@yawlabs/ctxlint 0.18.7 → 0.19.0

package/dist/index.js

@@ -13770,8 +13770,8 @@ function extractPathReferences(lines, sections) {
       if (inCodeBlock && codeBlockLang === "" && /^\s/.test(line) && /^[\w@.-]+\/$/.test(cleanValue)) {
         continue;
       }
-      const lowerProse = /^([a-z][\w-]*)\/[a-z][\w-]*$/.exec(cleanValue);
-      if (lowerProse && !PATH_FIRST_SEGMENTS.has(lowerProse[1])) {
+      const twoSegmentProse = /^([A-Za-z][\w-]*)\/[A-Za-z][\w-]*$/.exec(cleanValue);
+      if (twoSegmentProse && !PATH_FIRST_SEGMENTS.has(twoSegmentProse[1].toLowerCase())) {
         continue;
       }
       if (/^[a-z][\w-]*(?:\/[a-z][\w-]*){2,}$/.test(cleanValue)) continue;
@@ -19966,8 +19966,8 @@ async function findRenames(projectRoot, filePath) {
 async function findRenamesBatch(projectRoot, relPaths) {
   const result = /* @__PURE__ */ new Map();
   if (relPaths.length === 0) return result;
-  let cache = renameCache.get(projectRoot);
-  if (!cache) {
+  let cache2 = renameCache.get(projectRoot);
+  if (!cache2) {
     try {
       const git = getGit(projectRoot);
       const rawOutput = await git.raw([
@@ -19985,14 +19985,14 @@ async function findRenamesBatch(projectRoot, relPaths) {
       } catch {
       }
       const { allRenames: allRenames2, basenameBuckets: basenameBuckets2 } = parseRenameLogAll(rawOutput);
-      cache = { allRenames: allRenames2, basenameBuckets: basenameBuckets2, prefix: prefix2 };
-      renameCache.set(projectRoot, cache);
+      cache2 = { allRenames: allRenames2, basenameBuckets: basenameBuckets2, prefix: prefix2 };
+      renameCache.set(projectRoot, cache2);
     } catch {
       for (const p2 of relPaths) result.set(p2, null);
       return result;
     }
   }
-  const { allRenames, basenameBuckets, prefix } = cache;
+  const { allRenames, basenameBuckets, prefix } = cache2;
   for (const relPath of relPaths) {
     const rel = relPath.replace(/\\/g, "/");
     const target = prefix + rel;
@@ -22130,6 +22130,50 @@ var init_staleness = __esm({
   }
 });
 
+// src/core/suppressions.ts
+function collectSuppressions(content) {
+  const suppressions = /* @__PURE__ */ new Map();
+  const lines = content.split("\n");
+  const add = (lineNumber, checks) => {
+    const existing = suppressions.get(lineNumber);
+    if (existing === null) return;
+    if (checks.length === 0) {
+      suppressions.set(lineNumber, null);
+      return;
+    }
+    const merged = existing ?? /* @__PURE__ */ new Set();
+    for (const check2 of checks) merged.add(check2);
+    suppressions.set(lineNumber, merged);
+  };
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!line.includes("ctxlint-ignore-")) continue;
+    DIRECTIVE_RE.lastIndex = 0;
+    let match;
+    while ((match = DIRECTIVE_RE.exec(line)) !== null) {
+      const kind = match[1];
+      const checks = (match[2] ?? "").trim().split(/\s+/).filter(Boolean);
+      add(kind === "next-line" ? i2 + 2 : i2 + 1, checks);
+    }
+  }
+  return suppressions;
+}
+function isSuppressed(suppressions, issue2) {
+  if (suppressions.size === 0) return false;
+  if (!suppressions.has(issue2.line)) return false;
+  const checks = suppressions.get(issue2.line);
+  if (checks === null) return true;
+  return checks.has(issue2.check);
+}
+var DIRECTIVE_RE;
+var init_suppressions = __esm({
+  "src/core/suppressions.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    DIRECTIVE_RE = /<!--\s*ctxlint-ignore-(next-line|line)((?:\s+[\w-]+)*)\s*-->/g;
+  }
+});
+
 // src/core/checks/tokens.ts
 function resolveTokenThresholds(overrides) {
   if (!overrides) return DEFAULT_TOKEN_THRESHOLDS;
@@ -24081,6 +24125,11 @@ function loadWebFirstSegments() {
 function encodeProjectDir(fsPath) {
   return fsPath.replace(/[:\\/\.]/g, "-");
 }
+function projectDirCandidates(fsPath) {
+  const encoded = encodeProjectDir(fsPath);
+  const folded = encoded.replace(/_/g, "-");
+  return folded === encoded ? [encoded] : [encoded, folded];
+}
 function projectDirMatchesPath(encodedDir, fsPath) {
   const normalized = fsPath.replace(/\\/g, "/");
   return encodedDir === encodeProjectDir(normalized);
@@ -24967,13 +25016,19 @@ import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || homedir5();
   if (!home2) return [];
-  const encoded = encodeProjectDir(ctx.currentProject);
-  const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
-  let content;
-  try {
-    content = stripBom(await readFile3(memoryFile, "utf-8"));
-  } catch {
-    return [];
+  let content = "";
+  let memoryFile = "";
+  for (const encoded of projectDirCandidates(ctx.currentProject)) {
+    const candidate = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
+    try {
+      content = stripBom(await readFile3(candidate, "utf-8"));
+    } catch {
+      continue;
+    }
+    if (content) {
+      memoryFile = candidate;
+      break;
+    }
   }
   if (!content) return [];
   const lines = content.split("\n");
@@ -25018,16 +25073,429 @@ var init_memory_index_overflow = __esm({
   }
 });
 
-// src/core/checks/ci-coverage.ts
-import { readdir as readdir3, readFile as readFile4 } from "node:fs/promises";
+// src/core/transcript.ts
+import { createReadStream as createReadStream2, existsSync as existsSync5, statSync as statSync4 } from "node:fs";
+import { readdir as readdir3 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
 import { join as join9 } from "node:path";
-import { existsSync as existsSync5 } from "node:fs";
+import { createInterface as createInterface2 } from "node:readline";
+function asString(v2) {
+  return typeof v2 === "string" ? v2 : "";
+}
+function resultText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.map((b2) => b2 && typeof b2 === "object" ? asString(b2.text) : "").join("");
+}
+function resolveHome() {
+  return process.env.HOME || process.env.USERPROFILE || homedir6();
+}
+function readProjectTranscript(project, home2 = resolveHome()) {
+  const key = `${home2} ${project}`;
+  let hit = cache.get(key);
+  if (!hit) {
+    hit = readUncached(project, home2);
+    cache.set(key, hit);
+  }
+  return hit;
+}
+function candidateDirs(project, home2) {
+  const root = join9(home2, ".claude", "projects");
+  return projectDirCandidates(project).map((n7) => join9(root, n7)).filter((d) => existsSync5(d));
+}
+async function readUncached(project, home2) {
+  if (!home2 || !project) return EMPTY;
+  const dirs = candidateDirs(project, home2);
+  if (dirs.length === 0) return EMPTY;
+  const names = [];
+  for (const dir of dirs) {
+    for (const name of await readdir3(dir).catch(() => [])) {
+      names.push({ dir, name });
+    }
+  }
+  const files = names.filter(({ name }) => name.endsWith(".jsonl")).map(({ dir, name }) => {
+    const p2 = join9(dir, name);
+    try {
+      return { p: p2, mtime: statSync4(p2).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((f) => f !== null).sort((a, b2) => b2.mtime - a.mtime);
+  let truncated = files.length > MAX_TRANSCRIPTS;
+  const selected = files.slice(0, MAX_TRANSCRIPTS);
+  const events = [];
+  const pending = /* @__PURE__ */ new Map();
+  let lines = 0;
+  for (const { p: p2 } of selected) {
+    if (lines >= MAX_LINES2) {
+      truncated = true;
+      break;
+    }
+    const rl = createInterface2({
+      input: createReadStream2(p2, { encoding: "utf-8" }),
+      crlfDelay: Infinity
+    });
+    try {
+      for await (const raw of rl) {
+        if (++lines >= MAX_LINES2) {
+          truncated = true;
+          break;
+        }
+        const line = raw.trim();
+        if (!line) continue;
+        let rec;
+        try {
+          rec = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        collect(rec, events, pending);
+      }
+    } catch {
+    } finally {
+      rl.close();
+    }
+  }
+  return { events, filesRead: selected.length, truncated };
+}
+function collect(rec, events, pending) {
+  const message = rec.message;
+  const content = message?.content;
+  if (!Array.isArray(content)) return;
+  const timestamp = Date.parse(asString(rec.timestamp)) || 0;
+  const sessionId = asString(rec.sessionId) || asString(rec.session_id);
+  const gitBranch = asString(rec.gitBranch) || void 0;
+  for (const raw of content) {
+    if (!raw || typeof raw !== "object") continue;
+    const block = raw;
+    const type = asString(block.type);
+    if (type === "text" && rec.type === "assistant") {
+      const text = asString(block.text);
+      if (text) {
+        events.push({ kind: "assistant-text", text, tool: "", gitBranch, timestamp, sessionId });
+      }
+      continue;
+    }
+    if (type === "tool_use") {
+      const tool = asString(block.name);
+      const input = block.input ?? {};
+      const cmdField = COMMAND_TOOLS[tool];
+      const writeField = WRITE_TOOLS[tool];
+      let ev = null;
+      if (cmdField) {
+        const text = asString(input[cmdField]);
+        if (text) ev = { kind: "command", text, tool, gitBranch, timestamp, sessionId };
+      } else if (writeField) {
+        const text = asString(input[writeField]);
+        if (text) ev = { kind: "file-write", text, tool, gitBranch, timestamp, sessionId };
+      }
+      if (ev) {
+        events.push(ev);
+        const id = asString(block.id);
+        if (id) pending.set(id, ev);
+      }
+      continue;
+    }
+    if (type === "tool_result") {
+      const id = asString(block.tool_use_id);
+      const ev = id ? pending.get(id) : void 0;
+      if (!ev) continue;
+      pending.delete(id);
+      ev.isError = block.is_error === true;
+      ev.emptyOutput = resultText(block.content).trim().length === 0;
+    }
+  }
+}
+var WRITE_TOOLS, COMMAND_TOOLS, MAX_TRANSCRIPTS, MAX_LINES2, EMPTY, cache;
+var init_transcript = __esm({
+  "src/core/transcript.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_session_parser();
+    WRITE_TOOLS = {
+      Write: "file_path",
+      Edit: "file_path",
+      NotebookEdit: "notebook_path"
+    };
+    COMMAND_TOOLS = {
+      Bash: "command",
+      PowerShell: "command"
+    };
+    MAX_TRANSCRIPTS = 5;
+    MAX_LINES2 = 2e5;
+    EMPTY = { events: [], filesRead: 0, truncated: false };
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/core/checks/session/shared-temp-path.ts
+function unquote(raw) {
+  let s = raw;
+  let prev;
+  do {
+    prev = s;
+    s = s.replace(/^['"`]|['"`]$/g, "");
+  } while (s !== prev);
+  return s;
+}
+function normalize3(raw) {
+  return unquote(raw).replace(/\\/g, "/").toLowerCase();
+}
+function isFixedTempPath(candidate) {
+  const p2 = normalize3(candidate);
+  const root = TEMP_ROOTS.map((r2) => normalize3(r2)).find((r2) => p2.startsWith(r2));
+  if (!root) return false;
+  if (p2.length <= root.length) return false;
+  return !SCOPED_MARKERS.some((m) => p2.includes(m.toLowerCase()));
+}
+function extract(line, patterns) {
+  const found = [];
+  for (const re2 of patterns) {
+    for (const m of line.matchAll(new RegExp(re2, "g"))) {
+      if (m[1]) found.push(m[1]);
+    }
+  }
+  return found;
+}
+async function checkSharedTempPath(ctx) {
+  const issues = [];
+  const written = /* @__PURE__ */ new Map();
+  const reported = /* @__PURE__ */ new Set();
+  const transcript = await readProjectTranscript(ctx.currentProject);
+  const scanned = [
+    ...transcript.events.filter((e) => e.kind === "command").map((e) => ({ display: e.text, timestamp: e.timestamp })),
+    ...ctx.history.map((h2) => ({ display: h2.display, timestamp: h2.timestamp }))
+  ];
+  const ordered = scanned.sort((a, b2) => a.timestamp - b2.timestamp);
+  for (const entry of ordered) {
+    const line = entry.display;
+    const usesMktemp = /\bmktemp\b/.test(line);
+    for (const candidate of extract(line, READ_PATTERNS)) {
+      if (usesMktemp || !isFixedTempPath(candidate)) continue;
+      const key = normalize3(candidate);
+      const origin = written.get(key);
+      if (!origin || reported.has(key)) continue;
+      reported.add(key);
+      issues.push({
+        severity: "error",
+        check: "session-shared-temp-path",
+        ruleId: "session-shared-temp-path/shared-temp-path",
+        line: 0,
+        message: `Fixed temp path "${unquote(candidate)}" is written and later read back`,
+        detail: `Written by: ${origin.display.trim().slice(0, 120)}
+Read by:    ${line.trim().slice(0, 120)}`,
+        suggestion: "Use a per-run path instead: `T=$(mktemp)` in shell, or a session-scoped scratch directory. A literal path under a shared temp root can be overwritten by any concurrent session between the write and the read, and a restore then puts the wrong bytes into your workspace."
+      });
+    }
+    for (const candidate of extract(line, WRITE_PATTERNS)) {
+      if (usesMktemp || !isFixedTempPath(candidate)) continue;
+      written.set(normalize3(candidate), entry);
+    }
+  }
+  return issues;
+}
+var TEMP_ROOTS, SCOPED_MARKERS, WRITE_PATTERNS, READ_PATTERNS;
+var init_shared_temp_path = __esm({
+  "src/core/checks/session/shared-temp-path.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    TEMP_ROOTS = [
+      "/tmp/",
+      "/var/tmp/",
+      "$TMPDIR/",
+      "${TMPDIR}/",
+      "%TEMP%\\",
+      "%TMP%\\"
+    ];
+    SCOPED_MARKERS = [
+      "$$",
+      "$pid",
+      "${pid}",
+      "mktemp",
+      "$random",
+      "${random}",
+      "$session",
+      "${session}",
+      "$uuid",
+      "${uuid}"
+    ];
+    WRITE_PATTERNS = [
+      />\s*(\S+)/,
+      // shell redirect
+      /\bcp\s+\S+\s+(\S+)/,
+      // cp src dest
+      /\bmv\s+\S+\s+(\S+)/,
+      /\bcopy\s+\S+\s+(\S+)/,
+      /\bmove\s+\S+\s+(\S+)/,
+      /\btee\s+(\S+)/,
+      /writeFileSync\(\s*['"`]([^'"`]+)/,
+      /\bcurl\b[^|]*-o\s+(\S+)/
+    ];
+    READ_PATTERNS = [
+      /\bcp\s+(\S+)\s+\S+/,
+      /\bcopy\s+(\S+)\s+\S+/,
+      /\bcat\s+(\S+)/,
+      /\btype\s+(\S+)/,
+      /\bsource\s+(\S+)/,
+      /\breadFileSync\(\s*['"`]([^'"`]+)/,
+      // Input redirect. `(?!<)` excludes heredocs (`<<'EOF'`), and the leading
+      // boundary plus the restricted character class keep it from matching a `<`
+      // that is part of a comparison, an HTML fragment, or another operator --
+      // a bare /<\s*(\S+)/ matched unrelated text in real transcripts.
+      /(?:^|\s)<(?!<)\s*([^\s<>|&;]+)/
+    ];
+  }
+});
+
+// src/core/checks/session/unverified-gate-claimed-clean.ts
+function gateOf(cmd) {
+  for (const { re: re2, gate } of GATE_PATTERNS) {
+    if (re2.test(cmd)) return gate;
+  }
+  return null;
+}
+function isUnverified(ev) {
+  return ev.isError === true || ev.emptyOutput === true;
+}
+async function checkUnverifiedGateClaimedClean(ctx) {
+  const { events } = await readProjectTranscript(ctx.currentProject);
+  if (events.length === 0) return [];
+  const ordered = [...events].sort((a, b2) => a.timestamp - b2.timestamp);
+  const issues = [];
+  const reported = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < ordered.length; i2++) {
+    const ev = ordered[i2];
+    if (ev.kind !== "command") continue;
+    const gate = gateOf(ev.text);
+    if (!gate || !isUnverified(ev)) continue;
+    for (let j3 = i2 + 1; j3 < ordered.length && j3 <= i2 + ADJACENCY; j3++) {
+      const next = ordered[j3];
+      if (next.kind === "command" && gateOf(next.text) === gate) break;
+      if (next.kind !== "assistant-text") continue;
+      if (HONEST_MARKERS.some((re2) => re2.test(next.text))) break;
+      if (!CLEAN_CLAIMS.some((re2) => re2.test(next.text))) continue;
+      if (reported.has(gate)) break;
+      reported.add(gate);
+      const why = ev.isError ? "the invocation reported an error" : "the invocation produced no output";
+      issues.push({
+        severity: "warning",
+        check: "session-unverified-gate-claimed-clean",
+        ruleId: "session-unverified-gate-claimed-clean/unverified-gate-claimed-clean",
+        line: 0,
+        message: `'${gate}' asserted as passing, but ${why}`,
+        detail: `Gate command: ${ev.text.trim().slice(0, 120)}
+Claim:        ${next.text.trim().slice(0, 120)}`,
+        suggestion: 'An empty or failed gate carries no information about cleanliness -- a runner that dies before emitting diagnostics looks exactly like one that found none. Either re-run the gate until it produces a real result, or report the state honestly ("lint UNVERIFIED -- runner crashed").'
+      });
+      break;
+    }
+  }
+  return issues;
+}
+var GATE_PATTERNS, CLEAN_CLAIMS, HONEST_MARKERS, ADJACENCY;
+var init_unverified_gate_claimed_clean = __esm({
+  "src/core/checks/session/unverified-gate-claimed-clean.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    GATE_PATTERNS = [
+      { re: /\b(biome|eslint|ruff|clippy)\b/, gate: "lint" },
+      { re: /\blint(:fix)?\b/, gate: "lint" },
+      { re: /\btsc\b|\btypecheck\b|\btype-check\b/, gate: "typecheck" },
+      { re: /\b(vitest|jest|pytest|mocha)\b/, gate: "test" },
+      { re: /\btest\b/, gate: "test" },
+      { re: /\bbuild\b/, gate: "build" }
+    ];
+    CLEAN_CLAIMS = [
+      /\ball green\b/i,
+      /\bno (lint )?(violations|errors|issues|diagnostics)\b/i,
+      /\b0 errors\b/i,
+      /\bzero (errors|violations|diagnostics)\b/i,
+      /\b(lint|typecheck|type-check|tests?|build)\b[^.\n]{0,40}\b(clean|passe[sd]|passing|green|succeeded)\b/i,
+      /\b(clean|passing|green)\b[^.\n]{0,25}\b(lint|typecheck|type-check|tests?|build)\b/i
+    ];
+    HONEST_MARKERS = [
+      /\bunverified\b/i,
+      /\bcould not verify\b/i,
+      /\bcannot verify\b/i,
+      /\bunable to verify\b/i,
+      /\bcrashed?\b/i,
+      /\bsegfault/i,
+      /\bblocked\b/i,
+      /\bnot trustworthy\b/i,
+      /\bno signal\b/i,
+      /\bdid not run\b/i,
+      /\binconclusive\b/i
+    ];
+    ADJACENCY = 12;
+  }
+});
+
+// src/core/checks/session/default-branch-accumulation.ts
+function isCommit(cmd) {
+  return /\bgit\s+commit\b/.test(cmd) && !/--dry-run\b/.test(cmd);
+}
+function isBranchAway(cmd) {
+  return /\bgit\s+(checkout\s+-b|switch\s+-c|worktree\s+add)\b/.test(cmd);
+}
+async function checkDefaultBranchAccumulation(ctx) {
+  const { events } = await readProjectTranscript(ctx.currentProject);
+  if (events.length === 0) return [];
+  const ordered = [...events].sort((a, b2) => a.timestamp - b2.timestamp);
+  const pending = /* @__PURE__ */ new Set();
+  let branch = "";
+  let firstWrite = "";
+  for (const ev of ordered) {
+    if (ev.gitBranch) branch = ev.gitBranch;
+    if (ev.kind === "command") {
+      if (isCommit(ev.text) || isBranchAway(ev.text)) {
+        pending.clear();
+        firstWrite = "";
+      }
+      continue;
+    }
+    if (ev.kind !== "file-write") continue;
+    if (!DEFAULT_BRANCHES.has(branch)) continue;
+    if (pending.size === 0) firstWrite = ev.text;
+    pending.add(ev.text);
+  }
+  if (pending.size < THRESHOLD) return [];
+  const sample = [...pending].slice(0, 5);
+  return [
+    {
+      severity: "warning",
+      check: "session-default-branch-accumulation",
+      ruleId: "session-default-branch-accumulation/default-branch-accumulation",
+      line: 0,
+      message: `${pending.size} files edited on '${branch}' with no intervening commit`,
+      detail: `First uncommitted write: ${firstWrite}
+Sample: ${sample.join(", ")}${pending.size > sample.length ? ", ..." : ""}`,
+      suggestion: "Commit as you go, or move the work to a topic branch (`git checkout -b`). A large uncommitted delta on a shared default branch is hard to review and, when other agent sessions share the checkout, one `git stash` or `git checkout --` away from being lost."
+    }
+  ];
+}
+var DEFAULT_BRANCHES, THRESHOLD;
+var init_default_branch_accumulation = __esm({
+  "src/core/checks/session/default-branch-accumulation.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    DEFAULT_BRANCHES = /* @__PURE__ */ new Set(["main", "master"]);
+    THRESHOLD = 10;
+  }
+});
+
+// src/core/checks/ci-coverage.ts
+import { readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
 async function findReleaseWorkflows(projectRoot) {
-  const workflowDir = join9(projectRoot, ".github", "workflows");
-  if (!existsSync5(workflowDir)) return [];
+  const workflowDir = join10(projectRoot, ".github", "workflows");
+  if (!existsSync6(workflowDir)) return [];
   let files;
   try {
-    files = await readdir3(workflowDir);
+    files = await readdir4(workflowDir);
   } catch {
     return [];
   }
@@ -25039,7 +25507,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
+      const content = stripBom(await readFile4(join10(workflowDir, f), "utf-8"));
       const nameMatch = content.match(/^\s*name:\s*(.+?)\s*$/m);
       if (nameMatch) {
         const name = nameMatch[1].replace(/^(['"])(.*)\1$/, "$2");
@@ -25098,15 +25566,15 @@ var init_ci_coverage = __esm({
 });
 
 // src/core/checks/ci-secrets.ts
-import { readdir as readdir4, readFile as readFile5 } from "node:fs/promises";
-import { join as join10 } from "node:path";
-import { existsSync as existsSync6 } from "node:fs";
+import { readdir as readdir5, readFile as readFile5 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
 async function findSecretUsages(projectRoot) {
-  const workflowDir = join10(projectRoot, ".github", "workflows");
-  if (!existsSync6(workflowDir)) return [];
+  const workflowDir = join11(projectRoot, ".github", "workflows");
+  if (!existsSync7(workflowDir)) return [];
   let files;
   try {
-    files = await readdir4(workflowDir);
+    files = await readdir5(workflowDir);
   } catch {
     return [];
   }
@@ -25115,7 +25583,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = stripBom(await readFile5(join10(workflowDir, f), "utf-8"));
+      content = stripBom(await readFile5(join11(workflowDir, f), "utf-8"));
     } catch {
       continue;
     }
@@ -25504,9 +25972,24 @@ function isMsysFlag(token) {
 }
 function translateMsysDrivePath(s, platform) {
   if (platform !== "win32") return s;
-  const m = /^\/([A-Za-z])\/(.*)$/.exec(s);
+  const m = /^\/{1,2}([A-Za-z])\/(.*)$/.exec(s);
   return m ? `${m[1]}:/${m[2]}` : s;
 }
+function findExistingVariant(raw, projectRoot, homeDir, platform) {
+  const token = stripMatcherWildcard(raw);
+  const variants = /* @__PURE__ */ new Set();
+  if (/^\/{2}[A-Za-z]\//.test(token)) variants.add(token.slice(1));
+  if (/^\/[A-Za-z]\//.test(token)) variants.add(`/${token}`);
+  if (token.startsWith("/") && !/^\/{1,2}[A-Za-z]\//.test(token)) {
+    variants.add(token.replace(/^\/+/, ""));
+  }
+  if (token.includes("\\")) variants.add(token.replace(/\\/g, "/"));
+  for (const v2 of variants) {
+    const resolved = expandPath(v2, projectRoot, homeDir, platform);
+    if (resolved !== null && fileExists(resolved)) return resolved;
+  }
+  return null;
+}
 function extractCommandPaths(command, projectRoot, homeDir, platform) {
   const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
   const out = [];
@@ -25539,6 +26022,18 @@ function checkSource(source, projectRoot, homeDir, platform) {
     if (cand.resolved === null) return;
     if (fileExists(cand.resolved)) return;
     const where = source.isUserGlobal ? ` (in ${source.displayPath})` : "";
+    const variant = findExistingVariant(cand.raw, projectRoot, homeDir, platform);
+    if (variant !== null) {
+      issues.push({
+        severity: "warning",
+        check: "hook-coverage",
+        ruleId: "hook-coverage/dead-hook",
+        line,
+        message: `${origin} references "${cand.raw}" which does not resolve${where}, but "${variant}" exists \u2014 the path form is wrong, so the gate silently no-ops`,
+        suggestion: `Rewrite the entry to use "${variant}". Do NOT delete it \u2014 the target exists; only the path form is unresolvable.`
+      });
+      return;
+    }
     issues.push({
       severity: "warning",
       check: "hook-coverage",
@@ -27839,7 +28334,7 @@ import { readFileSync as readFileSync7 } from "node:fs";
 import { resolve as resolve14, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function loadVersion() {
-  if (true) return "0.18.6";
+  if (true) return "0.18.7";
   try {
     const __dir = dirname6(fileURLToPath2(import.meta.url));
     const pkgPath = resolve14(__dir, "../package.json");
@@ -27928,7 +28423,8 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         if (activeChecks.includes("content-secrets"))
           checkPromises.push(checkContentSecrets(parseResult, projectRoot));
         const results = await Promise.all(checkPromises);
-        const singleFileIssues = results.flat();
+        const suppressions = collectSuppressions(parseResult.content);
+        const singleFileIssues = results.flat().filter((issue2) => !isSuppressed(suppressions, issue2));
         if (stat3 !== null) {
           setCacheEntry(absPath, {
             mtime: stat3.mtimeMs,
@@ -28077,6 +28573,12 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         sessionPromises.push(checkLoopDetection(sessionCtx));
       if (sessionChecksToRun.includes("session-memory-index-overflow"))
         sessionPromises.push(checkMemoryIndexOverflow(sessionCtx));
+      if (sessionChecksToRun.includes("session-shared-temp-path"))
+        sessionPromises.push(checkSharedTempPath(sessionCtx));
+      if (sessionChecksToRun.includes("session-unverified-gate-claimed-clean"))
+        sessionPromises.push(checkUnverifiedGateClaimedClean(sessionCtx));
+      if (sessionChecksToRun.includes("session-default-branch-accumulation"))
+        sessionPromises.push(checkDefaultBranchAccumulation(sessionCtx));
       const sessionResults = await Promise.all(sessionPromises);
       const sessionIssues = sessionResults.flat();
       fileResults.push({
@@ -28255,6 +28757,7 @@ var init_audit = __esm({
     init_paths();
     init_commands();
     init_staleness();
+    init_suppressions();
     init_tokens2();
     init_tier_tokens();
     init_redundancy();
@@ -28276,6 +28779,9 @@ var init_audit = __esm({
     init_duplicate_memory();
     init_loop_detection();
     init_memory_index_overflow();
+    init_shared_temp_path();
+    init_unverified_gate_claimed_clean();
+    init_default_branch_accumulation();
     init_ci_coverage();
     init_ci_secrets();
     init_content_secrets();
@@ -28317,7 +28823,10 @@ var init_audit = __esm({
       "session-stale-memory",
       "session-duplicate-memory",
       "session-loop-detection",
-      "session-memory-index-overflow"
+      "session-memory-index-overflow",
+      "session-shared-temp-path",
+      "session-unverified-gate-claimed-clean",
+      "session-default-branch-accumulation"
     ];
     ALL_SKILL_CHECKS = [
       "skill-frontmatter",
@@ -54160,8 +54669,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize3) {
-      if (normalize3 !== false)
+    function getFullPath(resolver, id = "", normalize4) {
+      if (normalize4 !== false)
         id = normalizeId(id);
       const p2 = resolver.parse(id);
       return _getFullPath(resolver, p2);
@@ -55564,7 +56073,7 @@ var require_fast_uri = __commonJS({
     init_define_WEB_FIRST_SEGMENTS();
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize3(uri, options) {
+    function normalize4(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         normalizeString(uri, options);
@@ -55831,7 +56340,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize3,
+      normalize: normalize4,
       resolve: resolve18,
       resolveComponent,
       equal,
@@ -68384,6 +68893,8 @@ var init_ora = __esm({
 });
 
 // src/core/reporter.ts
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
+import { join as join16 } from "node:path";
 function classifyFile(f) {
   if (f.path === "(project)") return "context";
   if (f.path === "(mcp)") return "mcp";
@@ -68405,10 +68916,32 @@ function classifyFile(f) {
 function isSyntheticBucket(p2) {
   return p2 === "(project)" || p2 === "(mcp)" || p2.includes(SESSION_AUDIT_PATH_MARKER) || p2.includes(SKILL_AUDIT_PATH_MARKER);
 }
+function detectVersionSkew(projectRoot, runningVersion) {
+  try {
+    const pkgPath = join16(projectRoot, "package.json");
+    if (!existsSync8(pkgPath)) return null;
+    const raw = readFileSync10(pkgPath, "utf8").replace(/^\uFEFF/, "");
+    const pkg = JSON.parse(raw);
+    const name = pkg.name ?? "";
+    if (name !== "ctxlint" && name !== "@yawlabs/ctxlint") return null;
+    if (!pkg.version || pkg.version === runningVersion) return null;
+    return pkg.version;
+  } catch {
+    return null;
+  }
+}
 function formatText(result, verbose = false) {
   const lines = [];
   lines.push("");
   lines.push(source_default.bold(`ctxlint v${result.version}`));
+  const skew = detectVersionSkew(result.projectRoot, result.version);
+  if (skew !== null) {
+    lines.push(
+      source_default.yellow(
+        `  note: this checkout is v${skew} -- you are running v${result.version}. Rebuild or reinstall before trusting a result against it.`
+      )
+    );
+  }
   lines.push("");
   lines.push(`Scanning ${result.projectRoot}...`);
   lines.push("");
@@ -68782,6 +69315,27 @@ function buildRuleDescriptors() {
       },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     },
+    {
+      id: "ctxlint/session-shared-temp-path",
+      shortDescription: {
+        text: "Fixed temp path written then read back -- clobberable by a concurrent session"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-unverified-gate-claimed-clean",
+      shortDescription: {
+        text: "A quality gate asserted as passing while its invocation failed or emitted nothing"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-default-branch-accumulation",
+      shortDescription: {
+        text: "Many files edited on the default branch with no intervening commit"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
     {
       id: "ctxlint/skill-frontmatter",
       shortDescription: { text: "Skill/agent definition missing required frontmatter" },
@@ -69178,8 +69732,8 @@ npx @yawlabs/ctxlint@${VERSION} --strict
   program2.parse();
 }
 async function promptYesNo(question) {
-  const { createInterface: createInterface2 } = await import("node:readline/promises");
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const { createInterface: createInterface3 } = await import("node:readline/promises");
+  const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     const answer = await rl.question(question);
     return /^\s*y(es)?\s*$/i.test(answer);
@@ -69310,4 +69864,3 @@ if (args.includes("--lsp")) {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();
 }
-//# sourceMappingURL=index.js.map