manual",
-            "model"
+            "model",
+            "model_decision"
           ]
         }
       },