@yawlabs/ctxlint 0.18.7 → 0.20.0

package/dist/index.js

@@ -1330,8 +1330,8 @@ var require_semaphore = __commonJS({
         this._waiting = [];
       }
       lock(thunk) {
-        return new Promise((resolve18, reject) => {
-          this._waiting.push({ thunk, resolve: resolve18, reject });
+        return new Promise((resolve19, reject) => {
+          this._waiting.push({ thunk, resolve: resolve19, reject });
           this.runNext();
         });
       }
@@ -2960,9 +2960,9 @@ ${JSON.stringify(message, null, 4)}`);
           if (typeof cancellationStrategy.sender.enableCancellation === "function") {
             cancellationStrategy.sender.enableCancellation(requestMessage);
           }
-          return new Promise(async (resolve18, reject) => {
+          return new Promise(async (resolve19, reject) => {
             const resolveWithCleanup = (r2) => {
-              resolve18(r2);
+              resolve19(r2);
               cancellationStrategy.sender.cleanup(id);
               disposable?.dispose();
             };
@@ -8089,7 +8089,7 @@ var require_server = __commonJS({
     exports.createConnection = createConnection2;
     var vscode_languageserver_protocol_1 = require_api2();
     var Is3 = __importStar(require_is());
-    var UUID = __importStar(require_uuid());
+    var UUID2 = __importStar(require_uuid());
     var progress_1 = require_progress();
     var configuration_1 = require_configuration();
     var workspaceFolder_1 = require_workspaceFolder();
@@ -8231,7 +8231,7 @@ var require_server = __commonJS({
         if (this._registered.has(method)) {
           throw new Error(`${method} is already added to this registration`);
         }
-        const id = UUID.generateUuid();
+        const id = UUID2.generateUuid();
         this._registrations.push({
           id,
           method,
@@ -8325,7 +8325,7 @@ var require_server = __commonJS({
       }
       registerSingle1(unregistration, type, registerOptions) {
         const method = Is3.string(type) ? type : type.method;
-        const id = UUID.generateUuid();
+        const id = UUID2.generateUuid();
         const params = {
           registrations: [{ id, method, registerOptions: registerOptions || {} }]
         };
@@ -8342,7 +8342,7 @@ var require_server = __commonJS({
       }
       registerSingle2(type, registerOptions) {
         const method = Is3.string(type) ? type : type.method;
-        const id = UUID.generateUuid();
+        const id = UUID2.generateUuid();
         const params = {
           registrations: [{ id, method, registerOptions: registerOptions || {} }]
         };
@@ -8590,8 +8590,8 @@ var require_server = __commonJS({
         if (value instanceof Promise) {
           return value;
         } else if (Is3.thenable(value)) {
-          return new Promise((resolve18, reject) => {
-            value.then((resolved) => resolve18(resolved), (error52) => reject(error52));
+          return new Promise((resolve19, reject) => {
+            value.then((resolved) => resolve19(resolved), (error52) => reject(error52));
           });
         } else {
           return Promise.resolve(value);
@@ -8873,13 +8873,13 @@ var require_files = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.FileSystem = void 0;
     exports.uriToFilePath = uriToFilePath;
-    exports.resolve = resolve18;
+    exports.resolve = resolve19;
     exports.resolveGlobalNodePath = resolveGlobalNodePath;
     exports.resolveGlobalYarnPath = resolveGlobalYarnPath;
     exports.resolveModulePath = resolveModulePath;
     var url2 = __importStar(__require("url"));
-    var path20 = __importStar(__require("path"));
-    var fs15 = __importStar(__require("fs"));
+    var path21 = __importStar(__require("path"));
+    var fs16 = __importStar(__require("fs"));
     var child_process_1 = __require("child_process");
     function uriToFilePath(uri) {
       const parsed = url2.parse(uri);
@@ -8897,12 +8897,12 @@ var require_files = __commonJS({
           segments.shift();
         }
       }
-      return path20.normalize(segments.join("/"));
+      return path21.normalize(segments.join("/"));
     }
     function isWindows() {
       return process.platform === "win32";
     }
-    function resolve18(moduleName, nodePath, cwd, tracer) {
+    function resolve19(moduleName, nodePath, cwd, tracer) {
       const nodePathKey = "NODE_PATH";
       const app = [
         "var p = process;",
@@ -8921,13 +8921,13 @@ var require_files = __commonJS({
         "}",
         "});"
       ].join("");
-      return new Promise((resolve19, reject) => {
+      return new Promise((resolve20, reject) => {
         const env2 = process.env;
         const newEnv = /* @__PURE__ */ Object.create(null);
         Object.keys(env2).forEach((key) => newEnv[key] = env2[key]);
-        if (nodePath && fs15.existsSync(nodePath)) {
+        if (nodePath && fs16.existsSync(nodePath)) {
           if (newEnv[nodePathKey]) {
-            newEnv[nodePathKey] = nodePath + path20.delimiter + newEnv[nodePathKey];
+            newEnv[nodePathKey] = nodePath + path21.delimiter + newEnv[nodePathKey];
           } else {
             newEnv[nodePathKey] = nodePath;
           }
@@ -8953,7 +8953,7 @@ var require_files = __commonJS({
             if (message2.c === "r") {
               cp.send({ c: "e" });
               if (message2.s) {
-                resolve19(message2.r);
+                resolve20(message2.r);
               } else {
                 reject(new Error(`Failed to resolve module: ${moduleName}`));
               }
@@ -8999,9 +8999,9 @@ var require_files = __commonJS({
         }
         if (prefix.length > 0) {
           if (isWindows()) {
-            return path20.join(prefix, "node_modules");
+            return path21.join(prefix, "node_modules");
           } else {
-            return path20.join(prefix, "lib", "node_modules");
+            return path21.join(prefix, "lib", "node_modules");
           }
         }
         return void 0;
@@ -9040,7 +9040,7 @@ var require_files = __commonJS({
           try {
             const yarn = JSON.parse(line);
             if (yarn.type === "log") {
-              return path20.join(yarn.data, "node_modules");
+              return path21.join(yarn.data, "node_modules");
             }
           } catch (e) {
           }
@@ -9062,36 +9062,36 @@ var require_files = __commonJS({
         if (process.platform === "win32") {
           _isCaseSensitive = false;
         } else {
-          _isCaseSensitive = !fs15.existsSync(__filename.toUpperCase()) || !fs15.existsSync(__filename.toLowerCase());
+          _isCaseSensitive = !fs16.existsSync(__filename.toUpperCase()) || !fs16.existsSync(__filename.toLowerCase());
         }
         return _isCaseSensitive;
       }
       FileSystem2.isCaseSensitive = isCaseSensitive;
       function isParent(parent, child) {
         if (isCaseSensitive()) {
-          return path20.normalize(child).indexOf(path20.normalize(parent)) === 0;
+          return path21.normalize(child).indexOf(path21.normalize(parent)) === 0;
         } else {
-          return path20.normalize(child).toLowerCase().indexOf(path20.normalize(parent).toLowerCase()) === 0;
+          return path21.normalize(child).toLowerCase().indexOf(path21.normalize(parent).toLowerCase()) === 0;
         }
       }
       FileSystem2.isParent = isParent;
     })(FileSystem || (exports.FileSystem = FileSystem = {}));
     function resolveModulePath(workspaceRoot, moduleName, nodePath, tracer) {
       if (nodePath) {
-        if (!path20.isAbsolute(nodePath)) {
-          nodePath = path20.join(workspaceRoot, nodePath);
+        if (!path21.isAbsolute(nodePath)) {
+          nodePath = path21.join(workspaceRoot, nodePath);
         }
-        return resolve18(moduleName, nodePath, nodePath, tracer).then((value) => {
+        return resolve19(moduleName, nodePath, nodePath, tracer).then((value) => {
           if (FileSystem.isParent(nodePath, value)) {
             return value;
           } else {
             return Promise.reject(new Error(`Failed to load ${moduleName} from node path location.`));
           }
         }).then(void 0, (_error) => {
-          return resolve18(moduleName, resolveGlobalNodePath(tracer), workspaceRoot, tracer);
+          return resolve19(moduleName, resolveGlobalNodePath(tracer), workspaceRoot, tracer);
         });
       } else {
-        return resolve18(moduleName, resolveGlobalNodePath(tracer), workspaceRoot, tracer);
+        return resolve19(moduleName, resolveGlobalNodePath(tracer), workspaceRoot, tracer);
       }
     }
   }
@@ -9174,10 +9174,10 @@ var require_ril = __commonJS({
         return api_1.Disposable.create(() => this.stream.off("end", listener));
       }
       write(data, encoding) {
-        return new Promise((resolve18, reject) => {
+        return new Promise((resolve19, reject) => {
           const callback = (error52) => {
             if (error52 === void 0 || error52 === null) {
-              resolve18();
+              resolve19();
             } else {
               reject(error52);
             }
@@ -9314,9 +9314,9 @@ var require_main = __commonJS({
     exports.createMessageConnection = createMessageConnection;
     var ril_1 = __importDefault(require_ril());
     ril_1.default.install();
-    var path20 = __importStar(__require("path"));
+    var path21 = __importStar(__require("path"));
     var os7 = __importStar(__require("os"));
-    var fs15 = __importStar(__require("fs"));
+    var fs16 = __importStar(__require("fs"));
     var crypto_1 = __require("crypto");
     var net_1 = __require("net");
     var api_1 = require_api();
@@ -9457,7 +9457,7 @@ var require_main = __commonJS({
       }
       let randomLength = 32;
       const fixedLength = "/lsp-.sock".length;
-      const tmpDir = fs15.realpathSync(XDG_RUNTIME_DIR ?? os7.tmpdir());
+      const tmpDir = fs16.realpathSync(XDG_RUNTIME_DIR ?? os7.tmpdir());
       const limit = safeIpcPathLengths.get(process.platform);
       if (limit !== void 0) {
         randomLength = Math.min(limit - tmpDir.length - fixedLength, randomLength);
@@ -9466,14 +9466,14 @@ var require_main = __commonJS({
         throw new Error(`Unable to generate a random pipe name with ${randomLength} characters.`);
       }
       const randomSuffix = (0, crypto_1.randomBytes)(Math.floor(randomLength / 2)).toString("hex");
-      return path20.join(tmpDir, `lsp-${randomSuffix}.sock`);
+      return path21.join(tmpDir, `lsp-${randomSuffix}.sock`);
     }
     function createClientPipeTransport(pipeName, encoding = "utf-8") {
       let connectResolve;
-      const connected = new Promise((resolve18, _reject) => {
-        connectResolve = resolve18;
+      const connected = new Promise((resolve19, _reject) => {
+        connectResolve = resolve19;
       });
-      return new Promise((resolve18, reject) => {
+      return new Promise((resolve19, reject) => {
         const server2 = (0, net_1.createServer)((socket) => {
           server2.close();
           connectResolve([
@@ -9484,7 +9484,7 @@ var require_main = __commonJS({
         server2.on("error", reject);
         server2.listen(pipeName, () => {
           server2.removeListener("error", reject);
-          resolve18({
+          resolve19({
             onConnected: () => {
               return connected;
             }
@@ -9501,10 +9501,10 @@ var require_main = __commonJS({
     }
     function createClientSocketTransport(port, encoding = "utf-8") {
       let connectResolve;
-      const connected = new Promise((resolve18, _reject) => {
-        connectResolve = resolve18;
+      const connected = new Promise((resolve19, _reject) => {
+        connectResolve = resolve19;
       });
-      return new Promise((resolve18, reject) => {
+      return new Promise((resolve19, reject) => {
         const server2 = (0, net_1.createServer)((socket) => {
           server2.close();
           connectResolve([
@@ -9515,7 +9515,7 @@ var require_main = __commonJS({
         server2.on("error", reject);
         server2.listen(port, "127.0.0.1", () => {
           server2.removeListener("error", reject);
-          resolve18({
+          resolve19({
             onConnected: () => {
               return connected;
             }
@@ -13770,8 +13770,8 @@ function extractPathReferences(lines, sections) {
       if (inCodeBlock && codeBlockLang === "" && /^\s/.test(line) && /^[\w@.-]+\/$/.test(cleanValue)) {
         continue;
       }
-      const lowerProse = /^([a-z][\w-]*)\/[a-z][\w-]*$/.exec(cleanValue);
-      if (lowerProse && !PATH_FIRST_SEGMENTS.has(lowerProse[1])) {
+      const twoSegmentProse = /^([A-Za-z][\w-]*)\/[A-Za-z][\w-]*$/.exec(cleanValue);
+      if (twoSegmentProse && !PATH_FIRST_SEGMENTS.has(twoSegmentProse[1].toLowerCase())) {
         continue;
       }
       if (/^[a-z][\w-]*(?:\/[a-z][\w-]*){2,}$/.test(cleanValue)) continue;
@@ -14733,10 +14733,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault(require_src());
     var log = debug_1.default("@kwsites/file-exists");
-    function check2(path20, isFile, isDirectory2) {
-      log(`checking %s`, path20);
+    function check2(path21, isFile, isDirectory2) {
+      log(`checking %s`, path21);
       try {
-        const stat3 = fs_1.statSync(path20);
+        const stat3 = fs_1.statSync(path21);
         if (stat3.isFile() && isFile) {
           log(`[OK] path represents a file`);
           return true;
@@ -14756,8 +14756,8 @@ var require_src2 = __commonJS({
         throw e;
       }
     }
-    function exists2(path20, type = exports.READABLE) {
-      return check2(path20, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path21, type = exports.READABLE) {
+      return check2(path21, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -15355,8 +15355,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path20) {
-  return (0, import_file_exists.exists)(path20, import_file_exists.FOLDER);
+function folderExists(path21) {
+  return (0, import_file_exists.exists)(path21, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -15547,8 +15547,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path20) {
-      return /^\.(git)?$/.test(path20.trim());
+    parser(path21) {
+      return /^\.(git)?$/.test(path21.trim());
     }
   };
 }
@@ -15804,11 +15804,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path20, line, preview] = input.split(NULL);
-    paths.add(path20);
-    (results[path20] = results[path20] || []).push({
+    const [path21, line, preview] = input.split(NULL);
+    paths.add(path21);
+    (results[path21] = results[path21] || []).push({
       line: asNumber(line),
-      path: path20,
+      path: path21,
       preview
     });
   });
@@ -16105,14 +16105,14 @@ function hashObjectTask(filePath, write) {
   }
   return straightThroughStringTask(commands, true);
 }
-function parseInit(bare, path20, text) {
+function parseInit(bare, path21, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path20, false, result[1]);
+    return new InitSummary(bare, path21, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path20, true, result[1]);
+    return new InitSummary(bare, path21, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -16123,12 +16123,12 @@ function parseInit(bare, path20, text) {
       break;
     }
   }
-  return new InitSummary(bare, path20, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path21, /^re/i.test(response), gitDir);
 }
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path20, customArgs) {
+function initTask(bare = false, path21, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -16137,7 +16137,7 @@ function initTask(bare = false, path20, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path20, text);
+      return parseInit(commands.includes("--bare"), path21, text);
     }
   };
 }
@@ -16416,14 +16416,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path20) {
+  function data(index, workingDir, path21) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path20);
+      handler(result, path21);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path20, index, workingDir));
+      result.files.push(new FileStatusSummary(path21, index, workingDir));
     }
   }
 }
@@ -16610,8 +16610,8 @@ function deleteBranchTask(branch, forceDelete = false) {
   return task;
 }
 function toPath(input) {
-  const path20 = input.trim().replace(/^["']|["']$/g, "");
-  return path20 && normalize2(path20);
+  const path21 = input.trim().replace(/^["']|["']$/g, "");
+  return path21 && normalize2(path21);
 }
 function checkIgnoreTask(paths) {
   return {
@@ -16750,8 +16750,8 @@ function stashListTask(opt = {}, customArgs) {
     parser: parser4
   };
 }
-function addSubModuleTask(repo, path20) {
-  return subModuleTask(["add", repo, path20]);
+function addSubModuleTask(repo, path21) {
+  return subModuleTask(["add", repo, path21]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -18014,9 +18014,9 @@ var init_esm = __esm({
       "src/lib/responses/InitSummary.ts"() {
         "use strict";
         InitSummary = class {
-          constructor(bare, path20, existing, gitDir) {
+          constructor(bare, path21, existing, gitDir) {
             this.bare = bare;
-            this.path = path20;
+            this.path = path21;
             this.existing = existing;
             this.gitDir = gitDir;
           }
@@ -18549,12 +18549,12 @@ var init_esm = __esm({
         "use strict";
         fromPathRegex = /^(.+)\0(.+)$/;
         FileStatusSummary = class {
-          constructor(path20, index, working_dir) {
-            this.path = path20;
+          constructor(path21, index, working_dir) {
+            this.path = path21;
             this.index = index;
             this.working_dir = working_dir;
             if (index === "R" || working_dir === "R") {
-              const detail = fromPathRegex.exec(path20) || [null, path20, path20];
+              const detail = fromPathRegex.exec(path21) || [null, path21, path21];
               this.from = detail[2] || "";
               this.path = detail[1] || "";
             }
@@ -18816,9 +18816,9 @@ var init_esm = __esm({
               next
             );
           }
-          hashObject(path20, write) {
+          hashObject(path21, write) {
             return this._runTask(
-              hashObjectTask(path20, write === true),
+              hashObjectTask(path21, write === true),
               trailingFunctionArgument(arguments)
             );
           }
@@ -19455,8 +19455,8 @@ var init_esm = __esm({
           }
           return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
         };
-        Git2.prototype.submoduleAdd = function(repo, path20, then) {
-          return this._runTask(addSubModuleTask2(repo, path20), trailingFunctionArgument2(arguments));
+        Git2.prototype.submoduleAdd = function(repo, path21, then) {
+          return this._runTask(addSubModuleTask2(repo, path21), trailingFunctionArgument2(arguments));
         };
         Git2.prototype.submoduleUpdate = function(args2, then) {
           return this._runTask(
@@ -19772,7 +19772,7 @@ async function getCommitsSinceBatch(projectRoot, paths, since) {
   }
   try {
     const git = getGit(projectRoot);
-    const SENTINEL = "___CTXLINT_COMMIT___";
+    const SENTINEL2 = "___CTXLINT_COMMIT___";
     const pathspecs = [];
     for (const p2 of paths) {
       const spec = toGitPathspec(p2, projectRoot);
@@ -19791,7 +19791,7 @@ async function getCommitsSinceBatch(projectRoot, paths, since) {
       // %n emits a newline; prefixing with a valid format placeholder is
       // what keeps git from rejecting the sentinel as an invalid --pretty
       // format ("fatal: invalid --pretty format: ___CTXLINT_COMMIT___").
-      `--format=%n${SENTINEL}`
+      `--format=%n${SENTINEL2}`
     ];
     if (pathspecs.length > 0) {
       logArgs.push("--", ...pathspecs);
@@ -19808,7 +19808,7 @@ async function getCommitsSinceBatch(projectRoot, paths, since) {
       seenThisCommit.clear();
     };
     for (const line of lines) {
-      if (line === SENTINEL) {
+      if (line === SENTINEL2) {
         if (inCommit) flush();
         inCommit = true;
         continue;
@@ -19966,8 +19966,8 @@ async function findRenames(projectRoot, filePath) {
 async function findRenamesBatch(projectRoot, relPaths) {
   const result = /* @__PURE__ */ new Map();
   if (relPaths.length === 0) return result;
-  let cache = renameCache.get(projectRoot);
-  if (!cache) {
+  let cache2 = renameCache.get(projectRoot);
+  if (!cache2) {
     try {
       const git = getGit(projectRoot);
       const rawOutput = await git.raw([
@@ -19985,14 +19985,14 @@ async function findRenamesBatch(projectRoot, relPaths) {
       } catch {
       }
       const { allRenames: allRenames2, basenameBuckets: basenameBuckets2 } = parseRenameLogAll(rawOutput);
-      cache = { allRenames: allRenames2, basenameBuckets: basenameBuckets2, prefix: prefix2 };
-      renameCache.set(projectRoot, cache);
+      cache2 = { allRenames: allRenames2, basenameBuckets: basenameBuckets2, prefix: prefix2 };
+      renameCache.set(projectRoot, cache2);
     } catch {
       for (const p2 of relPaths) result.set(p2, null);
       return result;
     }
   }
-  const { allRenames, basenameBuckets, prefix } = cache;
+  const { allRenames, basenameBuckets, prefix } = cache2;
   for (const relPath of relPaths) {
     const rel = relPath.replace(/\\/g, "/");
     const target = prefix + rel;
@@ -21258,12 +21258,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path20) {
+function findNodeAtLocation(root, path21) {
   if (!root) {
     return void 0;
   }
   let node = root;
-  for (let segment of path20) {
+  for (let segment of path21) {
     if (typeof segment === "string") {
       if (node.type !== "object" || !Array.isArray(node.children)) {
         return void 0;
@@ -21760,9 +21760,495 @@ var init_main3 = __esm({
   }
 });
 
-// src/core/checks/commands.ts
+// src/core/checks/exit-status.ts
+function splitSegments(cmd) {
+  const out = [];
+  let buf = "";
+  let op = "";
+  let quote = null;
+  for (let i2 = 0; i2 < cmd.length; i2++) {
+    const ch = cmd[i2];
+    if (quote) {
+      buf += ch;
+      if (ch === "\\" && quote !== "'") {
+        if (i2 + 1 < cmd.length) buf += cmd[++i2];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      buf += ch;
+      continue;
+    }
+    if (ch === "\\" && i2 + 1 < cmd.length) {
+      buf += ch + cmd[++i2];
+      continue;
+    }
+    if (ch === "&" && cmd[i2 + 1] === "&") {
+      out.push({ op, text: buf.trim() });
+      op = "&&";
+      buf = "";
+      i2++;
+      continue;
+    }
+    if (ch === "|" && cmd[i2 + 1] === "|") {
+      out.push({ op, text: buf.trim() });
+      op = "||";
+      buf = "";
+      i2++;
+      continue;
+    }
+    if (ch === ";") {
+      out.push({ op, text: buf.trim() });
+      op = ";";
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  out.push({ op, text: buf.trim() });
+  return out.filter((s) => s.text.length > 0);
+}
+function splitPipes(segment) {
+  const out = [];
+  let buf = "";
+  let quote = null;
+  for (let i2 = 0; i2 < segment.length; i2++) {
+    const ch = segment[i2];
+    if (quote) {
+      buf += ch;
+      if (ch === "\\" && quote !== "'") {
+        if (i2 + 1 < segment.length) buf += segment[++i2];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      buf += ch;
+      continue;
+    }
+    if (ch === "\\" && i2 + 1 < segment.length) {
+      buf += ch + segment[++i2];
+      continue;
+    }
+    if (ch === "|") {
+      out.push(buf.trim());
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  out.push(buf.trim());
+  return out.map((s) => s.trim());
+}
+function unwrap(part) {
+  let s = part.trim();
+  s = s.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+)+/, "");
+  const execMatch = s.match(EXEC_WRAPPER_PATTERN);
+  if (execMatch) s = s.slice(execMatch[0].length).trim();
+  while (WRAPPER_PATTERN.test(s)) {
+    const tokens = s.split(/\s+/).slice(1);
+    let i2 = 0;
+    while (i2 < tokens.length && tokens[i2].startsWith("-")) {
+      if (tokens[i2] === "-p" || tokens[i2] === "--package") i2++;
+      i2++;
+    }
+    const next = tokens.slice(i2).join(" ");
+    if (!next || next === s) break;
+    s = next;
+  }
+  return s.trim();
+}
+function verifierName(part, scripts) {
+  const s = unwrap(part);
+  if (!s) return null;
+  for (const re2 of VERIFIER_PAIRS) {
+    const m = s.match(re2);
+    if (m) return m[0].replace(/\s+/g, " ");
+  }
+  const direct = s.match(VERIFIER_PATTERN);
+  if (direct) return direct[1];
+  const scriptName = (s.match(SCRIPT_RUNNER) ?? s.match(SCRIPT_SHORTHAND))?.[1];
+  if (scriptName && scripts) {
+    const body = scripts[scriptName];
+    if (typeof body === "string") {
+      const first2 = splitPipes(splitSegments(body)[0]?.text ?? "")[0] ?? "";
+      const inner = unwrap(first2);
+      for (const re2 of VERIFIER_PAIRS) {
+        const m = inner.match(re2);
+        if (m) return m[0].replace(/\s+/g, " ");
+      }
+      const d = inner.match(VERIFIER_PATTERN);
+      if (d) return d[1];
+    }
+  }
+  return null;
+}
+function filterName(part) {
+  const m = unwrap(part).match(FILTER_PATTERN);
+  return m ? m[1] : null;
+}
+function isSuccessClaim(segment) {
+  if (!/^(echo|printf)\b/.test(unwrap(segment))) return false;
+  return SUCCESS_WORD.test(segment);
+}
+function isStatusEcho(segment) {
+  if (!/^(echo|printf)\b/.test(unwrap(segment))) return false;
+  if (/PIPESTATUS/.test(segment)) return false;
+  return /\$\?/.test(segment);
+}
+function analyzeMaskedExitStatus(cmd, scripts) {
+  const segments = splitSegments(cmd);
+  if (segments.length < 2) return null;
+  for (let i2 = 0; i2 < segments.length - 1; i2++) {
+    if (segments.slice(0, i2 + 1).some((s) => PIPEFAIL.test(s.text))) return null;
+    const parts = splitPipes(segments[i2].text);
+    if (parts.length < 2) continue;
+    const verifier = verifierName(parts[0], scripts);
+    if (!verifier) continue;
+    const filter = filterName(parts[parts.length - 1]);
+    if (!filter) continue;
+    const next = segments[i2 + 1];
+    if (next.op !== "&&" && next.op !== ";") continue;
+    if (next.op === "&&" && isSuccessClaim(next.text)) {
+      return { verifier, filter, claim: next.text, kind: "success-claim" };
+    }
+    if (isStatusEcho(next.text)) {
+      return { verifier, filter, claim: next.text, kind: "status-echo" };
+    }
+  }
+  return null;
+}
+function pipefailInScope(content, line) {
+  const lines = content.split("\n");
+  const idx = line - 1;
+  if (idx < 0 || idx >= lines.length) return false;
+  let fenceStart = -1;
+  let open = false;
+  for (let i2 = 0; i2 < idx; i2++) {
+    if (/^\s*```/.test(lines[i2])) {
+      open = !open;
+      fenceStart = open ? i2 + 1 : -1;
+    }
+  }
+  if (!open || fenceStart < 0) return false;
+  for (let i2 = fenceStart; i2 < idx; i2++) {
+    if (PIPEFAIL.test(lines[i2])) return true;
+  }
+  return false;
+}
+var VERIFIER_PATTERN, VERIFIER_PAIRS, FILTER_PATTERN, SCRIPT_RUNNER, SCRIPT_SHORTHAND, WRAPPER_PATTERN, EXEC_WRAPPER_PATTERN, SUCCESS_WORD, PIPEFAIL;
+var init_exit_status = __esm({
+  "src/core/checks/exit-status.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    VERIFIER_PATTERN = /^(tsc|eslint|biome|vitest|jest|pytest|mypy|ruff|oxlint)\b/;
+    VERIFIER_PAIRS = [/^cargo\s+(test|clippy|check)\b/, /^go\s+(test|vet|build)\b/];
+    FILTER_PATTERN = /^(head|tail|grep|egrep|fgrep|sed|awk|less|more|cat|tee|wc)\b/;
+    SCRIPT_RUNNER = /^(?:npm\s+run|(?:pnpm|yarn|bun)(?:\s+run)?)\s+(\S+)/;
+    SCRIPT_SHORTHAND = /^(?:npm|pnpm|yarn|bun)\s+(test|start|build|dev|lint|format|check|typecheck|type-check|clean|serve|preview|e2e)\b/;
+    WRAPPER_PATTERN = /^(npx|bunx|sudo|time|command|nice)\b/;
+    EXEC_WRAPPER_PATTERN = /^(?:pnpm|npm|yarn|bun)\s+(?:exec|dlx)\b/;
+    SUCCESS_WORD = /\b(ok|okay|clean|pass|passed|passes|passing|green|success|successful|done|all\s+good|no\s+errors|looks\s+good)\b/i;
+    PIPEFAIL = /\bset\s+[-\w\s]*\bpipefail\b/;
+  }
+});
+
+// src/core/checks/cli-subcommands.ts
 import * as fs4 from "node:fs";
 import * as path5 from "node:path";
+function ownedBins(pkgJson) {
+  if (!pkgJson || !pkgJson.bin) return [];
+  const out = [];
+  if (typeof pkgJson.bin === "string") {
+    const raw = pkgJson.name ?? "";
+    const name = raw.includes("/") ? raw.slice(raw.lastIndexOf("/") + 1) : raw;
+    if (name) out.push({ name, entry: pkgJson.bin });
+    return out;
+  }
+  for (const [name, entry] of Object.entries(pkgJson.bin)) {
+    if (typeof entry === "string" && name) out.push({ name, entry });
+  }
+  return out;
+}
+function commandNameOf(token) {
+  let t2 = token.trim().replace(/^["']|["']$/g, "");
+  if (!t2) return null;
+  const cut = Math.max(t2.lastIndexOf("/"), t2.lastIndexOf("\\"));
+  if (cut >= 0) t2 = t2.slice(cut + 1);
+  t2 = t2.replace(BIN_EXT, "");
+  return t2 || null;
+}
+function resolveEntry(projectRoot, entry) {
+  const base = path5.resolve(projectRoot, entry);
+  const candidates = [base, `${base}.js`, `${base}.mjs`, `${base}.cjs`, `${base}.ts`];
+  for (const c3 of candidates) {
+    try {
+      if (fs4.statSync(c3).isFile()) return c3;
+    } catch {
+    }
+  }
+  return null;
+}
+function readEntry(abs) {
+  let src;
+  try {
+    const stat3 = fs4.statSync(abs);
+    if (stat3.size > MAX_ENTRY_BYTES) return null;
+    src = stripBom(fs4.readFileSync(abs, "utf-8"));
+  } catch {
+    return null;
+  }
+  for (const line of src.split("\n")) {
+    if (line.length > MAX_ENTRY_LINE) return null;
+  }
+  return src;
+}
+function shimTarget(src) {
+  const meaningful = src.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#!") && !l.startsWith("//") && !l.startsWith("*"));
+  if (meaningful.length > 12) return null;
+  const specs = /* @__PURE__ */ new Set();
+  for (const m of src.matchAll(/(?:^|\s)(?:import|require)\s*\(?\s*['"](\.[^'"]+)['"]/g)) {
+    specs.add(m[1]);
+  }
+  for (const m of src.matchAll(/^\s*import\s+[^'"]*from\s*['"](\.[^'"]+)['"]/gm)) {
+    specs.add(m[1]);
+  }
+  return specs.size === 1 ? [...specs][0] : null;
+}
+function stripComments2(src) {
+  let code = "";
+  let literals = "";
+  let i2 = 0;
+  const push = (ch, inString) => {
+    literals += ch;
+    code += inString && ch !== "\n" ? " " : ch;
+  };
+  while (i2 < src.length) {
+    const ch = src[i2];
+    const next = src[i2 + 1];
+    if (ch === "/" && next === "/") {
+      while (i2 < src.length && src[i2] !== "\n") i2++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i2 += 2;
+      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) {
+        if (src[i2] === "\n") push("\n", false);
+        i2++;
+      }
+      i2 += 2;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const quote = ch;
+      push(ch, false);
+      i2++;
+      while (i2 < src.length) {
+        if (src[i2] === "\\") {
+          push(src[i2], true);
+          if (i2 + 1 < src.length) push(src[i2 + 1], true);
+          i2 += 2;
+          continue;
+        }
+        if (src[i2] === quote) break;
+        push(src[i2], true);
+        i2++;
+      }
+      if (i2 < src.length) push(src[i2], false);
+      i2++;
+      continue;
+    }
+    push(ch, false);
+    i2++;
+  }
+  return { code, literals };
+}
+function commanderIsOpen(code) {
+  return /\.command\(\s*[^'"`\s)]/.test(code);
+}
+function commanderSubcommands(code, literals) {
+  if (commanderIsOpen(code)) return null;
+  const found = /* @__PURE__ */ new Set();
+  for (const m of literals.matchAll(/\.command\(\s*(['"`])([^'"`\n]+)\1/g)) {
+    const name = m[2].trim().split(/\s+/)[0];
+    if (name && !name.startsWith("<") && !name.startsWith("[")) found.add(name);
+  }
+  return found.size > 0 ? found : null;
+}
+function argvSubcommands(code, literals) {
+  const aliases = /* @__PURE__ */ new Set();
+  for (const m of code.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:process\.)?argv\[2\]/g
+  )) {
+    aliases.add(m[1]);
+  }
+  for (const m of code.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:process\.)?argv\.slice\(\s*2\s*\)\s*\[\s*0\s*\]/g
+  )) {
+    aliases.add(m[1]);
+  }
+  for (const m of code.matchAll(
+    /\b(?:const|let|var)\s*\[\s*,\s*,\s*([A-Za-z_$][\w$]*)\s*\]\s*=\s*process\.argv/g
+  )) {
+    aliases.add(m[1]);
+  }
+  const tokens = [...aliases].map((a) => `\\b${a}\\b`);
+  if (/(?:process\.)?argv\[2\]/.test(code)) tokens.push("(?:process\\.)?argv\\[2\\]");
+  if (tokens.length === 0) return null;
+  const tok = `(?:${tokens.join("|")})`;
+  const cmpIdent = new RegExp(`${tok}\\s*[=!]==?\\s*([A-Za-z_$][\\w$.]*)`, "g");
+  for (const m of code.matchAll(cmpIdent)) {
+    if (!SENTINEL.test(m[1])) return null;
+  }
+  const identCmp = new RegExp(`([A-Za-z_$][\\w$.]*)\\s*[=!]==?\\s*${tok}`, "g");
+  for (const m of code.matchAll(identCmp)) {
+    if (!SENTINEL.test(m[1])) return null;
+  }
+  if (new RegExp(`\\[\\s*${tok}\\s*\\]`).test(code)) return null;
+  if (new RegExp(`Object\\.(keys|values|entries)\\([^)]*\\)[^\\n]*${tok}`).test(code)) return null;
+  if (new RegExp(`${tok}\\s+in\\s+`).test(code)) return null;
+  if (new RegExp(`\\bhasOwnProperty\\(\\s*${tok}`).test(code)) return null;
+  const includesRe = new RegExp(`(\\S*)\\.includes\\(\\s*${tok}\\s*\\)`, "g");
+  for (const m of code.matchAll(includesRe)) {
+    if (!m[1].endsWith("]")) return null;
+  }
+  const found = /* @__PURE__ */ new Set();
+  const eqLit = new RegExp(`${tok}\\s*[=!]==?\\s*(['"\`])([^'"\`\\n]*)\\1`, "g");
+  for (const m of literals.matchAll(eqLit)) if (m[2]) found.add(m[2]);
+  const litEq = new RegExp(`(['"\`])([^'"\`\\n]*)\\1\\s*[=!]==?\\s*${tok}`, "g");
+  for (const m of literals.matchAll(litEq)) if (m[2]) found.add(m[2]);
+  const switchRe = new RegExp(`switch\\s*\\(\\s*${tok}\\s*\\)\\s*\\{`, "g");
+  for (const m of literals.matchAll(switchRe)) {
+    const body = literals.slice((m.index ?? 0) + m[0].length);
+    const end = body.indexOf("\n}");
+    const block = end >= 0 ? body.slice(0, end) : body;
+    for (const c3 of block.matchAll(/\bcase\s+(['"`])([^'"`\n]*)\1/g)) {
+      if (c3[2]) found.add(c3[2]);
+    }
+  }
+  const arrIncludes = new RegExp(`\\[([^\\]\\n]*)\\]\\.includes\\(\\s*${tok}\\s*\\)`, "g");
+  for (const m of literals.matchAll(arrIncludes)) {
+    for (const lit of m[1].matchAll(/(['"`])([^'"`]*)\1/g)) {
+      if (lit[2]) found.add(lit[2]);
+    }
+  }
+  return found.size > 0 ? found : null;
+}
+function knownSubcommands(projectRoot, entry) {
+  let abs = resolveEntry(projectRoot, entry);
+  for (let hop = 0; abs && hop <= MAX_FOLLOW; hop++) {
+    const src = readEntry(abs);
+    if (src === null) return null;
+    const { code, literals } = stripComments2(src);
+    const commander = commanderSubcommands(code, literals);
+    if (commander) return commander;
+    if (commanderIsOpen(code)) return null;
+    const argv = argvSubcommands(code, literals);
+    if (argv) return argv;
+    if (hop === MAX_FOLLOW) break;
+    const target = shimTarget(src);
+    if (!target) break;
+    abs = resolveEntry(path5.dirname(abs), target);
+  }
+  return null;
+}
+function findBinInvocations(content, binNames) {
+  if (binNames.size === 0) return [];
+  const out = [];
+  const lines = content.split("\n");
+  let inFence = false;
+  let fenceLang = "";
+  let inHtmlComment = false;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed2 = line.trim();
+    if (!inHtmlComment && trimmed2.includes("<!--")) {
+      inHtmlComment = !trimmed2.includes("-->");
+      continue;
+    }
+    if (inHtmlComment) {
+      if (trimmed2.includes("-->")) inHtmlComment = false;
+      continue;
+    }
+    if (trimmed2.startsWith("```")) {
+      if (!inFence) {
+        inFence = true;
+        fenceLang = trimmed2.slice(3).trim().toLowerCase();
+      } else {
+        inFence = false;
+        fenceLang = "";
+      }
+      continue;
+    }
+    const candidates = [];
+    if (inFence) {
+      if (["bash", "sh", "shell", "zsh", "console", ""].includes(fenceLang)) {
+        if (trimmed2 && !trimmed2.startsWith("#") && !trimmed2.startsWith("//")) {
+          candidates.push(trimmed2.replace(/^[$>]\s*/, ""));
+        }
+      }
+    } else {
+      if (/^[$>]\s+/.test(trimmed2)) candidates.push(trimmed2.replace(/^[$>]\s*/, ""));
+      for (const m of line.matchAll(/`([^`]+)`/g)) candidates.push(m[1].trim());
+    }
+    for (const candidate of candidates) {
+      const hit = matchBinInvocation(candidate, binNames);
+      if (hit) out.push({ ...hit, cmd: candidate, line: i2 + 1 });
+    }
+  }
+  return out;
+}
+function matchBinInvocation(candidate, binNames) {
+  let s = candidate.trim();
+  const stop = s.search(/&&|\|\||[;|]/);
+  if (stop >= 0) s = s.slice(0, stop).trim();
+  s = s.replace(TWO_TOKEN_DELEGATORS, "");
+  let tokens = s.split(/\s+/).filter(Boolean);
+  while (tokens.length > 0) {
+    const head = commandNameOf(tokens[0]);
+    if (head && DELEGATORS.has(head)) {
+      tokens = tokens.slice(1);
+      while (tokens.length > 0 && tokens[0].startsWith("-")) tokens = tokens.slice(1);
+      continue;
+    }
+    break;
+  }
+  if (tokens.length < 2) return null;
+  const bin = commandNameOf(tokens[0]);
+  if (!bin || !binNames.has(bin)) return null;
+  for (const raw of tokens.slice(1)) {
+    if (raw.startsWith("-")) continue;
+    const t2 = raw.replace(/^["']|["']$/g, "");
+    if (!SUBCOMMAND_SHAPE.test(t2)) return null;
+    return { bin, sub: t2 };
+  }
+  return null;
+}
+var BIN_EXT, MAX_ENTRY_BYTES, MAX_ENTRY_LINE, MAX_FOLLOW, SENTINEL, DELEGATORS, TWO_TOKEN_DELEGATORS, SUBCOMMAND_SHAPE;
+var init_cli_subcommands = __esm({
+  "src/core/checks/cli-subcommands.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_fs();
+    BIN_EXT = /\.(exe|cmd|bat|ps1|js|mjs|cjs|ts)$/i;
+    MAX_ENTRY_BYTES = 15e4;
+    MAX_ENTRY_LINE = 500;
+    MAX_FOLLOW = 1;
+    SENTINEL = /^(undefined|null|NaN|void)$/;
+    DELEGATORS = /* @__PURE__ */ new Set(["npx", "bunx", "sudo", "time"]);
+    TWO_TOKEN_DELEGATORS = /^(?:pnpm|npm|yarn|bun)\s+(?:exec|dlx)\s+/;
+    SUBCOMMAND_SHAPE = /^[a-z][a-z0-9:_-]*$/i;
+  }
+});
+
+// src/core/checks/commands.ts
+import * as fs5 from "node:fs";
+import * as path6 from "node:path";
 function isManagerBuiltin(manager, sub) {
   return PM_MANAGER_BUILTINS[manager]?.has(sub) ?? false;
 }
@@ -21803,7 +22289,7 @@ function loadDeniedCommandPrefixes(projectRoot) {
   for (const rel of ["settings.json", "settings.local.json"]) {
     let content;
     try {
-      content = stripBom(fs4.readFileSync(path5.join(projectRoot, ".claude", rel), "utf-8"));
+      content = stripBom(fs5.readFileSync(path6.join(projectRoot, ".claude", rel), "utf-8"));
     } catch {
       continue;
     }
@@ -21840,8 +22326,21 @@ async function checkCommands(file2, projectRoot) {
       });
     }
   }
+  issues.push(...checkUnknownSubcommand(file2, projectRoot, pkgJson));
   for (const ref of file2.references.commands) {
     const cmd = ref.value;
+    const masked = analyzeMaskedExitStatus(cmd, pkgJson?.scripts);
+    if (masked && !pipefailInScope(file2.content, ref.line)) {
+      const why = masked.kind === "success-claim" ? "the success claim cannot fail" : "`$?` reports the filter, not the verifier";
+      issues.push({
+        severity: "warning",
+        check: "commands",
+        ruleId: "commands/exit-status-masked",
+        line: ref.line,
+        message: `"${cmd}" \u2014 exit status comes from "${masked.filter}", not "${masked.verifier}"; ${why}`,
+        suggestion: "Add `set -o pipefail` before the pipeline, drop the filter, or read `${PIPESTATUS[0]}` instead of `$?`."
+      });
+    }
     const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
     if (scriptMatch && pkgJson) {
       const scriptName = scriptNameFromMatch(scriptMatch);
@@ -21885,9 +22384,9 @@ async function checkCommands(file2, projectRoot) {
       };
       if (!(pkgName in allDeps)) {
         if (isDeniedCommand(cmd, deniedPrefixes)) continue;
-        const binPath = path5.join(projectRoot, "node_modules", ".bin", pkgName);
+        const binPath = path6.join(projectRoot, "node_modules", ".bin", pkgName);
         try {
-          fs4.accessSync(binPath);
+          fs5.accessSync(binPath);
         } catch {
           issues.push({
             severity: "warning",
@@ -21935,9 +22434,9 @@ async function checkCommands(file2, projectRoot) {
         ...pkgJson.optionalDependencies
       };
       if (!(pkgName in allDeps)) {
-        const binPath = path5.join(projectRoot, "node_modules", ".bin", tool);
+        const binPath = path6.join(projectRoot, "node_modules", ".bin", tool);
         try {
-          fs4.accessSync(binPath);
+          fs5.accessSync(binPath);
         } catch {
           issues.push({
             severity: "warning",
@@ -21952,9 +22451,36 @@ async function checkCommands(file2, projectRoot) {
   }
   return issues;
 }
+function checkUnknownSubcommand(file2, projectRoot, pkgJson) {
+  const bins = ownedBins(pkgJson);
+  if (bins.length === 0) return [];
+  const invocations = findBinInvocations(file2.content, new Set(bins.map((b2) => b2.name)));
+  if (invocations.length === 0) return [];
+  const resolved = /* @__PURE__ */ new Map();
+  const issues = [];
+  for (const inv of invocations) {
+    if (!resolved.has(inv.bin)) {
+      const bin = bins.find((b2) => b2.name === inv.bin);
+      resolved.set(inv.bin, bin ? knownSubcommands(projectRoot, bin.entry) : null);
+    }
+    const known = resolved.get(inv.bin);
+    if (!known || known.size === 0) continue;
+    if (known.has(inv.sub)) continue;
+    const listed = [...known].sort().join(", ");
+    issues.push({
+      severity: "error",
+      check: "commands",
+      ruleId: "commands/unknown-subcommand",
+      line: inv.line,
+      message: `"${inv.cmd}" \u2014 "${inv.sub}" is not a subcommand of ${inv.bin} (known: ${listed})`,
+      suggestion: `Use one of the subcommands ${inv.bin} implements, or remove the invocation.`
+    });
+  }
+  return issues;
+}
 function loadMakefile(projectRoot) {
   try {
-    return stripBom(fs4.readFileSync(path5.join(projectRoot, "Makefile"), "utf-8"));
+    return stripBom(fs5.readFileSync(path6.join(projectRoot, "Makefile"), "utf-8"));
   } catch {
     return null;
   }
@@ -21979,6 +22505,8 @@ var init_commands = __esm({
     init_define_WEB_FIRST_SEGMENTS();
     init_main3();
     init_fs();
+    init_exit_status();
+    init_cli_subcommands();
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|(pnpm|yarn|bun)(?:\s+(run))?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+\S/;
     PM_BUILTIN_SUBCOMMANDS = /* @__PURE__ */ new Set([
@@ -22052,13 +22580,13 @@ var init_commands = __esm({
 });
 
 // src/core/checks/staleness.ts
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 async function checkStaleness(file2, projectRoot) {
   const issues = [];
   if (!await isGitRepo(projectRoot)) {
     return issues;
   }
-  const relativePath = path6.relative(projectRoot, file2.filePath).replace(/\\/g, "/");
+  const relativePath = path7.relative(projectRoot, file2.filePath).replace(/\\/g, "/");
   const lastModified = await getFileLastModified(projectRoot, relativePath);
   if (!lastModified || isNaN(lastModified.getTime())) {
     return issues;
@@ -22130,6 +22658,50 @@ var init_staleness = __esm({
   }
 });
 
+// src/core/suppressions.ts
+function collectSuppressions(content) {
+  const suppressions = /* @__PURE__ */ new Map();
+  const lines = content.split("\n");
+  const add = (lineNumber, checks) => {
+    const existing = suppressions.get(lineNumber);
+    if (existing === null) return;
+    if (checks.length === 0) {
+      suppressions.set(lineNumber, null);
+      return;
+    }
+    const merged = existing ?? /* @__PURE__ */ new Set();
+    for (const check2 of checks) merged.add(check2);
+    suppressions.set(lineNumber, merged);
+  };
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!line.includes("ctxlint-ignore-")) continue;
+    DIRECTIVE_RE.lastIndex = 0;
+    let match;
+    while ((match = DIRECTIVE_RE.exec(line)) !== null) {
+      const kind = match[1];
+      const checks = (match[2] ?? "").trim().split(/\s+/).filter(Boolean);
+      add(kind === "next-line" ? i2 + 2 : i2 + 1, checks);
+    }
+  }
+  return suppressions;
+}
+function isSuppressed(suppressions, issue2) {
+  if (suppressions.size === 0) return false;
+  if (!suppressions.has(issue2.line)) return false;
+  const checks = suppressions.get(issue2.line);
+  if (checks === null) return true;
+  return checks.has(issue2.check);
+}
+var DIRECTIVE_RE;
+var init_suppressions = __esm({
+  "src/core/suppressions.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    DIRECTIVE_RE = /<!--\s*ctxlint-ignore-(next-line|line)((?:\s+[\w-]+)*)\s*-->/g;
+  }
+});
+
 // src/core/checks/tokens.ts
 function resolveTokenThresholds(overrides) {
   if (!overrides) return DEFAULT_TOKEN_THRESHOLDS;
@@ -22205,9 +22777,9 @@ var init_tokens2 = __esm({
 });
 
 // src/core/checks/tier-tokens.ts
-import * as fs5 from "node:fs";
+import * as fs6 from "node:fs";
 import * as os2 from "node:os";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 function hasFrontmatterList(content, field) {
   const lines = content.split("\n");
   if (lines[0]?.trim() !== "---") return false;
@@ -22277,7 +22849,7 @@ function computeSectionCosts(file2) {
 function fingerprintFiles(paths) {
   return paths.map((p2) => {
     try {
-      const st2 = fs5.statSync(p2);
+      const st2 = fs6.statSync(p2);
       return `${st2.mtimeMs}:${st2.size}`;
     } catch {
       return "absent";
@@ -22286,11 +22858,11 @@ function fingerprintFiles(paths) {
 }
 function loadSettingsSources(projectRoot, includeGlobal) {
   const candidates = [
-    path7.join(projectRoot, ".claude", "settings.json"),
-    path7.join(projectRoot, ".claude", "settings.local.json")
+    path8.join(projectRoot, ".claude", "settings.json"),
+    path8.join(projectRoot, ".claude", "settings.local.json")
   ];
   if (includeGlobal) {
-    candidates.push(path7.join(os2.homedir(), ".claude", "settings.json"));
+    candidates.push(path8.join(os2.homedir(), ".claude", "settings.json"));
   }
   const fingerprint = fingerprintFiles(candidates);
   if (settingsCache?.root === projectRoot && settingsCache.includeGlobal === includeGlobal && settingsCache.fingerprint === fingerprint) {
@@ -22300,7 +22872,7 @@ function loadSettingsSources(projectRoot, includeGlobal) {
   for (const p2 of candidates) {
     let content;
     try {
-      content = stripBom(fs5.readFileSync(p2, "utf-8"));
+      content = stripBom(fs6.readFileSync(p2, "utf-8"));
     } catch {
       continue;
     }
@@ -22474,7 +23046,7 @@ var init_similarity = __esm({
 });
 
 // src/core/checks/redundancy.ts
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 function compilePatterns(allDeps) {
   const compiled = [];
   for (const [pkg, mentions] of Object.entries(PACKAGE_TECH_MAP)) {
@@ -22554,8 +23126,8 @@ async function checkRedundancy(file2, projectRoot) {
     );
     if (dirMatch) {
       const dir = dirMatch[1].replace(/[`"]/g, "");
-      const baseDir = dir.startsWith("./") || dir.startsWith("../") ? path8.dirname(file2.filePath) : projectRoot;
-      const fullPath = path8.resolve(baseDir, dir);
+      const baseDir = dir.startsWith("./") || dir.startsWith("../") ? path9.dirname(file2.filePath) : projectRoot;
+      const fullPath = path9.resolve(baseDir, dir);
       if (isDirectory(fullPath)) {
         issues.push({
           severity: "info",
@@ -23583,8 +24155,8 @@ var init_security = __esm({
 });
 
 // src/core/checks/mcp/commands.ts
-import * as fs6 from "node:fs";
-import * as path9 from "node:path";
+import * as fs7 from "node:fs";
+import * as path10 from "node:path";
 async function checkMcpCommands(config2, projectRoot) {
   const issues = [];
   if (config2.parseErrors.length > 0) return issues;
@@ -23601,7 +24173,7 @@ async function checkMcpCommands(config2, projectRoot) {
       });
     }
     if (config2.scope === "project" && LOCAL_PATH_PATTERN.test(server2.command)) {
-      const resolved = path9.resolve(projectRoot, server2.command);
+      const resolved = path10.resolve(projectRoot, server2.command);
       if (!fileExistsSafe(resolved)) {
         issues.push({
           severity: "warning",
@@ -23616,8 +24188,8 @@ async function checkMcpCommands(config2, projectRoot) {
       for (const arg of server2.args) {
         if (URL_PREFIX.test(arg)) continue;
         if (!LOCAL_PATH_PATTERN.test(arg) && !FILE_PATH_PATTERN.test(arg)) continue;
-        if (config2.scope !== "project" && !path9.isAbsolute(arg)) continue;
-        const resolved = path9.resolve(projectRoot, arg);
+        if (config2.scope !== "project" && !path10.isAbsolute(arg)) continue;
+        const resolved = path10.resolve(projectRoot, arg);
         if (!fileExistsSafe(resolved)) {
           issues.push({
             severity: "warning",
@@ -23634,7 +24206,7 @@ async function checkMcpCommands(config2, projectRoot) {
 }
 function fileExistsSafe(filePath) {
   try {
-    fs6.accessSync(filePath);
+    fs7.accessSync(filePath);
     return true;
   } catch {
     return false;
@@ -24065,22 +24637,27 @@ var init_redundancy2 = __esm({
 
 // src/core/session-parser.ts
 import { readFile } from "node:fs/promises";
-import { readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname3, resolve as resolve6 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname4, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadWebFirstSegments() {
   if (typeof define_WEB_FIRST_SEGMENTS_default !== "undefined") {
     return new Set(define_WEB_FIRST_SEGMENTS_default);
   }
-  const __dir = dirname3(fileURLToPath(import.meta.url));
-  const fixturePath = resolve6(__dir, "../../tests/fixtures/web-first-segments.json");
-  const raw = JSON.parse(readFileSync4(fixturePath, "utf-8"));
+  const __dir = dirname4(fileURLToPath(import.meta.url));
+  const fixturePath = resolve7(__dir, "../../tests/fixtures/web-first-segments.json");
+  const raw = JSON.parse(readFileSync5(fixturePath, "utf-8"));
   const list = Array.isArray(raw) ? raw : raw.segments;
   return new Set(list);
 }
 function encodeProjectDir(fsPath) {
   return fsPath.replace(/[:\\/\.]/g, "-");
 }
+function projectDirCandidates(fsPath) {
+  const encoded = encodeProjectDir(fsPath);
+  const folded = encoded.replace(/_/g, "-");
+  return folded === encoded ? [encoded] : [encoded, folded];
+}
 function projectDirMatchesPath(encodedDir, fsPath) {
   const normalized = fsPath.replace(/\\/g, "/");
   return encodedDir === encodeProjectDir(normalized);
@@ -24191,7 +24768,7 @@ import { readdir, stat } from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { createInterface } from "node:readline";
-import { dirname as dirname4, join as join5, resolve as resolve7 } from "node:path";
+import { dirname as dirname5, join as join5, resolve as resolve8 } from "node:path";
 import { existsSync } from "node:fs";
 function detectProviders() {
   if (!home) return [];
@@ -24306,7 +24883,7 @@ async function mapWithConcurrency(items, limit, fn) {
   return results;
 }
 async function detectSiblings(projectRoot) {
-  const parentDir = dirname4(resolve7(projectRoot));
+  const parentDir = dirname5(resolve8(projectRoot));
   let entries;
   try {
     entries = await readdir(parentDir);
@@ -24317,8 +24894,8 @@ async function detectSiblings(projectRoot) {
   for (const entry of entries) {
     if (entry.startsWith(".") || entry === "node_modules") continue;
     const fullPath = join5(parentDir, entry);
-    const entryPath = resolve7(fullPath);
-    if (entryPath === resolve7(projectRoot)) continue;
+    const entryPath = resolve8(fullPath);
+    if (entryPath === resolve8(projectRoot)) continue;
     try {
       const s = await stat(fullPath);
       if (!s.isDirectory()) continue;
@@ -24385,7 +24962,7 @@ async function scanSessionData(projectRoot) {
     history: histories,
     memories,
     siblings,
-    currentProject: resolve7(projectRoot).replace(/\\/g, "/"),
+    currentProject: resolve8(projectRoot).replace(/\\/g, "/"),
     providers
   };
 }
@@ -24426,9 +25003,9 @@ var init_session_scanner = __esm({
 });
 
 // src/core/checks/session/missing-secret.ts
-import { resolve as resolve8, basename as basename3 } from "node:path";
+import { resolve as resolve9, basename as basename3 } from "node:path";
 function normalizePath2(p2) {
-  return resolve8(p2).replace(/\\/g, "/").toLowerCase();
+  return resolve9(p2).replace(/\\/g, "/").toLowerCase();
 }
 function extractSecretName(display) {
   const prefixMatch = display.match(SECRET_SET_PREFIX);
@@ -24546,7 +25123,7 @@ var init_missing_secret = __esm({
 
 // src/core/checks/session/diverged-file.ts
 import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
-import { join as join6, resolve as resolve9 } from "node:path";
+import { join as join6, resolve as resolve10 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
 async function loadLineSet(absPath) {
   let mtimeMs;
@@ -24598,7 +25175,7 @@ async function checkDivergedFile(ctx) {
         diverged.push({
           sibling: sib.name,
           overlap: Math.round(overlap * 100),
-          path: resolve9(sibPath)
+          path: resolve10(sibPath)
         });
       }
     }
@@ -24613,7 +25190,7 @@ async function checkDivergedFile(ctx) {
         line: 0,
         message: `${fileName} has diverged from sibling repos: ${details}`,
         suggestion: `Compare with sibling versions to identify unintentional drift`,
-        detail: `File: ${resolve9(currentPath)}
+        detail: `File: ${resolve10(currentPath)}
 Diverged siblings:
 ${sibPaths}`
       });
@@ -24703,15 +25280,15 @@ var init_missing_workflow = __esm({
 // src/core/checks/session/stale-memory.ts
 import { existsSync as existsSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { resolve as resolve10, isAbsolute as isAbsolute5 } from "node:path";
+import { resolve as resolve11, isAbsolute as isAbsolute5 } from "node:path";
 function resolveRef(ref, projectRoot) {
   if (ref.startsWith("~/") || ref === "~") {
     const home2 = process.env.HOME || process.env.USERPROFILE || homedir4();
     if (!home2) return null;
-    return ref === "~" ? home2 : resolve10(home2, ref.slice(2));
+    return ref === "~" ? home2 : resolve11(home2, ref.slice(2));
   }
   if (isAbsolute5(ref)) return ref;
-  return resolve10(projectRoot, ref);
+  return resolve11(projectRoot, ref);
 }
 async function checkStaleMemory(ctx) {
   const issues = [];
@@ -24808,9 +25385,9 @@ var init_duplicate_memory = __esm({
 });
 
 // src/core/checks/session/loop-detection.ts
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 function normalizeProject(p2) {
-  return resolve11(p2).replace(/\\/g, "/");
+  return resolve12(p2).replace(/\\/g, "/");
 }
 function findConsecutiveRepeats(displays) {
   const results = [];
@@ -24967,13 +25544,19 @@ import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || homedir5();
   if (!home2) return [];
-  const encoded = encodeProjectDir(ctx.currentProject);
-  const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
-  let content;
-  try {
-    content = stripBom(await readFile3(memoryFile, "utf-8"));
-  } catch {
-    return [];
+  let content = "";
+  let memoryFile = "";
+  for (const encoded of projectDirCandidates(ctx.currentProject)) {
+    const candidate = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
+    try {
+      content = stripBom(await readFile3(candidate, "utf-8"));
+    } catch {
+      continue;
+    }
+    if (content) {
+      memoryFile = candidate;
+      break;
+    }
   }
   if (!content) return [];
   const lines = content.split("\n");
@@ -25018,16 +25601,529 @@ var init_memory_index_overflow = __esm({
   }
 });
 
-// src/core/checks/ci-coverage.ts
-import { readdir as readdir3, readFile as readFile4 } from "node:fs/promises";
+// src/core/transcript.ts
+import { createReadStream as createReadStream2, existsSync as existsSync5, statSync as statSync5 } from "node:fs";
+import { readdir as readdir3 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
 import { join as join9 } from "node:path";
-import { existsSync as existsSync5 } from "node:fs";
+import { createInterface as createInterface2 } from "node:readline";
+function asString(v2) {
+  return typeof v2 === "string" ? v2 : "";
+}
+function resultText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.map((b2) => b2 && typeof b2 === "object" ? asString(b2.text) : "").join("");
+}
+function resolveHome() {
+  return process.env.HOME || process.env.USERPROFILE || homedir6();
+}
+function readProjectTranscript(project, home2 = resolveHome()) {
+  const key = `${home2} ${project}`;
+  let hit = cache.get(key);
+  if (!hit) {
+    hit = readUncached(project, home2);
+    cache.set(key, hit);
+  }
+  return hit;
+}
+function candidateDirs(project, home2) {
+  const root = join9(home2, ".claude", "projects");
+  return projectDirCandidates(project).map((n7) => join9(root, n7)).filter((d) => existsSync5(d));
+}
+async function readUncached(project, home2) {
+  if (!home2 || !project) return EMPTY;
+  const dirs = candidateDirs(project, home2);
+  if (dirs.length === 0) return EMPTY;
+  const names = [];
+  for (const dir of dirs) {
+    for (const name of await readdir3(dir).catch(() => [])) {
+      names.push({ dir, name });
+    }
+  }
+  const files = names.filter(({ name }) => name.endsWith(".jsonl")).map(({ dir, name }) => {
+    const p2 = join9(dir, name);
+    try {
+      return { p: p2, mtime: statSync5(p2).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((f) => f !== null).sort((a, b2) => b2.mtime - a.mtime);
+  let truncated = files.length > MAX_TRANSCRIPTS;
+  const selected = files.slice(0, MAX_TRANSCRIPTS);
+  const events = [];
+  const pending = /* @__PURE__ */ new Map();
+  let lines = 0;
+  for (const { p: p2 } of selected) {
+    if (lines >= MAX_LINES2) {
+      truncated = true;
+      break;
+    }
+    const rl = createInterface2({
+      input: createReadStream2(p2, { encoding: "utf-8" }),
+      crlfDelay: Infinity
+    });
+    try {
+      for await (const raw of rl) {
+        if (++lines >= MAX_LINES2) {
+          truncated = true;
+          break;
+        }
+        const line = raw.trim();
+        if (!line) continue;
+        let rec;
+        try {
+          rec = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        collect(rec, events, pending);
+      }
+    } catch {
+    } finally {
+      rl.close();
+    }
+  }
+  return { events, filesRead: selected.length, truncated };
+}
+function collect(rec, events, pending) {
+  const message = rec.message;
+  const content = message?.content;
+  if (!Array.isArray(content)) return;
+  const timestamp = Date.parse(asString(rec.timestamp)) || 0;
+  const sessionId = asString(rec.sessionId) || asString(rec.session_id);
+  const gitBranch = asString(rec.gitBranch) || void 0;
+  for (const raw of content) {
+    if (!raw || typeof raw !== "object") continue;
+    const block = raw;
+    const type = asString(block.type);
+    if (type === "text" && rec.type === "assistant") {
+      const text = asString(block.text);
+      if (text) {
+        events.push({ kind: "assistant-text", text, tool: "", gitBranch, timestamp, sessionId });
+      }
+      continue;
+    }
+    if (type === "tool_use") {
+      const tool = asString(block.name);
+      const input = block.input ?? {};
+      const cmdField = COMMAND_TOOLS[tool];
+      const writeField = WRITE_TOOLS[tool];
+      let ev = null;
+      if (cmdField) {
+        const text = asString(input[cmdField]);
+        if (text) ev = { kind: "command", text, tool, gitBranch, timestamp, sessionId };
+      } else if (writeField) {
+        const text = asString(input[writeField]);
+        if (text) ev = { kind: "file-write", text, tool, gitBranch, timestamp, sessionId };
+      }
+      if (ev) {
+        events.push(ev);
+        const id = asString(block.id);
+        if (id) pending.set(id, ev);
+      }
+      continue;
+    }
+    if (type === "tool_result") {
+      const id = asString(block.tool_use_id);
+      const ev = id ? pending.get(id) : void 0;
+      if (!ev) continue;
+      pending.delete(id);
+      ev.isError = block.is_error === true;
+      ev.emptyOutput = resultText(block.content).trim().length === 0;
+    }
+  }
+}
+var WRITE_TOOLS, COMMAND_TOOLS, MAX_TRANSCRIPTS, MAX_LINES2, EMPTY, cache;
+var init_transcript = __esm({
+  "src/core/transcript.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_session_parser();
+    WRITE_TOOLS = {
+      Write: "file_path",
+      Edit: "file_path",
+      NotebookEdit: "notebook_path"
+    };
+    COMMAND_TOOLS = {
+      Bash: "command",
+      PowerShell: "command"
+    };
+    MAX_TRANSCRIPTS = 5;
+    MAX_LINES2 = 2e5;
+    EMPTY = { events: [], filesRead: 0, truncated: false };
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/core/checks/session/shared-temp-path.ts
+function unquote(raw) {
+  let s = raw;
+  let prev;
+  do {
+    prev = s;
+    s = s.replace(/^['"`]|['"`]$/g, "");
+  } while (s !== prev);
+  return s;
+}
+function normalize3(raw) {
+  return unquote(raw).replace(/\\/g, "/").toLowerCase();
+}
+function isFixedTempPath(candidate) {
+  const p2 = normalize3(candidate);
+  const root = TEMP_ROOTS.map((r2) => normalize3(r2)).find((r2) => p2.startsWith(r2));
+  if (!root) return false;
+  if (p2.length <= root.length) return false;
+  return !SCOPED_MARKERS.some((m) => p2.includes(m.toLowerCase()));
+}
+function extract(line, patterns) {
+  const found = [];
+  for (const re2 of patterns) {
+    for (const m of line.matchAll(new RegExp(re2, "g"))) {
+      if (m[1]) found.push(m[1]);
+    }
+  }
+  return found;
+}
+async function checkSharedTempPath(ctx) {
+  const issues = [];
+  const written = /* @__PURE__ */ new Map();
+  const reported = /* @__PURE__ */ new Set();
+  const transcript = await readProjectTranscript(ctx.currentProject);
+  const scanned = [
+    ...transcript.events.filter((e) => e.kind === "command").map((e) => ({ display: e.text, timestamp: e.timestamp })),
+    ...ctx.history.map((h2) => ({ display: h2.display, timestamp: h2.timestamp }))
+  ];
+  const ordered = scanned.sort((a, b2) => a.timestamp - b2.timestamp);
+  for (const entry of ordered) {
+    const line = entry.display;
+    const usesMktemp = /\bmktemp\b/.test(line);
+    for (const candidate of extract(line, READ_PATTERNS)) {
+      if (usesMktemp || !isFixedTempPath(candidate)) continue;
+      const key = normalize3(candidate);
+      const origin = written.get(key);
+      if (!origin || reported.has(key)) continue;
+      reported.add(key);
+      issues.push({
+        severity: "error",
+        check: "session-shared-temp-path",
+        ruleId: "session-shared-temp-path/shared-temp-path",
+        line: 0,
+        message: `Fixed temp path "${unquote(candidate)}" is written and later read back`,
+        detail: `Written by: ${origin.display.trim().slice(0, 120)}
+Read by:    ${line.trim().slice(0, 120)}`,
+        suggestion: "Use a per-run path instead: `T=$(mktemp)` in shell, or a session-scoped scratch directory. A literal path under a shared temp root can be overwritten by any concurrent session between the write and the read, and a restore then puts the wrong bytes into your workspace."
+      });
+    }
+    for (const candidate of extract(line, WRITE_PATTERNS)) {
+      if (usesMktemp || !isFixedTempPath(candidate)) continue;
+      written.set(normalize3(candidate), entry);
+    }
+  }
+  return issues;
+}
+var TEMP_ROOTS, SCOPED_MARKERS, WRITE_PATTERNS, READ_PATTERNS;
+var init_shared_temp_path = __esm({
+  "src/core/checks/session/shared-temp-path.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    TEMP_ROOTS = [
+      "/tmp/",
+      "/var/tmp/",
+      "$TMPDIR/",
+      "${TMPDIR}/",
+      "%TEMP%\\",
+      "%TMP%\\"
+    ];
+    SCOPED_MARKERS = [
+      "$$",
+      "$pid",
+      "${pid}",
+      "mktemp",
+      "$random",
+      "${random}",
+      "$session",
+      "${session}",
+      "$uuid",
+      "${uuid}"
+    ];
+    WRITE_PATTERNS = [
+      />\s*(\S+)/,
+      // shell redirect
+      /\bcp\s+\S+\s+(\S+)/,
+      // cp src dest
+      /\bmv\s+\S+\s+(\S+)/,
+      /\bcopy\s+\S+\s+(\S+)/,
+      /\bmove\s+\S+\s+(\S+)/,
+      /\btee\s+(\S+)/,
+      /writeFileSync\(\s*['"`]([^'"`]+)/,
+      /\bcurl\b[^|]*-o\s+(\S+)/
+    ];
+    READ_PATTERNS = [
+      /\bcp\s+(\S+)\s+\S+/,
+      /\bcopy\s+(\S+)\s+\S+/,
+      /\bcat\s+(\S+)/,
+      /\btype\s+(\S+)/,
+      /\bsource\s+(\S+)/,
+      /\breadFileSync\(\s*['"`]([^'"`]+)/,
+      // Input redirect. `(?!<)` excludes heredocs (`<<'EOF'`), and the leading
+      // boundary plus the restricted character class keep it from matching a `<`
+      // that is part of a comparison, an HTML fragment, or another operator --
+      // a bare /<\s*(\S+)/ matched unrelated text in real transcripts.
+      /(?:^|\s)<(?!<)\s*([^\s<>|&;]+)/
+    ];
+  }
+});
+
+// src/core/checks/session/unverified-gate-claimed-clean.ts
+function gateOf(cmd) {
+  for (const { re: re2, gate } of GATE_PATTERNS) {
+    if (re2.test(cmd)) return gate;
+  }
+  return null;
+}
+function isUnverified(ev) {
+  return ev.isError === true || ev.emptyOutput === true;
+}
+async function checkUnverifiedGateClaimedClean(ctx) {
+  const { events } = await readProjectTranscript(ctx.currentProject);
+  if (events.length === 0) return [];
+  const ordered = [...events].sort((a, b2) => a.timestamp - b2.timestamp);
+  const issues = [];
+  const reported = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < ordered.length; i2++) {
+    const ev = ordered[i2];
+    if (ev.kind !== "command") continue;
+    const gate = gateOf(ev.text);
+    if (!gate || !isUnverified(ev)) continue;
+    for (let j3 = i2 + 1; j3 < ordered.length && j3 <= i2 + ADJACENCY; j3++) {
+      const next = ordered[j3];
+      if (next.kind === "command" && gateOf(next.text) === gate) break;
+      if (next.kind !== "assistant-text") continue;
+      if (HONEST_MARKERS.some((re2) => re2.test(next.text))) break;
+      if (!CLEAN_CLAIMS.some((re2) => re2.test(next.text))) continue;
+      if (reported.has(gate)) break;
+      reported.add(gate);
+      const why = ev.isError ? "the invocation reported an error" : "the invocation produced no output";
+      issues.push({
+        severity: "warning",
+        check: "session-unverified-gate-claimed-clean",
+        ruleId: "session-unverified-gate-claimed-clean/unverified-gate-claimed-clean",
+        line: 0,
+        message: `'${gate}' asserted as passing, but ${why}`,
+        detail: `Gate command: ${ev.text.trim().slice(0, 120)}
+Claim:        ${next.text.trim().slice(0, 120)}`,
+        suggestion: 'An empty or failed gate carries no information about cleanliness -- a runner that dies before emitting diagnostics looks exactly like one that found none. Either re-run the gate until it produces a real result, or report the state honestly ("lint UNVERIFIED -- runner crashed").'
+      });
+      break;
+    }
+  }
+  return issues;
+}
+var GATE_PATTERNS, CLEAN_CLAIMS, HONEST_MARKERS, ADJACENCY;
+var init_unverified_gate_claimed_clean = __esm({
+  "src/core/checks/session/unverified-gate-claimed-clean.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    GATE_PATTERNS = [
+      { re: /\b(biome|eslint|ruff|clippy)\b/, gate: "lint" },
+      { re: /\blint(:fix)?\b/, gate: "lint" },
+      { re: /\btsc\b|\btypecheck\b|\btype-check\b/, gate: "typecheck" },
+      { re: /\b(vitest|jest|pytest|mocha)\b/, gate: "test" },
+      { re: /\btest\b/, gate: "test" },
+      { re: /\bbuild\b/, gate: "build" }
+    ];
+    CLEAN_CLAIMS = [
+      /\ball green\b/i,
+      /\bno (lint )?(violations|errors|issues|diagnostics)\b/i,
+      /\b0 errors\b/i,
+      /\bzero (errors|violations|diagnostics)\b/i,
+      /\b(lint|typecheck|type-check|tests?|build)\b[^.\n]{0,40}\b(clean|passe[sd]|passing|green|succeeded)\b/i,
+      /\b(clean|passing|green)\b[^.\n]{0,25}\b(lint|typecheck|type-check|tests?|build)\b/i
+    ];
+    HONEST_MARKERS = [
+      /\bunverified\b/i,
+      /\bcould not verify\b/i,
+      /\bcannot verify\b/i,
+      /\bunable to verify\b/i,
+      /\bcrashed?\b/i,
+      /\bsegfault/i,
+      /\bblocked\b/i,
+      /\bnot trustworthy\b/i,
+      /\bno signal\b/i,
+      /\bdid not run\b/i,
+      /\binconclusive\b/i
+    ];
+    ADJACENCY = 12;
+  }
+});
+
+// src/core/checks/session/default-branch-accumulation.ts
+function isCommit(cmd) {
+  return /\bgit\s+commit\b/.test(cmd) && !/--dry-run\b/.test(cmd);
+}
+function isBranchAway(cmd) {
+  return /\bgit\s+(checkout\s+-b|switch\s+-c|worktree\s+add)\b/.test(cmd);
+}
+async function checkDefaultBranchAccumulation(ctx) {
+  const { events } = await readProjectTranscript(ctx.currentProject);
+  if (events.length === 0) return [];
+  const ordered = [...events].sort((a, b2) => a.timestamp - b2.timestamp);
+  const pending = /* @__PURE__ */ new Set();
+  let branch = "";
+  let firstWrite = "";
+  for (const ev of ordered) {
+    if (ev.gitBranch) branch = ev.gitBranch;
+    if (ev.kind === "command") {
+      if (isCommit(ev.text) || isBranchAway(ev.text)) {
+        pending.clear();
+        firstWrite = "";
+      }
+      continue;
+    }
+    if (ev.kind !== "file-write") continue;
+    if (!DEFAULT_BRANCHES.has(branch)) continue;
+    if (pending.size === 0) firstWrite = ev.text;
+    pending.add(ev.text);
+  }
+  if (pending.size < THRESHOLD) return [];
+  const sample = [...pending].slice(0, 5);
+  return [
+    {
+      severity: "warning",
+      check: "session-default-branch-accumulation",
+      ruleId: "session-default-branch-accumulation/default-branch-accumulation",
+      line: 0,
+      message: `${pending.size} files edited on '${branch}' with no intervening commit`,
+      detail: `First uncommitted write: ${firstWrite}
+Sample: ${sample.join(", ")}${pending.size > sample.length ? ", ..." : ""}`,
+      suggestion: "Commit as you go, or move the work to a topic branch (`git checkout -b`). A large uncommitted delta on a shared default branch is hard to review and, when other agent sessions share the checkout, one `git stash` or `git checkout --` away from being lost."
+    }
+  ];
+}
+var DEFAULT_BRANCHES, THRESHOLD;
+var init_default_branch_accumulation = __esm({
+  "src/core/checks/session/default-branch-accumulation.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_transcript();
+    DEFAULT_BRANCHES = /* @__PURE__ */ new Set(["main", "master"]);
+    THRESHOLD = 10;
+  }
+});
+
+// src/core/checks/session/unresolvable-sha.ts
+function stripFences(text) {
+  const lines = text.split("\n");
+  let inFence = false;
+  return lines.map((line) => {
+    if (line.trimStart().startsWith("```")) {
+      inFence = !inFence;
+      return "";
+    }
+    return inFence ? "" : line;
+  }).join("\n");
+}
+function extractShaCitations(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawLine of stripFences(text).split("\n")) {
+    const line = rawLine.replace(UUID, " ");
+    HEX_TOKEN.lastIndex = 0;
+    for (const m of line.matchAll(HEX_TOKEN)) {
+      const sha = m[0];
+      const start = m.index ?? 0;
+      const before = line.slice(0, start);
+      const after = line.slice(start + sha.length);
+      if (/^\d+$/.test(sha)) continue;
+      if (/[#]$/.test(before) || /0x$/i.test(before)) continue;
+      if (DIGEST_PREFIX.test(before)) continue;
+      if (/[-.]$/.test(before) && /[\w]$/.test(before.slice(0, -1))) continue;
+      if (/^[-.][0-9a-z]/i.test(after)) continue;
+      if (/[/\\]$/.test(before) && /^[/\\]/.test(after)) continue;
+      const window2 = before.slice(-CUE_WINDOW);
+      if (!CITATION_CUE.test(window2)) continue;
+      if (seen.has(sha)) continue;
+      seen.add(sha);
+      out.push({ sha, context: rawLine.trim().slice(0, 160) });
+    }
+  }
+  return out;
+}
+async function checkUnresolvableSha(ctx) {
+  const projectMemories = ctx.memories.filter(
+    (m) => projectDirMatchesPath(m.projectDir, ctx.currentProject)
+  );
+  if (projectMemories.length === 0) return [];
+  if (!await isGitRepo(ctx.currentProject)) return [];
+  const git = getGit(ctx.currentProject);
+  const resolvedCache = /* @__PURE__ */ new Map();
+  let budget = MAX_RESOLVE;
+  async function resolves(sha) {
+    const cached2 = resolvedCache.get(sha);
+    if (cached2 !== void 0) return cached2;
+    if (budget <= 0) return null;
+    budget--;
+    let ok;
+    try {
+      const type = await git.raw(["cat-file", "-t", sha]);
+      ok = type.trim().length > 0;
+    } catch {
+      ok = false;
+    }
+    resolvedCache.set(sha, ok);
+    return ok;
+  }
+  const issues = [];
+  for (const mem of projectMemories) {
+    const dead = [];
+    for (const cite of extractShaCitations(mem.content)) {
+      const ok = await resolves(cite.sha);
+      if (ok === false) dead.push(cite);
+    }
+    if (dead.length === 0) continue;
+    const name = mem.name || mem.filePath.split(/[/\\]/).pop() || "unknown";
+    const list = dead.map((d) => d.sha).join(", ");
+    issues.push({
+      severity: "warning",
+      check: "session-unresolvable-sha",
+      ruleId: "session-unresolvable-sha/unresolvable-sha",
+      line: 0,
+      message: `Memory "${name}" cites ${dead.length} commit(s) that do not resolve in this repository: ${list}`,
+      detail: dead.map((d) => `${d.sha}: ${d.context}`).join("\n"),
+      suggestion: `Re-resolve the citation and update ${mem.filePath}. A squash-merge or rebase rewrites SHAs, so a memory written before the merge points at a commit that no longer exists -- cite the landed commit, or the PR number, which survives the rewrite.`
+    });
+  }
+  return issues;
+}
+var HEX_TOKEN, UUID, CITATION_CUE, CUE_WINDOW, DIGEST_PREFIX, MAX_RESOLVE;
+var init_unresolvable_sha = __esm({
+  "src/core/checks/session/unresolvable-sha.ts"() {
+    "use strict";
+    init_define_WEB_FIRST_SEGMENTS();
+    init_git();
+    init_session_parser();
+    HEX_TOKEN = /\b[0-9a-f]{7,40}\b/g;
+    UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi;
+    CITATION_CUE = /\b(commit|commits|committed|sha|revision|revs?|git|head|tag|tagged|branch|pr|landed|merged|shipped|introduced|reverted|cherry-?picked|backported|fixed|removed|added|renamed|bumped|released)\b/i;
+    CUE_WINDOW = 80;
+    DIGEST_PREFIX = /(sha\d{3}|md5|blake\d*|crc\d*)\s*[:=]\s*$/i;
+    MAX_RESOLVE = 40;
+  }
+});
+
+// src/core/checks/ci-coverage.ts
+import { readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
 async function findReleaseWorkflows(projectRoot) {
-  const workflowDir = join9(projectRoot, ".github", "workflows");
-  if (!existsSync5(workflowDir)) return [];
+  const workflowDir = join10(projectRoot, ".github", "workflows");
+  if (!existsSync6(workflowDir)) return [];
   let files;
   try {
-    files = await readdir3(workflowDir);
+    files = await readdir4(workflowDir);
   } catch {
     return [];
   }
@@ -25039,7 +26135,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
+      const content = stripBom(await readFile4(join10(workflowDir, f), "utf-8"));
       const nameMatch = content.match(/^\s*name:\s*(.+?)\s*$/m);
       if (nameMatch) {
         const name = nameMatch[1].replace(/^(['"])(.*)\1$/, "$2");
@@ -25098,15 +26194,15 @@ var init_ci_coverage = __esm({
 });
 
 // src/core/checks/ci-secrets.ts
-import { readdir as readdir4, readFile as readFile5 } from "node:fs/promises";
-import { join as join10 } from "node:path";
-import { existsSync as existsSync6 } from "node:fs";
+import { readdir as readdir5, readFile as readFile5 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
 async function findSecretUsages(projectRoot) {
-  const workflowDir = join10(projectRoot, ".github", "workflows");
-  if (!existsSync6(workflowDir)) return [];
+  const workflowDir = join11(projectRoot, ".github", "workflows");
+  if (!existsSync7(workflowDir)) return [];
   let files;
   try {
-    files = await readdir4(workflowDir);
+    files = await readdir5(workflowDir);
   } catch {
     return [];
   }
@@ -25115,7 +26211,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = stripBom(await readFile5(join10(workflowDir, f), "utf-8"));
+      content = stripBom(await readFile5(join11(workflowDir, f), "utf-8"));
     } catch {
       continue;
     }
@@ -25429,26 +26525,26 @@ var init_positions = __esm({
 });
 
 // src/core/checks/hook-coverage.ts
-import * as fs7 from "node:fs";
+import * as fs8 from "node:fs";
 import * as os3 from "node:os";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 function loadSettingsSources2(projectRoot, homeDir, includeUserGlobal) {
   const home2 = homeDir;
   const candidates = [
     {
-      filePath: path10.join(projectRoot, ".claude", "settings.json"),
-      displayPath: path10.join(".claude", "settings.json"),
+      filePath: path11.join(projectRoot, ".claude", "settings.json"),
+      displayPath: path11.join(".claude", "settings.json"),
       isUserGlobal: false
     },
     {
-      filePath: path10.join(projectRoot, ".claude", "settings.local.json"),
-      displayPath: path10.join(".claude", "settings.local.json"),
+      filePath: path11.join(projectRoot, ".claude", "settings.local.json"),
+      displayPath: path11.join(".claude", "settings.local.json"),
       isUserGlobal: false
     }
   ];
   if (includeUserGlobal) {
     candidates.push({
-      filePath: path10.join(home2, ".claude", "settings.json"),
+      filePath: path11.join(home2, ".claude", "settings.json"),
       displayPath: "~/.claude/settings.json",
       isUserGlobal: true
     });
@@ -25457,7 +26553,7 @@ function loadSettingsSources2(projectRoot, homeDir, includeUserGlobal) {
   for (const c3 of candidates) {
     let content;
     try {
-      content = stripBom(fs7.readFileSync(c3.filePath, "utf-8"));
+      content = stripBom(fs8.readFileSync(c3.filePath, "utf-8"));
     } catch {
       continue;
     }
@@ -25469,11 +26565,11 @@ function loadSettingsSources2(projectRoot, homeDir, includeUserGlobal) {
 function expandPath(raw, projectRoot, homeDir, platform) {
   let s = raw;
   if (s === "~" || s.startsWith("~/") || s.startsWith("~\\")) {
-    s = path10.join(homeDir, s.slice(1));
+    s = path11.join(homeDir, s.slice(1));
   }
   const replacements = {
     CLAUDE_PROJECT_DIR: projectRoot,
-    CLAUDE_CONFIG_DIR: path10.join(homeDir, ".claude"),
+    CLAUDE_CONFIG_DIR: path11.join(homeDir, ".claude"),
     HOME: homeDir,
     USERPROFILE: homeDir
   };
@@ -25488,7 +26584,7 @@ function expandPath(raw, projectRoot, homeDir, platform) {
   if (/\$\{?[A-Za-z_]/.test(s)) return null;
   if (/%[A-Za-z_][A-Za-z0-9_]*%/.test(s)) return null;
   s = translateMsysDrivePath(s, platform);
-  if (!path10.isAbsolute(s)) s = path10.resolve(projectRoot, s);
+  if (!path11.isAbsolute(s)) s = path11.resolve(projectRoot, s);
   return s;
 }
 function looksLikePath(token) {
@@ -25504,9 +26600,24 @@ function isMsysFlag(token) {
 }
 function translateMsysDrivePath(s, platform) {
   if (platform !== "win32") return s;
-  const m = /^\/([A-Za-z])\/(.*)$/.exec(s);
+  const m = /^\/{1,2}([A-Za-z])\/(.*)$/.exec(s);
   return m ? `${m[1]}:/${m[2]}` : s;
 }
+function findExistingVariant(raw, projectRoot, homeDir, platform) {
+  const token = stripMatcherWildcard(raw);
+  const variants = /* @__PURE__ */ new Set();
+  if (/^\/{2}[A-Za-z]\//.test(token)) variants.add(token.slice(1));
+  if (/^\/[A-Za-z]\//.test(token)) variants.add(`/${token}`);
+  if (token.startsWith("/") && !/^\/{1,2}[A-Za-z]\//.test(token)) {
+    variants.add(token.replace(/^\/+/, ""));
+  }
+  if (token.includes("\\")) variants.add(token.replace(/\\/g, "/"));
+  for (const v2 of variants) {
+    const resolved = expandPath(v2, projectRoot, homeDir, platform);
+    if (resolved !== null && fileExists(resolved)) return resolved;
+  }
+  return null;
+}
 function extractCommandPaths(command, projectRoot, homeDir, platform) {
   const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
   const out = [];
@@ -25539,6 +26650,18 @@ function checkSource(source, projectRoot, homeDir, platform) {
     if (cand.resolved === null) return;
     if (fileExists(cand.resolved)) return;
     const where = source.isUserGlobal ? ` (in ${source.displayPath})` : "";
+    const variant = findExistingVariant(cand.raw, projectRoot, homeDir, platform);
+    if (variant !== null) {
+      issues.push({
+        severity: "warning",
+        check: "hook-coverage",
+        ruleId: "hook-coverage/dead-hook",
+        line,
+        message: `${origin} references "${cand.raw}" which does not resolve${where}, but "${variant}" exists \u2014 the path form is wrong, so the gate silently no-ops`,
+        suggestion: `Rewrite the entry to use "${variant}". Do NOT delete it \u2014 the target exists; only the path form is unresolvable.`
+      });
+      return;
+    }
     issues.push({
       severity: "warning",
       check: "hook-coverage",
@@ -25599,19 +26722,19 @@ var init_hook_coverage = __esm({
 });
 
 // src/core/skill-scanner.ts
-import * as fs8 from "node:fs";
+import * as fs9 from "node:fs";
 import * as os4 from "node:os";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 function defaultHome() {
   return process.env.HOME || process.env.USERPROFILE || os4.homedir();
 }
 function scanSkillFiles(homeDir = defaultHome()) {
   const files = [];
   const orphanedSkillDirs = [];
-  const claudeDir = path11.join(homeDir, ".claude");
-  const skillsRoot = path11.join(claudeDir, "skills");
+  const claudeDir = path12.join(homeDir, ".claude");
+  const skillsRoot = path12.join(claudeDir, "skills");
   for (const name of safeReadDir(skillsRoot, "dir")) {
-    const skillMd = path11.join(skillsRoot, name, "SKILL.md");
+    const skillMd = path12.join(skillsRoot, name, "SKILL.md");
     const content = safeRead(skillMd);
     if (content === null) {
       orphanedSkillDirs.push({ name, displayPath: `~/.claude/skills/${name}/` });
@@ -25625,10 +26748,10 @@ function scanSkillFiles(homeDir = defaultHome()) {
       content
     });
   }
-  const agentsRoot = path11.join(claudeDir, "agents");
+  const agentsRoot = path12.join(claudeDir, "agents");
   for (const fileName of safeReadDir(agentsRoot, "file")) {
     if (!fileName.endsWith(".md")) continue;
-    const agentMd = path11.join(agentsRoot, fileName);
+    const agentMd = path12.join(agentsRoot, fileName);
     const content = safeRead(agentMd);
     if (content === null) continue;
     files.push({
@@ -25644,7 +26767,7 @@ function scanSkillFiles(homeDir = defaultHome()) {
 function safeReadDir(dir, want) {
   let entries;
   try {
-    entries = fs8.readdirSync(dir, { withFileTypes: true });
+    entries = fs9.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -25652,7 +26775,7 @@ function safeReadDir(dir, want) {
     if (want === "dir" ? e.isDirectory() : e.isFile()) return true;
     if (!e.isSymbolicLink()) return false;
     try {
-      const target = fs8.statSync(path11.join(dir, e.name));
+      const target = fs9.statSync(path12.join(dir, e.name));
       return want === "dir" ? target.isDirectory() : target.isFile();
     } catch {
       return false;
@@ -25661,7 +26784,7 @@ function safeReadDir(dir, want) {
 }
 function safeRead(file2) {
   try {
-    return stripBom(fs8.readFileSync(file2, "utf-8"));
+    return stripBom(fs9.readFileSync(file2, "utf-8"));
   } catch {
     return null;
   }
@@ -25675,7 +26798,7 @@ var init_skill_scanner = __esm({
 });
 
 // src/core/checks/skills.ts
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 function parseFrontmatter3(content) {
   const lines = content.split("\n");
   if (lines[0]?.trim() !== "---") {
@@ -25752,7 +26875,7 @@ function checkMissingFrontmatter(file2, fm) {
 }
 function checkBrokenRefs(file2, fmEndLine) {
   const issues = [];
-  const skillDir = path12.dirname(file2.filePath);
+  const skillDir = path13.dirname(file2.filePath);
   const lines = file2.content.split("\n");
   let inCode = false;
   let codeLang = "";
@@ -25772,7 +26895,7 @@ function checkBrokenRefs(file2, fmEndLine) {
       if (PATH_SKIP.test(value)) continue;
       if (!value.startsWith("./") && !value.startsWith("../")) continue;
       while (/[.,;:]$/.test(value)) value = value.slice(0, -1);
-      const resolved = path12.resolve(skillDir, value);
+      const resolved = path13.resolve(skillDir, value);
       if (fileExists(resolved) || isDirectory(resolved)) continue;
       issues.push({
         severity: "warning",
@@ -26280,8 +27403,8 @@ var require_utils = __commonJS({
       }
       return output;
     };
-    exports.basename = (path20, { windows } = {}) => {
-      const segs = path20.split(windows ? /[\\/]/ : "/");
+    exports.basename = (path21, { windows } = {}) => {
+      const segs = path21.split(windows ? /[\\/]/ : "/");
       const last2 = segs[segs.length - 1];
       if (last2 === "") {
         return segs[segs.length - 2];
@@ -27780,16 +28903,16 @@ var require_picomatch2 = __commonJS({
 });
 
 // src/core/ignore-file.ts
-import fs9 from "node:fs";
-import path13 from "node:path";
+import fs10 from "node:fs";
+import path14 from "node:path";
 function matchesGlob(filePath, glob) {
   return (0, import_picomatch.default)(glob, { dot: true })(filePath);
 }
 function loadIgnoreFile(projectRoot) {
-  const ignoreFilePath = path13.join(projectRoot, ".ctxlintignore");
+  const ignoreFilePath = path14.join(projectRoot, ".ctxlintignore");
   let content;
   try {
-    content = fs9.readFileSync(ignoreFilePath, "utf-8");
+    content = fs10.readFileSync(ignoreFilePath, "utf-8");
   } catch {
     return [];
   }
@@ -27835,15 +28958,15 @@ var init_types = __esm({
 });
 
 // src/version.ts
-import { readFileSync as readFileSync7 } from "node:fs";
-import { resolve as resolve14, dirname as dirname6 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve15, dirname as dirname7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function loadVersion() {
-  if (true) return "0.18.6";
+  if (true) return "0.19.0";
   try {
-    const __dir = dirname6(fileURLToPath2(import.meta.url));
-    const pkgPath = resolve14(__dir, "../package.json");
-    const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
+    const __dir = dirname7(fileURLToPath2(import.meta.url));
+    const pkgPath = resolve15(__dir, "../package.json");
+    const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0-dev";
   } catch {
     return "0.0.0-dev";
@@ -27859,9 +28982,9 @@ var init_version2 = __esm({
 });
 
 // src/core/audit.ts
-import * as fs10 from "node:fs";
+import * as fs11 from "node:fs";
 import * as os5 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 function hasMcpChecks(checks) {
   return checks.some((c3) => c3.startsWith("mcp-"));
 }
@@ -27897,7 +29020,7 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       const absPath = discoveredFile.absolutePath;
       let stat3 = null;
       try {
-        const s = fs10.statSync(absPath);
+        const s = fs11.statSync(absPath);
         stat3 = { mtimeMs: s.mtimeMs, size: s.size };
       } catch {
       }
@@ -27910,7 +29033,8 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         const parseResult = parseContextFile(discoveredFile);
         parsed.push(parseResult);
         const checkPromises = [];
-        if (activeChecks.includes("paths")) checkPromises.push(checkPaths(parseResult, projectRoot));
+        if (activeChecks.includes("paths"))
+          checkPromises.push(checkPaths(parseResult, projectRoot));
         if (activeChecks.includes("commands"))
           checkPromises.push(checkCommands(parseResult, projectRoot));
         if (activeChecks.includes("staleness"))
@@ -27928,7 +29052,8 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         if (activeChecks.includes("content-secrets"))
           checkPromises.push(checkContentSecrets(parseResult, projectRoot));
         const results = await Promise.all(checkPromises);
-        const singleFileIssues = results.flat();
+        const suppressions = collectSuppressions(parseResult.content);
+        const singleFileIssues = results.flat().filter((issue2) => !isSuppressed(suppressions, issue2));
         if (stat3 !== null) {
           setCacheEntry(absPath, {
             mtime: stat3.mtimeMs,
@@ -28077,6 +29202,14 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         sessionPromises.push(checkLoopDetection(sessionCtx));
       if (sessionChecksToRun.includes("session-memory-index-overflow"))
         sessionPromises.push(checkMemoryIndexOverflow(sessionCtx));
+      if (sessionChecksToRun.includes("session-shared-temp-path"))
+        sessionPromises.push(checkSharedTempPath(sessionCtx));
+      if (sessionChecksToRun.includes("session-unverified-gate-claimed-clean"))
+        sessionPromises.push(checkUnverifiedGateClaimedClean(sessionCtx));
+      if (sessionChecksToRun.includes("session-default-branch-accumulation"))
+        sessionPromises.push(checkDefaultBranchAccumulation(sessionCtx));
+      if (sessionChecksToRun.includes("session-unresolvable-sha"))
+        sessionPromises.push(checkUnresolvableSha(sessionCtx));
       const sessionResults = await Promise.all(sessionPromises);
       const sessionIssues = sessionResults.flat();
       fileResults.push({
@@ -28138,10 +29271,7 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     globUnusedRules = globScopedRules.filter((r2) => !firedGlobRules.has(r2)).map(({ _fileGlob: _unused, ...rest }) => rest);
     globRulesMissingReason = globScopedRules.filter((r2) => !r2.reason).map(({ _fileGlob: _unused, ...rest }) => rest);
   }
-  const allIgnoreRules = [
-    ...options.ignoreRules ?? [],
-    ...globalFileRules
-  ];
+  const allIgnoreRules = [...options.ignoreRules ?? [], ...globalFileRules];
   let ignoreReport;
   if (allIgnoreRules.length > 0 || globDropped > 0) {
     let flatDropped = 0;
@@ -28215,29 +29345,33 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
   return result;
 }
 async function runAuditOnContent(filePath, content, projectRoot, options = {}) {
-  const tmpDir = fs10.mkdtempSync(path14.join(os5.tmpdir(), "ctxlint-lsp-"));
-  const ext = path14.extname(filePath) || ".md";
-  const tmpFile = path14.join(tmpDir, "content" + ext);
+  const tmpDir = fs11.mkdtempSync(path15.join(os5.tmpdir(), "ctxlint-lsp-"));
+  const ext = path15.extname(filePath) || ".md";
+  const tmpFile = path15.join(tmpDir, "content" + ext);
   try {
-    fs10.writeFileSync(tmpFile, content, "utf-8");
-    const tmpRelative = path14.relative(tmpDir, tmpFile);
-    const rawResult = await runAudit(tmpDir, options.depth !== void 0 ? ALL_CHECKS : ALL_CHECKS, {
-      ...options,
-      extraPatterns: [tmpRelative],
-      // Disable cross-project checks that need the real project tree.
-      session: false,
-      sessionOnly: false,
-      skills: false,
-      skillsOnly: false
-    });
+    fs11.writeFileSync(tmpFile, content, "utf-8");
+    const tmpRelative = path15.relative(tmpDir, tmpFile);
+    const rawResult = await runAudit(
+      tmpDir,
+      options.depth !== void 0 ? ALL_CHECKS : ALL_CHECKS,
+      {
+        ...options,
+        extraPatterns: [tmpRelative],
+        // Disable cross-project checks that need the real project tree.
+        session: false,
+        sessionOnly: false,
+        skills: false,
+        skillsOnly: false
+      }
+    );
     const remapped = rawResult.files.map((fr) => {
-      const isTmp = fr.path === tmpRelative || fr.path === tmpFile || path14.resolve(tmpDir, fr.path) === tmpFile;
+      const isTmp = fr.path === tmpRelative || fr.path === tmpFile || path15.resolve(tmpDir, fr.path) === tmpFile;
       return isTmp ? { ...fr, path: filePath } : fr;
     });
     return { ...rawResult, files: remapped, projectRoot };
   } finally {
     try {
-      fs10.rmSync(tmpDir, { recursive: true, force: true });
+      fs11.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -28255,6 +29389,7 @@ var init_audit = __esm({
     init_paths();
     init_commands();
     init_staleness();
+    init_suppressions();
     init_tokens2();
     init_tier_tokens();
     init_redundancy();
@@ -28276,6 +29411,10 @@ var init_audit = __esm({
     init_duplicate_memory();
     init_loop_detection();
     init_memory_index_overflow();
+    init_shared_temp_path();
+    init_unverified_gate_claimed_clean();
+    init_default_branch_accumulation();
+    init_unresolvable_sha();
     init_ci_coverage();
     init_ci_secrets();
     init_content_secrets();
@@ -28317,7 +29456,11 @@ var init_audit = __esm({
       "session-stale-memory",
       "session-duplicate-memory",
       "session-loop-detection",
-      "session-memory-index-overflow"
+      "session-memory-index-overflow",
+      "session-shared-temp-path",
+      "session-unverified-gate-claimed-clean",
+      "session-default-branch-accumulation",
+      "session-unresolvable-sha"
     ];
     ALL_SKILL_CHECKS = [
       "skill-frontmatter",
@@ -28334,7 +29477,7 @@ var server_exports = {};
 __export(server_exports, {
   startLspServer: () => startLspServer
 });
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 async function startLspServer() {
   const connection = (0, import_node.createConnection)(import_node.ProposedFeatures.all);
   const documents = new import_node.TextDocuments(TextDocument2);
@@ -28349,7 +29492,7 @@ async function startLspServer() {
     const uri = doc.uri;
     let filePath = uri.startsWith("file://") ? decodeURIComponent(uri.slice(7)) : uri;
     filePath = filePath.replace(/^\/([A-Za-z]:)/, "$1");
-    const projectRoot = path15.dirname(filePath);
+    const projectRoot = path16.dirname(filePath);
     try {
       const result = await runAuditOnContent(filePath, doc.getText(), projectRoot, {
         depth: 2
@@ -28801,8 +29944,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path20, errorMaps, issueData } = params;
-      const fullPath = [...path20, ...issueData.path || []];
+      const { data, path: path21, errorMaps, issueData } = params;
+      const fullPath = [...path21, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -29085,11 +30228,11 @@ var init_types2 = __esm({
     init_parseUtil();
     init_util2();
     ParseInputLazyPath = class {
-      constructor(parent, value, path20, key) {
+      constructor(parent, value, path21, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path20;
+        this._path = path21;
         this._key = key;
       }
       get path() {
@@ -32591,10 +33734,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path20) {
-  if (!path20)
+function getElementAtPath(obj, path21) {
+  if (!path21)
     return obj;
-  return path20.reduce((acc, key) => acc?.[key], obj);
+  return path21.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -32922,11 +34065,11 @@ function explicitlyAborted(x3, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path20, issues) {
+function prefixIssues(path21, issues) {
   return issues.map((iss) => {
     var _a4;
     (_a4 = iss).path ?? (_a4.path = []);
-    iss.path.unshift(path20);
+    iss.path.unshift(path21);
     return iss;
   });
 }
@@ -33144,16 +34287,16 @@ function flattenError(error52, mapper = (issue2) => issue2.message) {
 }
 function formatError(error52, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error53, path20 = []) => {
+  const processError = (error53, path21 = []) => {
     for (const issue2 of error53.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else {
-        const fullpath = [...path20, ...issue2.path];
+        const fullpath = [...path21, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -33180,17 +34323,17 @@ function formatError(error52, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error52, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error53, path20 = []) => {
+  const processError = (error53, path21 = []) => {
     var _a4, _b;
     for (const issue2 of error53.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else {
-        const fullpath = [...path20, ...issue2.path];
+        const fullpath = [...path21, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -33222,8 +34365,8 @@ function treeifyError(error52, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path20 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path20) {
+  const path21 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path21) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -46984,13 +48127,13 @@ function resolveRef2(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path20 = ref.slice(1).split("/").filter(Boolean);
-  if (path20.length === 0) {
+  const path21 = ref.slice(1).split("/").filter(Boolean);
+  if (path21.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path20[0] === defsKey) {
-    const key = path20[1];
+  if (path21[0] === defsKey) {
+    const key = path21[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -51504,7 +52647,7 @@ var init_protocol = __esm({
               return;
             }
             const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-            await new Promise((resolve18) => setTimeout(resolve18, pollInterval));
+            await new Promise((resolve19) => setTimeout(resolve19, pollInterval));
             options?.signal?.throwIfAborted();
           }
         } catch (error52) {
@@ -51521,7 +52664,7 @@ var init_protocol = __esm({
        */
       request(request, resultSchema, options) {
         const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-        return new Promise((resolve18, reject) => {
+        return new Promise((resolve19, reject) => {
           const earlyReject = (error52) => {
             reject(error52);
           };
@@ -51599,7 +52742,7 @@ var init_protocol = __esm({
               if (!parseResult.success) {
                 reject(parseResult.error);
               } else {
-                resolve18(parseResult.data);
+                resolve19(parseResult.data);
               }
             } catch (error52) {
               reject(error52);
@@ -51860,12 +53003,12 @@ var init_protocol = __esm({
           }
         } catch {
         }
-        return new Promise((resolve18, reject) => {
+        return new Promise((resolve19, reject) => {
           if (signal.aborted) {
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
             return;
           }
-          const timeoutId = setTimeout(resolve18, interval);
+          const timeoutId = setTimeout(resolve19, interval);
           signal.addEventListener("abort", () => {
             clearTimeout(timeoutId);
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -54160,8 +55303,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize3) {
-      if (normalize3 !== false)
+    function getFullPath(resolver, id = "", normalize4) {
+      if (normalize4 !== false)
         id = normalizeId(id);
       const p2 = resolver.parse(id);
       return _getFullPath(resolver, p2);
@@ -54913,7 +56056,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve18.call(this, root, ref);
+      let _sch = resolve19.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a4 = root.localRefs) === null || _a4 === void 0 ? void 0 : _a4[ref];
         const { schemaId } = this.opts;
@@ -54940,7 +56083,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve18(root, ref) {
+    function resolve19(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -55159,8 +56302,8 @@ var require_utils2 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path20) {
-      let input = path20;
+    function removeDotSegments(path21) {
+      let input = path21;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -55413,8 +56556,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path20, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path20 && path20 !== "/" ? path20 : void 0;
+        const [path21, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path21 && path21 !== "/" ? path21 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -55564,7 +56707,7 @@ var require_fast_uri = __commonJS({
     init_define_WEB_FIRST_SEGMENTS();
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize3(uri, options) {
+    function normalize4(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         normalizeString(uri, options);
@@ -55574,7 +56717,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve18(baseURI, relativeURI, options) {
+    function resolve19(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -55831,8 +56974,8 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize3,
-      resolve: resolve18,
+      normalize: normalize4,
+      resolve: resolve19,
       resolveComponent,
       equal,
       serialize,
@@ -58853,12 +59996,12 @@ var require_dist3 = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs15, exportName) {
+    function addFormats(ajv, list, fs16, exportName) {
       var _a4;
       var _b;
       (_a4 = (_b = ajv.opts.code).formats) !== null && _a4 !== void 0 ? _a4 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs15[f]);
+        ajv.addFormat(f, fs16[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -60014,7 +61157,7 @@ var init_mcp = __esm({
         let task = createTaskResult.task;
         const pollInterval = task.pollInterval ?? 5e3;
         while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-          await new Promise((resolve18) => setTimeout(resolve18, pollInterval));
+          await new Promise((resolve19) => setTimeout(resolve19, pollInterval));
           const updatedTask = await extra.taskStore.getTask(taskId);
           if (!updatedTask) {
             throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -60610,12 +61753,12 @@ var init_stdio2 = __esm({
         this.onclose?.();
       }
       send(message) {
-        return new Promise((resolve18) => {
+        return new Promise((resolve19) => {
           const json2 = serializeMessage(message);
           if (this._stdout.write(json2)) {
-            resolve18();
+            resolve19();
           } else {
-            this._stdout.once("drain", resolve18);
+            this._stdout.once("drain", resolve19);
           }
         });
       }
@@ -61166,7 +62309,7 @@ var init_source = __esm({
 });
 
 // src/core/fixer.ts
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 function applyFixes(result, options = {}) {
   const log = options.quiet ? () => {
   } : console.log.bind(console);
@@ -61204,7 +62347,7 @@ function applyFixes(result, options = {}) {
   for (const [filePath, fixes] of fixesByFile) {
     let content;
     try {
-      content = fs11.readFileSync(filePath, "utf-8");
+      content = fs12.readFileSync(filePath, "utf-8");
     } catch (err) {
       log(source_default.yellow("  Skipped") + ` ${filePath}: ${err.message}`);
       continue;
@@ -61289,7 +62432,7 @@ function applyFixes(result, options = {}) {
       }
       if (!dryRun) {
         try {
-          fs11.writeFileSync(filePath, newContent, "utf-8");
+          fs12.writeFileSync(filePath, newContent, "utf-8");
         } catch (err) {
           log(source_default.yellow("  Skipped") + ` ${filePath}: ${err.message}`);
           continue;
@@ -61311,8 +62454,8 @@ var init_fixer = __esm({
 });
 
 // src/core/config.ts
-import * as fs12 from "node:fs";
-import * as path16 from "node:path";
+import * as fs13 from "node:fs";
+import * as path17 from "node:path";
 function formatJsonError(content, err) {
   const msg = err instanceof Error ? err.message : String(err);
   const posMatch = msg.match(/position (\d+)/);
@@ -61410,10 +62553,10 @@ function warnIgnoreRulePathPatternMisuse(config2, source) {
 }
 function loadConfig(projectRoot) {
   for (const filename of CONFIG_FILENAMES) {
-    const filePath = path16.join(projectRoot, filename);
+    const filePath = path17.join(projectRoot, filename);
     let content;
     try {
-      content = stripBom(fs12.readFileSync(filePath, "utf-8"));
+      content = stripBom(fs13.readFileSync(filePath, "utf-8"));
     } catch {
       continue;
     }
@@ -61424,7 +62567,7 @@ function loadConfig(projectRoot) {
 function loadConfigFromExplicitPath(configPath) {
   let content;
   try {
-    content = stripBom(fs12.readFileSync(configPath, "utf-8"));
+    content = stripBom(fs13.readFileSync(configPath, "utf-8"));
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(`could not load config from ${configPath}: ${detail}`, { cause: err });
@@ -61466,7 +62609,7 @@ __export(server_exports2, {
   server: () => server,
   startServer: () => startServer
 });
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 function describeDisallowed(rawPath) {
   const m = rawPath.match(PATH_DISALLOWED);
   if (!m) return "unknown";
@@ -61479,7 +62622,7 @@ function validateProjectPath(rawPath) {
       `projectPath contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
     );
   }
-  const resolved = path17.resolve(rawPath);
+  const resolved = path18.resolve(rawPath);
   if (!isDirectory(resolved)) {
     throw new Error("projectPath is not an existing directory");
   }
@@ -61503,10 +62646,10 @@ function validateFilePathInput(rawPath) {
   }
 }
 function resolveWithinRoot(filePath, root) {
-  const resolvedRoot = path17.resolve(root);
-  const resolved = path17.resolve(resolvedRoot, filePath);
-  const rel = path17.relative(resolvedRoot, resolved);
-  if (rel.startsWith("..") || path17.isAbsolute(rel)) {
+  const resolvedRoot = path18.resolve(root);
+  const resolved = path18.resolve(resolvedRoot, filePath);
+  const rel = path18.relative(resolvedRoot, resolved);
+  if (rel.startsWith("..") || path18.isAbsolute(rel)) {
     throw new Error("path escapes the project root");
   }
   return resolved;
@@ -61603,7 +62746,7 @@ var init_server4 = __esm({
             exists: fileExists(resolved) || isDirectory(resolved)
           };
           if (!result.exists) {
-            const rename = await findRenames(root, path17.relative(root, resolved));
+            const rename = await findRenames(root, path18.relative(root, resolved));
             if (rename) {
               result.renamed = true;
               result.newPath = rename.newPath;
@@ -63021,8 +64164,8 @@ var init_suggestSimilar = __esm({
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/command.js
 import { EventEmitter as EventEmitter2 } from "node:events";
 import childProcess from "node:child_process";
-import path18 from "node:path";
-import fs13 from "node:fs";
+import path19 from "node:path";
+import fs14 from "node:fs";
 import process5 from "node:process";
 import { stripVTControlCharacters as stripVTControlCharacters2 } from "node:util";
 function incrementNodeInspectorPort(args2) {
@@ -64060,7 +65203,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs13.existsSync(executableFile)) return;
+        if (fs14.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -64077,11 +65220,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         args2 = args2.slice();
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path18.resolve(baseDir, baseName);
-          if (fs13.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path18.extname(baseName))) return void 0;
+          const localBin = path19.resolve(baseDir, baseName);
+          if (fs14.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path19.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs13.existsSync(`${localBin}${ext}`)
+            (ext) => fs14.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -64093,21 +65236,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs13.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs14.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path18.resolve(
-            path18.dirname(resolvedScriptPath),
+          executableDir = path19.resolve(
+            path19.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path18.basename(
+            const legacyName = path19.basename(
               this._scriptPath,
-              path18.extname(this._scriptPath)
+              path19.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -64118,7 +65261,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        const launchWithNode = sourceExt.includes(path18.extname(executableFile));
+        const launchWithNode = sourceExt.includes(path19.extname(executableFile));
         let proc;
         if (process5.platform !== "win32") {
           if (launchWithNode) {
@@ -65035,7 +66178,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path18.basename(filename, path18.extname(filename));
+        this._name = path19.basename(filename, path19.extname(filename));
         return this;
       }
       /**
@@ -65049,9 +66192,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path20) {
-        if (path20 === void 0) return this._executableDir;
-        this._executableDir = path20;
+      executableDir(path21) {
+        if (path21 === void 0) return this._executableDir;
+        this._executableDir = path21;
         return this;
       }
       /**
@@ -68384,6 +69527,8 @@ var init_ora = __esm({
 });
 
 // src/core/reporter.ts
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 function classifyFile(f) {
   if (f.path === "(project)") return "context";
   if (f.path === "(mcp)") return "mcp";
@@ -68405,10 +69550,32 @@ function classifyFile(f) {
 function isSyntheticBucket(p2) {
   return p2 === "(project)" || p2 === "(mcp)" || p2.includes(SESSION_AUDIT_PATH_MARKER) || p2.includes(SKILL_AUDIT_PATH_MARKER);
 }
+function detectVersionSkew(projectRoot, runningVersion) {
+  try {
+    const pkgPath = join16(projectRoot, "package.json");
+    if (!existsSync8(pkgPath)) return null;
+    const raw = readFileSync11(pkgPath, "utf8").replace(/^\uFEFF/, "");
+    const pkg = JSON.parse(raw);
+    const name = pkg.name ?? "";
+    if (name !== "ctxlint" && name !== "@yawlabs/ctxlint") return null;
+    if (!pkg.version || pkg.version === runningVersion) return null;
+    return pkg.version;
+  } catch {
+    return null;
+  }
+}
 function formatText(result, verbose = false) {
   const lines = [];
   lines.push("");
   lines.push(source_default.bold(`ctxlint v${result.version}`));
+  const skew = detectVersionSkew(result.projectRoot, result.version);
+  if (skew !== null) {
+    lines.push(
+      source_default.yellow(
+        `  note: this checkout is v${skew} -- you are running v${result.version}. Rebuild or reinstall before trusting a result against it.`
+      )
+    );
+  }
   lines.push("");
   lines.push(`Scanning ${result.projectRoot}...`);
   lines.push("");
@@ -68782,6 +69949,34 @@ function buildRuleDescriptors() {
       },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     },
+    {
+      id: "ctxlint/session-shared-temp-path",
+      shortDescription: {
+        text: "Fixed temp path written then read back -- clobberable by a concurrent session"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-unverified-gate-claimed-clean",
+      shortDescription: {
+        text: "A quality gate asserted as passing while its invocation failed or emitted nothing"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-default-branch-accumulation",
+      shortDescription: {
+        text: "Many files edited on the default branch with no intervening commit"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-unresolvable-sha",
+      shortDescription: {
+        text: "Memory cites a git SHA that no longer resolves in the repository"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
     {
       id: "ctxlint/skill-frontmatter",
       shortDescription: { text: "Skill/agent definition missing required frontmatter" },
@@ -68852,8 +70047,8 @@ __export(cli_exports, {
   promptYesNo: () => promptYesNo,
   runCli: () => runCli
 });
-import * as fs14 from "node:fs";
-import * as path19 from "node:path";
+import * as fs15 from "node:fs";
+import * as path20 from "node:path";
 function validateCheckNames(names, source) {
   const invalid = names.filter((n7) => n7 && !VALID_CHECKS.has(n7));
   if (invalid.length > 0) {
@@ -68876,7 +70071,7 @@ async function runCli() {
     "Also scan the user-global ~/.claude/settings.json in the dead-hook check (off by default; the standard run only reads project .claude/settings.json[.local])",
     false
   ).option("--no-ignore-file", "Disable .ctxlintignore suppression (see all findings)").option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
-    const resolvedPath = path19.resolve(projectPath);
+    const resolvedPath = path20.resolve(projectPath);
     const { config: config2, options, activeChecks } = resolveSession(resolvedPath, opts);
     const spinner = options.format === "text" && !options.quiet ? ora("Scanning for context files...").start() : void 0;
     try {
@@ -69007,41 +70202,41 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       const chalk2 = (await Promise.resolve().then(() => (init_source(), source_exports))).default;
       console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
       const watchPaths = [
-        path19.join(resolvedPath, "CLAUDE.md"),
-        path19.join(resolvedPath, "CLAUDE.local.md"),
-        path19.join(resolvedPath, "AGENTS.md"),
-        path19.join(resolvedPath, "AGENT.md"),
-        path19.join(resolvedPath, ".cursorrules"),
-        path19.join(resolvedPath, ".windsurfrules"),
-        path19.join(resolvedPath, ".clinerules"),
-        path19.join(resolvedPath, ".aiderules"),
-        path19.join(resolvedPath, ".continuerules"),
-        path19.join(resolvedPath, ".rules"),
-        path19.join(resolvedPath, ".goosehints"),
-        path19.join(resolvedPath, "GEMINI.md"),
-        path19.join(resolvedPath, "replit.md"),
-        path19.join(resolvedPath, "package.json"),
-        path19.join(resolvedPath, ".mcp.json"),
+        path20.join(resolvedPath, "CLAUDE.md"),
+        path20.join(resolvedPath, "CLAUDE.local.md"),
+        path20.join(resolvedPath, "AGENTS.md"),
+        path20.join(resolvedPath, "AGENT.md"),
+        path20.join(resolvedPath, ".cursorrules"),
+        path20.join(resolvedPath, ".windsurfrules"),
+        path20.join(resolvedPath, ".clinerules"),
+        path20.join(resolvedPath, ".aiderules"),
+        path20.join(resolvedPath, ".continuerules"),
+        path20.join(resolvedPath, ".rules"),
+        path20.join(resolvedPath, ".goosehints"),
+        path20.join(resolvedPath, "GEMINI.md"),
+        path20.join(resolvedPath, "replit.md"),
+        path20.join(resolvedPath, "package.json"),
+        path20.join(resolvedPath, ".mcp.json"),
         // ctxlint config — re-resolve on edit so threshold changes,
         // ignore-list edits, and check-list overrides take effect without
         // restarting the watcher.
-        path19.join(resolvedPath, ".ctxlintrc"),
-        path19.join(resolvedPath, ".ctxlintrc.json"),
+        path20.join(resolvedPath, ".ctxlintrc"),
+        path20.join(resolvedPath, ".ctxlintrc.json"),
         // .ctxlintignore — re-lint when suppression rules change.
-        path19.join(resolvedPath, ".ctxlintignore")
+        path20.join(resolvedPath, ".ctxlintignore")
       ];
       const watchDirs = [
-        path19.join(resolvedPath, ".claude"),
-        path19.join(resolvedPath, ".cursor"),
-        path19.join(resolvedPath, ".github"),
-        path19.join(resolvedPath, ".windsurf"),
-        path19.join(resolvedPath, ".aide"),
-        path19.join(resolvedPath, ".amazonq"),
-        path19.join(resolvedPath, ".goose"),
-        path19.join(resolvedPath, ".junie"),
-        path19.join(resolvedPath, ".aiassistant"),
-        path19.join(resolvedPath, ".continue"),
-        path19.join(resolvedPath, ".vscode")
+        path20.join(resolvedPath, ".claude"),
+        path20.join(resolvedPath, ".cursor"),
+        path20.join(resolvedPath, ".github"),
+        path20.join(resolvedPath, ".windsurf"),
+        path20.join(resolvedPath, ".aide"),
+        path20.join(resolvedPath, ".amazonq"),
+        path20.join(resolvedPath, ".goose"),
+        path20.join(resolvedPath, ".junie"),
+        path20.join(resolvedPath, ".aiassistant"),
+        path20.join(resolvedPath, ".continue"),
+        path20.join(resolvedPath, ".vscode")
       ];
       const watchers = [];
       let debounceTimer = null;
@@ -69103,13 +70298,13 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       };
       for (const filePath of watchPaths) {
         try {
-          watchers.push(fs14.watch(filePath, rerun));
+          watchers.push(fs15.watch(filePath, rerun));
         } catch {
         }
       }
       for (const dir of watchDirs) {
         try {
-          watchers.push(fs14.watch(dir, { recursive: true }, rerun));
+          watchers.push(fs15.watch(dir, { recursive: true }, rerun));
         } catch {
         }
       }
@@ -69130,17 +70325,17 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
     }
   });
   program2.command("init").description("Set up a git pre-commit hook that runs ctxlint --strict").argument("[path]", "Project directory", ".").action(async (projectPath) => {
-    const resolvedRoot = path19.resolve(projectPath);
-    const gitDir = path19.join(resolvedRoot, ".git");
-    const hooksDir = path19.join(gitDir, "hooks");
-    if (!fs14.existsSync(gitDir)) {
+    const resolvedRoot = path20.resolve(projectPath);
+    const gitDir = path20.join(resolvedRoot, ".git");
+    const hooksDir = path20.join(gitDir, "hooks");
+    if (!fs15.existsSync(gitDir)) {
       console.error('Error: not a git repository. Run "git init" first.');
       process.exit(1);
     }
-    if (!fs14.existsSync(hooksDir)) {
-      fs14.mkdirSync(hooksDir, { recursive: true });
+    if (!fs15.existsSync(hooksDir)) {
+      fs15.mkdirSync(hooksDir, { recursive: true });
     }
-    const hookPath = path19.join(hooksDir, "pre-commit");
+    const hookPath = path20.join(hooksDir, "pre-commit");
     const fullHookContent = `#!/bin/sh
 # ctxlint pre-commit hook
 npx @yawlabs/ctxlint@${VERSION} --strict
@@ -69149,15 +70344,15 @@ npx @yawlabs/ctxlint@${VERSION} --strict
 # ctxlint pre-commit hook
 npx @yawlabs/ctxlint@${VERSION} --strict
 `;
-    if (fs14.existsSync(hookPath)) {
-      const existing = fs14.readFileSync(hookPath, "utf-8");
+    if (fs15.existsSync(hookPath)) {
+      const existing = fs15.readFileSync(hookPath, "utf-8");
       const installed = existing.match(
         /^[^#\r\n]*\bnpx\s+(?:-y\s+|--yes\s+)?@yawlabs\/ctxlint(?:@(\d+\.\d+\.\d+))?/m
       );
       if (installed) {
         const pinned = installed[1];
         if (pinned && pinned !== VERSION) {
-          fs14.writeFileSync(
+          fs15.writeFileSync(
             hookPath,
             existing.replace(/(@yawlabs\/ctxlint@)\d+\.\d+\.\d+/g, `$1${VERSION}`)
           );
@@ -69167,10 +70362,10 @@ npx @yawlabs/ctxlint@${VERSION} --strict
         }
         return;
       }
-      fs14.appendFileSync(hookPath, appendHookContent);
+      fs15.appendFileSync(hookPath, appendHookContent);
       console.log("Added ctxlint to existing pre-commit hook.");
     } else {
-      fs14.writeFileSync(hookPath, fullHookContent, { mode: 493 });
+      fs15.writeFileSync(hookPath, fullHookContent, { mode: 493 });
       console.log("Created pre-commit hook at .git/hooks/pre-commit");
     }
     console.log("ctxlint will now run automatically before each commit.");
@@ -69178,8 +70373,8 @@ npx @yawlabs/ctxlint@${VERSION} --strict
   program2.parse();
 }
 async function promptYesNo(question) {
-  const { createInterface: createInterface2 } = await import("node:readline/promises");
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const { createInterface: createInterface3 } = await import("node:readline/promises");
+  const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     const answer = await rl.question(question);
     return /^\s*y(es)?\s*$/i.test(answer);
@@ -69192,7 +70387,7 @@ function resolveDepth(raw) {
   return Number.isNaN(parsed) ? 2 : Math.max(0, Math.min(parsed, 10));
 }
 function resolveSession(resolvedPath, opts, throwOnConfigError = false) {
-  const configPath = opts.config ? path19.resolve(opts.config) : void 0;
+  const configPath = opts.config ? path20.resolve(opts.config) : void 0;
   const config2 = configPath ? loadConfigFromPath(configPath, throwOnConfigError) : loadConfig(resolvedPath);
   const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
   const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
@@ -69310,4 +70505,3 @@ if (args.includes("--lsp")) {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();
 }
-//# sourceMappingURL=index.js.map