@yawlabs/ctxlint 0.9.18 → 0.9.19

package/.pre-commit-hooks.yaml

@@ -4,7 +4,7 @@
   # Version-pinned so a checkout at `rev: vX.Y.Z` runs exactly that release
   # of ctxlint — matches the pinning done by `ctxlint init`. release.sh keeps
   # this in sync with package.json on each bump.
-  entry: npx @yawlabs/ctxlint@0.9.18 --strict
+  entry: npx @yawlabs/ctxlint@0.9.19 --strict
   language: node
   always_run: true
   pass_filenames: false

package/README.md

@@ -28,7 +28,7 @@ ctxlint is a linter purpose-built for this. It reads your context files, cross-r
 - **Token-aware** — shows how much context window your files consume and flags redundant content
 - **Every AI tool** — supports Claude Code, Cursor, Copilot, Windsurf, Gemini, Cline, Aider, and 14 more
 - **Multiple outputs** — text, JSON, and SARIF (GitHub Code Scanning)
-- **MCP server** — 6 tools for IDE/agent integration with tool annotations for auto-approval
+- **MCP server** — 7 tools for IDE/agent integration with tool annotations for auto-approval
 - **Watch mode** — `--watch` re-lints automatically when context files change
 
 ## Install
@@ -404,7 +404,7 @@ CLI flags override config file settings. Use `--config <path>` to load a config
 
 ## Use as MCP Server
 
-ctxlint ships with an MCP server that exposes six tools (`ctxlint_audit`, `ctxlint_mcp_audit`, `ctxlint_session_audit`, `ctxlint_validate_path`, `ctxlint_token_report`, `ctxlint_fix`). All read-only tools declare annotations so MCP clients can skip confirmation dialogs.
+ctxlint ships with an MCP server that exposes seven tools (`ctxlint_audit`, `ctxlint_mcp_audit`, `ctxlint_mcph_audit`, `ctxlint_session_audit`, `ctxlint_validate_path`, `ctxlint_token_report`, `ctxlint_fix`). All read-only tools declare annotations so MCP clients can skip confirmation dialogs.
 
 Launch it with the `serve` subcommand (or the equivalent `--mcp-server` flag, kept for back-compat):
 

package/dist/index.js

@@ -41316,6 +41316,28 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
+function getNodeValue(node) {
+  switch (node.type) {
+    case "array":
+      return node.children.map(getNodeValue);
+    case "object":
+      const obj = /* @__PURE__ */ Object.create(null);
+      for (let prop of node.children) {
+        const valueNode = prop.children[1];
+        if (valueNode) {
+          obj[prop.children[0].value] = getNodeValue(valueNode);
+        }
+      }
+      return obj;
+    case "null":
+    case "string":
+    case "number":
+    case "boolean":
+      return node.value;
+    default:
+      return void 0;
+  }
+}
 function visit(text, visitor, options = ParseOptions.DEFAULT) {
   const _scanner = createScanner(text, false);
   const _jsonPath = [];
@@ -41664,7 +41686,7 @@ var init_edit = __esm({
 });
 
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js
-var ScanError, SyntaxKind, parseTree2, ParseErrorCode;
+var ScanError, SyntaxKind, parseTree2, getNodeValue2, ParseErrorCode;
 var init_main = __esm({
   "node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js"() {
     "use strict";
@@ -41701,6 +41723,7 @@ var init_main = __esm({
       SyntaxKind2[SyntaxKind2["EOF"] = 17] = "EOF";
     })(SyntaxKind || (SyntaxKind = {}));
     parseTree2 = parseTree;
+    getNodeValue2 = getNodeValue;
     (function(ParseErrorCode2) {
       ParseErrorCode2[ParseErrorCode2["InvalidSymbol"] = 1] = "InvalidSymbol";
       ParseErrorCode2[ParseErrorCode2["InvalidNumberFormat"] = 2] = "InvalidNumberFormat";
@@ -41754,11 +41777,7 @@ async function parseMchpConfig(file2, projectRoot, scopeOverride) {
     result.parseErrors.push(".mcph.json must be a JSON object at the root");
     return result;
   }
-  try {
-    result.raw = JSON.parse(stripComments2(content));
-  } catch {
-    return result;
-  }
+  result.raw = getNodeValue2(tree);
   const rootProps = tree.children ?? [];
   for (const prop of rootProps) {
     if (prop.type !== "property" || !prop.children || prop.children.length < 2) continue;
@@ -41816,46 +41835,6 @@ function offsetToPosition(content, offset) {
   }
   return { line, column };
 }
-function stripComments2(src) {
-  let out = "";
-  let i2 = 0;
-  let inString = false;
-  let escape2 = false;
-  while (i2 < src.length) {
-    const ch = src[i2];
-    if (inString) {
-      out += ch;
-      if (escape2) {
-        escape2 = false;
-      } else if (ch === "\\") {
-        escape2 = true;
-      } else if (ch === '"') {
-        inString = false;
-      }
-      i2++;
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      out += ch;
-      i2++;
-      continue;
-    }
-    if (ch === "/" && src[i2 + 1] === "/") {
-      while (i2 < src.length && src[i2] !== "\n") i2++;
-      continue;
-    }
-    if (ch === "/" && src[i2 + 1] === "*") {
-      i2 += 2;
-      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) i2++;
-      i2 += 2;
-      continue;
-    }
-    out += ch;
-    i2++;
-  }
-  return out;
-}
 async function checkGitTracked2(filePath, projectRoot) {
   try {
     const git = getGit(projectRoot);
@@ -45242,7 +45221,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.18";
+  if (true) return "0.9.19";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -46190,6 +46169,8 @@ function applyFixes(result, options = {}) {
       existing.push(fix);
       fixesByLine.set(fix.line, existing);
     }
+    let perFileFixCount = 0;
+    const perFileLogs = [];
     for (const [lineNum, lineFixes] of fixesByLine) {
       const lineIdx = lineNum - 1;
       if (lineIdx < 0 || lineIdx >= lines.length) continue;
@@ -46197,9 +46178,9 @@ function applyFixes(result, options = {}) {
       for (const fix of lineFixes) {
         if (line.includes(fix.oldText)) {
           line = line.replaceAll(fix.oldText, fix.newText);
-          totalFixes++;
+          perFileFixCount++;
           const prefix = dryRun ? source_default.cyan("  Would fix") : source_default.green("  Fixed");
-          log(
+          perFileLogs.push(
             prefix + ` Line ${fix.line}: ${source_default.dim(fix.oldText)} ${source_default.dim("->")} ${fix.newText}`
           );
         }
@@ -46223,6 +46204,8 @@ function applyFixes(result, options = {}) {
         fs7.writeFileSync(filePath, newContent, "utf-8");
       }
       filesModified.push(filePath);
+      totalFixes += perFileFixCount;
+      for (const m of perFileLogs) log(m);
     }
   }
   return { totalFixes, filesModified };
@@ -46253,7 +46236,7 @@ function validateFilePathInput(rawPath) {
     throw new Error("path contains disallowed characters");
   }
 }
-var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
+var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
 var init_server3 = __esm({
   async "src/mcp/server.ts"() {
     "use strict";
@@ -46272,6 +46255,7 @@ var init_server3 = __esm({
     init_version2();
     contextCheckEnum = external_exports3.enum(ALL_CHECKS);
     mcpCheckEnum = external_exports3.enum(ALL_MCP_CHECKS);
+    mcphCheckEnum = external_exports3.enum(ALL_MCPH_CHECKS);
     sessionCheckEnum = external_exports3.enum(ALL_SESSION_CHECKS);
     PATH_DISALLOWED = /[\n\r\t;`|]|\$\(|\$\{/;
     server = new McpServer({
@@ -46493,6 +46477,48 @@ var init_server3 = __esm({
         }
       }
     );
+    server.tool(
+      "ctxlint_mcph_audit",
+      "Lint .mcph.json (the @yawlabs/mcph CLI config) files. Checks for PAT (mcp_pat_*) leakage in git-tracked project-scope files, environment-variable posture, plaintext HTTP apiBase to public hosts, schema drift, allow/deny list conflicts and duplicates, and machine-local override files not covered by .gitignore. Distinct from ctxlint_mcp_audit, which lints client-side .mcp.json server lists.",
+      {
+        projectPath: external_exports3.string().optional().describe("Path to the project root. Defaults to current working directory."),
+        checks: external_exports3.array(mcphCheckEnum).optional().describe("Specific mcph checks to run (default: all mcph-* checks)."),
+        includeGlobal: external_exports3.boolean().optional().describe("Also scan ~/.mcph.json (user-global config)."),
+        strictEnvToken: external_exports3.boolean().optional().describe(
+          "Upgrade mcph-config/prefer-env-token from warning to error (env-var-only posture)."
+        )
+      },
+      {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      },
+      async ({ projectPath, checks, includeGlobal, strictEnvToken }) => {
+        try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_MCPH_CHECKS;
+          const result = await runAudit(root, activeChecks, {
+            mcph: true,
+            mcphOnly: true,
+            mcphGlobal: includeGlobal || false,
+            mcphStrictEnvToken: strictEnvToken || false
+          });
+          return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: msg }) }],
+            isError: true
+          };
+        } finally {
+          freeEncoder();
+          resetGit();
+          resetPathsCache();
+          resetPackageJsonCache();
+        }
+      }
+    );
     server.tool(
       "ctxlint_session_audit",
       "Audit AI agent session data for cross-project consistency. Checks for missing GitHub secrets, diverged config files, missing workflows, stale memory entries, and duplicate memories across sibling repositories.",
@@ -53008,6 +53034,24 @@ var init_ora = __esm({
 });
 
 // src/core/reporter.ts
+function classifyFile(f) {
+  if (f.path === "(mcp)") return "mcp";
+  if (f.path.includes("session audit")) return "session";
+  for (const issue2 of f.issues) {
+    if (issue2.check.startsWith("session-")) return "session";
+    if (issue2.check.startsWith("mcph-")) return "mcph";
+    if (issue2.check.startsWith("mcp-")) return "mcp";
+  }
+  const norm = f.path.replace(/\\/g, "/");
+  if (norm.endsWith(".mcph.json") || norm.endsWith(".mcph.local.json")) return "mcph";
+  if (norm === ".mcp.json" || norm.endsWith("/.mcp.json") || norm.endsWith("/mcp.json") || norm.includes("/mcpServers/") || norm.endsWith("/.claude.json") || norm.endsWith(".claude/settings.json") || norm.endsWith("claude_desktop_config.json")) {
+    return "mcp";
+  }
+  return "context";
+}
+function isSyntheticBucket(p2) {
+  return p2.startsWith("(") || p2.includes("session audit");
+}
 function formatText(result, verbose = false) {
   const lines = [];
   lines.push("");
@@ -53015,30 +53059,45 @@ function formatText(result, verbose = false) {
   lines.push("");
   lines.push(`Scanning ${result.projectRoot}...`);
   lines.push("");
-  const isMcpFile = (f) => f.issues.some((i2) => i2.check.startsWith("mcp-"));
-  const contextFiles = result.files.filter((f) => !isMcpFile(f));
-  const mcpFiles = result.files.filter((f) => isMcpFile(f));
+  const groups = {
+    context: [],
+    mcp: [],
+    mcph: [],
+    session: []
+  };
+  for (const f of result.files) {
+    groups[classifyFile(f)].push(f);
+  }
   const totalTokens = result.summary.totalTokens;
-  if (contextFiles.length > 0) {
+  let renderedAnySummary = false;
+  const contextReal = groups.context.filter((f) => !isSyntheticBucket(f.path));
+  if (contextReal.length > 0) {
     lines.push(
-      `Found ${contextFiles.length} context file${contextFiles.length !== 1 ? "s" : ""} (${totalTokens.toLocaleString()} tokens total)`
+      `Found ${contextReal.length} context file${contextReal.length !== 1 ? "s" : ""} (${totalTokens.toLocaleString()} tokens total)`
     );
-    for (const file2 of contextFiles) {
+    for (const file2 of contextReal) {
       let desc = `  ${file2.path} (${file2.tokens.toLocaleString()} tokens, ${file2.lines} lines)`;
       if (file2.isSymlink && file2.symlinkTarget) {
         desc = `  ${file2.path} ${source_default.dim(`-> ${file2.symlinkTarget} (symlink)`)}`;
       }
       lines.push(desc);
     }
+    renderedAnySummary = true;
   }
-  if (mcpFiles.length > 0) {
-    if (contextFiles.length > 0) lines.push("");
-    lines.push(`Found ${mcpFiles.length} MCP config${mcpFiles.length !== 1 ? "s" : ""}`);
-    for (const file2 of mcpFiles) {
-      lines.push(`  ${file2.path}`);
-    }
+  for (const g of ["mcp", "mcph"]) {
+    const real = groups[g].filter((f) => !isSyntheticBucket(f.path));
+    if (real.length === 0) continue;
+    if (renderedAnySummary) lines.push("");
+    lines.push(`Found ${real.length} ${GROUP_SUMMARY_NOUNS[g]}${real.length !== 1 ? "s" : ""}`);
+    for (const file2 of real) lines.push(`  ${file2.path}`);
+    renderedAnySummary = true;
+  }
+  if (groups.session.length > 0) {
+    if (renderedAnySummary) lines.push("");
+    lines.push("Session audit scanned");
+    renderedAnySummary = true;
   }
-  if (contextFiles.length === 0 && mcpFiles.length === 0) {
+  if (!renderedAnySummary) {
     lines.push(`Found ${result.files.length} file${result.files.length !== 1 ? "s" : ""}`);
   }
   lines.push("");
@@ -53057,16 +53116,13 @@ function formatText(result, verbose = false) {
       lines.push("");
     }
   };
-  if (contextFiles.length > 0 && mcpFiles.length > 0) {
-    const contextWithIssues = contextFiles.filter((f) => f.issues.length > 0 || verbose);
-    const mcpWithIssues = mcpFiles.filter((f) => f.issues.length > 0 || verbose);
-    if (contextWithIssues.length > 0) {
-      lines.push(source_default.bold("Context Files"));
-      renderFileGroup(contextFiles);
-    }
-    if (mcpWithIssues.length > 0) {
-      lines.push(source_default.bold("MCP Configs"));
-      renderFileGroup(mcpFiles);
+  const groupsToRender = GROUP_ORDER.filter(
+    (g) => groups[g].some((f) => f.issues.length > 0 || verbose)
+  );
+  if (groupsToRender.length > 1) {
+    for (const g of groupsToRender) {
+      lines.push(source_default.bold(GROUP_LABELS[g]));
+      renderFileGroup(groups[g]);
     }
   } else {
     renderFileGroup(result.files);
@@ -53282,6 +53338,31 @@ function buildRuleDescriptors() {
       shortDescription: { text: "Redundant MCP config entry" },
       helpUri: "https://github.com/yawlabs/ctxlint#mcp-config-linting"
     },
+    {
+      id: "ctxlint/mcph-token-security",
+      shortDescription: { text: "mcp.hosting PAT leakage or env-var posture" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-apibase",
+      shortDescription: { text: "mcph apiBase URL validation" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-schema-conformance",
+      shortDescription: { text: "mcph config unknown field or stale schema version" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-lists",
+      shortDescription: { text: "mcph allow/deny list conflict or duplicate entry" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-gitignore",
+      shortDescription: { text: "mcph machine-local file not covered by .gitignore" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
     {
       id: "ctxlint/session-missing-secret",
       shortDescription: { text: "GitHub secret set on sibling repos but missing here" },
@@ -53335,10 +53416,24 @@ function formatIssue(issue2) {
   }
   return line;
 }
+var GROUP_ORDER, GROUP_LABELS, GROUP_SUMMARY_NOUNS;
 var init_reporter = __esm({
   "src/core/reporter.ts"() {
     "use strict";
     init_source();
+    GROUP_ORDER = ["context", "mcp", "mcph", "session"];
+    GROUP_LABELS = {
+      context: "Context Files",
+      mcp: "MCP Configs",
+      mcph: "mcph Configs",
+      session: "Session Audit"
+    };
+    GROUP_SUMMARY_NOUNS = {
+      context: "context file",
+      mcp: "MCP config",
+      mcph: "mcph config",
+      session: "session audit"
+    };
   }
 });
 
@@ -53511,74 +53606,7 @@ async function runCli() {
     false
   ).option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
     const resolvedPath = path12.resolve(projectPath);
-    const configPath = opts.config ? path12.resolve(opts.config) : void 0;
-    const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
-    const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
-    const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
-    const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
-    const mcphGlobal = opts.mcphGlobal || config2?.mcphGlobal || false;
-    const mcphOnly = opts.mcphOnly || config2?.mcphOnly || false;
-    const mcphFlag = opts.mcph || mcphGlobal || mcphOnly || config2?.mcph || false;
-    const mcphStrictEnvToken = opts.mcphStrictEnvToken || config2?.mcphStrictEnvToken || false;
-    const sessionOnly = opts.sessionOnly || config2?.sessionOnly || false;
-    const sessionFlag = opts.session || sessionOnly || config2?.session || false;
-    let explicitChecks = opts.checks ? validateCheckNames(
-      opts.checks.split(",").map((c3) => c3.trim()),
-      "--checks"
-    ) : null;
-    if (explicitChecks?.length === 0) explicitChecks = null;
-    const hasMcpInChecks = explicitChecks?.some((c3) => c3.startsWith("mcp-")) || false;
-    const hasMcphInChecks = explicitChecks?.some((c3) => c3.startsWith("mcph-")) || false;
-    const hasSessionInChecks = explicitChecks?.some((c3) => c3.startsWith("session-")) || false;
-    const effectiveMcp = mcpFlag || hasMcpInChecks;
-    const effectiveMcph = mcphFlag || hasMcphInChecks;
-    const effectiveSession = sessionFlag || sessionOnly || hasSessionInChecks;
-    let checks;
-    if (explicitChecks) {
-      checks = explicitChecks;
-    } else if (sessionOnly) {
-      checks = ALL_SESSION_CHECKS;
-    } else if (mcpOnly) {
-      checks = ALL_MCP_CHECKS;
-    } else if (mcphOnly) {
-      checks = ALL_MCPH_CHECKS;
-    } else {
-      const base = config2?.checks || ALL_CHECKS;
-      checks = [
-        ...base,
-        ...effectiveMcp ? ALL_MCP_CHECKS : [],
-        ...effectiveMcph ? ALL_MCPH_CHECKS : [],
-        ...effectiveSession ? ALL_SESSION_CHECKS : []
-      ];
-    }
-    const options = {
-      projectPath: resolvedPath,
-      checks,
-      strict: opts.strict || config2?.strict || false,
-      format: opts.format,
-      verbose: opts.verbose,
-      fix: opts.fix,
-      ignore: opts.ignore ? validateCheckNames(
-        opts.ignore.split(",").map((c3) => c3.trim()),
-        "--ignore"
-      ) : config2?.ignore || [],
-      tokensOnly: opts.tokens,
-      quiet: opts.quiet,
-      depth: Math.max(0, Math.min(parseInt(opts.depth, 10) || 2, 10)),
-      mcp: effectiveMcp,
-      mcpOnly,
-      mcpGlobal,
-      mcph: effectiveMcph,
-      mcphOnly,
-      mcphGlobal,
-      mcphStrictEnvToken,
-      session: effectiveSession,
-      sessionOnly
-    };
-    if (config2?.tokenThresholds) {
-      setTokenThresholds(config2.tokenThresholds);
-    }
-    const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
+    const { config: config2, options, activeChecks } = resolveSession(resolvedPath, opts);
     const spinner = options.format === "text" && !options.quiet ? ora("Scanning for context files...").start() : void 0;
     try {
       if (spinner) spinner.text = "Running checks...";
@@ -53706,7 +53734,16 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         path12.join(resolvedPath, "GEMINI.md"),
         path12.join(resolvedPath, "replit.md"),
         path12.join(resolvedPath, "package.json"),
-        path12.join(resolvedPath, ".mcp.json")
+        path12.join(resolvedPath, ".mcp.json"),
+        // mcph configs — without these, edits to the .mcph.json the user is
+        // actively iterating on don't trigger a re-lint.
+        path12.join(resolvedPath, ".mcph.json"),
+        path12.join(resolvedPath, ".mcph.local.json"),
+        // ctxlint config — re-resolve on edit so threshold changes,
+        // ignore-list edits, and check-list overrides take effect without
+        // restarting the watcher.
+        path12.join(resolvedPath, ".ctxlintrc"),
+        path12.join(resolvedPath, ".ctxlintrc.json")
       ];
       const watchDirs = [
         path12.join(resolvedPath, ".claude"),
@@ -53727,30 +53764,46 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         if (debounceTimer) clearTimeout(debounceTimer);
         debounceTimer = setTimeout(async () => {
           if (process.stdout.isTTY) console.clear();
+          let liveConfig = config2;
+          let liveOptions = options;
+          let liveActiveChecks = activeChecks;
+          try {
+            const resolved = resolveSession(resolvedPath, opts);
+            liveConfig = resolved.config;
+            liveOptions = resolved.options;
+            liveActiveChecks = resolved.activeChecks;
+          } catch (err) {
+            console.error("Error reloading config:", err instanceof Error ? err.message : err);
+          }
           try {
-            const result = await runAudit(resolvedPath, activeChecks, {
-              depth: options.depth,
-              extraPatterns: config2?.contextFiles,
-              mcp: options.mcp,
-              mcpGlobal: options.mcpGlobal,
-              mcpOnly: options.mcpOnly,
-              mcph: options.mcph,
-              mcphGlobal: options.mcphGlobal,
-              mcphOnly: options.mcphOnly,
-              mcphStrictEnvToken: options.mcphStrictEnvToken,
-              session: options.session,
-              sessionOnly: options.sessionOnly
+            if (liveConfig?.tokenThresholds) {
+              setTokenThresholds(liveConfig.tokenThresholds);
+            } else {
+              resetTokenThresholds();
+            }
+            const result = await runAudit(resolvedPath, liveActiveChecks, {
+              depth: liveOptions.depth,
+              extraPatterns: liveConfig?.contextFiles,
+              mcp: liveOptions.mcp,
+              mcpGlobal: liveOptions.mcpGlobal,
+              mcpOnly: liveOptions.mcpOnly,
+              mcph: liveOptions.mcph,
+              mcphGlobal: liveOptions.mcphGlobal,
+              mcphOnly: liveOptions.mcphOnly,
+              mcphStrictEnvToken: liveOptions.mcphStrictEnvToken,
+              session: liveOptions.session,
+              sessionOnly: liveOptions.sessionOnly
             });
             if (result.files.length === 0) {
               console.log("\nNo context files found.\n");
-            } else if (options.tokensOnly) {
+            } else if (liveOptions.tokensOnly) {
               console.log(formatTokenReport(result));
-            } else if (options.format === "json") {
+            } else if (liveOptions.format === "json") {
               console.log(formatJson(result));
-            } else if (options.format === "sarif") {
+            } else if (liveOptions.format === "sarif") {
               console.log(formatSarif(result));
             } else {
-              console.log(formatText(result, options.verbose));
+              console.log(formatText(result, liveOptions.verbose));
             }
           } catch (err) {
             console.error("Error:", err instanceof Error ? err.message : err);
@@ -53760,7 +53813,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             resetPathsCache();
             resetPackageJsonCache();
             resetTokenThresholds();
-            if (config2?.tokenThresholds) setTokenThresholds(config2.tokenThresholds);
           }
           console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
         }, 300);
@@ -53839,6 +53891,77 @@ async function promptYesNo(question) {
     rl.close();
   }
 }
+function resolveSession(resolvedPath, opts) {
+  const configPath = opts.config ? path12.resolve(opts.config) : void 0;
+  const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
+  const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
+  const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
+  const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
+  const mcphGlobal = opts.mcphGlobal || config2?.mcphGlobal || false;
+  const mcphOnly = opts.mcphOnly || config2?.mcphOnly || false;
+  const mcphFlag = opts.mcph || mcphGlobal || mcphOnly || config2?.mcph || false;
+  const mcphStrictEnvToken = opts.mcphStrictEnvToken || config2?.mcphStrictEnvToken || false;
+  const sessionOnly = opts.sessionOnly || config2?.sessionOnly || false;
+  const sessionFlag = opts.session || sessionOnly || config2?.session || false;
+  let explicitChecks = opts.checks ? validateCheckNames(
+    opts.checks.split(",").map((c3) => c3.trim()),
+    "--checks"
+  ) : null;
+  if (explicitChecks?.length === 0) explicitChecks = null;
+  const hasMcpInChecks = explicitChecks?.some((c3) => c3.startsWith("mcp-") && !c3.startsWith("mcph-")) || false;
+  const hasMcphInChecks = explicitChecks?.some((c3) => c3.startsWith("mcph-")) || false;
+  const hasSessionInChecks = explicitChecks?.some((c3) => c3.startsWith("session-")) || false;
+  const effectiveMcp = mcpFlag || hasMcpInChecks;
+  const effectiveMcph = mcphFlag || hasMcphInChecks;
+  const effectiveSession = sessionFlag || sessionOnly || hasSessionInChecks;
+  let checks;
+  if (explicitChecks) {
+    checks = explicitChecks;
+  } else if (sessionOnly) {
+    checks = ALL_SESSION_CHECKS;
+  } else if (mcpOnly) {
+    checks = ALL_MCP_CHECKS;
+  } else if (mcphOnly) {
+    checks = ALL_MCPH_CHECKS;
+  } else {
+    const base = config2?.checks || ALL_CHECKS;
+    checks = [
+      ...base,
+      ...effectiveMcp ? ALL_MCP_CHECKS : [],
+      ...effectiveMcph ? ALL_MCPH_CHECKS : [],
+      ...effectiveSession ? ALL_SESSION_CHECKS : []
+    ];
+  }
+  const options = {
+    projectPath: resolvedPath,
+    checks,
+    strict: opts.strict || config2?.strict || false,
+    format: opts.format,
+    verbose: opts.verbose,
+    fix: opts.fix,
+    ignore: opts.ignore ? validateCheckNames(
+      opts.ignore.split(",").map((c3) => c3.trim()),
+      "--ignore"
+    ) : config2?.ignore || [],
+    tokensOnly: opts.tokens,
+    quiet: opts.quiet,
+    depth: Math.max(0, Math.min(parseInt(opts.depth, 10) || 2, 10)),
+    mcp: effectiveMcp,
+    mcpOnly,
+    mcpGlobal,
+    mcph: effectiveMcph,
+    mcphOnly,
+    mcphGlobal,
+    mcphStrictEnvToken,
+    session: effectiveSession,
+    sessionOnly
+  };
+  if (config2?.tokenThresholds) {
+    setTokenThresholds(config2.tokenThresholds);
+  }
+  const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
+  return { config: config2, options, activeChecks };
+}
 function loadConfigFromPath(configPath) {
   try {
     return loadConfigFromExplicitPath(configPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.18",
+  "version": "0.9.19",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"