@yawlabs/ctxlint 0.9.17 → 0.9.19

package/dist/index.js

@@ -448,8 +448,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path14, errorMaps, issueData } = params;
-      const fullPath = [...path14, ...issueData.path || []];
+      const { data, path: path13, errorMaps, issueData } = params;
+      const fullPath = [...path13, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -729,11 +729,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path14, key) {
+      constructor(parent, value, path13, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path14;
+        this._path = path13;
         this._key = key;
       }
       get path() {
@@ -4238,10 +4238,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path14) {
-  if (!path14)
+function getElementAtPath(obj, path13) {
+  if (!path13)
     return obj;
-  return path14.reduce((acc, key) => acc?.[key], obj);
+  return path13.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -4553,11 +4553,11 @@ function aborted(x3, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path14, issues) {
+function prefixIssues(path13, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path14);
+    iss.path.unshift(path13);
     return iss;
   });
 }
@@ -4799,7 +4799,7 @@ function formatError(error49, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error49, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error50, path14 = []) => {
+  const processError = (error50, path13 = []) => {
     var _a3, _b;
     for (const issue2 of error50.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -4809,7 +4809,7 @@ function treeifyError(error49, mapper = (issue2) => issue2.message) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path14, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -4841,8 +4841,8 @@ function treeifyError(error49, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path14 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path14) {
+  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path13) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -17792,13 +17792,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path14 = ref.slice(1).split("/").filter(Boolean);
-  if (path14.length === 0) {
+  const path13 = ref.slice(1).split("/").filter(Boolean);
+  if (path13.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path14[0] === defsKey) {
-    const key = path14[1];
+  if (path13[0] === defsKey) {
+    const key = path13[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25888,8 +25888,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path14) {
-      let input = path14;
+    function removeDotSegments(path13) {
+      let input = path13;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -26088,8 +26088,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path14, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path14 && path14 !== "/" ? path14 : void 0;
+        const [path13, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path13 && path13 !== "/" ? path13 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -29451,12 +29451,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs11, exportName) {
+    function addFormats(ajv, list, fs10, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs11[f]);
+        ajv.addFormat(f, fs10[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -35561,10 +35561,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault(require_src());
     var log = debug_1.default("@kwsites/file-exists");
-    function check2(path14, isFile, isDirectory2) {
-      log(`checking %s`, path14);
+    function check2(path13, isFile, isDirectory2) {
+      log(`checking %s`, path13);
       try {
-        const stat3 = fs_1.statSync(path14);
+        const stat3 = fs_1.statSync(path13);
         if (stat3.isFile() && isFile) {
           log(`[OK] path represents a file`);
           return true;
@@ -35584,8 +35584,8 @@ var require_src2 = __commonJS({
         throw e;
       }
     }
-    function exists2(path14, type = exports.READABLE) {
-      return check2(path14, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path13, type = exports.READABLE) {
+      return check2(path13, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -36174,8 +36174,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path14) {
-  return (0, import_file_exists.exists)(path14, import_file_exists.FOLDER);
+function folderExists(path13) {
+  return (0, import_file_exists.exists)(path13, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -36366,8 +36366,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path14) {
-      return /^\.(git)?$/.test(path14.trim());
+    parser(path13) {
+      return /^\.(git)?$/.test(path13.trim());
     }
   };
 }
@@ -36623,11 +36623,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path14, line, preview] = input.split(NULL);
-    paths.add(path14);
-    (results[path14] = results[path14] || []).push({
+    const [path13, line, preview] = input.split(NULL);
+    paths.add(path13);
+    (results[path13] = results[path13] || []).push({
       line: asNumber(line),
-      path: path14,
+      path: path13,
       preview
     });
   });
@@ -36924,14 +36924,14 @@ function hashObjectTask(filePath, write) {
   }
   return straightThroughStringTask(commands, true);
 }
-function parseInit(bare, path14, text) {
+function parseInit(bare, path13, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path14, false, result[1]);
+    return new InitSummary(bare, path13, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path14, true, result[1]);
+    return new InitSummary(bare, path13, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -36942,12 +36942,12 @@ function parseInit(bare, path14, text) {
       break;
     }
   }
-  return new InitSummary(bare, path14, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path13, /^re/i.test(response), gitDir);
 }
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path14, customArgs) {
+function initTask(bare = false, path13, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -36956,7 +36956,7 @@ function initTask(bare = false, path14, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path14, text);
+      return parseInit(commands.includes("--bare"), path13, text);
     }
   };
 }
@@ -37235,14 +37235,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path14) {
+  function data(index, workingDir, path13) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path14);
+      handler(result, path13);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path14, index, workingDir));
+      result.files.push(new FileStatusSummary(path13, index, workingDir));
     }
   }
 }
@@ -37429,8 +37429,8 @@ function deleteBranchTask(branch, forceDelete = false) {
   return task;
 }
 function toPath(input) {
-  const path14 = input.trim().replace(/^["']|["']$/g, "");
-  return path14 && normalize2(path14);
+  const path13 = input.trim().replace(/^["']|["']$/g, "");
+  return path13 && normalize2(path13);
 }
 function checkIgnoreTask(paths) {
   return {
@@ -37569,8 +37569,8 @@ function stashListTask(opt = {}, customArgs) {
     parser: parser4
   };
 }
-function addSubModuleTask(repo, path14) {
-  return subModuleTask(["add", repo, path14]);
+function addSubModuleTask(repo, path13) {
+  return subModuleTask(["add", repo, path13]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -38832,9 +38832,9 @@ var init_esm2 = __esm({
       "src/lib/responses/InitSummary.ts"() {
         "use strict";
         InitSummary = class {
-          constructor(bare, path14, existing, gitDir) {
+          constructor(bare, path13, existing, gitDir) {
             this.bare = bare;
-            this.path = path14;
+            this.path = path13;
             this.existing = existing;
             this.gitDir = gitDir;
           }
@@ -39367,12 +39367,12 @@ var init_esm2 = __esm({
         "use strict";
         fromPathRegex = /^(.+)\0(.+)$/;
         FileStatusSummary = class {
-          constructor(path14, index, working_dir) {
-            this.path = path14;
+          constructor(path13, index, working_dir) {
+            this.path = path13;
             this.index = index;
             this.working_dir = working_dir;
             if (index === "R" || working_dir === "R") {
-              const detail = fromPathRegex.exec(path14) || [null, path14, path14];
+              const detail = fromPathRegex.exec(path13) || [null, path13, path13];
               this.from = detail[2] || "";
               this.path = detail[1] || "";
             }
@@ -39634,9 +39634,9 @@ var init_esm2 = __esm({
               next
             );
           }
-          hashObject(path14, write) {
+          hashObject(path13, write) {
             return this._runTask(
-              hashObjectTask(path14, write === true),
+              hashObjectTask(path13, write === true),
               trailingFunctionArgument(arguments)
             );
           }
@@ -40273,8 +40273,8 @@ var init_esm2 = __esm({
           }
           return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
         };
-        Git2.prototype.submoduleAdd = function(repo, path14, then) {
-          return this._runTask(addSubModuleTask2(repo, path14), trailingFunctionArgument2(arguments));
+        Git2.prototype.submoduleAdd = function(repo, path13, then) {
+          return this._runTask(addSubModuleTask2(repo, path13), trailingFunctionArgument2(arguments));
         };
         Git2.prototype.submoduleUpdate = function(args2, then) {
           return this._runTask(
@@ -40617,21 +40617,24 @@ async function findRenames(projectRoot, filePath) {
       filePath
     ]);
     if (!result.trim()) return null;
+    let currentHash = "unknown";
+    let currentDateStr;
     const lines = result.trim().split("\n");
-    for (let i2 = 0; i2 < lines.length; i2++) {
-      const line = lines[i2];
+    for (const line of lines) {
+      const headerMatch = line.match(/^([a-f0-9]{7,40})\s+(.+)$/);
+      if (headerMatch) {
+        currentHash = headerMatch[1].substring(0, 7);
+        currentDateStr = headerMatch[2];
+        continue;
+      }
       if (line.startsWith("R")) {
         const parts = line.split("	");
         if (parts.length >= 3) {
-          const hashLine = lines[i2 - 1] || "";
-          const hashMatch = hashLine.match(/^([a-f0-9]+)\s+(.+)/);
-          const commitHash = hashMatch?.[1]?.substring(0, 7) || "unknown";
-          const dateStr = hashMatch?.[2];
-          const daysAgo = dateStr ? Math.floor((Date.now() - new Date(dateStr).getTime()) / (1e3 * 60 * 60 * 24)) : 0;
+          const daysAgo = currentDateStr ? Math.floor((Date.now() - new Date(currentDateStr).getTime()) / (1e3 * 60 * 60 * 24)) : 0;
           return {
             oldPath: parts[1],
             newPath: parts[2],
-            commitHash,
+            commitHash: currentHash,
             daysAgo
           };
         }
@@ -41313,6 +41316,28 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
+function getNodeValue(node) {
+  switch (node.type) {
+    case "array":
+      return node.children.map(getNodeValue);
+    case "object":
+      const obj = /* @__PURE__ */ Object.create(null);
+      for (let prop of node.children) {
+        const valueNode = prop.children[1];
+        if (valueNode) {
+          obj[prop.children[0].value] = getNodeValue(valueNode);
+        }
+      }
+      return obj;
+    case "null":
+    case "string":
+    case "number":
+    case "boolean":
+      return node.value;
+    default:
+      return void 0;
+  }
+}
 function visit(text, visitor, options = ParseOptions.DEFAULT) {
   const _scanner = createScanner(text, false);
   const _jsonPath = [];
@@ -41661,7 +41686,7 @@ var init_edit = __esm({
 });
 
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js
-var ScanError, SyntaxKind, parseTree2, ParseErrorCode;
+var ScanError, SyntaxKind, parseTree2, getNodeValue2, ParseErrorCode;
 var init_main = __esm({
   "node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js"() {
     "use strict";
@@ -41698,6 +41723,7 @@ var init_main = __esm({
       SyntaxKind2[SyntaxKind2["EOF"] = 17] = "EOF";
     })(SyntaxKind || (SyntaxKind = {}));
     parseTree2 = parseTree;
+    getNodeValue2 = getNodeValue;
     (function(ParseErrorCode2) {
       ParseErrorCode2[ParseErrorCode2["InvalidSymbol"] = 1] = "InvalidSymbol";
       ParseErrorCode2[ParseErrorCode2["InvalidNumberFormat"] = 2] = "InvalidNumberFormat";
@@ -41720,13 +41746,11 @@ var init_main = __esm({
 });
 
 // src/core/mcph-parser.ts
-import * as fs4 from "node:fs";
-import * as path3 from "node:path";
 async function parseMchpConfig(file2, projectRoot, scopeOverride) {
   const content = readFileContent(file2.absolutePath);
   const scope = scopeOverride ?? detectScope2(file2.relativePath);
   const isGitTracked = await checkGitTracked2(file2.absolutePath, projectRoot);
-  const isGitignored = checkGitignored(file2.absolutePath, projectRoot);
+  const isGitignored = await checkGitignored(file2.absolutePath, projectRoot);
   const result = {
     filePath: file2.absolutePath,
     relativePath: file2.relativePath,
@@ -41753,11 +41777,7 @@ async function parseMchpConfig(file2, projectRoot, scopeOverride) {
     result.parseErrors.push(".mcph.json must be a JSON object at the root");
     return result;
   }
-  try {
-    result.raw = JSON.parse(stripComments2(content));
-  } catch {
-    return result;
-  }
+  result.raw = getNodeValue2(tree);
   const rootProps = tree.children ?? [];
   for (const prop of rootProps) {
     if (prop.type !== "property" || !prop.children || prop.children.length < 2) continue;
@@ -41815,46 +41835,6 @@ function offsetToPosition(content, offset) {
   }
   return { line, column };
 }
-function stripComments2(src) {
-  let out = "";
-  let i2 = 0;
-  let inString = false;
-  let escape2 = false;
-  while (i2 < src.length) {
-    const ch = src[i2];
-    if (inString) {
-      out += ch;
-      if (escape2) {
-        escape2 = false;
-      } else if (ch === "\\") {
-        escape2 = true;
-      } else if (ch === '"') {
-        inString = false;
-      }
-      i2++;
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      out += ch;
-      i2++;
-      continue;
-    }
-    if (ch === "/" && src[i2 + 1] === "/") {
-      while (i2 < src.length && src[i2] !== "\n") i2++;
-      continue;
-    }
-    if (ch === "/" && src[i2 + 1] === "*") {
-      i2 += 2;
-      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) i2++;
-      i2 += 2;
-      continue;
-    }
-    out += ch;
-    i2++;
-  }
-  return out;
-}
 async function checkGitTracked2(filePath, projectRoot) {
   try {
     const git = getGit(projectRoot);
@@ -41864,17 +41844,14 @@ async function checkGitTracked2(filePath, projectRoot) {
     return false;
   }
 }
-function checkGitignored(filePath, projectRoot) {
-  const gitignorePath = path3.join(projectRoot, ".gitignore");
-  let content;
+async function checkGitignored(filePath, projectRoot) {
   try {
-    content = fs4.readFileSync(gitignorePath, "utf-8");
+    const git = getGit(projectRoot);
+    const result = await git.raw(["check-ignore", "--", filePath]);
+    return result.trim().length > 0;
   } catch {
     return false;
   }
-  const basename5 = path3.basename(filePath);
-  const patterns = content.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
-  return patterns.some((p2) => p2 === basename5 || p2 === `/${basename5}` || p2 === `./${basename5}`);
 }
 var KNOWN_FIELDS;
 var init_mcph_parser = __esm({
@@ -42111,7 +42088,7 @@ var require_levenshtein = __commonJS({
 });
 
 // src/core/checks/paths.ts
-import * as path4 from "node:path";
+import * as path3 from "node:path";
 function getProjectFiles(projectRoot) {
   if (cachedProjectFiles?.root === projectRoot) return cachedProjectFiles.files;
   const files = getAllProjectFiles(projectRoot);
@@ -42124,10 +42101,10 @@ function resetPathsCache() {
 async function checkPaths(file2, projectRoot) {
   const issues = [];
   const projectFiles = getProjectFiles(projectRoot);
-  const contextDir = path4.dirname(file2.filePath);
+  const contextDir = path3.dirname(file2.filePath);
   for (const ref of file2.references.paths) {
     const baseDir = ref.value.startsWith("./") || ref.value.startsWith("../") ? contextDir : projectRoot;
-    const resolvedPath = path4.resolve(baseDir, ref.value);
+    const resolvedPath = path3.resolve(baseDir, ref.value);
     const normalizedRef = ref.value.replace(/\\/g, "/");
     if (normalizedRef.includes("*")) {
       const matches = await Ze(normalizedRef, { cwd: baseDir, nodir: false });
@@ -42145,7 +42122,7 @@ async function checkPaths(file2, projectRoot) {
     }
     const isDir = normalizedRef.endsWith("/");
     if (isDir) {
-      const dirPath = path4.resolve(baseDir, normalizedRef);
+      const dirPath = path3.resolve(baseDir, normalizedRef);
       if (!isDirectory(dirPath)) {
         issues.push({
           severity: "error",
@@ -42190,12 +42167,12 @@ async function checkPaths(file2, projectRoot) {
 }
 function findClosestMatch(target, files) {
   const targetNorm = target.replace(/\\/g, "/");
-  const targetBase = path4.basename(targetNorm);
+  const targetBase = path3.basename(targetNorm);
   let bestMatch = null;
   let bestDistance = Infinity;
   for (const file2 of files) {
     const fileNorm = file2.replace(/\\/g, "/");
-    if (path4.basename(fileNorm) === targetBase && fileNorm !== targetNorm) {
+    if (path3.basename(fileNorm) === targetBase && fileNorm !== targetNorm) {
       const dist = levenshtein(targetNorm, fileNorm);
       if (dist < bestDistance) {
         bestDistance = dist;
@@ -42229,8 +42206,8 @@ var init_paths = __esm({
 });
 
 // src/core/checks/commands.ts
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
 async function checkCommands(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42280,9 +42257,9 @@ async function checkCommands(file2, projectRoot) {
         ...pkgJson.optionalDependencies
       };
       if (!(pkgName in allDeps)) {
-        const binPath = path5.join(projectRoot, "node_modules", ".bin", pkgName);
+        const binPath = path4.join(projectRoot, "node_modules", ".bin", pkgName);
         try {
-          fs5.accessSync(binPath);
+          fs4.accessSync(binPath);
         } catch {
           issues.push({
             severity: "warning",
@@ -42328,9 +42305,9 @@ async function checkCommands(file2, projectRoot) {
         ...pkgJson.optionalDependencies
       };
       if (!(tool in allDeps)) {
-        const binPath = path5.join(projectRoot, "node_modules", ".bin", tool);
+        const binPath = path4.join(projectRoot, "node_modules", ".bin", tool);
         try {
-          fs5.accessSync(binPath);
+          fs4.accessSync(binPath);
         } catch {
           issues.push({
             severity: "warning",
@@ -42347,7 +42324,7 @@ async function checkCommands(file2, projectRoot) {
 }
 function loadMakefile(projectRoot) {
   try {
-    return fs5.readFileSync(path5.join(projectRoot, "Makefile"), "utf-8");
+    return fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8");
   } catch {
     return null;
   }
@@ -42368,13 +42345,13 @@ var init_commands = __esm({
 });
 
 // src/core/checks/staleness.ts
-import * as path6 from "node:path";
+import * as path5 from "node:path";
 async function checkStaleness(file2, projectRoot) {
   const issues = [];
   if (!await isGitRepo(projectRoot)) {
     return issues;
   }
-  const relativePath = path6.relative(projectRoot, file2.filePath).replace(/\\/g, "/");
+  const relativePath = path5.relative(projectRoot, file2.filePath).replace(/\\/g, "/");
   const lastModified = await getFileLastModified(projectRoot, relativePath);
   if (!lastModified || isNaN(lastModified.getTime())) {
     return issues;
@@ -42507,8 +42484,8 @@ var init_tokens2 = __esm({
 });
 
 // src/core/checks/tier-tokens.ts
-import * as fs6 from "node:fs";
-import * as path7 from "node:path";
+import * as fs5 from "node:fs";
+import * as path6 from "node:path";
 function hasPathsFrontmatter(content) {
   const lines = content.split("\n");
   if (lines[0]?.trim() !== "---") return false;
@@ -42537,8 +42514,8 @@ function isAlwaysLoaded(file2) {
   if (rel.includes("/rules/")) {
     return !hasPathsFrontmatter(file2.content);
   }
-  const basename5 = rel.split("/").pop() ?? "";
-  return ALWAYS_LOADED_BASENAMES.has(basename5);
+  const basename4 = rel.split("/").pop() ?? "";
+  return ALWAYS_LOADED_BASENAMES.has(basename4);
 }
 function computeSectionCosts(file2) {
   if (file2.sections.length === 0) return [];
@@ -42553,14 +42530,14 @@ function computeSectionCosts(file2) {
 function loadSettingsSources(projectRoot) {
   const sources = [];
   const candidates = [
-    path7.join(projectRoot, ".claude", "settings.json"),
-    path7.join(projectRoot, ".claude", "settings.local.json"),
-    path7.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
+    path6.join(projectRoot, ".claude", "settings.json"),
+    path6.join(projectRoot, ".claude", "settings.local.json"),
+    path6.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
   ];
   for (const p2 of candidates) {
     let content;
     try {
-      content = fs6.readFileSync(p2, "utf-8");
+      content = fs5.readFileSync(p2, "utf-8");
     } catch {
       continue;
     }
@@ -42687,7 +42664,7 @@ var init_tier_tokens = __esm({
 });
 
 // src/core/checks/redundancy.ts
-import * as path8 from "node:path";
+import * as path7 from "node:path";
 function compilePatterns(allDeps) {
   const compiled = [];
   for (const [pkg, mentions] of Object.entries(PACKAGE_TECH_MAP)) {
@@ -42752,7 +42729,7 @@ async function checkRedundancy(file2, projectRoot) {
     );
     if (dirMatch) {
       const dir = dirMatch[1].replace(/[`"]/g, "");
-      const fullPath = path8.resolve(projectRoot, dir);
+      const fullPath = path7.resolve(projectRoot, dir);
       if (isDirectory(fullPath)) {
         issues.push({
           severity: "info",
@@ -43621,8 +43598,8 @@ var init_security = __esm({
 });
 
 // src/core/checks/mcp/commands.ts
-import * as fs7 from "node:fs";
-import * as path9 from "node:path";
+import * as fs6 from "node:fs";
+import * as path8 from "node:path";
 async function checkMcpCommands(config2, projectRoot) {
   const issues = [];
   if (config2.parseErrors.length > 0) return issues;
@@ -43639,7 +43616,7 @@ async function checkMcpCommands(config2, projectRoot) {
       });
     }
     if (LOCAL_PATH_PATTERN.test(server2.command)) {
-      const resolved = path9.resolve(projectRoot, server2.command);
+      const resolved = path8.resolve(projectRoot, server2.command);
       if (!fileExistsSafe(resolved)) {
         issues.push({
           severity: "warning",
@@ -43654,7 +43631,7 @@ async function checkMcpCommands(config2, projectRoot) {
       for (const arg of server2.args) {
         if (URL_PREFIX.test(arg)) continue;
         if (LOCAL_PATH_PATTERN.test(arg) || FILE_PATH_PATTERN.test(arg)) {
-          const resolved = path9.resolve(projectRoot, arg);
+          const resolved = path8.resolve(projectRoot, arg);
           if (!fileExistsSafe(resolved)) {
             issues.push({
               severity: "warning",
@@ -43672,7 +43649,7 @@ async function checkMcpCommands(config2, projectRoot) {
 }
 function fileExistsSafe(filePath) {
   try {
-    fs7.accessSync(filePath);
+    fs6.accessSync(filePath);
     return true;
   } catch {
     return false;
@@ -43826,17 +43803,19 @@ async function checkMcpEnv(config2, _projectRoot) {
         }
       }
     }
-    for (const value of allValues) {
-      const refs = extractEnvVarRefs(value);
-      for (const ref of refs) {
-        if (!(ref.varName in process.env)) {
-          issues.push({
-            severity: "info",
-            check: "mcp-env",
-            ruleId: "unset-variable",
-            line: server2.line,
-            message: `Server "${server2.name}": environment variable "${ref.varName}" is not set`
-          });
+    if (config2.client !== "continue") {
+      for (const value of allValues) {
+        const refs = extractEnvVarRefs(value);
+        for (const ref of refs) {
+          if (!(ref.varName in process.env)) {
+            issues.push({
+              severity: "info",
+              check: "mcp-env",
+              ruleId: "unset-variable",
+              line: server2.line,
+              message: `Server "${server2.name}": environment variable "${ref.varName}" is not set`
+            });
+          }
         }
       }
     }
@@ -44342,27 +44321,18 @@ var init_lists = __esm({
 });
 
 // src/core/checks/mcph/gitignore.ts
-import * as path10 from "node:path";
+import * as path9 from "node:path";
 async function checkMcphGitignore(config2, _projectRoot) {
   const issues = [];
   if (config2.scope === "project-local" && !config2.isGitignored) {
-    const basename5 = path10.basename(config2.filePath);
+    const basename4 = path9.basename(config2.filePath);
     issues.push({
       severity: "error",
       check: "mcph-gitignore",
       ruleId: "mcph-config/local-file-not-gitignored",
       line: 1,
-      message: `${basename5} is not covered by .gitignore \u2014 machine-local overrides can leak via git`,
-      suggestion: `Add "${basename5}" to .gitignore in your project root.`,
-      fix: {
-        file: path10.join(path10.dirname(config2.filePath), ".gitignore"),
-        line: 0,
-        oldText: "",
-        newText: `
-# mcph CLI local overrides (machine-specific, never commit)
-${basename5}
-`
-      }
+      message: `${basename4} is not covered by .gitignore \u2014 machine-local overrides can leak via git`,
+      suggestion: `Add "${basename4}" to .gitignore in your project root.`
     });
   }
   return issues;
@@ -44444,7 +44414,7 @@ var init_session_parser = __esm({
 import { readdir, stat } from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import { createInterface } from "node:readline";
-import { dirname as dirname3, join as join7, resolve as resolve4 } from "node:path";
+import { dirname as dirname2, join as join5, resolve as resolve4 } from "node:path";
 import { existsSync } from "node:fs";
 function detectProviders() {
   if (!home) return [];
@@ -44469,7 +44439,7 @@ async function parseJsonlFiltered(filePath, filter) {
   return results;
 }
 async function readClaudeHistory() {
-  const historyPath = join7(home, ".claude", "history.jsonl");
+  const historyPath = join5(home, ".claude", "history.jsonl");
   return parseJsonlFiltered(historyPath, (entry) => {
     if (!entry.display || !entry.project) return null;
     return {
@@ -44482,7 +44452,7 @@ async function readClaudeHistory() {
   });
 }
 async function readCodexHistory() {
-  const historyPath = join7(home, ".codex", "history.jsonl");
+  const historyPath = join5(home, ".codex", "history.jsonl");
   return parseJsonlFiltered(historyPath, (entry) => {
     if (!entry.display && !entry.command) return null;
     return {
@@ -44495,18 +44465,18 @@ async function readCodexHistory() {
   });
 }
 async function readClaudeMemories() {
-  const projectsDir = join7(home, ".claude", "projects");
+  const projectsDir = join5(home, ".claude", "projects");
   if (!existsSync(projectsDir)) return [];
   const memories = [];
   const projectDirs = await readdir(projectsDir).catch(() => []);
   for (const projDir of projectDirs) {
-    const memoryDir = join7(projectsDir, projDir, "memory");
+    const memoryDir = join5(projectsDir, projDir, "memory");
     if (!existsSync(memoryDir)) continue;
     const files = await readdir(memoryDir).catch(() => []);
     for (const file2 of files) {
       if (!file2.endsWith(".md") || file2 === "MEMORY.md") continue;
       try {
-        const entry = await parseMemoryFile(join7(memoryDir, file2), projDir);
+        const entry = await parseMemoryFile(join5(memoryDir, file2), projDir);
         memories.push(entry);
       } catch {
       }
@@ -44516,14 +44486,14 @@ async function readClaudeMemories() {
 }
 function detectAiderInSiblings(siblings) {
   for (const sib of siblings) {
-    if (existsSync(join7(sib.path, ".aider.chat.history.md"))) {
+    if (existsSync(join5(sib.path, ".aider.chat.history.md"))) {
       return "aider";
     }
   }
   return null;
 }
 async function detectSiblings(projectRoot) {
-  const parentDir = dirname3(resolve4(projectRoot));
+  const parentDir = dirname2(resolve4(projectRoot));
   let entries;
   try {
     entries = await readdir(parentDir);
@@ -44533,7 +44503,7 @@ async function detectSiblings(projectRoot) {
   const candidates = [];
   for (const entry of entries) {
     if (entry.startsWith(".") || entry === "node_modules") continue;
-    const fullPath = join7(parentDir, entry);
+    const fullPath = join5(parentDir, entry);
     const entryPath = resolve4(fullPath);
     if (entryPath === resolve4(projectRoot)) continue;
     try {
@@ -44542,7 +44512,7 @@ async function detectSiblings(projectRoot) {
     } catch {
       continue;
     }
-    const isProject = existsSync(join7(fullPath, ".git")) || existsSync(join7(fullPath, "package.json")) || existsSync(join7(fullPath, "Cargo.toml")) || existsSync(join7(fullPath, "go.mod")) || existsSync(join7(fullPath, "pyproject.toml"));
+    const isProject = existsSync(join5(fullPath, ".git")) || existsSync(join5(fullPath, "package.json")) || existsSync(join5(fullPath, "Cargo.toml")) || existsSync(join5(fullPath, "go.mod")) || existsSync(join5(fullPath, "pyproject.toml"));
     if (!isProject) continue;
     candidates.push({ fullPath, entryPath, name: entry });
   }
@@ -44556,7 +44526,7 @@ async function detectSiblings(projectRoot) {
       if (orgMatch) currentOrg = orgMatch[1];
     } catch {
     }
-    const gitCandidates = candidates.filter((c3) => existsSync(join7(c3.fullPath, ".git")));
+    const gitCandidates = candidates.filter((c3) => existsSync(join5(c3.fullPath, ".git")));
     const results = await Promise.all(
       gitCandidates.map(async (c3) => {
         const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
@@ -44628,28 +44598,28 @@ var init_session_scanner = __esm({
     init_session_parser();
     home = process.env.HOME || process.env.USERPROFILE || "";
     AGENT_DIRS = [
-      { provider: "claude-code", dir: join7(home, ".claude"), historyFile: "history.jsonl" },
-      { provider: "codex-cli", dir: join7(home, ".codex"), historyFile: "history.jsonl" },
-      { provider: "vibe-cli", dir: join7(home, ".vibe") },
+      { provider: "claude-code", dir: join5(home, ".claude"), historyFile: "history.jsonl" },
+      { provider: "codex-cli", dir: join5(home, ".codex"), historyFile: "history.jsonl" },
+      { provider: "vibe-cli", dir: join5(home, ".vibe") },
       {
         provider: "amazon-q",
-        dir: join7(home, ".aws", "amazonq")
+        dir: join5(home, ".aws", "amazonq")
       },
       {
         provider: "goose",
-        dir: process.platform === "win32" ? join7(process.env.APPDATA || "", "Block", "goose") : join7(home, ".config", "goose")
+        dir: process.platform === "win32" ? join5(process.env.APPDATA || "", "Block", "goose") : join5(home, ".config", "goose")
       },
-      { provider: "continue", dir: join7(home, ".continue") },
+      { provider: "continue", dir: join5(home, ".continue") },
       {
         provider: "windsurf",
-        dir: join7(home, ".windsurf")
+        dir: join5(home, ".windsurf")
       }
     ];
   }
 });
 
 // src/core/checks/session/missing-secret.ts
-import { resolve as resolve5, basename as basename4 } from "node:path";
+import { resolve as resolve5, basename as basename3 } from "node:path";
 function normalizePath(p2) {
   return resolve5(p2).replace(/\\/g, "/").toLowerCase();
 }
@@ -44673,7 +44643,7 @@ async function checkMissingSecret(ctx) {
     if (s.repo) byName.get(s.name).add(s.repo);
   }
   const currentNorm = normalizePath(ctx.currentProject);
-  const currentBase = basename4(currentNorm);
+  const currentBase = basename3(currentNorm);
   for (const [secretName, projects] of byName) {
     const normalizedProjects = [...projects].map(normalizePath);
     const currentHas = normalizedProjects.some((p2) => {
@@ -44684,7 +44654,7 @@ async function checkMissingSecret(ctx) {
     if (currentHas) continue;
     const siblingMatches = ctx.siblings.filter((sib) => {
       const sibNorm = normalizePath(sib.path);
-      const sibBase = basename4(sibNorm);
+      const sibBase = basename3(sibNorm);
       return normalizedProjects.some((p2) => {
         if (p2 === sibNorm) return true;
         const lastSegment = p2.split("/").pop() || "";
@@ -44717,25 +44687,28 @@ var init_missing_secret = __esm({
 
 // src/core/checks/session/diverged-file.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { join as join6 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
 function calculateOverlap(a, b2) {
-  const linesA = a.split("\n").map((l) => l.trim()).filter((l) => l.length > 3);
+  const linesA = new Set(
+    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
+  );
   const linesB = new Set(
     b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
   );
-  if (linesA.length === 0 && linesB.size === 0) return 1;
-  if (linesA.length === 0 || linesB.size === 0) return 0;
-  let matches = 0;
+  if (linesA.size === 0 && linesB.size === 0) return 1;
+  if (linesA.size === 0 || linesB.size === 0) return 0;
+  let intersection2 = 0;
   for (const line of linesA) {
-    if (linesB.has(line)) matches++;
+    if (linesB.has(line)) intersection2++;
   }
-  return matches / Math.max(linesA.length, linesB.size);
+  const unionSize = linesA.size + linesB.size - intersection2;
+  return intersection2 / unionSize;
 }
 async function checkDivergedFile(ctx) {
   const issues = [];
   for (const fileName of CANONICAL_FILES) {
-    const currentPath = join8(ctx.currentProject, fileName);
+    const currentPath = join6(ctx.currentProject, fileName);
     if (!existsSync2(currentPath)) continue;
     let currentContent;
     try {
@@ -44745,7 +44718,7 @@ async function checkDivergedFile(ctx) {
     }
     const diverged = [];
     for (const sib of ctx.siblings) {
-      const sibPath = join8(sib.path, fileName);
+      const sibPath = join6(sib.path, fileName);
       if (!existsSync2(sibPath)) continue;
       try {
         const sibContent = await readFile2(sibPath, "utf-8");
@@ -44791,12 +44764,12 @@ var init_diverged_file = __esm({
 
 // src/core/checks/session/missing-workflow.ts
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { join as join7 } from "node:path";
 import { existsSync as existsSync3 } from "node:fs";
 async function checkMissingWorkflow(ctx) {
   const issues = [];
-  const currentWorkflowDir = join9(ctx.currentProject, ".github", "workflows");
-  if (!existsSync3(join9(ctx.currentProject, ".github"))) return issues;
+  const currentWorkflowDir = join7(ctx.currentProject, ".github", "workflows");
+  if (!existsSync3(join7(ctx.currentProject, ".github"))) return issues;
   const currentWorkflows = /* @__PURE__ */ new Set();
   if (existsSync3(currentWorkflowDir)) {
     try {
@@ -44809,7 +44782,7 @@ async function checkMissingWorkflow(ctx) {
   }
   const workflowMap = /* @__PURE__ */ new Map();
   for (const sib of ctx.siblings) {
-    const sibWorkflowDir = join9(sib.path, ".github", "workflows");
+    const sibWorkflowDir = join7(sib.path, ".github", "workflows");
     if (!existsSync3(sibWorkflowDir)) continue;
     try {
       const files = await readdir2(sibWorkflowDir);
@@ -44894,16 +44867,19 @@ var init_stale_memory = __esm({
 
 // src/core/checks/session/duplicate-memory.ts
 function calculateLineOverlap2(a, b2) {
-  const linesA = a.split("\n").map((l) => l.trim()).filter((l) => l.length > 5);
+  const linesA = new Set(
+    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
+  );
   const linesB = new Set(
     b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
   );
-  if (linesA.length === 0 || linesB.size === 0) return 0;
-  let matches = 0;
+  if (linesA.size === 0 || linesB.size === 0) return 0;
+  let intersection2 = 0;
   for (const line of linesA) {
-    if (linesB.has(line)) matches++;
+    if (linesB.has(line)) intersection2++;
   }
-  return matches / Math.max(linesA.length, linesB.size);
+  const unionSize = linesA.size + linesB.size - intersection2;
+  return intersection2 / unionSize;
 }
 async function checkDuplicateMemory(ctx) {
   const issues = [];
@@ -44913,6 +44889,9 @@ async function checkDuplicateMemory(ctx) {
       const a = ctx.memories[i2];
       const b2 = ctx.memories[j3];
       if (a.projectDir === b2.projectDir) continue;
+      const aIsCurrent = projectDirMatchesPath(a.projectDir, ctx.currentProject);
+      const bIsCurrent = projectDirMatchesPath(b2.projectDir, ctx.currentProject);
+      if (!aIsCurrent && !bIsCurrent) continue;
       if (a.content.length < 50 || b2.content.length < 50) continue;
       const overlap = calculateLineOverlap2(a.content, b2.content);
       if (overlap < 0.6) continue;
@@ -44939,6 +44918,7 @@ async function checkDuplicateMemory(ctx) {
 var init_duplicate_memory = __esm({
   "src/core/checks/session/duplicate-memory.ts"() {
     "use strict";
+    init_session_parser();
   }
 });
 
@@ -45010,7 +44990,7 @@ async function checkLoopDetection(ctx) {
   }
   const cycles = findCyclicPatterns(displays);
   for (const { cycle, repeats: reps } of cycles) {
-    const cycleStr = cycle.map((c3) => c3.length > 40 ? c3.slice(0, 37) + "..." : c3).join(" \u2192 ");
+    const cycleStr = cycle.map((c3) => c3.length > 40 ? c3.slice(0, 37) + "..." : c3).join(" -> ");
     issues.push({
       severity: "warning",
       check: "session-loop-detection",
@@ -45034,12 +45014,12 @@ var init_loop_detection = __esm({
 
 // src/core/checks/session/memory-index-overflow.ts
 import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || "";
   if (!home2) return [];
   const encoded = encodeProjectDir(ctx.currentProject);
-  const memoryFile = join10(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
+  const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
   let stats;
   try {
     stats = await stat2(memoryFile);
@@ -45090,10 +45070,10 @@ var init_memory_index_overflow = __esm({
 
 // src/core/checks/ci-coverage.ts
 import { readdir as readdir3, readFile as readFile4 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join9 } from "node:path";
 import { existsSync as existsSync5 } from "node:fs";
 async function findReleaseWorkflows(projectRoot) {
-  const workflowDir = join11(projectRoot, ".github", "workflows");
+  const workflowDir = join9(projectRoot, ".github", "workflows");
   if (!existsSync5(workflowDir)) return [];
   let files;
   try {
@@ -45109,7 +45089,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = await readFile4(join11(workflowDir, f), "utf-8");
+      const content = await readFile4(join9(workflowDir, f), "utf-8");
       const nameMatch = content.match(/^name:\s*(.+)$/m);
       if (nameMatch && RELEASE_FILENAME_PATTERNS.some((p2) => p2.test(nameMatch[1]))) {
         releaseWorkflows.push(f);
@@ -45164,10 +45144,10 @@ var init_ci_coverage = __esm({
 
 // src/core/checks/ci-secrets.ts
 import { readdir as readdir4, readFile as readFile5 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join10 } from "node:path";
 import { existsSync as existsSync6 } from "node:fs";
 async function findSecretUsages(projectRoot) {
-  const workflowDir = join12(projectRoot, ".github", "workflows");
+  const workflowDir = join10(projectRoot, ".github", "workflows");
   if (!existsSync6(workflowDir)) return [];
   let files;
   try {
@@ -45180,7 +45160,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = await readFile5(join12(workflowDir, f), "utf-8");
+      content = await readFile5(join10(workflowDir, f), "utf-8");
     } catch {
       continue;
     }
@@ -45197,7 +45177,7 @@ async function findSecretUsages(projectRoot) {
 }
 function contextMentionsSecret(files, secretName) {
   const escaped = secretName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(escaped.replace(/_/g, "[_\\s-]?"), "i");
+  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[_\\s-]")}\\b`, "i");
   return files.some((f) => pattern.test(f.content));
 }
 async function checkCiSecrets(files, projectRoot) {
@@ -45237,14 +45217,14 @@ var init_ci_secrets = __esm({
 });
 
 // src/version.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { resolve as resolve8, dirname as dirname4 } from "node:path";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.17";
-  const __dir = dirname4(fileURLToPath(import.meta.url));
+  if (true) return "0.9.19";
+  const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
-  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
   return pkg.version;
 }
 var VERSION;
@@ -46138,7 +46118,7 @@ var init_source = __esm({
 });
 
 // src/core/fixer.ts
-import * as fs8 from "node:fs";
+import * as fs7 from "node:fs";
 function applyFixes(result, options = {}) {
   const log = options.quiet ? () => {
   } : console.log.bind(console);
@@ -46180,16 +46160,17 @@ function applyFixes(result, options = {}) {
   let totalFixes = 0;
   const filesModified = [];
   for (const [filePath, fixes] of fixesByFile) {
-    const content = fs8.readFileSync(filePath, "utf-8");
+    const content = fs7.readFileSync(filePath, "utf-8");
     const lines = content.split("\n");
     let modified = false;
-    const sortedFixes = [...fixes].sort((a, b2) => b2.line - a.line);
     const fixesByLine = /* @__PURE__ */ new Map();
-    for (const fix of sortedFixes) {
+    for (const fix of fixes) {
       const existing = fixesByLine.get(fix.line) || [];
       existing.push(fix);
       fixesByLine.set(fix.line, existing);
     }
+    let perFileFixCount = 0;
+    const perFileLogs = [];
     for (const [lineNum, lineFixes] of fixesByLine) {
       const lineIdx = lineNum - 1;
       if (lineIdx < 0 || lineIdx >= lines.length) continue;
@@ -46197,10 +46178,10 @@ function applyFixes(result, options = {}) {
       for (const fix of lineFixes) {
         if (line.includes(fix.oldText)) {
           line = line.replaceAll(fix.oldText, fix.newText);
-          totalFixes++;
+          perFileFixCount++;
           const prefix = dryRun ? source_default.cyan("  Would fix") : source_default.green("  Fixed");
-          log(
-            prefix + ` Line ${fix.line}: ${source_default.dim(fix.oldText)} ${source_default.dim("\u2192")} ${fix.newText}`
+          perFileLogs.push(
+            prefix + ` Line ${fix.line}: ${source_default.dim(fix.oldText)} ${source_default.dim("->")} ${fix.newText}`
           );
         }
       }
@@ -46220,9 +46201,11 @@ function applyFixes(result, options = {}) {
         }
       }
       if (!dryRun) {
-        fs8.writeFileSync(filePath, newContent, "utf-8");
+        fs7.writeFileSync(filePath, newContent, "utf-8");
       }
       filesModified.push(filePath);
+      totalFixes += perFileFixCount;
+      for (const m of perFileLogs) log(m);
     }
   }
   return { totalFixes, filesModified };
@@ -46236,13 +46219,13 @@ var init_fixer = __esm({
 
 // src/mcp/server.ts
 var server_exports = {};
-import * as path11 from "node:path";
+import * as path10 from "node:path";
 function validateProjectPath(rawPath) {
   if (!rawPath) return process.cwd();
   if (PATH_DISALLOWED.test(rawPath)) {
     throw new Error("projectPath contains disallowed characters");
   }
-  const resolved = path11.resolve(rawPath);
+  const resolved = path10.resolve(rawPath);
   if (!isDirectory(resolved)) {
     throw new Error("projectPath is not an existing directory");
   }
@@ -46253,7 +46236,7 @@ function validateFilePathInput(rawPath) {
     throw new Error("path contains disallowed characters");
   }
 }
-var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
+var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
 var init_server3 = __esm({
   async "src/mcp/server.ts"() {
     "use strict";
@@ -46272,6 +46255,7 @@ var init_server3 = __esm({
     init_version2();
     contextCheckEnum = external_exports3.enum(ALL_CHECKS);
     mcpCheckEnum = external_exports3.enum(ALL_MCP_CHECKS);
+    mcphCheckEnum = external_exports3.enum(ALL_MCPH_CHECKS);
     sessionCheckEnum = external_exports3.enum(ALL_SESSION_CHECKS);
     PATH_DISALLOWED = /[\n\r\t;`|]|\$\(|\$\{/;
     server = new McpServer({
@@ -46328,7 +46312,7 @@ var init_server3 = __esm({
         try {
           validateFilePathInput(filePath);
           const root = validateProjectPath(projectPath);
-          const resolved = path11.resolve(root, filePath);
+          const resolved = path10.resolve(root, filePath);
           const result = {
             path: filePath,
             exists: fileExists(resolved) || isDirectory(resolved)
@@ -46493,6 +46477,48 @@ var init_server3 = __esm({
         }
       }
     );
+    server.tool(
+      "ctxlint_mcph_audit",
+      "Lint .mcph.json (the @yawlabs/mcph CLI config) files. Checks for PAT (mcp_pat_*) leakage in git-tracked project-scope files, environment-variable posture, plaintext HTTP apiBase to public hosts, schema drift, allow/deny list conflicts and duplicates, and machine-local override files not covered by .gitignore. Distinct from ctxlint_mcp_audit, which lints client-side .mcp.json server lists.",
+      {
+        projectPath: external_exports3.string().optional().describe("Path to the project root. Defaults to current working directory."),
+        checks: external_exports3.array(mcphCheckEnum).optional().describe("Specific mcph checks to run (default: all mcph-* checks)."),
+        includeGlobal: external_exports3.boolean().optional().describe("Also scan ~/.mcph.json (user-global config)."),
+        strictEnvToken: external_exports3.boolean().optional().describe(
+          "Upgrade mcph-config/prefer-env-token from warning to error (env-var-only posture)."
+        )
+      },
+      {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      },
+      async ({ projectPath, checks, includeGlobal, strictEnvToken }) => {
+        try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_MCPH_CHECKS;
+          const result = await runAudit(root, activeChecks, {
+            mcph: true,
+            mcphOnly: true,
+            mcphGlobal: includeGlobal || false,
+            mcphStrictEnvToken: strictEnvToken || false
+          });
+          return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: msg }) }],
+            isError: true
+          };
+        } finally {
+          freeEncoder();
+          resetGit();
+          resetPathsCache();
+          resetPackageJsonCache();
+        }
+      }
+    );
     server.tool(
       "ctxlint_session_audit",
       "Audit AI agent session data for cross-project consistency. Checks for missing GitHub secrets, diverged config files, missing workflows, stale memory entries, and duplicate memories across sibling repositories.",
@@ -47698,8 +47724,8 @@ var require_command = __commonJS({
   "node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js"(exports) {
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
-    var path14 = __require("node:path");
-    var fs11 = __require("node:fs");
+    var path13 = __require("node:path");
+    var fs10 = __require("node:fs");
     var process11 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -48693,7 +48719,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs11.existsSync(executableFile)) return;
+        if (fs10.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -48711,11 +48737,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path14.resolve(baseDir, baseName);
-          if (fs11.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path14.extname(baseName))) return void 0;
+          const localBin = path13.resolve(baseDir, baseName);
+          if (fs10.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path13.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs11.existsSync(`${localBin}${ext}`)
+            (ext) => fs10.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -48727,21 +48753,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs11.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs10.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path14.resolve(
-            path14.dirname(resolvedScriptPath),
+          executableDir = path13.resolve(
+            path13.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path14.basename(
+            const legacyName = path13.basename(
               this._scriptPath,
-              path14.extname(this._scriptPath)
+              path13.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -48752,7 +48778,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path14.extname(executableFile));
+        launchWithNode = sourceExt.includes(path13.extname(executableFile));
         let proc;
         if (process11.platform !== "win32") {
           if (launchWithNode) {
@@ -49667,7 +49693,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path14.basename(filename, path14.extname(filename));
+        this._name = path13.basename(filename, path13.extname(filename));
         return this;
       }
       /**
@@ -49681,9 +49707,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path15) {
-        if (path15 === void 0) return this._executableDir;
-        this._executableDir = path15;
+      executableDir(path14) {
+        if (path14 === void 0) return this._executableDir;
+        this._executableDir = path14;
         return this;
       }
       /**
@@ -53008,6 +53034,24 @@ var init_ora = __esm({
 });
 
 // src/core/reporter.ts
+function classifyFile(f) {
+  if (f.path === "(mcp)") return "mcp";
+  if (f.path.includes("session audit")) return "session";
+  for (const issue2 of f.issues) {
+    if (issue2.check.startsWith("session-")) return "session";
+    if (issue2.check.startsWith("mcph-")) return "mcph";
+    if (issue2.check.startsWith("mcp-")) return "mcp";
+  }
+  const norm = f.path.replace(/\\/g, "/");
+  if (norm.endsWith(".mcph.json") || norm.endsWith(".mcph.local.json")) return "mcph";
+  if (norm === ".mcp.json" || norm.endsWith("/.mcp.json") || norm.endsWith("/mcp.json") || norm.includes("/mcpServers/") || norm.endsWith("/.claude.json") || norm.endsWith(".claude/settings.json") || norm.endsWith("claude_desktop_config.json")) {
+    return "mcp";
+  }
+  return "context";
+}
+function isSyntheticBucket(p2) {
+  return p2.startsWith("(") || p2.includes("session audit");
+}
 function formatText(result, verbose = false) {
   const lines = [];
   lines.push("");
@@ -53015,30 +53059,45 @@ function formatText(result, verbose = false) {
   lines.push("");
   lines.push(`Scanning ${result.projectRoot}...`);
   lines.push("");
-  const isMcpFile = (f) => f.issues.some((i2) => i2.check.startsWith("mcp-"));
-  const contextFiles = result.files.filter((f) => !isMcpFile(f));
-  const mcpFiles = result.files.filter((f) => isMcpFile(f));
+  const groups = {
+    context: [],
+    mcp: [],
+    mcph: [],
+    session: []
+  };
+  for (const f of result.files) {
+    groups[classifyFile(f)].push(f);
+  }
   const totalTokens = result.summary.totalTokens;
-  if (contextFiles.length > 0) {
+  let renderedAnySummary = false;
+  const contextReal = groups.context.filter((f) => !isSyntheticBucket(f.path));
+  if (contextReal.length > 0) {
     lines.push(
-      `Found ${contextFiles.length} context file${contextFiles.length !== 1 ? "s" : ""} (${totalTokens.toLocaleString()} tokens total)`
+      `Found ${contextReal.length} context file${contextReal.length !== 1 ? "s" : ""} (${totalTokens.toLocaleString()} tokens total)`
     );
-    for (const file2 of contextFiles) {
+    for (const file2 of contextReal) {
       let desc = `  ${file2.path} (${file2.tokens.toLocaleString()} tokens, ${file2.lines} lines)`;
       if (file2.isSymlink && file2.symlinkTarget) {
-        desc = `  ${file2.path} ${source_default.dim(`\u2192 ${file2.symlinkTarget} (symlink)`)}`;
+        desc = `  ${file2.path} ${source_default.dim(`-> ${file2.symlinkTarget} (symlink)`)}`;
       }
       lines.push(desc);
     }
+    renderedAnySummary = true;
   }
-  if (mcpFiles.length > 0) {
-    if (contextFiles.length > 0) lines.push("");
-    lines.push(`Found ${mcpFiles.length} MCP config${mcpFiles.length !== 1 ? "s" : ""}`);
-    for (const file2 of mcpFiles) {
-      lines.push(`  ${file2.path}`);
-    }
+  for (const g of ["mcp", "mcph"]) {
+    const real = groups[g].filter((f) => !isSyntheticBucket(f.path));
+    if (real.length === 0) continue;
+    if (renderedAnySummary) lines.push("");
+    lines.push(`Found ${real.length} ${GROUP_SUMMARY_NOUNS[g]}${real.length !== 1 ? "s" : ""}`);
+    for (const file2 of real) lines.push(`  ${file2.path}`);
+    renderedAnySummary = true;
   }
-  if (contextFiles.length === 0 && mcpFiles.length === 0) {
+  if (groups.session.length > 0) {
+    if (renderedAnySummary) lines.push("");
+    lines.push("Session audit scanned");
+    renderedAnySummary = true;
+  }
+  if (!renderedAnySummary) {
     lines.push(`Found ${result.files.length} file${result.files.length !== 1 ? "s" : ""}`);
   }
   lines.push("");
@@ -53048,7 +53107,7 @@ function formatText(result, verbose = false) {
       if (fileIssues.length === 0 && !verbose) continue;
       lines.push(source_default.underline(file2.path));
       if (fileIssues.length === 0) {
-        lines.push(source_default.green("  \u2713 All checks passed"));
+        lines.push(source_default.green("  [ok] All checks passed"));
       } else {
         for (const issue2 of fileIssues) {
           lines.push(formatIssue(issue2));
@@ -53057,16 +53116,13 @@ function formatText(result, verbose = false) {
       lines.push("");
     }
   };
-  if (contextFiles.length > 0 && mcpFiles.length > 0) {
-    const contextWithIssues = contextFiles.filter((f) => f.issues.length > 0 || verbose);
-    const mcpWithIssues = mcpFiles.filter((f) => f.issues.length > 0 || verbose);
-    if (contextWithIssues.length > 0) {
-      lines.push(source_default.bold("Context Files"));
-      renderFileGroup(contextFiles);
-    }
-    if (mcpWithIssues.length > 0) {
-      lines.push(source_default.bold("MCP Configs"));
-      renderFileGroup(mcpFiles);
+  const groupsToRender = GROUP_ORDER.filter(
+    (g) => groups[g].some((f) => f.issues.length > 0 || verbose)
+  );
+  if (groupsToRender.length > 1) {
+    for (const g of groupsToRender) {
+      lines.push(source_default.bold(GROUP_LABELS[g]));
+      renderFileGroup(groups[g]);
     }
   } else {
     renderFileGroup(result.files);
@@ -53103,13 +53159,13 @@ function formatTokenReport(result) {
   lines.push(
     `  ${source_default.dim("File".padEnd(maxPathLen))}  ${source_default.dim("Tokens".padStart(8))}  ${source_default.dim("Lines".padStart(6))}`
   );
-  lines.push(`  ${"\u2500".repeat(maxPathLen)}  ${"\u2500".repeat(8)}  ${"\u2500".repeat(6)}`);
+  lines.push(`  ${"-".repeat(maxPathLen)}  ${"-".repeat(8)}  ${"-".repeat(6)}`);
   for (const file2 of result.files) {
     const tokenStr = file2.tokens.toLocaleString().padStart(8);
     const lineStr = file2.lines.toString().padStart(6);
     lines.push(`  ${file2.path.padEnd(maxPathLen)}  ${tokenStr}  ${lineStr}`);
   }
-  lines.push(`  ${"\u2500".repeat(maxPathLen)}  ${"\u2500".repeat(8)}  ${"\u2500".repeat(6)}`);
+  lines.push(`  ${"-".repeat(maxPathLen)}  ${"-".repeat(8)}  ${"-".repeat(6)}`);
   lines.push(
     `  ${"Total".padEnd(maxPathLen)}  ${result.summary.totalTokens.toLocaleString().padStart(8)}`
   );
@@ -53282,6 +53338,31 @@ function buildRuleDescriptors() {
       shortDescription: { text: "Redundant MCP config entry" },
       helpUri: "https://github.com/yawlabs/ctxlint#mcp-config-linting"
     },
+    {
+      id: "ctxlint/mcph-token-security",
+      shortDescription: { text: "mcp.hosting PAT leakage or env-var posture" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-apibase",
+      shortDescription: { text: "mcph apiBase URL validation" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-schema-conformance",
+      shortDescription: { text: "mcph config unknown field or stale schema version" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-lists",
+      shortDescription: { text: "mcph allow/deny list conflict or duplicate entry" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-gitignore",
+      shortDescription: { text: "mcph machine-local file not covered by .gitignore" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
     {
       id: "ctxlint/session-missing-secret",
       shortDescription: { text: "GitHub secret set on sibling repos but missing here" },
@@ -53322,12 +53403,12 @@ function buildRuleDescriptors() {
   ];
 }
 function formatIssue(issue2) {
-  const icon = issue2.severity === "error" ? source_default.red("\u2717") : issue2.severity === "warning" ? source_default.yellow("\u26A0") : source_default.blue("\u2139");
+  const icon = issue2.severity === "error" ? source_default.red("x") : issue2.severity === "warning" ? source_default.yellow("!") : source_default.blue("i");
   const lineRef = issue2.line > 0 ? `Line ${issue2.line}: ` : "";
   let line = `  ${icon} ${lineRef}${issue2.message}`;
   if (issue2.suggestion) {
     line += `
-    ${source_default.dim("\u2192")} ${source_default.dim(issue2.suggestion)}`;
+    ${source_default.dim("->")} ${source_default.dim(issue2.suggestion)}`;
   }
   if (issue2.detail) {
     line += `
@@ -53335,16 +53416,30 @@ function formatIssue(issue2) {
   }
   return line;
 }
+var GROUP_ORDER, GROUP_LABELS, GROUP_SUMMARY_NOUNS;
 var init_reporter = __esm({
   "src/core/reporter.ts"() {
     "use strict";
     init_source();
+    GROUP_ORDER = ["context", "mcp", "mcph", "session"];
+    GROUP_LABELS = {
+      context: "Context Files",
+      mcp: "MCP Configs",
+      mcph: "mcph Configs",
+      session: "Session Audit"
+    };
+    GROUP_SUMMARY_NOUNS = {
+      context: "context file",
+      mcp: "MCP config",
+      mcph: "mcph config",
+      session: "session audit"
+    };
   }
 });
 
 // src/core/config.ts
-import * as fs9 from "node:fs";
-import * as path12 from "node:path";
+import * as fs8 from "node:fs";
+import * as path11 from "node:path";
 function formatJsonError(content, err) {
   const msg = err instanceof Error ? err.message : String(err);
   const posMatch = msg.match(/position (\d+)/);
@@ -53415,33 +53510,46 @@ function warnUnknownKeys(config2, source) {
     console.error(`Warning: unknown config key "${k3}" in ${source}${suggestion}`);
   }
 }
+function parseConfigContent(content, source) {
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch (err) {
+    throw new Error(`Invalid JSON in ${source}: ${formatJsonError(content, err)}`, {
+      cause: err
+    });
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(
+      `Invalid config in ${source}: expected a JSON object at the root, got ${Array.isArray(parsed) ? "an array" : typeof parsed}`
+    );
+  }
+  warnUnknownKeys(parsed, source);
+  return parsed;
+}
 function loadConfig(projectRoot) {
   for (const filename of CONFIG_FILENAMES) {
-    const filePath = path12.join(projectRoot, filename);
+    const filePath = path11.join(projectRoot, filename);
     let content;
     try {
-      content = fs9.readFileSync(filePath, "utf-8");
+      content = fs8.readFileSync(filePath, "utf-8");
     } catch {
       continue;
     }
-    let parsed;
-    try {
-      parsed = JSON.parse(content);
-    } catch (err) {
-      throw new Error(`Invalid JSON in ${filePath}: ${formatJsonError(content, err)}`, {
-        cause: err
-      });
-    }
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error(
-        `Invalid config in ${filePath}: expected a JSON object at the root, got ${Array.isArray(parsed) ? "an array" : typeof parsed}`
-      );
-    }
-    warnUnknownKeys(parsed, filePath);
-    return parsed;
+    return parseConfigContent(content, filePath);
   }
   return null;
 }
+function loadConfigFromExplicitPath(configPath) {
+  let content;
+  try {
+    content = fs8.readFileSync(configPath, "utf-8");
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new Error(`could not load config from ${configPath}: ${detail}`, { cause: err });
+  }
+  return parseConfigContent(content, configPath);
+}
 var import_fast_levenshtein2, levenshtein2, KNOWN_CONFIG_KEYS, CONFIG_FILENAMES;
 var init_config2 = __esm({
   "src/core/config.ts"() {
@@ -53455,7 +53563,14 @@ var init_config2 = __esm({
       "tokenThresholds",
       "contextFiles",
       "mcp",
-      "mcpGlobal"
+      "mcpOnly",
+      "mcpGlobal",
+      "mcph",
+      "mcphOnly",
+      "mcphGlobal",
+      "mcphStrictEnvToken",
+      "session",
+      "sessionOnly"
     ];
     CONFIG_FILENAMES = [".ctxlintrc", ".ctxlintrc.json"];
   }
@@ -53466,8 +53581,8 @@ var cli_exports = {};
 __export(cli_exports, {
   runCli: () => runCli
 });
-import * as fs10 from "node:fs";
-import * as path13 from "node:path";
+import * as fs9 from "node:fs";
+import * as path12 from "node:path";
 function validateCheckNames(names, source) {
   const invalid = names.filter((n7) => n7 && !VALID_CHECKS.has(n7));
   if (invalid.length > 0) {
@@ -53490,75 +53605,8 @@ async function runCli() {
     "Upgrade mcph-config/prefer-env-token from warning to error (strict env-var-only posture)",
     false
   ).option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
-    const resolvedPath = path13.resolve(projectPath);
-    const configPath = opts.config ? path13.resolve(opts.config) : void 0;
-    const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
-    const mcpGlobal = opts.mcpGlobal || false;
-    const mcpOnly = opts.mcpOnly || false;
-    const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
-    const mcphGlobal = opts.mcphGlobal || false;
-    const mcphOnly = opts.mcphOnly || false;
-    const mcphFlag = opts.mcph || mcphGlobal || mcphOnly || false;
-    const mcphStrictEnvToken = opts.mcphStrictEnvToken || false;
-    const sessionFlag = opts.session || false;
-    const sessionOnly = opts.sessionOnly || false;
-    let explicitChecks = opts.checks ? validateCheckNames(
-      opts.checks.split(",").map((c3) => c3.trim()),
-      "--checks"
-    ) : null;
-    if (explicitChecks?.length === 0) explicitChecks = null;
-    const hasMcpInChecks = explicitChecks?.some((c3) => c3.startsWith("mcp-")) || false;
-    const hasMcphInChecks = explicitChecks?.some((c3) => c3.startsWith("mcph-")) || false;
-    const hasSessionInChecks = explicitChecks?.some((c3) => c3.startsWith("session-")) || false;
-    const effectiveMcp = mcpFlag || hasMcpInChecks;
-    const effectiveMcph = mcphFlag || hasMcphInChecks;
-    const effectiveSession = sessionFlag || sessionOnly || hasSessionInChecks;
-    let checks;
-    if (explicitChecks) {
-      checks = explicitChecks;
-    } else if (sessionOnly) {
-      checks = ALL_SESSION_CHECKS;
-    } else if (mcpOnly) {
-      checks = ALL_MCP_CHECKS;
-    } else if (mcphOnly) {
-      checks = ALL_MCPH_CHECKS;
-    } else {
-      const base = config2?.checks || ALL_CHECKS;
-      checks = [
-        ...base,
-        ...effectiveMcp ? ALL_MCP_CHECKS : [],
-        ...effectiveMcph ? ALL_MCPH_CHECKS : [],
-        ...effectiveSession ? ALL_SESSION_CHECKS : []
-      ];
-    }
-    const options = {
-      projectPath: resolvedPath,
-      checks,
-      strict: opts.strict || config2?.strict || false,
-      format: opts.format,
-      verbose: opts.verbose,
-      fix: opts.fix,
-      ignore: opts.ignore ? validateCheckNames(
-        opts.ignore.split(",").map((c3) => c3.trim()),
-        "--ignore"
-      ) : config2?.ignore || [],
-      tokensOnly: opts.tokens,
-      quiet: opts.quiet,
-      depth: Math.max(0, Math.min(parseInt(opts.depth, 10) || 2, 10)),
-      mcp: effectiveMcp,
-      mcpOnly,
-      mcpGlobal: mcpGlobal || config2?.mcpGlobal || false,
-      mcph: effectiveMcph,
-      mcphOnly,
-      mcphGlobal,
-      mcphStrictEnvToken,
-      session: effectiveSession,
-      sessionOnly
-    };
-    if (config2?.tokenThresholds) {
-      setTokenThresholds(config2.tokenThresholds);
-    }
-    const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
+    const resolvedPath = path12.resolve(projectPath);
+    const { config: config2, options, activeChecks } = resolveSession(resolvedPath, opts);
     const spinner = options.format === "text" && !options.quiet ? ora("Scanning for context files...").start() : void 0;
     try {
       if (spinner) spinner.text = "Running checks...";
@@ -53672,34 +53720,43 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       const chalk2 = (await Promise.resolve().then(() => (init_source(), source_exports))).default;
       console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
       const watchPaths = [
-        path13.join(resolvedPath, "CLAUDE.md"),
-        path13.join(resolvedPath, "CLAUDE.local.md"),
-        path13.join(resolvedPath, "AGENTS.md"),
-        path13.join(resolvedPath, "AGENT.md"),
-        path13.join(resolvedPath, ".cursorrules"),
-        path13.join(resolvedPath, ".windsurfrules"),
-        path13.join(resolvedPath, ".clinerules"),
-        path13.join(resolvedPath, ".aiderules"),
-        path13.join(resolvedPath, ".continuerules"),
-        path13.join(resolvedPath, ".rules"),
-        path13.join(resolvedPath, ".goosehints"),
-        path13.join(resolvedPath, "GEMINI.md"),
-        path13.join(resolvedPath, "replit.md"),
-        path13.join(resolvedPath, "package.json"),
-        path13.join(resolvedPath, ".mcp.json")
+        path12.join(resolvedPath, "CLAUDE.md"),
+        path12.join(resolvedPath, "CLAUDE.local.md"),
+        path12.join(resolvedPath, "AGENTS.md"),
+        path12.join(resolvedPath, "AGENT.md"),
+        path12.join(resolvedPath, ".cursorrules"),
+        path12.join(resolvedPath, ".windsurfrules"),
+        path12.join(resolvedPath, ".clinerules"),
+        path12.join(resolvedPath, ".aiderules"),
+        path12.join(resolvedPath, ".continuerules"),
+        path12.join(resolvedPath, ".rules"),
+        path12.join(resolvedPath, ".goosehints"),
+        path12.join(resolvedPath, "GEMINI.md"),
+        path12.join(resolvedPath, "replit.md"),
+        path12.join(resolvedPath, "package.json"),
+        path12.join(resolvedPath, ".mcp.json"),
+        // mcph configs — without these, edits to the .mcph.json the user is
+        // actively iterating on don't trigger a re-lint.
+        path12.join(resolvedPath, ".mcph.json"),
+        path12.join(resolvedPath, ".mcph.local.json"),
+        // ctxlint config — re-resolve on edit so threshold changes,
+        // ignore-list edits, and check-list overrides take effect without
+        // restarting the watcher.
+        path12.join(resolvedPath, ".ctxlintrc"),
+        path12.join(resolvedPath, ".ctxlintrc.json")
       ];
       const watchDirs = [
-        path13.join(resolvedPath, ".claude"),
-        path13.join(resolvedPath, ".cursor"),
-        path13.join(resolvedPath, ".github"),
-        path13.join(resolvedPath, ".windsurf"),
-        path13.join(resolvedPath, ".aide"),
-        path13.join(resolvedPath, ".amazonq"),
-        path13.join(resolvedPath, ".goose"),
-        path13.join(resolvedPath, ".junie"),
-        path13.join(resolvedPath, ".aiassistant"),
-        path13.join(resolvedPath, ".continue"),
-        path13.join(resolvedPath, ".vscode")
+        path12.join(resolvedPath, ".claude"),
+        path12.join(resolvedPath, ".cursor"),
+        path12.join(resolvedPath, ".github"),
+        path12.join(resolvedPath, ".windsurf"),
+        path12.join(resolvedPath, ".aide"),
+        path12.join(resolvedPath, ".amazonq"),
+        path12.join(resolvedPath, ".goose"),
+        path12.join(resolvedPath, ".junie"),
+        path12.join(resolvedPath, ".aiassistant"),
+        path12.join(resolvedPath, ".continue"),
+        path12.join(resolvedPath, ".vscode")
       ];
       const watchers = [];
       let debounceTimer = null;
@@ -53707,30 +53764,46 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         if (debounceTimer) clearTimeout(debounceTimer);
         debounceTimer = setTimeout(async () => {
           if (process.stdout.isTTY) console.clear();
+          let liveConfig = config2;
+          let liveOptions = options;
+          let liveActiveChecks = activeChecks;
+          try {
+            const resolved = resolveSession(resolvedPath, opts);
+            liveConfig = resolved.config;
+            liveOptions = resolved.options;
+            liveActiveChecks = resolved.activeChecks;
+          } catch (err) {
+            console.error("Error reloading config:", err instanceof Error ? err.message : err);
+          }
           try {
-            const result = await runAudit(resolvedPath, activeChecks, {
-              depth: options.depth,
-              extraPatterns: config2?.contextFiles,
-              mcp: options.mcp,
-              mcpGlobal: options.mcpGlobal,
-              mcpOnly: options.mcpOnly,
-              mcph: options.mcph,
-              mcphGlobal: options.mcphGlobal,
-              mcphOnly: options.mcphOnly,
-              mcphStrictEnvToken: options.mcphStrictEnvToken,
-              session: options.session,
-              sessionOnly: options.sessionOnly
+            if (liveConfig?.tokenThresholds) {
+              setTokenThresholds(liveConfig.tokenThresholds);
+            } else {
+              resetTokenThresholds();
+            }
+            const result = await runAudit(resolvedPath, liveActiveChecks, {
+              depth: liveOptions.depth,
+              extraPatterns: liveConfig?.contextFiles,
+              mcp: liveOptions.mcp,
+              mcpGlobal: liveOptions.mcpGlobal,
+              mcpOnly: liveOptions.mcpOnly,
+              mcph: liveOptions.mcph,
+              mcphGlobal: liveOptions.mcphGlobal,
+              mcphOnly: liveOptions.mcphOnly,
+              mcphStrictEnvToken: liveOptions.mcphStrictEnvToken,
+              session: liveOptions.session,
+              sessionOnly: liveOptions.sessionOnly
             });
             if (result.files.length === 0) {
               console.log("\nNo context files found.\n");
-            } else if (options.tokensOnly) {
+            } else if (liveOptions.tokensOnly) {
               console.log(formatTokenReport(result));
-            } else if (options.format === "json") {
+            } else if (liveOptions.format === "json") {
               console.log(formatJson(result));
-            } else if (options.format === "sarif") {
+            } else if (liveOptions.format === "sarif") {
               console.log(formatSarif(result));
             } else {
-              console.log(formatText(result, options.verbose));
+              console.log(formatText(result, liveOptions.verbose));
             }
           } catch (err) {
             console.error("Error:", err instanceof Error ? err.message : err);
@@ -53740,20 +53813,19 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             resetPathsCache();
             resetPackageJsonCache();
             resetTokenThresholds();
-            if (config2?.tokenThresholds) setTokenThresholds(config2.tokenThresholds);
           }
           console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
         }, 300);
       };
       for (const filePath of watchPaths) {
         try {
-          watchers.push(fs10.watch(filePath, rerun));
+          watchers.push(fs9.watch(filePath, rerun));
         } catch {
         }
       }
       for (const dir of watchDirs) {
         try {
-          watchers.push(fs10.watch(dir, { recursive: true }, rerun));
+          watchers.push(fs9.watch(dir, { recursive: true }, rerun));
         } catch {
         }
       }
@@ -53774,17 +53846,17 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
     }
   });
   program2.command("init").description("Set up a git pre-commit hook that runs ctxlint --strict").argument("[path]", "Project directory", ".").action(async (projectPath) => {
-    const resolvedRoot = path13.resolve(projectPath);
-    const gitDir = path13.join(resolvedRoot, ".git");
-    const hooksDir = path13.join(gitDir, "hooks");
-    if (!fs10.existsSync(gitDir)) {
+    const resolvedRoot = path12.resolve(projectPath);
+    const gitDir = path12.join(resolvedRoot, ".git");
+    const hooksDir = path12.join(gitDir, "hooks");
+    if (!fs9.existsSync(gitDir)) {
       console.error('Error: not a git repository. Run "git init" first.');
       process.exit(1);
     }
-    if (!fs10.existsSync(hooksDir)) {
-      fs10.mkdirSync(hooksDir, { recursive: true });
+    if (!fs9.existsSync(hooksDir)) {
+      fs9.mkdirSync(hooksDir, { recursive: true });
     }
-    const hookPath = path13.join(hooksDir, "pre-commit");
+    const hookPath = path12.join(hooksDir, "pre-commit");
     const fullHookContent = `#!/bin/sh
 # ctxlint pre-commit hook
 npx @yawlabs/ctxlint@${VERSION} --strict
@@ -53793,16 +53865,16 @@ npx @yawlabs/ctxlint@${VERSION} --strict
 # ctxlint pre-commit hook
 npx @yawlabs/ctxlint@${VERSION} --strict
 `;
-    if (fs10.existsSync(hookPath)) {
-      const existing = fs10.readFileSync(hookPath, "utf-8");
+    if (fs9.existsSync(hookPath)) {
+      const existing = fs9.readFileSync(hookPath, "utf-8");
       if (existing.includes("ctxlint")) {
         console.log("Pre-commit hook already includes ctxlint.");
         return;
       }
-      fs10.appendFileSync(hookPath, appendHookContent);
+      fs9.appendFileSync(hookPath, appendHookContent);
       console.log("Added ctxlint to existing pre-commit hook.");
     } else {
-      fs10.writeFileSync(hookPath, fullHookContent, { mode: 493 });
+      fs9.writeFileSync(hookPath, fullHookContent, { mode: 493 });
       console.log("Created pre-commit hook at .git/hooks/pre-commit");
     }
     console.log("ctxlint will now run automatically before each commit.");
@@ -53819,13 +53891,83 @@ async function promptYesNo(question) {
     rl.close();
   }
 }
+function resolveSession(resolvedPath, opts) {
+  const configPath = opts.config ? path12.resolve(opts.config) : void 0;
+  const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
+  const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
+  const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
+  const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
+  const mcphGlobal = opts.mcphGlobal || config2?.mcphGlobal || false;
+  const mcphOnly = opts.mcphOnly || config2?.mcphOnly || false;
+  const mcphFlag = opts.mcph || mcphGlobal || mcphOnly || config2?.mcph || false;
+  const mcphStrictEnvToken = opts.mcphStrictEnvToken || config2?.mcphStrictEnvToken || false;
+  const sessionOnly = opts.sessionOnly || config2?.sessionOnly || false;
+  const sessionFlag = opts.session || sessionOnly || config2?.session || false;
+  let explicitChecks = opts.checks ? validateCheckNames(
+    opts.checks.split(",").map((c3) => c3.trim()),
+    "--checks"
+  ) : null;
+  if (explicitChecks?.length === 0) explicitChecks = null;
+  const hasMcpInChecks = explicitChecks?.some((c3) => c3.startsWith("mcp-") && !c3.startsWith("mcph-")) || false;
+  const hasMcphInChecks = explicitChecks?.some((c3) => c3.startsWith("mcph-")) || false;
+  const hasSessionInChecks = explicitChecks?.some((c3) => c3.startsWith("session-")) || false;
+  const effectiveMcp = mcpFlag || hasMcpInChecks;
+  const effectiveMcph = mcphFlag || hasMcphInChecks;
+  const effectiveSession = sessionFlag || sessionOnly || hasSessionInChecks;
+  let checks;
+  if (explicitChecks) {
+    checks = explicitChecks;
+  } else if (sessionOnly) {
+    checks = ALL_SESSION_CHECKS;
+  } else if (mcpOnly) {
+    checks = ALL_MCP_CHECKS;
+  } else if (mcphOnly) {
+    checks = ALL_MCPH_CHECKS;
+  } else {
+    const base = config2?.checks || ALL_CHECKS;
+    checks = [
+      ...base,
+      ...effectiveMcp ? ALL_MCP_CHECKS : [],
+      ...effectiveMcph ? ALL_MCPH_CHECKS : [],
+      ...effectiveSession ? ALL_SESSION_CHECKS : []
+    ];
+  }
+  const options = {
+    projectPath: resolvedPath,
+    checks,
+    strict: opts.strict || config2?.strict || false,
+    format: opts.format,
+    verbose: opts.verbose,
+    fix: opts.fix,
+    ignore: opts.ignore ? validateCheckNames(
+      opts.ignore.split(",").map((c3) => c3.trim()),
+      "--ignore"
+    ) : config2?.ignore || [],
+    tokensOnly: opts.tokens,
+    quiet: opts.quiet,
+    depth: Math.max(0, Math.min(parseInt(opts.depth, 10) || 2, 10)),
+    mcp: effectiveMcp,
+    mcpOnly,
+    mcpGlobal,
+    mcph: effectiveMcph,
+    mcphOnly,
+    mcphGlobal,
+    mcphStrictEnvToken,
+    session: effectiveSession,
+    sessionOnly
+  };
+  if (config2?.tokenThresholds) {
+    setTokenThresholds(config2.tokenThresholds);
+  }
+  const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
+  return { config: config2, options, activeChecks };
+}
 function loadConfigFromPath(configPath) {
   try {
-    const content = fs10.readFileSync(configPath, "utf-8");
-    return JSON.parse(content);
+    return loadConfigFromExplicitPath(configPath);
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`Error: could not load config from ${configPath}: ${detail}`);
+    console.error(`Error: ${detail}`);
     process.exit(2);
   }
 }