@yawlabs/ctxlint 0.18.6 → 0.19.0

package/dist/index.js

@@ -13770,10 +13770,16 @@ function extractPathReferences(lines, sections) {
       if (inCodeBlock && codeBlockLang === "" && /^\s/.test(line) && /^[\w@.-]+\/$/.test(cleanValue)) {
         continue;
       }
-      const lowerProse = /^([a-z][\w-]*)\/[a-z][\w-]*$/.exec(cleanValue);
-      if (lowerProse && !PATH_FIRST_SEGMENTS.has(lowerProse[1])) {
+      const twoSegmentProse = /^([A-Za-z][\w-]*)\/[A-Za-z][\w-]*$/.exec(cleanValue);
+      if (twoSegmentProse && !PATH_FIRST_SEGMENTS.has(twoSegmentProse[1].toLowerCase())) {
         continue;
       }
+      if (/^[a-z][\w-]*(?:\/[a-z][\w-]*){2,}$/.test(cleanValue)) continue;
+      if (/([A-Z])\1{2,}/.test(cleanValue)) continue;
+      if (cleanValue.includes("*")) {
+        const anchored = /^\.{0,2}\//.test(cleanValue) || cleanValue.includes("**") || PATH_FIRST_SEGMENTS.has(cleanValue.split("/")[0]);
+        if (!anchored) continue;
+      }
       if (/(^|\/)\.git\//.test(cleanValue) || /\.app\//.test(cleanValue)) continue;
       const column = match.index + match[0].length - match[1].length + 1;
       paths.push({
@@ -19960,8 +19966,8 @@ async function findRenames(projectRoot, filePath) {
 async function findRenamesBatch(projectRoot, relPaths) {
   const result = /* @__PURE__ */ new Map();
   if (relPaths.length === 0) return result;
-  let cache = renameCache.get(projectRoot);
-  if (!cache) {
+  let cache2 = renameCache.get(projectRoot);
+  if (!cache2) {
     try {
       const git = getGit(projectRoot);
       const rawOutput = await git.raw([
@@ -19979,14 +19985,14 @@ async function findRenamesBatch(projectRoot, relPaths) {
       } catch {
       }
       const { allRenames: allRenames2, basenameBuckets: basenameBuckets2 } = parseRenameLogAll(rawOutput);
-      cache = { allRenames: allRenames2, basenameBuckets: basenameBuckets2, prefix: prefix2 };
-      renameCache.set(projectRoot, cache);
+      cache2 = { allRenames: allRenames2, basenameBuckets: basenameBuckets2, prefix: prefix2 };
+      renameCache.set(projectRoot, cache2);
     } catch {
       for (const p2 of relPaths) result.set(p2, null);
       return result;
     }
   }
-  const { allRenames, basenameBuckets, prefix } = cache;
+  const { allRenames, basenameBuckets, prefix } = cache2;
   for (const relPath of relPaths) {
     const rel = relPath.replace(/\\/g, "/");
     const target = prefix + rel;
@@ -20505,6 +20511,7 @@ async function checkPaths(file2, projectRoot) {
   const projectFiles = getProjectFiles(projectRoot);
   const basenameIndex = getBasenameIndex(projectRoot, projectFiles);
   const contextDir = path4.dirname(file2.filePath);
+  const inRootDotConfigDir = path4.dirname(contextDir) === projectRoot && path4.basename(contextDir).startsWith(".");
   const pending = [];
   for (const ref of file2.references.paths) {
     const rawNormalized = ref.value.replace(/\\/g, "/");
@@ -20515,7 +20522,7 @@ async function checkPaths(file2, projectRoot) {
       continue;
     }
     const explicitRel = /^\.\.?\//.test(normalizedRef);
-    const baseDirs = explicitRel || isImport ? [contextDir] : [projectRoot, contextDir];
+    const baseDirs = isImport ? [contextDir] : explicitRel ? inRootDotConfigDir ? [contextDir, projectRoot] : [contextDir] : [projectRoot, contextDir];
     const primaryBase = baseDirs[0];
     if (normalizedRef.includes("*")) {
       let hasMatch = false;
@@ -20676,423 +20683,6 @@ var init_paths = __esm({
   }
 });
 
-// src/core/checks/commands.ts
-import * as fs4 from "node:fs";
-import * as path5 from "node:path";
-function isManagerBuiltin(manager, sub) {
-  return PM_MANAGER_BUILTINS[manager]?.has(sub) ?? false;
-}
-function scriptNameFromMatch(match) {
-  const [, manager, explicitRun, name] = match;
-  if (name.startsWith("-")) return null;
-  if (manager && !explicitRun && PM_BUILTIN_SUBCOMMANDS.has(name)) return null;
-  if (manager && !explicitRun && isManagerBuiltin(manager, name)) return null;
-  return name;
-}
-function extractNpxPackage(cmd) {
-  if (!/^npx\b/.test(cmd)) return null;
-  const tokens = cmd.split(/\s+/).slice(1);
-  for (let i2 = 0; i2 < tokens.length; i2++) {
-    const t2 = tokens[i2];
-    if (t2 === "-p" || t2 === "--package") {
-      const v2 = tokens[i2 + 1];
-      if (v2 && !v2.startsWith("-")) return v2;
-      continue;
-    }
-    if (t2.startsWith("-p=") || t2.startsWith("--package=")) {
-      return t2.slice(t2.indexOf("=") + 1) || null;
-    }
-    if (t2.startsWith("-")) continue;
-    return t2;
-  }
-  return null;
-}
-function wouldNeedPackageJson(cmd) {
-  const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
-  if (scriptMatch && scriptNameFromMatch(scriptMatch) !== null) return true;
-  const shorthandMatch = cmd.match(PKG_SHORTHAND_PATTERN);
-  if (shorthandMatch && !isManagerBuiltin(shorthandMatch[1], shorthandMatch[2])) return true;
-  return /^npx\b/.test(cmd) || PKG_DEPENDENT_TOOL_PATTERN.test(cmd);
-}
-async function checkCommands(file2, projectRoot) {
-  const issues = [];
-  const pkgJson = loadPackageJson(projectRoot);
-  const makefile = loadMakefile(projectRoot);
-  if (!pkgJson) {
-    const skipped = file2.references.commands.find((ref) => wouldNeedPackageJson(ref.value));
-    if (skipped) {
-      issues.push({
-        severity: "info",
-        check: "commands",
-        ruleId: "commands/package-json-missing",
-        line: skipped.line,
-        message: "package.json missing or unparseable \u2014 command checks skipped",
-        suggestion: "Add a parseable package.json at the project root so script, npx, and tool references can be validated."
-      });
-    }
-  }
-  for (const ref of file2.references.commands) {
-    const cmd = ref.value;
-    const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
-    if (scriptMatch && pkgJson) {
-      const scriptName = scriptNameFromMatch(scriptMatch);
-      if (scriptName && pkgJson.scripts && !(scriptName in pkgJson.scripts)) {
-        const available = Object.keys(pkgJson.scripts).join(", ");
-        issues.push({
-          severity: "error",
-          check: "commands",
-          ruleId: "commands/script-not-found",
-          line: ref.line,
-          message: `"${cmd}" \u2014 script "${scriptName}" not found in package.json`,
-          suggestion: available ? `Available scripts: ${available}` : void 0
-        });
-      }
-      continue;
-    }
-    const shorthandMatch = cmd.match(PKG_SHORTHAND_PATTERN);
-    if (shorthandMatch && pkgJson) {
-      const manager = shorthandMatch[1];
-      const scriptName = shorthandMatch[2];
-      if (isManagerBuiltin(manager, scriptName)) continue;
-      if (pkgJson.scripts && !(scriptName in pkgJson.scripts)) {
-        issues.push({
-          severity: "error",
-          check: "commands",
-          ruleId: "commands/script-not-found",
-          line: ref.line,
-          message: `"${cmd}" \u2014 script "${scriptName}" not found in package.json`
-        });
-      }
-      continue;
-    }
-    if (/^npx\b/.test(cmd) && pkgJson) {
-      const pkgName = extractNpxPackage(cmd);
-      if (!pkgName) continue;
-      const allDeps = {
-        ...pkgJson.dependencies,
-        ...pkgJson.devDependencies,
-        ...pkgJson.peerDependencies,
-        ...pkgJson.optionalDependencies
-      };
-      if (!(pkgName in allDeps)) {
-        const binPath = path5.join(projectRoot, "node_modules", ".bin", pkgName);
-        try {
-          fs4.accessSync(binPath);
-        } catch {
-          issues.push({
-            severity: "warning",
-            check: "commands",
-            ruleId: "commands/npx-not-in-deps",
-            line: ref.line,
-            message: `"${cmd}" \u2014 "${pkgName}" not found in dependencies`,
-            suggestion: "If this is a global tool, consider adding it to devDependencies for reproducibility"
-          });
-        }
-      }
-      continue;
-    }
-    if (MAKE_PATTERN.test(cmd)) {
-      if (!makefile) {
-        issues.push({
-          severity: "error",
-          check: "commands",
-          ruleId: "commands/no-makefile",
-          line: ref.line,
-          message: `"${cmd}" \u2014 no Makefile found in project`
-        });
-      } else {
-        const target = extractMakeTarget(cmd);
-        if (target && !hasMakeTarget(makefile, target)) {
-          issues.push({
-            severity: "error",
-            check: "commands",
-            ruleId: "commands/make-target-not-found",
-            line: ref.line,
-            message: `"${cmd}" \u2014 target "${target}" not found in Makefile`
-          });
-        }
-      }
-      continue;
-    }
-    const toolMatch = cmd.match(PKG_DEPENDENT_TOOL_PATTERN);
-    if (toolMatch && pkgJson) {
-      const tool = toolMatch[1];
-      const pkgName = BIN_TO_PACKAGE[tool] ?? tool;
-      const allDeps = {
-        ...pkgJson.dependencies,
-        ...pkgJson.devDependencies,
-        ...pkgJson.peerDependencies,
-        ...pkgJson.optionalDependencies
-      };
-      if (!(pkgName in allDeps)) {
-        const binPath = path5.join(projectRoot, "node_modules", ".bin", tool);
-        try {
-          fs4.accessSync(binPath);
-        } catch {
-          issues.push({
-            severity: "warning",
-            check: "commands",
-            ruleId: "commands/tool-not-found",
-            line: ref.line,
-            message: `"${cmd}" \u2014 "${tool}" not found in dependencies or node_modules/.bin`
-          });
-        }
-      }
-    }
-  }
-  return issues;
-}
-function loadMakefile(projectRoot) {
-  try {
-    return stripBom(fs4.readFileSync(path5.join(projectRoot, "Makefile"), "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function extractMakeTarget(cmd) {
-  for (const token of cmd.split(/\s+/).slice(1)) {
-    if (token.startsWith("-")) return null;
-    if (token.includes("=")) continue;
-    return token;
-  }
-  return null;
-}
-function hasMakeTarget(makefile, target) {
-  const escaped = target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`^${escaped}\\s*:(?!:?=)`, "m");
-  return pattern.test(makefile);
-}
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN, PM_BUILTIN_SUBCOMMANDS, PM_MANAGER_BUILTINS, PKG_DEPENDENT_TOOL_PATTERN, BIN_TO_PACKAGE, PKG_SHORTHAND_PATTERN;
-var init_commands = __esm({
-  "src/core/checks/commands.ts"() {
-    "use strict";
-    init_define_WEB_FIRST_SEGMENTS();
-    init_fs();
-    NPM_SCRIPT_PATTERN = /^(?:npm\s+run|(pnpm|yarn|bun)(?:\s+(run))?)\s+(\S+)/;
-    MAKE_PATTERN = /^make\s+\S/;
-    PM_BUILTIN_SUBCOMMANDS = /* @__PURE__ */ new Set([
-      "add",
-      "approve-builds",
-      "audit",
-      "bin",
-      "cache",
-      "ci",
-      "config",
-      "create",
-      "dedupe",
-      "dlx",
-      "doctor",
-      "env",
-      "exec",
-      "fetch",
-      "global",
-      "help",
-      "i",
-      "import",
-      "info",
-      "init",
-      "install",
-      "licenses",
-      "link",
-      "list",
-      "login",
-      "logout",
-      "ls",
-      "node",
-      "npm",
-      "outdated",
-      "pack",
-      "patch",
-      "patch-commit",
-      "prune",
-      "publish",
-      "rebuild",
-      "remove",
-      "rm",
-      "root",
-      "run",
-      "self-update",
-      "set",
-      "setup",
-      "store",
-      "team",
-      "un",
-      "uninstall",
-      "unlink",
-      "up",
-      "update",
-      "upgrade",
-      "version",
-      "whoami",
-      "why",
-      "workspace",
-      "workspaces",
-      "x"
-    ]);
-    PM_MANAGER_BUILTINS = {
-      bun: /* @__PURE__ */ new Set(["test"])
-    };
-    PKG_DEPENDENT_TOOL_PATTERN = /^(vitest|jest|pytest|mocha|eslint|prettier|tsc)\b/;
-    BIN_TO_PACKAGE = {
-      tsc: "typescript"
-    };
-    PKG_SHORTHAND_PATTERN = /^(npm|pnpm|yarn|bun)\s+(test|start|build|dev|lint|format|check|typecheck|clean|serve|preview|e2e)\b/;
-  }
-});
-
-// src/core/checks/staleness.ts
-import * as path6 from "node:path";
-async function checkStaleness(file2, projectRoot) {
-  const issues = [];
-  if (!await isGitRepo(projectRoot)) {
-    return issues;
-  }
-  const relativePath = path6.relative(projectRoot, file2.filePath).replace(/\\/g, "/");
-  const lastModified = await getFileLastModified(projectRoot, relativePath);
-  if (!lastModified || isNaN(lastModified.getTime())) {
-    return issues;
-  }
-  const daysSinceUpdate = Math.floor((Date.now() - lastModified.getTime()) / (1e3 * 60 * 60 * 24));
-  if (daysSinceUpdate < INFO_DAYS) {
-    return issues;
-  }
-  const referencedPaths = /* @__PURE__ */ new Set();
-  const globByPrefix = /* @__PURE__ */ new Map();
-  for (const ref of file2.references.paths) {
-    const normalized = ref.value.replace(/\\/g, "/");
-    if (normalized.includes("*")) {
-      const staticSegments = [];
-      for (const segment of normalized.split("/")) {
-        if (segment === ".") continue;
-        if (segment.includes("*")) break;
-        staticSegments.push(segment);
-      }
-      const prefix = staticSegments.join("/");
-      if (prefix) {
-        const key = `${prefix}/`;
-        referencedPaths.add(key);
-        if (!globByPrefix.has(key)) globByPrefix.set(key, ref.value);
-      }
-      continue;
-    }
-    referencedPaths.add(ref.value);
-  }
-  if (referencedPaths.size === 0) {
-    return issues;
-  }
-  const counts = await getCommitsSinceBatch(projectRoot, [...referencedPaths], lastModified);
-  let totalCommits = 0;
-  let mostActiveRef = "";
-  let mostActiveCommits = 0;
-  for (const [refPath, commits] of counts) {
-    totalCommits += commits;
-    if (commits > mostActiveCommits) {
-      mostActiveCommits = commits;
-      mostActiveRef = refPath;
-    }
-  }
-  if (totalCommits === 0) {
-    return issues;
-  }
-  const isStale = daysSinceUpdate >= WARNING_DAYS;
-  const severity = isStale ? "warning" : "info";
-  const mostActiveLabel = globByPrefix.get(mostActiveRef) ?? mostActiveRef;
-  issues.push({
-    severity,
-    check: "staleness",
-    ruleId: isStale ? "staleness/stale" : "staleness/aging",
-    line: 1,
-    message: `Last updated ${daysSinceUpdate} days ago. ${mostActiveLabel} has ${mostActiveCommits} commits since.`,
-    suggestion: "Review and update this context file to reflect recent changes.",
-    detail: `${totalCommits} total commits to referenced paths since last update.`
-  });
-  return issues;
-}
-var WARNING_DAYS, INFO_DAYS;
-var init_staleness = __esm({
-  "src/core/checks/staleness.ts"() {
-    "use strict";
-    init_define_WEB_FIRST_SEGMENTS();
-    init_git();
-    WARNING_DAYS = 30;
-    INFO_DAYS = 14;
-  }
-});
-
-// src/core/checks/tokens.ts
-function resolveTokenThresholds(overrides) {
-  if (!overrides) return DEFAULT_TOKEN_THRESHOLDS;
-  const merged = { ...DEFAULT_TOKEN_THRESHOLDS, ...overrides };
-  if (merged.info >= merged.warning || merged.warning >= merged.error) {
-    console.error(
-      `Warning: token thresholds should satisfy info < warning < error (got ${merged.info}, ${merged.warning}, ${merged.error}) \u2014 using defaults`
-    );
-    return DEFAULT_TOKEN_THRESHOLDS;
-  }
-  return merged;
-}
-async function checkTokens(file2, _projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
-  const issues = [];
-  const tokens = file2.totalTokens;
-  if (tokens >= thresholds.error) {
-    issues.push({
-      severity: "error",
-      check: "tokens",
-      ruleId: "tokens/excessive",
-      line: 1,
-      message: `${tokens.toLocaleString()} tokens \u2014 consumes significant context window space`,
-      suggestion: "Consider splitting into focused sections or removing redundant content."
-    });
-  } else if (tokens >= thresholds.warning) {
-    issues.push({
-      severity: "warning",
-      check: "tokens",
-      ruleId: "tokens/large",
-      line: 1,
-      message: `${tokens.toLocaleString()} tokens \u2014 large context file`,
-      suggestion: "Consider trimming \u2014 research shows diminishing returns past ~300 lines."
-    });
-  } else if (tokens >= thresholds.info) {
-    issues.push({
-      severity: "info",
-      check: "tokens",
-      ruleId: "tokens/info",
-      line: 1,
-      message: `Uses ~${tokens.toLocaleString()} tokens per session`
-    });
-  }
-  return issues;
-}
-function checkAggregateTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
-  const total = files.reduce((sum, f) => sum + f.tokens, 0);
-  if (total >= thresholds.aggregate && files.length > 1) {
-    return {
-      severity: "warning",
-      check: "tokens",
-      ruleId: "tokens/aggregate",
-      line: 0,
-      message: `${files.length} context files consume ${total.toLocaleString()} tokens combined`,
-      suggestion: "Consider consolidating or trimming to reduce per-session context cost."
-    };
-  }
-  return null;
-}
-var DEFAULT_TOKEN_THRESHOLDS;
-var init_tokens2 = __esm({
-  "src/core/checks/tokens.ts"() {
-    "use strict";
-    init_define_WEB_FIRST_SEGMENTS();
-    DEFAULT_TOKEN_THRESHOLDS = {
-      info: 1e3,
-      warning: 3e3,
-      error: 8e3,
-      aggregate: 5e3,
-      tierBreakdown: 1e3,
-      tierAggregate: 4e3
-    };
-  }
-});
-
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
 function createScanner(text, ignoreTrivia = false) {
   const len = text.length;
@@ -22170,6 +21760,494 @@ var init_main3 = __esm({
   }
 });
 
+// src/core/checks/commands.ts
+import * as fs4 from "node:fs";
+import * as path5 from "node:path";
+function isManagerBuiltin(manager, sub) {
+  return PM_MANAGER_BUILTINS[manager]?.has(sub) ?? false;
+}
+function scriptNameFromMatch(match) {
+  const [, manager, explicitRun, name] = match;
+  if (name.startsWith("-")) return null;
+  if (manager && !explicitRun && PM_BUILTIN_SUBCOMMANDS.has(name)) return null;
+  if (manager && !explicitRun && isManagerBuiltin(manager, name)) return null;
+  return name;
+}
+function extractNpxPackage(cmd) {
+  if (!/^npx\b/.test(cmd)) return null;
+  const tokens = cmd.split(/\s+/).slice(1);
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const t2 = tokens[i2];
+    if (t2 === "-p" || t2 === "--package") {
+      const v2 = tokens[i2 + 1];
+      if (v2 && !v2.startsWith("-")) return v2;
+      continue;
+    }
+    if (t2.startsWith("-p=") || t2.startsWith("--package=")) {
+      return t2.slice(t2.indexOf("=") + 1) || null;
+    }
+    if (t2.startsWith("-")) continue;
+    return t2;
+  }
+  return null;
+}
+function wouldNeedPackageJson(cmd) {
+  const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
+  if (scriptMatch && scriptNameFromMatch(scriptMatch) !== null) return true;
+  const shorthandMatch = cmd.match(PKG_SHORTHAND_PATTERN);
+  if (shorthandMatch && !isManagerBuiltin(shorthandMatch[1], shorthandMatch[2])) return true;
+  return /^npx\b/.test(cmd) || PKG_DEPENDENT_TOOL_PATTERN.test(cmd);
+}
+function loadDeniedCommandPrefixes(projectRoot) {
+  const prefixes = [];
+  for (const rel of ["settings.json", "settings.local.json"]) {
+    let content;
+    try {
+      content = stripBom(fs4.readFileSync(path5.join(projectRoot, ".claude", rel), "utf-8"));
+    } catch {
+      continue;
+    }
+    const data = parse2(content, [], { allowTrailingComma: true });
+    const deny = data?.permissions?.deny;
+    if (!Array.isArray(deny)) continue;
+    for (const entry of deny) {
+      if (typeof entry !== "string") continue;
+      const inner = entry.replace(/^[A-Za-z]+\((.*)\)$/, "$1");
+      const prefix = inner.replace(/:?\*+$/, "").trim();
+      if (prefix) prefixes.push(prefix);
+    }
+  }
+  return prefixes;
+}
+function isDeniedCommand(cmd, deniedPrefixes) {
+  return deniedPrefixes.some((p2) => cmd === p2 || cmd.startsWith(`${p2} `));
+}
+async function checkCommands(file2, projectRoot) {
+  const issues = [];
+  const pkgJson = loadPackageJson(projectRoot);
+  const makefile = loadMakefile(projectRoot);
+  const deniedPrefixes = loadDeniedCommandPrefixes(projectRoot);
+  if (!pkgJson) {
+    const skipped = file2.references.commands.find((ref) => wouldNeedPackageJson(ref.value));
+    if (skipped) {
+      issues.push({
+        severity: "info",
+        check: "commands",
+        ruleId: "commands/package-json-missing",
+        line: skipped.line,
+        message: "package.json missing or unparseable \u2014 command checks skipped",
+        suggestion: "Add a parseable package.json at the project root so script, npx, and tool references can be validated."
+      });
+    }
+  }
+  for (const ref of file2.references.commands) {
+    const cmd = ref.value;
+    const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
+    if (scriptMatch && pkgJson) {
+      const scriptName = scriptNameFromMatch(scriptMatch);
+      if (scriptName && pkgJson.scripts && !(scriptName in pkgJson.scripts)) {
+        const available = Object.keys(pkgJson.scripts).join(", ");
+        issues.push({
+          severity: "error",
+          check: "commands",
+          ruleId: "commands/script-not-found",
+          line: ref.line,
+          message: `"${cmd}" \u2014 script "${scriptName}" not found in package.json`,
+          suggestion: available ? `Available scripts: ${available}` : void 0
+        });
+      }
+      continue;
+    }
+    const shorthandMatch = cmd.match(PKG_SHORTHAND_PATTERN);
+    if (shorthandMatch && pkgJson) {
+      const manager = shorthandMatch[1];
+      const scriptName = shorthandMatch[2];
+      if (isManagerBuiltin(manager, scriptName)) continue;
+      if (pkgJson.scripts && !(scriptName in pkgJson.scripts)) {
+        issues.push({
+          severity: "error",
+          check: "commands",
+          ruleId: "commands/script-not-found",
+          line: ref.line,
+          message: `"${cmd}" \u2014 script "${scriptName}" not found in package.json`
+        });
+      }
+      continue;
+    }
+    if (/^npx\b/.test(cmd) && pkgJson) {
+      const pkgName = extractNpxPackage(cmd);
+      if (!pkgName) continue;
+      const allDeps = {
+        ...pkgJson.dependencies,
+        ...pkgJson.devDependencies,
+        ...pkgJson.peerDependencies,
+        ...pkgJson.optionalDependencies
+      };
+      if (!(pkgName in allDeps)) {
+        if (isDeniedCommand(cmd, deniedPrefixes)) continue;
+        const binPath = path5.join(projectRoot, "node_modules", ".bin", pkgName);
+        try {
+          fs4.accessSync(binPath);
+        } catch {
+          issues.push({
+            severity: "warning",
+            check: "commands",
+            ruleId: "commands/npx-not-in-deps",
+            line: ref.line,
+            message: `"${cmd}" \u2014 "${pkgName}" not found in dependencies`,
+            suggestion: "If this is a global tool, consider adding it to devDependencies for reproducibility"
+          });
+        }
+      }
+      continue;
+    }
+    if (MAKE_PATTERN.test(cmd)) {
+      if (!makefile) {
+        issues.push({
+          severity: "error",
+          check: "commands",
+          ruleId: "commands/no-makefile",
+          line: ref.line,
+          message: `"${cmd}" \u2014 no Makefile found in project`
+        });
+      } else {
+        const target = extractMakeTarget(cmd);
+        if (target && !hasMakeTarget(makefile, target)) {
+          issues.push({
+            severity: "error",
+            check: "commands",
+            ruleId: "commands/make-target-not-found",
+            line: ref.line,
+            message: `"${cmd}" \u2014 target "${target}" not found in Makefile`
+          });
+        }
+      }
+      continue;
+    }
+    const toolMatch = cmd.match(PKG_DEPENDENT_TOOL_PATTERN);
+    if (toolMatch && pkgJson) {
+      const tool = toolMatch[1];
+      const pkgName = BIN_TO_PACKAGE[tool] ?? tool;
+      const allDeps = {
+        ...pkgJson.dependencies,
+        ...pkgJson.devDependencies,
+        ...pkgJson.peerDependencies,
+        ...pkgJson.optionalDependencies
+      };
+      if (!(pkgName in allDeps)) {
+        const binPath = path5.join(projectRoot, "node_modules", ".bin", tool);
+        try {
+          fs4.accessSync(binPath);
+        } catch {
+          issues.push({
+            severity: "warning",
+            check: "commands",
+            ruleId: "commands/tool-not-found",
+            line: ref.line,
+            message: `"${cmd}" \u2014 "${tool}" not found in dependencies or node_modules/.bin`
+          });
+        }
+      }
+    }
+  }
+  return issues;
+}
+function loadMakefile(projectRoot) {
+  try {
+    return stripBom(fs4.readFileSync(path5.join(projectRoot, "Makefile"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function extractMakeTarget(cmd) {
+  for (const token of cmd.split(/\s+/).slice(1)) {
+    if (token.startsWith("-")) return null;
+    if (token.includes("=")) continue;
+    return token;
+  }
+  return null;
+}
+function hasMakeTarget(makefile, target) {
+  const escaped = target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`^${escaped}\\s*:(?!:?=)`, "m");
+  return pattern.test(makefile);
+}
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN, PM_BUILTIN_SUBCOMMANDS, PM_MANAGER_BUILTINS, PKG_DEPENDENT_TOOL_PATTERN, BIN_TO_PACKAGE, PKG_SHORTHAND_PATTERN;
+var init_commands = __esm({
+  "src/core/checks/commands.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_main3();
+    init_fs();
+    NPM_SCRIPT_PATTERN = /^(?:npm\s+run|(pnpm|yarn|bun)(?:\s+(run))?)\s+(\S+)/;
+    MAKE_PATTERN = /^make\s+\S/;
+    PM_BUILTIN_SUBCOMMANDS = /* @__PURE__ */ new Set([
+      "add",
+      "approve-builds",
+      "audit",
+      "bin",
+      "cache",
+      "ci",
+      "config",
+      "create",
+      "dedupe",
+      "dlx",
+      "doctor",
+      "env",
+      "exec",
+      "fetch",
+      "global",
+      "help",
+      "i",
+      "import",
+      "info",
+      "init",
+      "install",
+      "licenses",
+      "link",
+      "list",
+      "login",
+      "logout",
+      "ls",
+      "node",
+      "npm",
+      "outdated",
+      "pack",
+      "patch",
+      "patch-commit",
+      "prune",
+      "publish",
+      "rebuild",
+      "remove",
+      "rm",
+      "root",
+      "run",
+      "self-update",
+      "set",
+      "setup",
+      "store",
+      "team",
+      "un",
+      "uninstall",
+      "unlink",
+      "up",
+      "update",
+      "upgrade",
+      "version",
+      "whoami",
+      "why",
+      "workspace",
+      "workspaces",
+      "x"
+    ]);
+    PM_MANAGER_BUILTINS = {
+      bun: /* @__PURE__ */ new Set(["test"])
+    };
+    PKG_DEPENDENT_TOOL_PATTERN = /^(vitest|jest|pytest|mocha|eslint|prettier|tsc)\b/;
+    BIN_TO_PACKAGE = {
+      tsc: "typescript"
+    };
+    PKG_SHORTHAND_PATTERN = /^(npm|pnpm|yarn|bun)\s+(test|start|build|dev|lint|format|check|typecheck|clean|serve|preview|e2e)\b/;
+  }
+});
+
+// src/core/checks/staleness.ts
+import * as path6 from "node:path";
+async function checkStaleness(file2, projectRoot) {
+  const issues = [];
+  if (!await isGitRepo(projectRoot)) {
+    return issues;
+  }
+  const relativePath = path6.relative(projectRoot, file2.filePath).replace(/\\/g, "/");
+  const lastModified = await getFileLastModified(projectRoot, relativePath);
+  if (!lastModified || isNaN(lastModified.getTime())) {
+    return issues;
+  }
+  const daysSinceUpdate = Math.floor((Date.now() - lastModified.getTime()) / (1e3 * 60 * 60 * 24));
+  if (daysSinceUpdate < INFO_DAYS) {
+    return issues;
+  }
+  const referencedPaths = /* @__PURE__ */ new Set();
+  const globByPrefix = /* @__PURE__ */ new Map();
+  for (const ref of file2.references.paths) {
+    const normalized = ref.value.replace(/\\/g, "/");
+    if (normalized.includes("*")) {
+      const staticSegments = [];
+      for (const segment of normalized.split("/")) {
+        if (segment === ".") continue;
+        if (segment.includes("*")) break;
+        staticSegments.push(segment);
+      }
+      const prefix = staticSegments.join("/");
+      if (prefix) {
+        const key = `${prefix}/`;
+        referencedPaths.add(key);
+        if (!globByPrefix.has(key)) globByPrefix.set(key, ref.value);
+      }
+      continue;
+    }
+    referencedPaths.add(ref.value);
+  }
+  if (referencedPaths.size === 0) {
+    return issues;
+  }
+  const counts = await getCommitsSinceBatch(projectRoot, [...referencedPaths], lastModified);
+  let totalCommits = 0;
+  let mostActiveRef = "";
+  let mostActiveCommits = 0;
+  for (const [refPath, commits] of counts) {
+    totalCommits += commits;
+    if (commits > mostActiveCommits) {
+      mostActiveCommits = commits;
+      mostActiveRef = refPath;
+    }
+  }
+  if (totalCommits === 0) {
+    return issues;
+  }
+  const isStale = daysSinceUpdate >= WARNING_DAYS;
+  const severity = isStale ? "warning" : "info";
+  const mostActiveLabel = globByPrefix.get(mostActiveRef) ?? mostActiveRef;
+  issues.push({
+    severity,
+    check: "staleness",
+    ruleId: isStale ? "staleness/stale" : "staleness/aging",
+    line: 1,
+    message: `Last updated ${daysSinceUpdate} days ago. ${mostActiveLabel} has ${mostActiveCommits} commits since.`,
+    suggestion: "Review and update this context file to reflect recent changes.",
+    detail: `${totalCommits} total commits to referenced paths since last update.`
+  });
+  return issues;
+}
+var WARNING_DAYS, INFO_DAYS;
+var init_staleness = __esm({
+  "src/core/checks/staleness.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_git();
+    WARNING_DAYS = 30;
+    INFO_DAYS = 14;
+  }
+});
+
+// src/core/suppressions.ts
+function collectSuppressions(content) {
+  const suppressions = /* @__PURE__ */ new Map();
+  const lines = content.split("\n");
+  const add = (lineNumber, checks) => {
+    const existing = suppressions.get(lineNumber);
+    if (existing === null) return;
+    if (checks.length === 0) {
+      suppressions.set(lineNumber, null);
+      return;
+    }
+    const merged = existing ?? /* @__PURE__ */ new Set();
+    for (const check2 of checks) merged.add(check2);
+    suppressions.set(lineNumber, merged);
+  };
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!line.includes("ctxlint-ignore-")) continue;
+    DIRECTIVE_RE.lastIndex = 0;
+    let match;
+    while ((match = DIRECTIVE_RE.exec(line)) !== null) {
+      const kind = match[1];
+      const checks = (match[2] ?? "").trim().split(/\s+/).filter(Boolean);
+      add(kind === "next-line" ? i2 + 2 : i2 + 1, checks);
+    }
+  }
+  return suppressions;
+}
+function isSuppressed(suppressions, issue2) {
+  if (suppressions.size === 0) return false;
+  if (!suppressions.has(issue2.line)) return false;
+  const checks = suppressions.get(issue2.line);
+  if (checks === null) return true;
+  return checks.has(issue2.check);
+}
+var DIRECTIVE_RE;
+var init_suppressions = __esm({
+  "src/core/suppressions.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    DIRECTIVE_RE = /<!--\s*ctxlint-ignore-(next-line|line)((?:\s+[\w-]+)*)\s*-->/g;
+  }
+});
+
+// src/core/checks/tokens.ts
+function resolveTokenThresholds(overrides) {
+  if (!overrides) return DEFAULT_TOKEN_THRESHOLDS;
+  const merged = { ...DEFAULT_TOKEN_THRESHOLDS, ...overrides };
+  if (merged.info >= merged.warning || merged.warning >= merged.error) {
+    console.error(
+      `Warning: token thresholds should satisfy info < warning < error (got ${merged.info}, ${merged.warning}, ${merged.error}) \u2014 using defaults`
+    );
+    return DEFAULT_TOKEN_THRESHOLDS;
+  }
+  return merged;
+}
+async function checkTokens(file2, _projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
+  const issues = [];
+  const tokens = file2.totalTokens;
+  if (tokens >= thresholds.error) {
+    issues.push({
+      severity: "error",
+      check: "tokens",
+      ruleId: "tokens/excessive",
+      line: 1,
+      message: `${tokens.toLocaleString()} tokens \u2014 consumes significant context window space`,
+      suggestion: "Consider splitting into focused sections or removing redundant content."
+    });
+  } else if (tokens >= thresholds.warning) {
+    issues.push({
+      severity: "warning",
+      check: "tokens",
+      ruleId: "tokens/large",
+      line: 1,
+      message: `${tokens.toLocaleString()} tokens \u2014 large context file`,
+      suggestion: "Consider trimming \u2014 research shows diminishing returns past ~300 lines."
+    });
+  } else if (tokens >= thresholds.info) {
+    issues.push({
+      severity: "info",
+      check: "tokens",
+      ruleId: "tokens/info",
+      line: 1,
+      message: `Uses ~${tokens.toLocaleString()} tokens per session`
+    });
+  }
+  return issues;
+}
+function checkAggregateTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
+  const total = files.reduce((sum, f) => sum + f.tokens, 0);
+  if (total >= thresholds.aggregate && files.length > 1) {
+    return {
+      severity: "warning",
+      check: "tokens",
+      ruleId: "tokens/aggregate",
+      line: 0,
+      message: `${files.length} context files consume ${total.toLocaleString()} tokens combined`,
+      suggestion: "Consider consolidating or trimming to reduce per-session context cost."
+    };
+  }
+  return null;
+}
+var DEFAULT_TOKEN_THRESHOLDS;
+var init_tokens2 = __esm({
+  "src/core/checks/tokens.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    DEFAULT_TOKEN_THRESHOLDS = {
+      info: 1e3,
+      warning: 3e3,
+      error: 8e3,
+      aggregate: 5e3,
+      tierBreakdown: 1e3,
+      tierAggregate: 4e3
+    };
+  }
+});
+
 // src/core/checks/tier-tokens.ts
 import * as fs5 from "node:fs";
 import * as os2 from "node:os";
@@ -24047,6 +24125,11 @@ function loadWebFirstSegments() {
 function encodeProjectDir(fsPath) {
   return fsPath.replace(/[:\\/\.]/g, "-");
 }
+function projectDirCandidates(fsPath) {
+  const encoded = encodeProjectDir(fsPath);
+  const folded = encoded.replace(/_/g, "-");
+  return folded === encoded ? [encoded] : [encoded, folded];
+}
 function projectDirMatchesPath(encodedDir, fsPath) {
   const normalized = fsPath.replace(/\\/g, "/");
   return encodedDir === encodeProjectDir(normalized);
@@ -24933,13 +25016,19 @@ import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || homedir5();
   if (!home2) return [];
-  const encoded = encodeProjectDir(ctx.currentProject);
-  const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
-  let content;
-  try {
-    content = stripBom(await readFile3(memoryFile, "utf-8"));
-  } catch {
-    return [];
+  let content = "";
+  let memoryFile = "";
+  for (const encoded of projectDirCandidates(ctx.currentProject)) {
+    const candidate = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
+    try {
+      content = stripBom(await readFile3(candidate, "utf-8"));
+    } catch {
+      continue;
+    }
+    if (content) {
+      memoryFile = candidate;
+      break;
+    }
   }
   if (!content) return [];
   const lines = content.split("\n");
@@ -24984,16 +25073,429 @@ var init_memory_index_overflow = __esm({
   }
 });
 
-// src/core/checks/ci-coverage.ts
-import { readdir as readdir3, readFile as readFile4 } from "node:fs/promises";
+// src/core/transcript.ts
+import { createReadStream as createReadStream2, existsSync as existsSync5, statSync as statSync4 } from "node:fs";
+import { readdir as readdir3 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
 import { join as join9 } from "node:path";
-import { existsSync as existsSync5 } from "node:fs";
+import { createInterface as createInterface2 } from "node:readline";
+function asString(v2) {
+  return typeof v2 === "string" ? v2 : "";
+}
+function resultText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.map((b2) => b2 && typeof b2 === "object" ? asString(b2.text) : "").join("");
+}
+function resolveHome() {
+  return process.env.HOME || process.env.USERPROFILE || homedir6();
+}
+function readProjectTranscript(project, home2 = resolveHome()) {
+  const key = `${home2} ${project}`;
+  let hit = cache.get(key);
+  if (!hit) {
+    hit = readUncached(project, home2);
+    cache.set(key, hit);
+  }
+  return hit;
+}
+function candidateDirs(project, home2) {
+  const root = join9(home2, ".claude", "projects");
+  return projectDirCandidates(project).map((n7) => join9(root, n7)).filter((d) => existsSync5(d));
+}
+async function readUncached(project, home2) {
+  if (!home2 || !project) return EMPTY;
+  const dirs = candidateDirs(project, home2);
+  if (dirs.length === 0) return EMPTY;
+  const names = [];
+  for (const dir of dirs) {
+    for (const name of await readdir3(dir).catch(() => [])) {
+      names.push({ dir, name });
+    }
+  }
+  const files = names.filter(({ name }) => name.endsWith(".jsonl")).map(({ dir, name }) => {
+    const p2 = join9(dir, name);
+    try {
+      return { p: p2, mtime: statSync4(p2).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((f) => f !== null).sort((a, b2) => b2.mtime - a.mtime);
+  let truncated = files.length > MAX_TRANSCRIPTS;
+  const selected = files.slice(0, MAX_TRANSCRIPTS);
+  const events = [];
+  const pending = /* @__PURE__ */ new Map();
+  let lines = 0;
+  for (const { p: p2 } of selected) {
+    if (lines >= MAX_LINES2) {
+      truncated = true;
+      break;
+    }
+    const rl = createInterface2({
+      input: createReadStream2(p2, { encoding: "utf-8" }),
+      crlfDelay: Infinity
+    });
+    try {
+      for await (const raw of rl) {
+        if (++lines >= MAX_LINES2) {
+          truncated = true;
+          break;
+        }
+        const line = raw.trim();
+        if (!line) continue;
+        let rec;
+        try {
+          rec = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        collect(rec, events, pending);
+      }
+    } catch {
+    } finally {
+      rl.close();
+    }
+  }
+  return { events, filesRead: selected.length, truncated };
+}
+function collect(rec, events, pending) {
+  const message = rec.message;
+  const content = message?.content;
+  if (!Array.isArray(content)) return;
+  const timestamp = Date.parse(asString(rec.timestamp)) || 0;
+  const sessionId = asString(rec.sessionId) || asString(rec.session_id);
+  const gitBranch = asString(rec.gitBranch) || void 0;
+  for (const raw of content) {
+    if (!raw || typeof raw !== "object") continue;
+    const block = raw;
+    const type = asString(block.type);
+    if (type === "text" && rec.type === "assistant") {
+      const text = asString(block.text);
+      if (text) {
+        events.push({ kind: "assistant-text", text, tool: "", gitBranch, timestamp, sessionId });
+      }
+      continue;
+    }
+    if (type === "tool_use") {
+      const tool = asString(block.name);
+      const input = block.input ?? {};
+      const cmdField = COMMAND_TOOLS[tool];
+      const writeField = WRITE_TOOLS[tool];
+      let ev = null;
+      if (cmdField) {
+        const text = asString(input[cmdField]);
+        if (text) ev = { kind: "command", text, tool, gitBranch, timestamp, sessionId };
+      } else if (writeField) {
+        const text = asString(input[writeField]);
+        if (text) ev = { kind: "file-write", text, tool, gitBranch, timestamp, sessionId };
+      }
+      if (ev) {
+        events.push(ev);
+        const id = asString(block.id);
+        if (id) pending.set(id, ev);
+      }
+      continue;
+    }
+    if (type === "tool_result") {
+      const id = asString(block.tool_use_id);
+      const ev = id ? pending.get(id) : void 0;
+      if (!ev) continue;
+      pending.delete(id);
+      ev.isError = block.is_error === true;
+      ev.emptyOutput = resultText(block.content).trim().length === 0;
+    }
+  }
+}
+var WRITE_TOOLS, COMMAND_TOOLS, MAX_TRANSCRIPTS, MAX_LINES2, EMPTY, cache;
+var init_transcript = __esm({
+  "src/core/transcript.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_session_parser();
+    WRITE_TOOLS = {
+      Write: "file_path",
+      Edit: "file_path",
+      NotebookEdit: "notebook_path"
+    };
+    COMMAND_TOOLS = {
+      Bash: "command",
+      PowerShell: "command"
+    };
+    MAX_TRANSCRIPTS = 5;
+    MAX_LINES2 = 2e5;
+    EMPTY = { events: [], filesRead: 0, truncated: false };
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/core/checks/session/shared-temp-path.ts
+function unquote(raw) {
+  let s = raw;
+  let prev;
+  do {
+    prev = s;
+    s = s.replace(/^['"`]|['"`]$/g, "");
+  } while (s !== prev);
+  return s;
+}
+function normalize3(raw) {
+  return unquote(raw).replace(/\\/g, "/").toLowerCase();
+}
+function isFixedTempPath(candidate) {
+  const p2 = normalize3(candidate);
+  const root = TEMP_ROOTS.map((r2) => normalize3(r2)).find((r2) => p2.startsWith(r2));
+  if (!root) return false;
+  if (p2.length <= root.length) return false;
+  return !SCOPED_MARKERS.some((m) => p2.includes(m.toLowerCase()));
+}
+function extract(line, patterns) {
+  const found = [];
+  for (const re2 of patterns) {
+    for (const m of line.matchAll(new RegExp(re2, "g"))) {
+      if (m[1]) found.push(m[1]);
+    }
+  }
+  return found;
+}
+async function checkSharedTempPath(ctx) {
+  const issues = [];
+  const written = /* @__PURE__ */ new Map();
+  const reported = /* @__PURE__ */ new Set();
+  const transcript = await readProjectTranscript(ctx.currentProject);
+  const scanned = [
+    ...transcript.events.filter((e) => e.kind === "command").map((e) => ({ display: e.text, timestamp: e.timestamp })),
+    ...ctx.history.map((h2) => ({ display: h2.display, timestamp: h2.timestamp }))
+  ];
+  const ordered = scanned.sort((a, b2) => a.timestamp - b2.timestamp);
+  for (const entry of ordered) {
+    const line = entry.display;
+    const usesMktemp = /\bmktemp\b/.test(line);
+    for (const candidate of extract(line, READ_PATTERNS)) {
+      if (usesMktemp || !isFixedTempPath(candidate)) continue;
+      const key = normalize3(candidate);
+      const origin = written.get(key);
+      if (!origin || reported.has(key)) continue;
+      reported.add(key);
+      issues.push({
+        severity: "error",
+        check: "session-shared-temp-path",
+        ruleId: "session-shared-temp-path/shared-temp-path",
+        line: 0,
+        message: `Fixed temp path "${unquote(candidate)}" is written and later read back`,
+        detail: `Written by: ${origin.display.trim().slice(0, 120)}
+Read by:    ${line.trim().slice(0, 120)}`,
+        suggestion: "Use a per-run path instead: `T=$(mktemp)` in shell, or a session-scoped scratch directory. A literal path under a shared temp root can be overwritten by any concurrent session between the write and the read, and a restore then puts the wrong bytes into your workspace."
+      });
+    }
+    for (const candidate of extract(line, WRITE_PATTERNS)) {
+      if (usesMktemp || !isFixedTempPath(candidate)) continue;
+      written.set(normalize3(candidate), entry);
+    }
+  }
+  return issues;
+}
+var TEMP_ROOTS, SCOPED_MARKERS, WRITE_PATTERNS, READ_PATTERNS;
+var init_shared_temp_path = __esm({
+  "src/core/checks/session/shared-temp-path.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    TEMP_ROOTS = [
+      "/tmp/",
+      "/var/tmp/",
+      "$TMPDIR/",
+      "${TMPDIR}/",
+      "%TEMP%\\",
+      "%TMP%\\"
+    ];
+    SCOPED_MARKERS = [
+      "$$",
+      "$pid",
+      "${pid}",
+      "mktemp",
+      "$random",
+      "${random}",
+      "$session",
+      "${session}",
+      "$uuid",
+      "${uuid}"
+    ];
+    WRITE_PATTERNS = [
+      />\s*(\S+)/,
+      // shell redirect
+      /\bcp\s+\S+\s+(\S+)/,
+      // cp src dest
+      /\bmv\s+\S+\s+(\S+)/,
+      /\bcopy\s+\S+\s+(\S+)/,
+      /\bmove\s+\S+\s+(\S+)/,
+      /\btee\s+(\S+)/,
+      /writeFileSync\(\s*['"`]([^'"`]+)/,
+      /\bcurl\b[^|]*-o\s+(\S+)/
+    ];
+    READ_PATTERNS = [
+      /\bcp\s+(\S+)\s+\S+/,
+      /\bcopy\s+(\S+)\s+\S+/,
+      /\bcat\s+(\S+)/,
+      /\btype\s+(\S+)/,
+      /\bsource\s+(\S+)/,
+      /\breadFileSync\(\s*['"`]([^'"`]+)/,
+      // Input redirect. `(?!<)` excludes heredocs (`<<'EOF'`), and the leading
+      // boundary plus the restricted character class keep it from matching a `<`
+      // that is part of a comparison, an HTML fragment, or another operator --
+      // a bare /<\s*(\S+)/ matched unrelated text in real transcripts.
+      /(?:^|\s)<(?!<)\s*([^\s<>|&;]+)/
+    ];
+  }
+});
+
+// src/core/checks/session/unverified-gate-claimed-clean.ts
+function gateOf(cmd) {
+  for (const { re: re2, gate } of GATE_PATTERNS) {
+    if (re2.test(cmd)) return gate;
+  }
+  return null;
+}
+function isUnverified(ev) {
+  return ev.isError === true || ev.emptyOutput === true;
+}
+async function checkUnverifiedGateClaimedClean(ctx) {
+  const { events } = await readProjectTranscript(ctx.currentProject);
+  if (events.length === 0) return [];
+  const ordered = [...events].sort((a, b2) => a.timestamp - b2.timestamp);
+  const issues = [];
+  const reported = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < ordered.length; i2++) {
+    const ev = ordered[i2];
+    if (ev.kind !== "command") continue;
+    const gate = gateOf(ev.text);
+    if (!gate || !isUnverified(ev)) continue;
+    for (let j3 = i2 + 1; j3 < ordered.length && j3 <= i2 + ADJACENCY; j3++) {
+      const next = ordered[j3];
+      if (next.kind === "command" && gateOf(next.text) === gate) break;
+      if (next.kind !== "assistant-text") continue;
+      if (HONEST_MARKERS.some((re2) => re2.test(next.text))) break;
+      if (!CLEAN_CLAIMS.some((re2) => re2.test(next.text))) continue;
+      if (reported.has(gate)) break;
+      reported.add(gate);
+      const why = ev.isError ? "the invocation reported an error" : "the invocation produced no output";
+      issues.push({
+        severity: "warning",
+        check: "session-unverified-gate-claimed-clean",
+        ruleId: "session-unverified-gate-claimed-clean/unverified-gate-claimed-clean",
+        line: 0,
+        message: `'${gate}' asserted as passing, but ${why}`,
+        detail: `Gate command: ${ev.text.trim().slice(0, 120)}
+Claim:        ${next.text.trim().slice(0, 120)}`,
+        suggestion: 'An empty or failed gate carries no information about cleanliness -- a runner that dies before emitting diagnostics looks exactly like one that found none. Either re-run the gate until it produces a real result, or report the state honestly ("lint UNVERIFIED -- runner crashed").'
+      });
+      break;
+    }
+  }
+  return issues;
+}
+var GATE_PATTERNS, CLEAN_CLAIMS, HONEST_MARKERS, ADJACENCY;
+var init_unverified_gate_claimed_clean = __esm({
+  "src/core/checks/session/unverified-gate-claimed-clean.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    GATE_PATTERNS = [
+      { re: /\b(biome|eslint|ruff|clippy)\b/, gate: "lint" },
+      { re: /\blint(:fix)?\b/, gate: "lint" },
+      { re: /\btsc\b|\btypecheck\b|\btype-check\b/, gate: "typecheck" },
+      { re: /\b(vitest|jest|pytest|mocha)\b/, gate: "test" },
+      { re: /\btest\b/, gate: "test" },
+      { re: /\bbuild\b/, gate: "build" }
+    ];
+    CLEAN_CLAIMS = [
+      /\ball green\b/i,
+      /\bno (lint )?(violations|errors|issues|diagnostics)\b/i,
+      /\b0 errors\b/i,
+      /\bzero (errors|violations|diagnostics)\b/i,
+      /\b(lint|typecheck|type-check|tests?|build)\b[^.\n]{0,40}\b(clean|passe[sd]|passing|green|succeeded)\b/i,
+      /\b(clean|passing|green)\b[^.\n]{0,25}\b(lint|typecheck|type-check|tests?|build)\b/i
+    ];
+    HONEST_MARKERS = [
+      /\bunverified\b/i,
+      /\bcould not verify\b/i,
+      /\bcannot verify\b/i,
+      /\bunable to verify\b/i,
+      /\bcrashed?\b/i,
+      /\bsegfault/i,
+      /\bblocked\b/i,
+      /\bnot trustworthy\b/i,
+      /\bno signal\b/i,
+      /\bdid not run\b/i,
+      /\binconclusive\b/i
+    ];
+    ADJACENCY = 12;
+  }
+});
+
+// src/core/checks/session/default-branch-accumulation.ts
+function isCommit(cmd) {
+  return /\bgit\s+commit\b/.test(cmd) && !/--dry-run\b/.test(cmd);
+}
+function isBranchAway(cmd) {
+  return /\bgit\s+(checkout\s+-b|switch\s+-c|worktree\s+add)\b/.test(cmd);
+}
+async function checkDefaultBranchAccumulation(ctx) {
+  const { events } = await readProjectTranscript(ctx.currentProject);
+  if (events.length === 0) return [];
+  const ordered = [...events].sort((a, b2) => a.timestamp - b2.timestamp);
+  const pending = /* @__PURE__ */ new Set();
+  let branch = "";
+  let firstWrite = "";
+  for (const ev of ordered) {
+    if (ev.gitBranch) branch = ev.gitBranch;
+    if (ev.kind === "command") {
+      if (isCommit(ev.text) || isBranchAway(ev.text)) {
+        pending.clear();
+        firstWrite = "";
+      }
+      continue;
+    }
+    if (ev.kind !== "file-write") continue;
+    if (!DEFAULT_BRANCHES.has(branch)) continue;
+    if (pending.size === 0) firstWrite = ev.text;
+    pending.add(ev.text);
+  }
+  if (pending.size < THRESHOLD) return [];
+  const sample = [...pending].slice(0, 5);
+  return [
+    {
+      severity: "warning",
+      check: "session-default-branch-accumulation",
+      ruleId: "session-default-branch-accumulation/default-branch-accumulation",
+      line: 0,
+      message: `${pending.size} files edited on '${branch}' with no intervening commit`,
+      detail: `First uncommitted write: ${firstWrite}
+Sample: ${sample.join(", ")}${pending.size > sample.length ? ", ..." : ""}`,
+      suggestion: "Commit as you go, or move the work to a topic branch (`git checkout -b`). A large uncommitted delta on a shared default branch is hard to review and, when other agent sessions share the checkout, one `git stash` or `git checkout --` away from being lost."
+    }
+  ];
+}
+var DEFAULT_BRANCHES, THRESHOLD;
+var init_default_branch_accumulation = __esm({
+  "src/core/checks/session/default-branch-accumulation.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    DEFAULT_BRANCHES = /* @__PURE__ */ new Set(["main", "master"]);
+    THRESHOLD = 10;
+  }
+});
+
+// src/core/checks/ci-coverage.ts
+import { readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
 async function findReleaseWorkflows(projectRoot) {
-  const workflowDir = join9(projectRoot, ".github", "workflows");
-  if (!existsSync5(workflowDir)) return [];
+  const workflowDir = join10(projectRoot, ".github", "workflows");
+  if (!existsSync6(workflowDir)) return [];
   let files;
   try {
-    files = await readdir3(workflowDir);
+    files = await readdir4(workflowDir);
   } catch {
     return [];
   }
@@ -25005,7 +25507,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
+      const content = stripBom(await readFile4(join10(workflowDir, f), "utf-8"));
       const nameMatch = content.match(/^\s*name:\s*(.+?)\s*$/m);
       if (nameMatch) {
         const name = nameMatch[1].replace(/^(['"])(.*)\1$/, "$2");
@@ -25064,15 +25566,15 @@ var init_ci_coverage = __esm({
 });
 
 // src/core/checks/ci-secrets.ts
-import { readdir as readdir4, readFile as readFile5 } from "node:fs/promises";
-import { join as join10 } from "node:path";
-import { existsSync as existsSync6 } from "node:fs";
+import { readdir as readdir5, readFile as readFile5 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
 async function findSecretUsages(projectRoot) {
-  const workflowDir = join10(projectRoot, ".github", "workflows");
-  if (!existsSync6(workflowDir)) return [];
+  const workflowDir = join11(projectRoot, ".github", "workflows");
+  if (!existsSync7(workflowDir)) return [];
   let files;
   try {
-    files = await readdir4(workflowDir);
+    files = await readdir5(workflowDir);
   } catch {
     return [];
   }
@@ -25081,7 +25583,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = stripBom(await readFile5(join10(workflowDir, f), "utf-8"));
+      content = stripBom(await readFile5(join11(workflowDir, f), "utf-8"));
     } catch {
       continue;
     }
@@ -25470,9 +25972,24 @@ function isMsysFlag(token) {
 }
 function translateMsysDrivePath(s, platform) {
   if (platform !== "win32") return s;
-  const m = /^\/([A-Za-z])\/(.*)$/.exec(s);
+  const m = /^\/{1,2}([A-Za-z])\/(.*)$/.exec(s);
   return m ? `${m[1]}:/${m[2]}` : s;
 }
+function findExistingVariant(raw, projectRoot, homeDir, platform) {
+  const token = stripMatcherWildcard(raw);
+  const variants = /* @__PURE__ */ new Set();
+  if (/^\/{2}[A-Za-z]\//.test(token)) variants.add(token.slice(1));
+  if (/^\/[A-Za-z]\//.test(token)) variants.add(`/${token}`);
+  if (token.startsWith("/") && !/^\/{1,2}[A-Za-z]\//.test(token)) {
+    variants.add(token.replace(/^\/+/, ""));
+  }
+  if (token.includes("\\")) variants.add(token.replace(/\\/g, "/"));
+  for (const v2 of variants) {
+    const resolved = expandPath(v2, projectRoot, homeDir, platform);
+    if (resolved !== null && fileExists(resolved)) return resolved;
+  }
+  return null;
+}
 function extractCommandPaths(command, projectRoot, homeDir, platform) {
   const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
   const out = [];
@@ -25505,6 +26022,18 @@ function checkSource(source, projectRoot, homeDir, platform) {
     if (cand.resolved === null) return;
     if (fileExists(cand.resolved)) return;
     const where = source.isUserGlobal ? ` (in ${source.displayPath})` : "";
+    const variant = findExistingVariant(cand.raw, projectRoot, homeDir, platform);
+    if (variant !== null) {
+      issues.push({
+        severity: "warning",
+        check: "hook-coverage",
+        ruleId: "hook-coverage/dead-hook",
+        line,
+        message: `${origin} references "${cand.raw}" which does not resolve${where}, but "${variant}" exists \u2014 the path form is wrong, so the gate silently no-ops`,
+        suggestion: `Rewrite the entry to use "${variant}". Do NOT delete it \u2014 the target exists; only the path form is unresolvable.`
+      });
+      return;
+    }
     issues.push({
       severity: "warning",
       check: "hook-coverage",
@@ -27805,7 +28334,7 @@ import { readFileSync as readFileSync7 } from "node:fs";
 import { resolve as resolve14, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function loadVersion() {
-  if (true) return "0.18.5";
+  if (true) return "0.18.7";
   try {
     const __dir = dirname6(fileURLToPath2(import.meta.url));
     const pkgPath = resolve14(__dir, "../package.json");
@@ -27894,7 +28423,8 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         if (activeChecks.includes("content-secrets"))
           checkPromises.push(checkContentSecrets(parseResult, projectRoot));
         const results = await Promise.all(checkPromises);
-        const singleFileIssues = results.flat();
+        const suppressions = collectSuppressions(parseResult.content);
+        const singleFileIssues = results.flat().filter((issue2) => !isSuppressed(suppressions, issue2));
         if (stat3 !== null) {
           setCacheEntry(absPath, {
             mtime: stat3.mtimeMs,
@@ -28043,6 +28573,12 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         sessionPromises.push(checkLoopDetection(sessionCtx));
       if (sessionChecksToRun.includes("session-memory-index-overflow"))
         sessionPromises.push(checkMemoryIndexOverflow(sessionCtx));
+      if (sessionChecksToRun.includes("session-shared-temp-path"))
+        sessionPromises.push(checkSharedTempPath(sessionCtx));
+      if (sessionChecksToRun.includes("session-unverified-gate-claimed-clean"))
+        sessionPromises.push(checkUnverifiedGateClaimedClean(sessionCtx));
+      if (sessionChecksToRun.includes("session-default-branch-accumulation"))
+        sessionPromises.push(checkDefaultBranchAccumulation(sessionCtx));
       const sessionResults = await Promise.all(sessionPromises);
       const sessionIssues = sessionResults.flat();
       fileResults.push({
@@ -28221,6 +28757,7 @@ var init_audit = __esm({
     init_paths();
     init_commands();
     init_staleness();
+    init_suppressions();
     init_tokens2();
     init_tier_tokens();
     init_redundancy();
@@ -28242,6 +28779,9 @@ var init_audit = __esm({
     init_duplicate_memory();
     init_loop_detection();
     init_memory_index_overflow();
+    init_shared_temp_path();
+    init_unverified_gate_claimed_clean();
+    init_default_branch_accumulation();
     init_ci_coverage();
     init_ci_secrets();
     init_content_secrets();
@@ -28283,7 +28823,10 @@ var init_audit = __esm({
       "session-stale-memory",
       "session-duplicate-memory",
       "session-loop-detection",
-      "session-memory-index-overflow"
+      "session-memory-index-overflow",
+      "session-shared-temp-path",
+      "session-unverified-gate-claimed-clean",
+      "session-default-branch-accumulation"
     ];
     ALL_SKILL_CHECKS = [
       "skill-frontmatter",
@@ -54126,8 +54669,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize3) {
-      if (normalize3 !== false)
+    function getFullPath(resolver, id = "", normalize4) {
+      if (normalize4 !== false)
         id = normalizeId(id);
       const p2 = resolver.parse(id);
       return _getFullPath(resolver, p2);
@@ -55530,7 +56073,7 @@ var require_fast_uri = __commonJS({
     init_define_WEB_FIRST_SEGMENTS();
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize3(uri, options) {
+    function normalize4(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         normalizeString(uri, options);
@@ -55797,7 +56340,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize3,
+      normalize: normalize4,
       resolve: resolve18,
       resolveComponent,
       equal,
@@ -68350,6 +68893,8 @@ var init_ora = __esm({
 });
 
 // src/core/reporter.ts
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
+import { join as join16 } from "node:path";
 function classifyFile(f) {
   if (f.path === "(project)") return "context";
   if (f.path === "(mcp)") return "mcp";
@@ -68371,10 +68916,32 @@ function classifyFile(f) {
 function isSyntheticBucket(p2) {
   return p2 === "(project)" || p2 === "(mcp)" || p2.includes(SESSION_AUDIT_PATH_MARKER) || p2.includes(SKILL_AUDIT_PATH_MARKER);
 }
+function detectVersionSkew(projectRoot, runningVersion) {
+  try {
+    const pkgPath = join16(projectRoot, "package.json");
+    if (!existsSync8(pkgPath)) return null;
+    const raw = readFileSync10(pkgPath, "utf8").replace(/^\uFEFF/, "");
+    const pkg = JSON.parse(raw);
+    const name = pkg.name ?? "";
+    if (name !== "ctxlint" && name !== "@yawlabs/ctxlint") return null;
+    if (!pkg.version || pkg.version === runningVersion) return null;
+    return pkg.version;
+  } catch {
+    return null;
+  }
+}
 function formatText(result, verbose = false) {
   const lines = [];
   lines.push("");
   lines.push(source_default.bold(`ctxlint v${result.version}`));
+  const skew = detectVersionSkew(result.projectRoot, result.version);
+  if (skew !== null) {
+    lines.push(
+      source_default.yellow(
+        `  note: this checkout is v${skew} -- you are running v${result.version}. Rebuild or reinstall before trusting a result against it.`
+      )
+    );
+  }
   lines.push("");
   lines.push(`Scanning ${result.projectRoot}...`);
   lines.push("");
@@ -68748,6 +69315,27 @@ function buildRuleDescriptors() {
       },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     },
+    {
+      id: "ctxlint/session-shared-temp-path",
+      shortDescription: {
+        text: "Fixed temp path written then read back -- clobberable by a concurrent session"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-unverified-gate-claimed-clean",
+      shortDescription: {
+        text: "A quality gate asserted as passing while its invocation failed or emitted nothing"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-default-branch-accumulation",
+      shortDescription: {
+        text: "Many files edited on the default branch with no intervening commit"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
     {
       id: "ctxlint/skill-frontmatter",
       shortDescription: { text: "Skill/agent definition missing required frontmatter" },
@@ -69144,8 +69732,8 @@ npx @yawlabs/ctxlint@${VERSION} --strict
   program2.parse();
 }
 async function promptYesNo(question) {
-  const { createInterface: createInterface2 } = await import("node:readline/promises");
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const { createInterface: createInterface3 } = await import("node:readline/promises");
+  const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     const answer = await rl.question(question);
     return /^\s*y(es)?\s*$/i.test(answer);
@@ -69276,4 +69864,3 @@ if (args.includes("--lsp")) {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();
 }
-//# sourceMappingURL=index.js.map