@yawlabs/ctxlint 0.9.10 → 0.9.12

package/.pre-commit-hooks.yaml

@@ -1,7 +1,10 @@
 - id: ctxlint
   name: ctxlint
   description: Lint AI agent context files against your actual codebase
-  entry: npx @yawlabs/ctxlint --strict
+  # Version-pinned so a checkout at `rev: vX.Y.Z` runs exactly that release
+  # of ctxlint — matches the pinning done by `ctxlint init`. release.sh keeps
+  # this in sync with package.json on each bump.
+  entry: npx @yawlabs/ctxlint@0.9.12 --strict
   language: node
   always_run: true
   pass_filenames: false

package/AGENT_SESSION_LINT_SPEC.md

@@ -15,7 +15,7 @@ This specification defines a standard set of lint rules for validating agent ses
 
 The specification includes:
 - A reference of session data locations across 8 AI coding agents
-- 5 lint rules in the `session` category with defined severities
+- 7 lint rules in the `session` category with defined severities
 - A machine-readable rule catalog ([`agent-session-lint-rules.json`](./agent-session-lint-rules.json))
 - Sibling-repo detection for cross-project checks
 

package/MCP_CONFIG_LINT_SPEC.md

@@ -16,7 +16,7 @@ This specification defines a standard set of lint rules for validating MCP serve
 
 The specification includes:
 - A complete reference of MCP config file locations, formats, and client-specific behaviors
-- 27 lint rules organized into 8 categories with defined severities
+- 43 lint rules organized into 8 categories with defined severities
 - A machine-readable rule catalog ([`mcp-config-lint-rules.json`](./mcp-config-lint-rules.json))
 - Auto-fix definitions for rules that support automated correction
 

package/README.md

@@ -20,7 +20,7 @@ Multiply that across a team with 5 context files, 3 MCP configs, and 2 people wh
 
 ctxlint is a linter purpose-built for this. It reads your context files, cross-references them against your actual codebase, and catches the drift before your agent does.
 
-- **Instant startup** — ships as a single self-contained bundle with zero runtime dependencies. `npx` downloads ~200 KB and starts immediately
+- **Instant startup** — ships as a single self-contained bundle with zero runtime dependencies. `npx` downloads a ~400 KB tarball and starts immediately
 - **Catches real problems** — broken paths, wrong commands, stale references, contradictions across files
 - **Smart suggestions** — detects git renames and fuzzy-matches to suggest the right path
 - **Auto-fix** — `--fix` rewrites broken paths automatically using git history
@@ -215,7 +215,7 @@ Session checks are **opt-in** because they access files outside the project dire
 ## Example Output
 
 ```
-ctxlint v0.9.0
+ctxlint v0.9.10
 
 Scanning /Users/you/my-app...
 
@@ -351,7 +351,7 @@ Add to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/yawlabs/ctxlint
-    rev: v0.9.0
+    rev: v0.9.10
     hooks:
       - id: ctxlint
 ```

package/dist/index.js

@@ -34559,7 +34559,7 @@ function parseSections(lines) {
       if (sections.length > 0) {
         const prev = sections[sections.length - 1];
         if (prev.endLine === -1) {
-          prev.endLine = i2 - 1;
+          prev.endLine = i2;
         }
       }
       sections.push({
@@ -41404,10 +41404,16 @@ function loadSettingsSources(projectRoot) {
     path6.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
   ];
   for (const p2 of candidates) {
+    let content;
     try {
-      const content = fs5.readFileSync(p2, "utf-8");
-      sources.push(JSON.parse(content));
+      content = fs5.readFileSync(p2, "utf-8");
     } catch {
+      continue;
+    }
+    try {
+      sources.push(JSON.parse(content));
+    } catch (err) {
+      console.warn(`ctxlint: could not parse ${p2}: ${err.message}`);
     }
   }
   return sources;
@@ -41609,10 +41615,11 @@ async function checkRedundancy(file2, projectRoot) {
 }
 function checkDuplicateContent(files) {
   const issues = [];
+  const DUPLICATE_CONTENT_THRESHOLD = 0.6;
   for (let i2 = 0; i2 < files.length; i2++) {
     for (let j3 = i2 + 1; j3 < files.length; j3++) {
       const overlap = calculateLineOverlap(files[i2].content, files[j3].content);
-      if (overlap > 0.6) {
+      if (overlap >= DUPLICATE_CONTENT_THRESHOLD) {
         issues.push({
           severity: "warning",
           check: "redundancy",
@@ -41634,11 +41641,12 @@ function calculateLineOverlap(contentA, contentB) {
     contentB.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
   );
   if (linesA.size === 0 || linesB.size === 0) return 0;
-  let overlap = 0;
+  let intersection2 = 0;
   for (const line of linesA) {
-    if (linesB.has(line)) overlap++;
+    if (linesB.has(line)) intersection2++;
   }
-  return overlap / Math.max(linesA.size, linesB.size);
+  const unionSize = linesA.size + linesB.size - intersection2;
+  return intersection2 / unionSize;
 }
 function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -43845,7 +43853,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.10";
+  if (true) return "0.9.12";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -44721,7 +44729,7 @@ function applyFixes(result, options = {}) {
       let line = lines[lineIdx];
       for (const fix of lineFixes) {
         if (line.includes(fix.oldText)) {
-          line = line.replace(fix.oldText, fix.newText);
+          line = line.replaceAll(fix.oldText, fix.newText);
           totalFixes++;
           const prefix = dryRun ? source_default.cyan("  Would fix") : source_default.green("  Fixed");
           log(
@@ -44917,8 +44925,11 @@ var init_server3 = __esm({
         checks: external_exports3.array(checkEnum).optional().describe("Which checks to run before fixing. Defaults to all.")
       },
       {
+        // ctxlint_fix writes to disk via applyFixes() → fs.writeFileSync, so it
+        // must advertise destructiveHint: true. Hosts (Claude Code, Cursor, etc.)
+        // use this to decide whether to require user confirmation before the call.
         readOnlyHint: false,
-        destructiveHint: false,
+        destructiveHint: true,
         idempotentHint: true,
         openWorldHint: false
       },
@@ -51627,6 +51638,9 @@ function formatTokenReport(result) {
   lines.push("");
   return lines.join("\n");
 }
+function isSyntheticPath(p2) {
+  return p2.startsWith("(") || p2.startsWith("~");
+}
 function formatSarif(result) {
   const severityToLevel = {
     error: "error",
@@ -51636,25 +51650,31 @@ function formatSarif(result) {
   const results = [];
   for (const file2 of result.files) {
     for (const issue2 of file2.issues) {
+      const location = isSyntheticPath(file2.path) ? {
+        logicalLocations: [
+          {
+            name: file2.path,
+            kind: "resource"
+          }
+        ]
+      } : {
+        physicalLocation: {
+          artifactLocation: {
+            uri: file2.path,
+            uriBaseId: "%SRCROOT%"
+          },
+          region: {
+            startLine: Math.max(issue2.line, 1)
+          }
+        }
+      };
       const sarifResult = {
         ruleId: `ctxlint/${issue2.check}`,
         level: severityToLevel[issue2.severity] || "note",
         message: {
           text: issue2.message + (issue2.suggestion ? ` (${issue2.suggestion})` : "")
         },
-        locations: [
-          {
-            physicalLocation: {
-              artifactLocation: {
-                uri: file2.path,
-                uriBaseId: "%SRCROOT%"
-              },
-              region: {
-                startLine: Math.max(issue2.line, 1)
-              }
-            }
-          }
-        ]
+        locations: [location]
       };
       if (issue2.detail) {
         sarifResult.message.text += `
@@ -52174,6 +52194,7 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         path11.join(resolvedPath, ".continue"),
         path11.join(resolvedPath, ".vscode")
       ];
+      const watchers = [];
       let debounceTimer = null;
       const rerun = () => {
         if (debounceTimer) clearTimeout(debounceTimer);
@@ -52215,16 +52236,28 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       };
       for (const filePath of watchPaths) {
         try {
-          fs9.watch(filePath, rerun);
+          watchers.push(fs9.watch(filePath, rerun));
         } catch {
         }
       }
       for (const dir of watchDirs) {
         try {
-          fs9.watch(dir, { recursive: true }, rerun);
+          watchers.push(fs9.watch(dir, { recursive: true }, rerun));
         } catch {
         }
       }
+      const shutdown = () => {
+        if (debounceTimer) clearTimeout(debounceTimer);
+        for (const w of watchers) {
+          try {
+            w.close();
+          } catch {
+          }
+        }
+        process.exit(0);
+      };
+      process.once("SIGINT", shutdown);
+      process.once("SIGTERM", shutdown);
       await new Promise(() => {
       });
     }
@@ -52243,11 +52276,11 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
     const hookPath = path11.join(hooksDir, "pre-commit");
     const fullHookContent = `#!/bin/sh
 # ctxlint pre-commit hook
-npx @yawlabs/ctxlint --strict
+npx @yawlabs/ctxlint@${VERSION} --strict
 `;
     const appendHookContent = `
 # ctxlint pre-commit hook
-npx @yawlabs/ctxlint --strict
+npx @yawlabs/ctxlint@${VERSION} --strict
 `;
     if (fs9.existsSync(hookPath)) {
       const existing = fs9.readFileSync(hookPath, "utf-8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"
@@ -103,7 +103,7 @@
       "esbuild"
     ],
     "overrides": {
-      "hono": "^4.12.12",
+      "hono": "^4.12.14",
       "@hono/node-server": "^1.19.13",
       "vite": "^8.0.8"
     }