@yawlabs/ctxlint 0.9.18 → 0.9.20

package/dist/index.js

@@ -21934,11 +21934,11 @@ var init_protocol = __esm({
        *
        * The Protocol object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
        */
-      async connect(transport2) {
+      async connect(transport) {
         if (this._transport) {
           throw new Error("Already connected to a transport. Call close() before connecting to a new transport, or use a separate Protocol instance per connection.");
         }
-        this._transport = transport2;
+        this._transport = transport;
         const _onclose = this.transport?.onclose;
         this._transport.onclose = () => {
           _onclose?.();
@@ -26254,49 +26254,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse4(serialize(base, options), options);
-        relative4 = parse4(serialize(relative4, options), options);
+        relative5 = parse4(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -26304,7 +26304,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -30411,8 +30411,8 @@ var init_mcp = __esm({
        *
        * The `server` object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
        */
-      async connect(transport2) {
-        return await this.server.connect(transport2);
+      async connect(transport) {
+        return await this.server.connect(transport);
       }
       /**
        * Closes the connection.
@@ -34201,10 +34201,13 @@ globstar while`, t2, d, e, f, m), this.matchOne(t2.slice(d), e.slice(f), s)) ret
 // src/utils/fs.ts
 import * as fs2 from "node:fs";
 import * as path from "node:path";
+function stripBom(content) {
+  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+}
 function loadPackageJson(projectRoot) {
   if (pkgJsonCache?.root === projectRoot) return pkgJsonCache.data;
   try {
-    const content = fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8");
+    const content = stripBom(fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8"));
     const data = JSON.parse(content);
     pkgJsonCache = { root: projectRoot, data };
     return data;
@@ -34247,7 +34250,7 @@ function readSymlinkTarget(filePath) {
 }
 function readFileContent(filePath) {
   try {
-    return fs2.readFileSync(filePath, "utf-8");
+    return stripBom(fs2.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -40656,10 +40659,9 @@ var init_git = __esm({
 });
 
 // src/core/mcp-parser.ts
-async function parseMcpConfig(file2, projectRoot, scopeOverride) {
+async function parseMcpConfig(file2, projectRoot, scope) {
   const content = readFileContent(file2.absolutePath);
   const client = detectClient(file2.relativePath);
-  const scope = scopeOverride ?? detectScope(file2.relativePath);
   const expectedRootKey = client === "vscode" ? "servers" : "mcpServers";
   const isGitTracked = await checkGitTracked(file2.absolutePath, projectRoot);
   const result = {
@@ -40703,10 +40705,10 @@ async function parseMcpConfig(file2, projectRoot, scopeOverride) {
     }
     const raw = value;
     const line = findServerLine(lines, name);
-    const transport2 = inferTransport(raw);
+    const transport = inferTransport(raw);
     const entry = {
       name,
-      transport: transport2,
+      transport,
       line,
       raw
     };
@@ -40718,7 +40720,7 @@ async function parseMcpConfig(file2, projectRoot, scopeOverride) {
     if (typeof raw.disabled === "boolean") entry.disabled = raw.disabled;
     if (Array.isArray(raw.autoApprove)) entry.autoApprove = raw.autoApprove.map(String);
     if (typeof raw.timeout === "number") entry.timeout = raw.timeout;
-    if (typeof raw.oauth === "object" && raw.oauth !== null)
+    if (typeof raw.oauth === "object" && raw.oauth !== null && !Array.isArray(raw.oauth))
       entry.oauth = raw.oauth;
     if (typeof raw.headersHelper === "string") entry.headersHelper = raw.headersHelper;
     result.servers.push(entry);
@@ -40737,9 +40739,6 @@ function detectClient(relativePath) {
   }
   return "claude-code";
 }
-function detectScope(_relativePath) {
-  return "project";
-}
 function findRootKey(parsed) {
   if ("mcpServers" in parsed) return "mcpServers";
   if ("servers" in parsed) return "servers";
@@ -41316,6 +41315,28 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
+function getNodeValue(node) {
+  switch (node.type) {
+    case "array":
+      return node.children.map(getNodeValue);
+    case "object":
+      const obj = /* @__PURE__ */ Object.create(null);
+      for (let prop of node.children) {
+        const valueNode = prop.children[1];
+        if (valueNode) {
+          obj[prop.children[0].value] = getNodeValue(valueNode);
+        }
+      }
+      return obj;
+    case "null":
+    case "string":
+    case "number":
+    case "boolean":
+      return node.value;
+    default:
+      return void 0;
+  }
+}
 function visit(text, visitor, options = ParseOptions.DEFAULT) {
   const _scanner = createScanner(text, false);
   const _jsonPath = [];
@@ -41664,7 +41685,7 @@ var init_edit = __esm({
 });
 
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js
-var ScanError, SyntaxKind, parseTree2, ParseErrorCode;
+var ScanError, SyntaxKind, parseTree2, getNodeValue2, ParseErrorCode;
 var init_main = __esm({
   "node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js"() {
     "use strict";
@@ -41701,6 +41722,7 @@ var init_main = __esm({
       SyntaxKind2[SyntaxKind2["EOF"] = 17] = "EOF";
     })(SyntaxKind || (SyntaxKind = {}));
     parseTree2 = parseTree;
+    getNodeValue2 = getNodeValue;
     (function(ParseErrorCode2) {
       ParseErrorCode2[ParseErrorCode2["InvalidSymbol"] = 1] = "InvalidSymbol";
       ParseErrorCode2[ParseErrorCode2["InvalidNumberFormat"] = 2] = "InvalidNumberFormat";
@@ -41723,9 +41745,9 @@ var init_main = __esm({
 });
 
 // src/core/mcph-parser.ts
-async function parseMchpConfig(file2, projectRoot, scopeOverride) {
+async function parseMcphConfig(file2, projectRoot, scopeOverride) {
   const content = readFileContent(file2.absolutePath);
-  const scope = scopeOverride ?? detectScope2(file2.relativePath);
+  const scope = scopeOverride ?? detectScope(file2.relativePath);
   const isGitTracked = await checkGitTracked2(file2.absolutePath, projectRoot);
   const isGitignored = await checkGitignored(file2.absolutePath, projectRoot);
   const result = {
@@ -41754,11 +41776,7 @@ async function parseMchpConfig(file2, projectRoot, scopeOverride) {
     result.parseErrors.push(".mcph.json must be a JSON object at the root");
     return result;
   }
-  try {
-    result.raw = JSON.parse(stripComments2(content));
-  } catch {
-    return result;
-  }
+  result.raw = getNodeValue2(tree);
   const rootProps = tree.children ?? [];
   for (const prop of rootProps) {
     if (prop.type !== "property" || !prop.children || prop.children.length < 2) continue;
@@ -41787,7 +41805,7 @@ async function parseMchpConfig(file2, projectRoot, scopeOverride) {
   }
   return result;
 }
-function detectScope2(relativePath) {
+function detectScope(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.startsWith("~/")) return "global";
   if (normalized.endsWith(".mcph.local.json")) return "project-local";
@@ -41816,46 +41834,6 @@ function offsetToPosition(content, offset) {
   }
   return { line, column };
 }
-function stripComments2(src) {
-  let out = "";
-  let i2 = 0;
-  let inString = false;
-  let escape2 = false;
-  while (i2 < src.length) {
-    const ch = src[i2];
-    if (inString) {
-      out += ch;
-      if (escape2) {
-        escape2 = false;
-      } else if (ch === "\\") {
-        escape2 = true;
-      } else if (ch === '"') {
-        inString = false;
-      }
-      i2++;
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      out += ch;
-      i2++;
-      continue;
-    }
-    if (ch === "/" && src[i2 + 1] === "/") {
-      while (i2 < src.length && src[i2] !== "\n") i2++;
-      continue;
-    }
-    if (ch === "/" && src[i2 + 1] === "*") {
-      i2 += 2;
-      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) i2++;
-      i2 += 2;
-      continue;
-    }
-    out += ch;
-    i2++;
-  }
-  return out;
-}
 async function checkGitTracked2(filePath, projectRoot) {
   try {
     const git = getGit(projectRoot);
@@ -42189,29 +42167,33 @@ async function checkPaths(file2, projectRoot) {
 function findClosestMatch(target, files) {
   const targetNorm = target.replace(/\\/g, "/");
   const targetBase = path3.basename(targetNorm);
-  let bestMatch = null;
-  let bestDistance = Infinity;
+  let basenameMatch = null;
+  let basenameDistance = Infinity;
   for (const file2 of files) {
     const fileNorm = file2.replace(/\\/g, "/");
     if (path3.basename(fileNorm) === targetBase && fileNorm !== targetNorm) {
       const dist = levenshtein(targetNorm, fileNorm);
-      if (dist < bestDistance) {
-        bestDistance = dist;
-        bestMatch = fileNorm;
+      if (dist < basenameDistance) {
+        basenameDistance = dist;
+        basenameMatch = fileNorm;
       }
     }
   }
-  if (!bestMatch) {
-    for (const file2 of files) {
-      const fileNorm = file2.replace(/\\/g, "/");
-      const dist = levenshtein(targetNorm, fileNorm);
-      if (dist < bestDistance && dist <= Math.max(targetNorm.length * 0.4, 5)) {
-        bestDistance = dist;
-        bestMatch = fileNorm;
-      }
+  if (basenameMatch) return basenameMatch;
+  const absoluteCap = Math.max(targetNorm.length * 0.4, 5);
+  let fullPathMatch = null;
+  let fullPathDistance = Infinity;
+  for (const file2 of files) {
+    const fileNorm = file2.replace(/\\/g, "/");
+    const lenDelta = Math.abs(targetNorm.length - fileNorm.length);
+    if (lenDelta >= fullPathDistance || lenDelta > absoluteCap) continue;
+    const dist = levenshtein(targetNorm, fileNorm);
+    if (dist < fullPathDistance && dist <= absoluteCap) {
+      fullPathDistance = dist;
+      fullPathMatch = fileNorm;
     }
   }
-  return bestMatch;
+  return fullPathMatch;
 }
 var import_fast_levenshtein, levenshtein, cachedProjectFiles;
 var init_paths = __esm({
@@ -42229,6 +42211,24 @@ var init_paths = __esm({
 // src/core/checks/commands.ts
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
+function extractNpxPackage(cmd) {
+  if (!/^npx\b/.test(cmd)) return null;
+  const tokens = cmd.split(/\s+/).slice(1);
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const t2 = tokens[i2];
+    if (t2 === "-p" || t2 === "--package") {
+      const v2 = tokens[i2 + 1];
+      if (v2 && !v2.startsWith("-")) return v2;
+      continue;
+    }
+    if (t2.startsWith("-p=") || t2.startsWith("--package=")) {
+      return t2.slice(t2.indexOf("=") + 1) || null;
+    }
+    if (t2.startsWith("-")) continue;
+    return t2;
+  }
+  return null;
+}
 async function checkCommands(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42267,10 +42267,9 @@ async function checkCommands(file2, projectRoot) {
       }
       continue;
     }
-    const npxMatch = cmd.match(NPX_PATTERN);
-    if (npxMatch && pkgJson) {
-      const pkgName = npxMatch[1];
-      if (pkgName.startsWith("-")) continue;
+    if (/^npx\b/.test(cmd) && pkgJson) {
+      const pkgName = extractNpxPackage(cmd);
+      if (!pkgName) continue;
       const allDeps = {
         ...pkgJson.dependencies,
         ...pkgJson.devDependencies,
@@ -42345,7 +42344,7 @@ async function checkCommands(file2, projectRoot) {
 }
 function loadMakefile(projectRoot) {
   try {
-    return fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8");
+    return stripBom(fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8"));
   } catch {
     return null;
   }
@@ -42354,14 +42353,13 @@ function hasMakeTarget(makefile, target) {
   const pattern = new RegExp(`^${target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`, "m");
   return pattern.test(makefile);
 }
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN;
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN;
 var init_commands = __esm({
   "src/core/checks/commands.ts"() {
     "use strict";
     init_fs();
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|pnpm(?:\s+run)?|yarn(?:\s+run)?|bun(?:\s+run)?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+(\S+)/;
-    NPX_PATTERN = /^npx\s+(\S+)/;
   }
 });
 
@@ -42536,7 +42534,14 @@ function isAlwaysLoaded(file2) {
     return !hasPathsFrontmatter(file2.content);
   }
   const basename4 = rel.split("/").pop() ?? "";
-  return ALWAYS_LOADED_BASENAMES.has(basename4);
+  for (const name of ALWAYS_LOADED_NAMES) {
+    if (name.includes("/")) {
+      if (rel === name || rel.endsWith("/" + name)) return true;
+    } else if (basename4 === name) {
+      return true;
+    }
+  }
+  return false;
 }
 function computeSectionCosts(file2) {
   if (file2.sections.length === 0) return [];
@@ -42558,7 +42563,7 @@ function loadSettingsSources(projectRoot) {
   for (const p2 of candidates) {
     let content;
     try {
-      content = fs5.readFileSync(p2, "utf-8");
+      content = stripBom(fs5.readFileSync(p2, "utf-8"));
     } catch {
       continue;
     }
@@ -42574,9 +42579,17 @@ function canonicalizeCommand(backticked) {
   const beforeFlags = backticked.trim().split(/\s+--?/, 1)[0];
   return beforeFlags.replace(/\s+/g, " ");
 }
+function buildCommandPattern(cmd) {
+  const tokens = cmd.split(/\s+/).filter(Boolean);
+  const escaped = tokens.map((t2) => t2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  if (tokens.length === 1) {
+    return new RegExp(`(?<![A-Za-z0-9_\\-])${escaped[0]}(?![A-Za-z0-9_\\-])`, "i");
+  }
+  const body = escaped.join("[\\s\\-_]+");
+  return new RegExp(`(?<![A-Za-z0-9])${body}(?![A-Za-z0-9])`, "i");
+}
 function commandIsEnforced(cmd, settings) {
-  const escaped = cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`\\b${escaped}\\b`, "i");
+  const pattern = buildCommandPattern(cmd);
   for (const s of settings) {
     for (const entry of s.permissions?.deny ?? []) {
       if (pattern.test(entry)) return true;
@@ -42654,13 +42667,14 @@ function checkAggregateTierTokens(files) {
     suggestion: "Consider moving the largest files or their heaviest sections to on-demand tiers (skills, subagents, memory)."
   };
 }
-var ALWAYS_LOADED_BASENAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
+var ALWAYS_LOADED_NAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
 var init_tier_tokens = __esm({
   "src/core/checks/tier-tokens.ts"() {
     "use strict";
     init_tokens();
+    init_fs();
     init_tokens2();
-    ALWAYS_LOADED_BASENAMES = /* @__PURE__ */ new Set([
+    ALWAYS_LOADED_NAMES = [
       "CLAUDE.md",
       "CLAUDE.local.md",
       "AGENTS.md",
@@ -42675,15 +42689,42 @@ var init_tier_tokens = __esm({
       ".rules",
       ".goosehints",
       "replit.md",
-      "copilot-instructions.md",
-      "guidelines.md",
-      "instructions.md"
-    ]);
+      ".github/copilot-instructions.md",
+      ".junie/guidelines.md",
+      ".junie/AGENTS.md",
+      ".goose/instructions.md"
+    ];
     TOP_SECTIONS_TO_REPORT = 3;
     INVIOLABLE_WITH_COMMAND = /\b(NEVER|ALWAYS|DON'?T|DO NOT|MUST NOT)\b[^.!?`]{0,80}`([^`]+)`/i;
   }
 });
 
+// src/utils/similarity.ts
+function jaccardSimilarityFromSets(a, b2, opts = {}) {
+  const bothEmptyIsIdentical = opts.bothEmptyIsIdentical ?? false;
+  if (a.size === 0 && b2.size === 0) {
+    return bothEmptyIsIdentical ? 1 : 0;
+  }
+  if (a.size === 0 || b2.size === 0) return 0;
+  const [small, large] = a.size <= b2.size ? [a, b2] : [b2, a];
+  let intersection2 = 0;
+  for (const line of small) {
+    if (large.has(line)) intersection2++;
+  }
+  const unionSize = a.size + b2.size - intersection2;
+  return intersection2 / unionSize;
+}
+function toLineSet(text, minTokenLen) {
+  return new Set(
+    text.split("\n").map((l) => l.trim()).filter((l) => l.length > minTokenLen)
+  );
+}
+var init_similarity = __esm({
+  "src/utils/similarity.ts"() {
+    "use strict";
+  }
+});
+
 // src/core/checks/redundancy.ts
 import * as path7 from "node:path";
 function compilePatterns(allDeps) {
@@ -42706,6 +42747,20 @@ function compilePatterns(allDeps) {
   }
   return compiled;
 }
+function getCompiledPatterns(projectRoot, allDeps) {
+  const relevant = [];
+  for (const pkg of Object.keys(PACKAGE_TECH_MAP)) {
+    if (allDeps.has(pkg)) relevant.push(pkg);
+  }
+  relevant.sort();
+  const key = `${projectRoot}\0${relevant.join(" ")}`;
+  let compiled = compiledPatternsCache.get(key);
+  if (!compiled) {
+    compiled = compilePatterns(allDeps);
+    compiledPatternsCache.set(key, compiled);
+  }
+  return compiled;
+}
 async function checkRedundancy(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42716,7 +42771,7 @@ async function checkRedundancy(file2, projectRoot) {
       ...Object.keys(pkgJson.peerDependencies || {}),
       ...Object.keys(pkgJson.optionalDependencies || {})
     ]);
-    const compiledPatterns = compilePatterns(allDeps);
+    const compiledPatterns = getCompiledPatterns(projectRoot, allDeps);
     const lines2 = file2.content.split("\n");
     for (let i2 = 0; i2 < lines2.length; i2++) {
       const line = lines2[i2];
@@ -42767,10 +42822,14 @@ async function checkRedundancy(file2, projectRoot) {
 }
 function checkDuplicateContent(files) {
   const issues = [];
-  const DUPLICATE_CONTENT_THRESHOLD = 0.6;
+  const lineSets = files.map((f) => toLineSet(f.content, DUPLICATE_CONTENT_MIN_TOKEN_LEN));
   for (let i2 = 0; i2 < files.length; i2++) {
+    const a = lineSets[i2];
+    if (a.size === 0) continue;
     for (let j3 = i2 + 1; j3 < files.length; j3++) {
-      const overlap = calculateLineOverlap(files[i2].content, files[j3].content);
+      const b2 = lineSets[j3];
+      if (b2.size === 0) continue;
+      const overlap = jaccardSimilarityFromSets(a, b2);
       if (overlap >= DUPLICATE_CONTENT_THRESHOLD) {
         issues.push({
           severity: "warning",
@@ -42785,29 +42844,15 @@ function checkDuplicateContent(files) {
   }
   return issues;
 }
-function calculateLineOverlap(contentA, contentB) {
-  const linesA = new Set(
-    contentA.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
-  );
-  const linesB = new Set(
-    contentB.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
-  );
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
-  }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
-}
 function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-var PACKAGE_TECH_MAP;
+var PACKAGE_TECH_MAP, compiledPatternsCache, DUPLICATE_CONTENT_THRESHOLD, DUPLICATE_CONTENT_MIN_TOKEN_LEN;
 var init_redundancy = __esm({
   "src/core/checks/redundancy.ts"() {
     "use strict";
     init_fs();
+    init_similarity();
     init_tokens();
     PACKAGE_TECH_MAP = {
       react: ["React", "react"],
@@ -42860,6 +42905,9 @@ var init_redundancy = __esm({
       cypress: ["Cypress"],
       puppeteer: ["Puppeteer"]
     };
+    compiledPatternsCache = /* @__PURE__ */ new Map();
+    DUPLICATE_CONTENT_THRESHOLD = 0.6;
+    DUPLICATE_CONTENT_MIN_TOKEN_LEN = 10;
   }
 });
 
@@ -43177,7 +43225,7 @@ var init_contradictions = __esm({
 function parseFrontmatter(content) {
   const lines = content.split("\n");
   if (lines[0]?.trim() !== "---") {
-    return { found: false, fields: {}, endLine: 0 };
+    return { found: false, fields: {}, endLine: 0, unclosed: false };
   }
   const fields = {};
   let endLine = 0;
@@ -43204,9 +43252,9 @@ function parseFrontmatter(content) {
     }
   }
   if (endLine === 0) {
-    return { found: true, fields, endLine: lines.length };
+    return { found: true, fields, endLine: lines.length, unclosed: true };
   }
-  return { found: true, fields, endLine };
+  return { found: true, fields, endLine, unclosed: false };
 }
 function isCursorMdc(file2) {
   return file2.relativePath.endsWith(".mdc");
@@ -43217,6 +43265,23 @@ function isCopilotInstructions(file2) {
 function isWindsurfRule(file2) {
   return file2.relativePath.includes(".windsurf/rules/") && file2.relativePath.endsWith(".md");
 }
+function hasUnbalancedBracketsOrQuotes(val) {
+  let square = 0;
+  let curly = 0;
+  for (const ch of val) {
+    if (ch === "[") square++;
+    else if (ch === "]") square--;
+    else if (ch === "{") curly++;
+    else if (ch === "}") curly--;
+    if (square < 0 || curly < 0) return true;
+  }
+  if (square !== 0 || curly !== 0) return true;
+  const doubleQuotes = (val.match(/"/g) || []).length;
+  const singleQuotes = (val.match(/'/g) || []).length;
+  if (doubleQuotes % 2 !== 0) return true;
+  if (singleQuotes % 2 !== 0) return true;
+  return false;
+}
 async function checkFrontmatter(file2, _projectRoot) {
   const issues = [];
   if (isCursorMdc(file2)) {
@@ -43228,9 +43293,23 @@ async function checkFrontmatter(file2, _projectRoot) {
   }
   return issues;
 }
+function unclosedFrontmatterIssue() {
+  return {
+    severity: "error",
+    check: "frontmatter",
+    ruleId: "frontmatter/unclosed",
+    line: 1,
+    message: "Frontmatter opens with `---` but is never closed",
+    suggestion: "Add a matching `---` line (with no leading whitespace) after the last frontmatter field"
+  };
+}
 function validateCursorMdc(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "warning",
@@ -43277,13 +43356,13 @@ function validateCursorMdc(file2) {
   }
   if ("globs" in fm.fields) {
     const val = fm.fields["globs"];
-    if (val && !val.startsWith("[") && !val.startsWith('"') && !val.includes("*") && !val.includes("/")) {
+    if (val && hasUnbalancedBracketsOrQuotes(val)) {
       issues.push({
         severity: "warning",
         check: "frontmatter",
         ruleId: "frontmatter/invalid-value",
         line: 1,
-        message: `Possibly invalid globs value: "${val}"`,
+        message: `Possibly malformed globs value: "${val}"`,
         suggestion: 'globs should be a glob pattern like "src/**/*.ts" or an array like ["*.ts", "*.tsx"]'
       });
     }
@@ -43293,6 +43372,10 @@ function validateCursorMdc(file2) {
 function validateCopilotInstructions(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "info",
@@ -43319,6 +43402,10 @@ function validateCopilotInstructions(file2) {
 function validateWindsurfRule(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "info",
@@ -43490,6 +43577,10 @@ function isEnvVarRef(value) {
 function isKnownApiKey(value) {
   return API_KEY_PATTERNS.some((p2) => p2.test(value));
 }
+function nameSuggestsSecret(name) {
+  const upper = name.toUpperCase();
+  return SECRET_NAME_KEYWORDS.some((kw) => upper.includes(kw));
+}
 function isHighEntropySecret(value) {
   if (isEnvVarRef(value)) return false;
   return HIGH_ENTROPY_PATTERN.test(value);
@@ -43538,8 +43629,9 @@ async function checkMcpSecurity(config2, _projectRoot) {
       }
     }
     if (server2.env) {
-      for (const envValue of Object.values(server2.env)) {
-        if (!isEnvVarRef(envValue) && (isKnownApiKey(envValue) || isHighEntropySecret(envValue))) {
+      for (const [envName, envValue] of Object.entries(server2.env)) {
+        const isSecret = isKnownApiKey(envValue) || nameSuggestsSecret(envName) && isHighEntropySecret(envValue);
+        if (!isEnvVarRef(envValue) && isSecret) {
           const envVar = deriveEnvVarName(server2.name, "API_KEY");
           issues.push({
             severity: "error",
@@ -43586,7 +43678,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
   }
   return issues;
 }
-var API_KEY_PATTERNS, ENV_VAR_REF, HIGH_ENTROPY_PATTERN, URL_SECRET_PARAMS;
+var API_KEY_PATTERNS, ENV_VAR_REF, HIGH_ENTROPY_PATTERN, URL_SECRET_PARAMS, SECRET_NAME_KEYWORDS;
 var init_security = __esm({
   "src/core/checks/mcp/security.ts"() {
     "use strict";
@@ -43615,6 +43707,22 @@ var init_security = __esm({
     ENV_VAR_REF = /\$\{[^}]+\}/;
     HIGH_ENTROPY_PATTERN = /^[A-Za-z0-9+/=_-]{21,}$/;
     URL_SECRET_PARAMS = /[?&](key|token|api_key|apikey|secret|password|access_token)=/i;
+    SECRET_NAME_KEYWORDS = [
+      "KEY",
+      "TOKEN",
+      "SECRET",
+      "PASSWORD",
+      "PASSWD",
+      "PASS",
+      "AUTH",
+      "CREDENTIAL",
+      "CREDENTIALS",
+      "APIKEY",
+      "PRIVATE",
+      "SIGNING",
+      "SESSION",
+      "COOKIE"
+    ];
   }
 });
 
@@ -44381,6 +44489,12 @@ function extractPaths(content) {
       paths.push(p2);
     }
   }
+  for (const match of content.matchAll(BARE_FILE_PATH)) {
+    const p2 = match[1].replace(/[)}\]]+$/, "");
+    if (p2.length > 2 && !p2.startsWith("http")) {
+      paths.push(p2);
+    }
+  }
   return [...new Set(paths)];
 }
 function parseFrontmatter2(content) {
@@ -44410,7 +44524,7 @@ function parseFrontmatter2(content) {
   };
 }
 async function parseMemoryFile(filePath, projectDir) {
-  const content = await readFile(filePath, "utf-8");
+  const content = stripBom(await readFile(filePath, "utf-8"));
   const { name, description, type, body } = parseFrontmatter2(content);
   const referencedPaths = extractPaths(body);
   return {
@@ -44423,11 +44537,13 @@ async function parseMemoryFile(filePath, projectDir) {
     referencedPaths
   };
 }
-var PATH_PATTERN2;
+var PATH_PATTERN2, BARE_FILE_PATH;
 var init_session_parser = __esm({
   "src/core/session-parser.ts"() {
     "use strict";
+    init_fs();
     PATH_PATTERN2 = /(?:^|\s|['"`(])([.~/][^\s'"`),;:!?]+)/g;
+    BARE_FILE_PATH = /(?:^|[\s`"'(])([\w][\w-]*(?:\/[\w.-]+)+\.[a-zA-Z0-9]{1,8})\b/g;
   }
 });
 
@@ -44459,30 +44575,46 @@ async function parseJsonlFiltered(filePath, filter) {
   }
   return results;
 }
-async function readClaudeHistory() {
-  const historyPath = join5(home, ".claude", "history.jsonl");
-  return parseJsonlFiltered(historyPath, (entry) => {
-    if (!entry.display || !entry.project) return null;
+function pickField(entry, fields) {
+  for (const f of fields) {
+    const v2 = entry[f];
+    if (typeof v2 === "string" && v2.length > 0) return v2;
+  }
+  return "";
+}
+async function readJsonlHistory(opts) {
+  return parseJsonlFiltered(opts.historyPath, (parsed) => {
+    if (!parsed || typeof parsed !== "object") return null;
+    const entry = parsed;
+    const display = pickField(entry, opts.displayFields);
+    if (!display) return null;
+    const project = pickField(entry, opts.projectFields);
+    if (opts.requireProject && !project) return null;
     return {
-      display: entry.display,
-      timestamp: entry.timestamp || 0,
-      project: entry.project.replace(/\\/g, "/"),
-      sessionId: entry.sessionId || "",
-      provider: "claude-code"
+      display,
+      timestamp: typeof entry.timestamp === "number" ? entry.timestamp : 0,
+      project: project.replace(/\\/g, "/"),
+      sessionId: typeof entry.sessionId === "string" ? entry.sessionId : "",
+      provider: opts.provider
     };
   });
 }
+async function readClaudeHistory() {
+  return readJsonlHistory({
+    historyPath: join5(home, ".claude", "history.jsonl"),
+    provider: "claude-code",
+    displayFields: ["display"],
+    projectFields: ["project"],
+    requireProject: true
+  });
+}
 async function readCodexHistory() {
-  const historyPath = join5(home, ".codex", "history.jsonl");
-  return parseJsonlFiltered(historyPath, (entry) => {
-    if (!entry.display && !entry.command) return null;
-    return {
-      display: entry.display || entry.command || "",
-      timestamp: entry.timestamp || 0,
-      project: (entry.project || entry.cwd || "").replace(/\\/g, "/"),
-      sessionId: entry.sessionId || "",
-      provider: "codex-cli"
-    };
+  return readJsonlHistory({
+    historyPath: join5(home, ".codex", "history.jsonl"),
+    provider: "codex-cli",
+    displayFields: ["display", "command"],
+    projectFields: ["project", "cwd"],
+    requireProject: false
   });
 }
 async function readClaudeMemories() {
@@ -44547,47 +44679,29 @@ async function detectSiblings(projectRoot) {
       if (orgMatch) currentOrg = orgMatch[1];
     } catch {
     }
-    const gitCandidates = candidates.filter((c3) => existsSync(join5(c3.fullPath, ".git")));
-    const results = await Promise.all(
-      gitCandidates.map(async (c3) => {
-        const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
-        try {
-          const git = simpleGit(c3.fullPath);
-          const remotes = await git.getRemotes(true);
-          const origin = remotes.find((r2) => r2.name === "origin");
-          if (origin?.refs?.fetch) {
-            sibling.gitRemoteUrl = origin.refs.fetch;
-            const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
-            if (orgMatch) sibling.gitOrg = orgMatch[1];
-          }
-        } catch {
-        }
-        return sibling;
-      })
-    );
+    const results = await Promise.all(candidates.map((c3) => resolveSibling(c3)));
     if (currentOrg) {
-      return results.filter((s) => s.gitOrg === currentOrg);
+      return results.filter((s) => !s.gitOrg || s.gitOrg === currentOrg);
     }
     return results;
   }
-  const siblings = await Promise.all(
-    candidates.map(async (c3) => {
-      const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
-      try {
-        const git = simpleGit(c3.fullPath);
-        const remotes = await git.getRemotes(true);
-        const origin = remotes.find((r2) => r2.name === "origin");
-        if (origin?.refs?.fetch) {
-          sibling.gitRemoteUrl = origin.refs.fetch;
-          const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
-          if (orgMatch) sibling.gitOrg = orgMatch[1];
-        }
-      } catch {
-      }
-      return sibling;
-    })
-  );
-  return siblings;
+  return Promise.all(candidates.map((c3) => resolveSibling(c3)));
+}
+async function resolveSibling(c3) {
+  const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
+  if (!existsSync(join5(c3.fullPath, ".git"))) return sibling;
+  try {
+    const git = simpleGit(c3.fullPath);
+    const remotes = await git.getRemotes(true);
+    const origin = remotes.find((r2) => r2.name === "origin");
+    if (origin?.refs?.fetch) {
+      sibling.gitRemoteUrl = origin.refs.fetch;
+      const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
+      if (orgMatch) sibling.gitOrg = orgMatch[1];
+    }
+  } catch {
+  }
+  return sibling;
 }
 async function scanSessionData(projectRoot) {
   const providers = detectProviders();
@@ -44707,48 +44821,57 @@ var init_missing_secret = __esm({
 });
 
 // src/core/checks/session/diverged-file.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { join as join6 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
-function calculateOverlap(a, b2) {
-  const linesA = new Set(
-    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
-  );
-  const linesB = new Set(
-    b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
-  );
-  if (linesA.size === 0 && linesB.size === 0) return 1;
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
+async function loadLineSet(absPath) {
+  let mtimeMs;
+  let size;
+  try {
+    const stats = await stat2(absPath);
+    mtimeMs = stats.mtimeMs;
+    size = stats.size;
+  } catch {
+    return null;
   }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
+  const cached2 = lineSetCache.get(absPath);
+  if (cached2 && cached2.mtimeMs === mtimeMs && cached2.size === size) {
+    lineSetCache.delete(absPath);
+    lineSetCache.set(absPath, cached2);
+    return cached2.lineSet;
+  }
+  let content;
+  try {
+    content = stripBom(await readFile2(absPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const lineSet = toLineSet(content, MIN_TOKEN_LEN);
+  lineSetCache.set(absPath, { mtimeMs, size, lineSet });
+  if (lineSetCache.size > CACHE_MAX_ENTRIES) {
+    const oldest = lineSetCache.keys().next().value;
+    if (oldest !== void 0) lineSetCache.delete(oldest);
+  }
+  return lineSet;
 }
 async function checkDivergedFile(ctx) {
   const issues = [];
   for (const fileName of CANONICAL_FILES) {
     const currentPath = join6(ctx.currentProject, fileName);
     if (!existsSync2(currentPath)) continue;
-    let currentContent;
-    try {
-      currentContent = await readFile2(currentPath, "utf-8");
-    } catch {
-      continue;
-    }
+    const currentLineSet = await loadLineSet(currentPath);
+    if (!currentLineSet) continue;
     const diverged = [];
     for (const sib of ctx.siblings) {
       const sibPath = join6(sib.path, fileName);
       if (!existsSync2(sibPath)) continue;
-      try {
-        const sibContent = await readFile2(sibPath, "utf-8");
-        const overlap = calculateOverlap(currentContent, sibContent);
-        if (overlap >= 0.2 && overlap < 0.9) {
-          diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
-        }
-      } catch {
-        continue;
+      const sibLineSet = await loadLineSet(sibPath);
+      if (!sibLineSet) continue;
+      const overlap = jaccardSimilarityFromSets(currentLineSet, sibLineSet, {
+        bothEmptyIsIdentical: true
+      });
+      if (overlap >= 0.2 && overlap < 0.9) {
+        diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
       }
     }
     if (diverged.length > 0) {
@@ -44766,10 +44889,12 @@ async function checkDivergedFile(ctx) {
   }
   return issues;
 }
-var CANONICAL_FILES;
+var CANONICAL_FILES, MIN_TOKEN_LEN, CACHE_MAX_ENTRIES, lineSetCache;
 var init_diverged_file = __esm({
   "src/core/checks/session/diverged-file.ts"() {
     "use strict";
+    init_similarity();
+    init_fs();
     CANONICAL_FILES = [
       "release.sh",
       ".github/workflows/ci.yml",
@@ -44780,6 +44905,9 @@ var init_diverged_file = __esm({
       "tsconfig.json",
       ".gitignore"
     ];
+    MIN_TOKEN_LEN = 3;
+    CACHE_MAX_ENTRIES = 256;
+    lineSetCache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -44887,24 +45015,10 @@ var init_stale_memory = __esm({
 });
 
 // src/core/checks/session/duplicate-memory.ts
-function calculateLineOverlap2(a, b2) {
-  const linesA = new Set(
-    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
-  );
-  const linesB = new Set(
-    b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
-  );
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
-  }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
-}
 async function checkDuplicateMemory(ctx) {
   const issues = [];
   const reported = /* @__PURE__ */ new Set();
+  const lineSets = ctx.memories.map((m) => toLineSet(m.content, MIN_TOKEN_LEN2));
   for (let i2 = 0; i2 < ctx.memories.length; i2++) {
     for (let j3 = i2 + 1; j3 < ctx.memories.length; j3++) {
       const a = ctx.memories[i2];
@@ -44914,7 +45028,7 @@ async function checkDuplicateMemory(ctx) {
       const bIsCurrent = projectDirMatchesPath(b2.projectDir, ctx.currentProject);
       if (!aIsCurrent && !bIsCurrent) continue;
       if (a.content.length < 50 || b2.content.length < 50) continue;
-      const overlap = calculateLineOverlap2(a.content, b2.content);
+      const overlap = jaccardSimilarityFromSets(lineSets[i2], lineSets[j3]);
       if (overlap < 0.6) continue;
       const pairKey = [a.filePath, b2.filePath].sort().join("::");
       if (reported.has(pairKey)) continue;
@@ -44936,10 +45050,13 @@ async function checkDuplicateMemory(ctx) {
   }
   return issues;
 }
+var MIN_TOKEN_LEN2;
 var init_duplicate_memory = __esm({
   "src/core/checks/session/duplicate-memory.ts"() {
     "use strict";
     init_session_parser();
+    init_similarity();
+    MIN_TOKEN_LEN2 = 5;
   }
 });
 
@@ -45034,24 +45151,23 @@ var init_loop_detection = __esm({
 });
 
 // src/core/checks/session/memory-index-overflow.ts
-import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || "";
   if (!home2) return [];
   const encoded = encodeProjectDir(ctx.currentProject);
   const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
-  let stats;
+  let content;
   try {
-    stats = await stat2(memoryFile);
+    content = stripBom(await readFile3(memoryFile, "utf-8"));
   } catch {
     return [];
   }
-  const content = await readFile3(memoryFile, "utf-8").catch(() => "");
   if (!content) return [];
   const lines = content.split("\n");
   const lineCount = lines.length;
-  const byteSize = stats.size;
+  const byteSize = Buffer.byteLength(content, "utf8");
   const issues = [];
   if (lineCount > MAX_LINES) {
     const excess = lineCount - MAX_LINES;
@@ -45084,6 +45200,7 @@ var init_memory_index_overflow = __esm({
   "src/core/checks/session/memory-index-overflow.ts"() {
     "use strict";
     init_session_parser();
+    init_fs();
     MAX_LINES = 200;
     MAX_BYTES = 25 * 1024;
   }
@@ -45110,7 +45227,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = await readFile4(join9(workflowDir, f), "utf-8");
+      const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
       const nameMatch = content.match(/^name:\s*(.+)$/m);
       if (nameMatch && RELEASE_FILENAME_PATTERNS.some((p2) => p2.test(nameMatch[1]))) {
         releaseWorkflows.push(f);
@@ -45147,6 +45264,7 @@ var RELEASE_FILENAME_PATTERNS, RELEASE_DOC_PATTERNS;
 var init_ci_coverage = __esm({
   "src/core/checks/ci-coverage.ts"() {
     "use strict";
+    init_fs();
     RELEASE_FILENAME_PATTERNS = [/release/i, /deploy/i, /publish/i, /\bcd\b/i];
     RELEASE_DOC_PATTERNS = [
       /release\s+(process|workflow|steps|via|by|using)/i,
@@ -45181,7 +45299,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = await readFile5(join10(workflowDir, f), "utf-8");
+      content = stripBom(await readFile5(join10(workflowDir, f), "utf-8"));
     } catch {
       continue;
     }
@@ -45198,7 +45316,7 @@ async function findSecretUsages(projectRoot) {
 }
 function contextMentionsSecret(files, secretName) {
   const escaped = secretName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[_\\s-]")}\\b`, "i");
+  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[ _-]")}\\b`, "i");
   return files.some((f) => pattern.test(f.content));
 }
 async function checkCiSecrets(files, projectRoot) {
@@ -45222,6 +45340,7 @@ var BUILTIN_SECRETS, SECRETS_REGEX;
 var init_ci_secrets = __esm({
   "src/core/checks/ci-secrets.ts"() {
     "use strict";
+    init_fs();
     BUILTIN_SECRETS = /* @__PURE__ */ new Set([
       "GITHUB_TOKEN",
       "ACTIONS_RUNTIME_TOKEN",
@@ -45242,7 +45361,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.18";
+  if (true) return "0.9.20";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -45266,6 +45385,11 @@ function hasMcphChecks(checks) {
 function hasSessionChecks(checks) {
   return checks.some((c3) => c3.startsWith("session-"));
 }
+function deriveChecksToRun(activeChecks, prefix, enabled, allChecks) {
+  const filtered = activeChecks.filter((c3) => c3.startsWith(prefix));
+  if (filtered.length > 0) return filtered;
+  return enabled ? [...allChecks] : [];
+}
 async function runAudit(projectRoot, activeChecks, options = {}) {
   const fileResults = [];
   const shouldRunContextChecks = !options.mcpOnly && !options.mcphOnly && !options.sessionOnly;
@@ -45346,8 +45470,12 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       );
       mcpConfigs.push(...globalConfigs);
     }
-    const activeMcpChecks = activeChecks.filter((c3) => c3.startsWith("mcp-"));
-    const mcpChecksToRun = activeMcpChecks.length > 0 ? activeMcpChecks : options.mcp || options.mcpGlobal || options.mcpOnly ? ALL_MCP_CHECKS : [];
+    const mcpChecksToRun = deriveChecksToRun(
+      activeChecks,
+      "mcp-",
+      Boolean(options.mcp || options.mcpGlobal || options.mcpOnly),
+      ALL_MCP_CHECKS
+    );
     for (const config2 of mcpConfigs) {
       const checkPromises = [];
       if (mcpChecksToRun.includes("mcp-schema"))
@@ -45393,7 +45521,7 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     const projectMcphFiles = await scanForMcphConfigs(projectRoot);
     const mcphConfigs = await Promise.all(
       projectMcphFiles.map(
-        (f) => parseMchpConfig(
+        (f) => parseMcphConfig(
           f,
           projectRoot,
           f.relativePath.endsWith(".mcph.local.json") ? "project-local" : "project"
@@ -45403,12 +45531,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     if (options.mcphGlobal) {
       const globalMcphFiles = await scanGlobalMcphConfigs();
       const globalMcphConfigs = await Promise.all(
-        globalMcphFiles.map((f) => parseMchpConfig(f, projectRoot, "global"))
+        globalMcphFiles.map((f) => parseMcphConfig(f, projectRoot, "global"))
       );
       mcphConfigs.push(...globalMcphConfigs);
     }
-    const activeMcphChecks = activeChecks.filter((c3) => c3.startsWith("mcph-"));
-    const mcphChecksToRun = activeMcphChecks.length > 0 ? activeMcphChecks : options.mcph || options.mcphGlobal || options.mcphOnly ? ALL_MCPH_CHECKS : [];
+    const mcphChecksToRun = deriveChecksToRun(
+      activeChecks,
+      "mcph-",
+      Boolean(options.mcph || options.mcphGlobal || options.mcphOnly),
+      ALL_MCPH_CHECKS
+    );
     for (const config2 of mcphConfigs) {
       const checkPromises = [];
       if (mcphChecksToRun.includes("mcph-token-security")) {
@@ -45432,14 +45564,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       }
       const results = await Promise.all(checkPromises);
       const issues = results.flat();
-      for (const err of config2.parseErrors) {
-        issues.push({
-          severity: "error",
-          check: "mcph-schema-conformance",
-          ruleId: "mcph-config/parse-error",
-          line: 1,
-          message: err
-        });
+      if (mcphChecksToRun.includes("mcph-schema-conformance")) {
+        for (const err of config2.parseErrors) {
+          issues.push({
+            severity: "error",
+            check: "mcph-schema-conformance",
+            ruleId: "mcph-config/parse-error",
+            line: 1,
+            message: err
+          });
+        }
       }
       const lines = config2.content.split("\n").length;
       fileResults.push({
@@ -45475,15 +45609,13 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         sessionPromises.push(checkMemoryIndexOverflow(sessionCtx));
       const sessionResults = await Promise.all(sessionPromises);
       const sessionIssues = sessionResults.flat();
-      if (sessionIssues.length > 0) {
-        fileResults.push({
-          path: "~/.claude/ (session audit)",
-          isSymlink: false,
-          tokens: 0,
-          lines: 0,
-          issues: sessionIssues
-        });
-      }
+      fileResults.push({
+        path: "~/.claude/ (session audit)",
+        isSymlink: false,
+        tokens: 0,
+        lines: 0,
+        issues: sessionIssues
+      });
     }
   }
   let estimatedWaste = 0;
@@ -46190,6 +46322,8 @@ function applyFixes(result, options = {}) {
       existing.push(fix);
       fixesByLine.set(fix.line, existing);
     }
+    let perFileFixCount = 0;
+    const perFileLogs = [];
     for (const [lineNum, lineFixes] of fixesByLine) {
       const lineIdx = lineNum - 1;
       if (lineIdx < 0 || lineIdx >= lines.length) continue;
@@ -46197,9 +46331,9 @@ function applyFixes(result, options = {}) {
       for (const fix of lineFixes) {
         if (line.includes(fix.oldText)) {
           line = line.replaceAll(fix.oldText, fix.newText);
-          totalFixes++;
+          perFileFixCount++;
           const prefix = dryRun ? source_default.cyan("  Would fix") : source_default.green("  Fixed");
-          log(
+          perFileLogs.push(
             prefix + ` Line ${fix.line}: ${source_default.dim(fix.oldText)} ${source_default.dim("->")} ${fix.newText}`
           );
         }
@@ -46223,6 +46357,8 @@ function applyFixes(result, options = {}) {
         fs7.writeFileSync(filePath, newContent, "utf-8");
       }
       filesModified.push(filePath);
+      totalFixes += perFileFixCount;
+      for (const m of perFileLogs) log(m);
     }
   }
   return { totalFixes, filesModified };
@@ -46236,11 +46372,22 @@ var init_fixer = __esm({
 
 // src/mcp/server.ts
 var server_exports = {};
+__export(server_exports, {
+  server: () => server,
+  startServer: () => startServer
+});
 import * as path10 from "node:path";
+function describeDisallowed(rawPath) {
+  const m = rawPath.match(PATH_DISALLOWED);
+  if (!m) return "unknown";
+  return JSON.stringify(m[0]);
+}
 function validateProjectPath(rawPath) {
   if (!rawPath) return process.cwd();
   if (PATH_DISALLOWED.test(rawPath)) {
-    throw new Error("projectPath contains disallowed characters");
+    throw new Error(
+      `projectPath contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
+    );
   }
   const resolved = path10.resolve(rawPath);
   if (!isDirectory(resolved)) {
@@ -46250,12 +46397,28 @@ function validateProjectPath(rawPath) {
 }
 function validateFilePathInput(rawPath) {
   if (PATH_DISALLOWED.test(rawPath)) {
-    throw new Error("path contains disallowed characters");
+    throw new Error(
+      `path contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
+    );
   }
 }
-var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
+function resolveWithinRoot(filePath, root) {
+  const resolvedRoot = path10.resolve(root);
+  const resolved = path10.resolve(resolvedRoot, filePath);
+  const rel = path10.relative(resolvedRoot, resolved);
+  if (rel.startsWith("..") || path10.isAbsolute(rel)) {
+    throw new Error("path escapes the project root");
+  }
+  return resolved;
+}
+async function startServer() {
+  keepEncoderAlive(true);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server;
 var init_server3 = __esm({
-  async "src/mcp/server.ts"() {
+  "src/mcp/server.ts"() {
     "use strict";
     init_mcp();
     init_stdio2();
@@ -46272,6 +46435,7 @@ var init_server3 = __esm({
     init_version2();
     contextCheckEnum = external_exports3.enum(ALL_CHECKS);
     mcpCheckEnum = external_exports3.enum(ALL_MCP_CHECKS);
+    mcphCheckEnum = external_exports3.enum(ALL_MCPH_CHECKS);
     sessionCheckEnum = external_exports3.enum(ALL_SESSION_CHECKS);
     PATH_DISALLOWED = /[\n\r\t;`|]|\$\(|\$\{/;
     server = new McpServer({
@@ -46328,7 +46492,7 @@ var init_server3 = __esm({
         try {
           validateFilePathInput(filePath);
           const root = validateProjectPath(projectPath);
-          const resolved = path10.resolve(root, filePath);
+          const resolved = resolveWithinRoot(filePath, root);
           const result = {
             path: filePath,
             exists: fileExists(resolved) || isDirectory(resolved)
@@ -46493,6 +46657,48 @@ var init_server3 = __esm({
         }
       }
     );
+    server.tool(
+      "ctxlint_mcph_audit",
+      "Lint .mcph.json (the @yawlabs/mcph CLI config) files. Checks for PAT (mcp_pat_*) leakage in git-tracked project-scope files, environment-variable posture, plaintext HTTP apiBase to public hosts, schema drift, allow/deny list conflicts and duplicates, and machine-local override files not covered by .gitignore. Distinct from ctxlint_mcp_audit, which lints client-side .mcp.json server lists.",
+      {
+        projectPath: external_exports3.string().optional().describe("Path to the project root. Defaults to current working directory."),
+        checks: external_exports3.array(mcphCheckEnum).optional().describe("Specific mcph checks to run (default: all mcph-* checks)."),
+        includeGlobal: external_exports3.boolean().optional().describe("Also scan ~/.mcph.json (user-global config)."),
+        strictEnvToken: external_exports3.boolean().optional().describe(
+          "Upgrade mcph-config/prefer-env-token from warning to error (env-var-only posture)."
+        )
+      },
+      {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      },
+      async ({ projectPath, checks, includeGlobal, strictEnvToken }) => {
+        try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_MCPH_CHECKS;
+          const result = await runAudit(root, activeChecks, {
+            mcph: true,
+            mcphOnly: true,
+            mcphGlobal: includeGlobal || false,
+            mcphStrictEnvToken: strictEnvToken || false
+          });
+          return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: msg }) }],
+            isError: true
+          };
+        } finally {
+          freeEncoder();
+          resetGit();
+          resetPathsCache();
+          resetPackageJsonCache();
+        }
+      }
+    );
     server.tool(
       "ctxlint_session_audit",
       "Audit AI agent session data for cross-project consistency. Checks for missing GitHub secrets, diverged config files, missing workflows, stale memory entries, and duplicate memories across sibling repositories.",
@@ -46529,9 +46735,6 @@ var init_server3 = __esm({
         }
       }
     );
-    keepEncoderAlive(true);
-    transport = new StdioServerTransport();
-    await server.connect(transport);
   }
 });
 
@@ -53008,6 +53211,26 @@ var init_ora = __esm({
 });
 
 // src/core/reporter.ts
+function classifyFile(f) {
+  if (f.path === "(project)") return "context";
+  if (f.path === "(mcp)") return "mcp";
+  if (f.path === "(mcph)") return "mcph";
+  if (f.path.includes("session audit")) return "session";
+  for (const issue2 of f.issues) {
+    if (issue2.check.startsWith("session-")) return "session";
+    if (issue2.check.startsWith("mcph-")) return "mcph";
+    if (issue2.check.startsWith("mcp-")) return "mcp";
+  }
+  const norm = f.path.replace(/\\/g, "/");
+  if (norm.endsWith(".mcph.json") || norm.endsWith(".mcph.local.json")) return "mcph";
+  if (norm === ".mcp.json" || norm.endsWith("/.mcp.json") || norm.endsWith("/mcp.json") || norm.includes("/mcpServers/") || norm.endsWith("/.claude.json") || norm.endsWith(".claude/settings.json") || norm.endsWith("claude_desktop_config.json")) {
+    return "mcp";
+  }
+  return "context";
+}
+function isSyntheticBucket(p2) {
+  return p2.startsWith("(") || p2.includes("session audit");
+}
 function formatText(result, verbose = false) {
   const lines = [];
   lines.push("");
@@ -53015,30 +53238,45 @@ function formatText(result, verbose = false) {
   lines.push("");
   lines.push(`Scanning ${result.projectRoot}...`);
   lines.push("");
-  const isMcpFile = (f) => f.issues.some((i2) => i2.check.startsWith("mcp-"));
-  const contextFiles = result.files.filter((f) => !isMcpFile(f));
-  const mcpFiles = result.files.filter((f) => isMcpFile(f));
+  const groups = {
+    context: [],
+    mcp: [],
+    mcph: [],
+    session: []
+  };
+  for (const f of result.files) {
+    groups[classifyFile(f)].push(f);
+  }
   const totalTokens = result.summary.totalTokens;
-  if (contextFiles.length > 0) {
+  let renderedAnySummary = false;
+  const contextReal = groups.context.filter((f) => !isSyntheticBucket(f.path));
+  if (contextReal.length > 0) {
     lines.push(
-      `Found ${contextFiles.length} context file${contextFiles.length !== 1 ? "s" : ""} (${totalTokens.toLocaleString()} tokens total)`
+      `Found ${contextReal.length} context file${contextReal.length !== 1 ? "s" : ""} (${totalTokens.toLocaleString()} tokens total)`
     );
-    for (const file2 of contextFiles) {
+    for (const file2 of contextReal) {
       let desc = `  ${file2.path} (${file2.tokens.toLocaleString()} tokens, ${file2.lines} lines)`;
       if (file2.isSymlink && file2.symlinkTarget) {
         desc = `  ${file2.path} ${source_default.dim(`-> ${file2.symlinkTarget} (symlink)`)}`;
       }
       lines.push(desc);
     }
+    renderedAnySummary = true;
   }
-  if (mcpFiles.length > 0) {
-    if (contextFiles.length > 0) lines.push("");
-    lines.push(`Found ${mcpFiles.length} MCP config${mcpFiles.length !== 1 ? "s" : ""}`);
-    for (const file2 of mcpFiles) {
-      lines.push(`  ${file2.path}`);
-    }
+  for (const g of ["mcp", "mcph"]) {
+    const real = groups[g].filter((f) => !isSyntheticBucket(f.path));
+    if (real.length === 0) continue;
+    if (renderedAnySummary) lines.push("");
+    lines.push(`Found ${real.length} ${GROUP_SUMMARY_NOUNS[g]}${real.length !== 1 ? "s" : ""}`);
+    for (const file2 of real) lines.push(`  ${file2.path}`);
+    renderedAnySummary = true;
   }
-  if (contextFiles.length === 0 && mcpFiles.length === 0) {
+  if (groups.session.length > 0) {
+    if (renderedAnySummary) lines.push("");
+    lines.push("Session audit scanned");
+    renderedAnySummary = true;
+  }
+  if (!renderedAnySummary) {
     lines.push(`Found ${result.files.length} file${result.files.length !== 1 ? "s" : ""}`);
   }
   lines.push("");
@@ -53057,16 +53295,13 @@ function formatText(result, verbose = false) {
       lines.push("");
     }
   };
-  if (contextFiles.length > 0 && mcpFiles.length > 0) {
-    const contextWithIssues = contextFiles.filter((f) => f.issues.length > 0 || verbose);
-    const mcpWithIssues = mcpFiles.filter((f) => f.issues.length > 0 || verbose);
-    if (contextWithIssues.length > 0) {
-      lines.push(source_default.bold("Context Files"));
-      renderFileGroup(contextFiles);
-    }
-    if (mcpWithIssues.length > 0) {
-      lines.push(source_default.bold("MCP Configs"));
-      renderFileGroup(mcpFiles);
+  const groupsToRender = GROUP_ORDER.filter(
+    (g) => groups[g].some((f) => f.issues.length > 0 || verbose)
+  );
+  if (groupsToRender.length > 1) {
+    for (const g of groupsToRender) {
+      lines.push(source_default.bold(GROUP_LABELS[g]));
+      renderFileGroup(groups[g]);
     }
   } else {
     renderFileGroup(result.files);
@@ -53282,6 +53517,31 @@ function buildRuleDescriptors() {
       shortDescription: { text: "Redundant MCP config entry" },
       helpUri: "https://github.com/yawlabs/ctxlint#mcp-config-linting"
     },
+    {
+      id: "ctxlint/mcph-token-security",
+      shortDescription: { text: "mcp.hosting PAT leakage or env-var posture" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-apibase",
+      shortDescription: { text: "mcph apiBase URL validation" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-schema-conformance",
+      shortDescription: { text: "mcph config unknown field or stale schema version" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-lists",
+      shortDescription: { text: "mcph allow/deny list conflict or duplicate entry" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
+    {
+      id: "ctxlint/mcph-gitignore",
+      shortDescription: { text: "mcph machine-local file not covered by .gitignore" },
+      helpUri: "https://github.com/yawlabs/ctxlint#mcph-config-linting"
+    },
     {
       id: "ctxlint/session-missing-secret",
       shortDescription: { text: "GitHub secret set on sibling repos but missing here" },
@@ -53335,10 +53595,24 @@ function formatIssue(issue2) {
   }
   return line;
 }
+var GROUP_ORDER, GROUP_LABELS, GROUP_SUMMARY_NOUNS;
 var init_reporter = __esm({
   "src/core/reporter.ts"() {
     "use strict";
     init_source();
+    GROUP_ORDER = ["context", "mcp", "mcph", "session"];
+    GROUP_LABELS = {
+      context: "Context Files",
+      mcp: "MCP Configs",
+      mcph: "mcph Configs",
+      session: "Session Audit"
+    };
+    GROUP_SUMMARY_NOUNS = {
+      context: "context file",
+      mcp: "MCP config",
+      mcph: "mcph config",
+      session: "session audit"
+    };
   }
 });
 
@@ -53437,7 +53711,7 @@ function loadConfig(projectRoot) {
     const filePath = path11.join(projectRoot, filename);
     let content;
     try {
-      content = fs8.readFileSync(filePath, "utf-8");
+      content = stripBom(fs8.readFileSync(filePath, "utf-8"));
     } catch {
       continue;
     }
@@ -53448,7 +53722,7 @@ function loadConfig(projectRoot) {
 function loadConfigFromExplicitPath(configPath) {
   let content;
   try {
-    content = fs8.readFileSync(configPath, "utf-8");
+    content = stripBom(fs8.readFileSync(configPath, "utf-8"));
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(`could not load config from ${configPath}: ${detail}`, { cause: err });
@@ -53460,6 +53734,7 @@ var init_config2 = __esm({
   "src/core/config.ts"() {
     "use strict";
     import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
+    init_fs();
     levenshtein2 = import_fast_levenshtein2.default.get;
     KNOWN_CONFIG_KEYS = [
       "checks",
@@ -53511,74 +53786,7 @@ async function runCli() {
     false
   ).option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
     const resolvedPath = path12.resolve(projectPath);
-    const configPath = opts.config ? path12.resolve(opts.config) : void 0;
-    const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
-    const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
-    const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
-    const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
-    const mcphGlobal = opts.mcphGlobal || config2?.mcphGlobal || false;
-    const mcphOnly = opts.mcphOnly || config2?.mcphOnly || false;
-    const mcphFlag = opts.mcph || mcphGlobal || mcphOnly || config2?.mcph || false;
-    const mcphStrictEnvToken = opts.mcphStrictEnvToken || config2?.mcphStrictEnvToken || false;
-    const sessionOnly = opts.sessionOnly || config2?.sessionOnly || false;
-    const sessionFlag = opts.session || sessionOnly || config2?.session || false;
-    let explicitChecks = opts.checks ? validateCheckNames(
-      opts.checks.split(",").map((c3) => c3.trim()),
-      "--checks"
-    ) : null;
-    if (explicitChecks?.length === 0) explicitChecks = null;
-    const hasMcpInChecks = explicitChecks?.some((c3) => c3.startsWith("mcp-")) || false;
-    const hasMcphInChecks = explicitChecks?.some((c3) => c3.startsWith("mcph-")) || false;
-    const hasSessionInChecks = explicitChecks?.some((c3) => c3.startsWith("session-")) || false;
-    const effectiveMcp = mcpFlag || hasMcpInChecks;
-    const effectiveMcph = mcphFlag || hasMcphInChecks;
-    const effectiveSession = sessionFlag || sessionOnly || hasSessionInChecks;
-    let checks;
-    if (explicitChecks) {
-      checks = explicitChecks;
-    } else if (sessionOnly) {
-      checks = ALL_SESSION_CHECKS;
-    } else if (mcpOnly) {
-      checks = ALL_MCP_CHECKS;
-    } else if (mcphOnly) {
-      checks = ALL_MCPH_CHECKS;
-    } else {
-      const base = config2?.checks || ALL_CHECKS;
-      checks = [
-        ...base,
-        ...effectiveMcp ? ALL_MCP_CHECKS : [],
-        ...effectiveMcph ? ALL_MCPH_CHECKS : [],
-        ...effectiveSession ? ALL_SESSION_CHECKS : []
-      ];
-    }
-    const options = {
-      projectPath: resolvedPath,
-      checks,
-      strict: opts.strict || config2?.strict || false,
-      format: opts.format,
-      verbose: opts.verbose,
-      fix: opts.fix,
-      ignore: opts.ignore ? validateCheckNames(
-        opts.ignore.split(",").map((c3) => c3.trim()),
-        "--ignore"
-      ) : config2?.ignore || [],
-      tokensOnly: opts.tokens,
-      quiet: opts.quiet,
-      depth: Math.max(0, Math.min(parseInt(opts.depth, 10) || 2, 10)),
-      mcp: effectiveMcp,
-      mcpOnly,
-      mcpGlobal,
-      mcph: effectiveMcph,
-      mcphOnly,
-      mcphGlobal,
-      mcphStrictEnvToken,
-      session: effectiveSession,
-      sessionOnly
-    };
-    if (config2?.tokenThresholds) {
-      setTokenThresholds(config2.tokenThresholds);
-    }
-    const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
+    const { config: config2, options, activeChecks } = resolveSession(resolvedPath, opts);
     const spinner = options.format === "text" && !options.quiet ? ora("Scanning for context files...").start() : void 0;
     try {
       if (spinner) spinner.text = "Running checks...";
@@ -53706,7 +53914,16 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         path12.join(resolvedPath, "GEMINI.md"),
         path12.join(resolvedPath, "replit.md"),
         path12.join(resolvedPath, "package.json"),
-        path12.join(resolvedPath, ".mcp.json")
+        path12.join(resolvedPath, ".mcp.json"),
+        // mcph configs — without these, edits to the .mcph.json the user is
+        // actively iterating on don't trigger a re-lint.
+        path12.join(resolvedPath, ".mcph.json"),
+        path12.join(resolvedPath, ".mcph.local.json"),
+        // ctxlint config — re-resolve on edit so threshold changes,
+        // ignore-list edits, and check-list overrides take effect without
+        // restarting the watcher.
+        path12.join(resolvedPath, ".ctxlintrc"),
+        path12.join(resolvedPath, ".ctxlintrc.json")
       ];
       const watchDirs = [
         path12.join(resolvedPath, ".claude"),
@@ -53727,30 +53944,46 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         if (debounceTimer) clearTimeout(debounceTimer);
         debounceTimer = setTimeout(async () => {
           if (process.stdout.isTTY) console.clear();
+          let liveConfig = config2;
+          let liveOptions = options;
+          let liveActiveChecks = activeChecks;
+          try {
+            const resolved = resolveSession(resolvedPath, opts);
+            liveConfig = resolved.config;
+            liveOptions = resolved.options;
+            liveActiveChecks = resolved.activeChecks;
+          } catch (err) {
+            console.error("Error reloading config:", err instanceof Error ? err.message : err);
+          }
           try {
-            const result = await runAudit(resolvedPath, activeChecks, {
-              depth: options.depth,
-              extraPatterns: config2?.contextFiles,
-              mcp: options.mcp,
-              mcpGlobal: options.mcpGlobal,
-              mcpOnly: options.mcpOnly,
-              mcph: options.mcph,
-              mcphGlobal: options.mcphGlobal,
-              mcphOnly: options.mcphOnly,
-              mcphStrictEnvToken: options.mcphStrictEnvToken,
-              session: options.session,
-              sessionOnly: options.sessionOnly
+            if (liveConfig?.tokenThresholds) {
+              setTokenThresholds(liveConfig.tokenThresholds);
+            } else {
+              resetTokenThresholds();
+            }
+            const result = await runAudit(resolvedPath, liveActiveChecks, {
+              depth: liveOptions.depth,
+              extraPatterns: liveConfig?.contextFiles,
+              mcp: liveOptions.mcp,
+              mcpGlobal: liveOptions.mcpGlobal,
+              mcpOnly: liveOptions.mcpOnly,
+              mcph: liveOptions.mcph,
+              mcphGlobal: liveOptions.mcphGlobal,
+              mcphOnly: liveOptions.mcphOnly,
+              mcphStrictEnvToken: liveOptions.mcphStrictEnvToken,
+              session: liveOptions.session,
+              sessionOnly: liveOptions.sessionOnly
             });
             if (result.files.length === 0) {
               console.log("\nNo context files found.\n");
-            } else if (options.tokensOnly) {
+            } else if (liveOptions.tokensOnly) {
               console.log(formatTokenReport(result));
-            } else if (options.format === "json") {
+            } else if (liveOptions.format === "json") {
               console.log(formatJson(result));
-            } else if (options.format === "sarif") {
+            } else if (liveOptions.format === "sarif") {
               console.log(formatSarif(result));
             } else {
-              console.log(formatText(result, options.verbose));
+              console.log(formatText(result, liveOptions.verbose));
             }
           } catch (err) {
             console.error("Error:", err instanceof Error ? err.message : err);
@@ -53760,7 +53993,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             resetPathsCache();
             resetPackageJsonCache();
             resetTokenThresholds();
-            if (config2?.tokenThresholds) setTokenThresholds(config2.tokenThresholds);
           }
           console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
         }, 300);
@@ -53839,6 +54071,77 @@ async function promptYesNo(question) {
     rl.close();
   }
 }
+function resolveSession(resolvedPath, opts) {
+  const configPath = opts.config ? path12.resolve(opts.config) : void 0;
+  const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
+  const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
+  const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
+  const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
+  const mcphGlobal = opts.mcphGlobal || config2?.mcphGlobal || false;
+  const mcphOnly = opts.mcphOnly || config2?.mcphOnly || false;
+  const mcphFlag = opts.mcph || mcphGlobal || mcphOnly || config2?.mcph || false;
+  const mcphStrictEnvToken = opts.mcphStrictEnvToken || config2?.mcphStrictEnvToken || false;
+  const sessionOnly = opts.sessionOnly || config2?.sessionOnly || false;
+  const sessionFlag = opts.session || sessionOnly || config2?.session || false;
+  let explicitChecks = opts.checks ? validateCheckNames(
+    opts.checks.split(",").map((c3) => c3.trim()),
+    "--checks"
+  ) : null;
+  if (explicitChecks?.length === 0) explicitChecks = null;
+  const hasMcpInChecks = explicitChecks?.some((c3) => c3.startsWith("mcp-") && !c3.startsWith("mcph-")) || false;
+  const hasMcphInChecks = explicitChecks?.some((c3) => c3.startsWith("mcph-")) || false;
+  const hasSessionInChecks = explicitChecks?.some((c3) => c3.startsWith("session-")) || false;
+  const effectiveMcp = mcpFlag || hasMcpInChecks;
+  const effectiveMcph = mcphFlag || hasMcphInChecks;
+  const effectiveSession = sessionFlag || sessionOnly || hasSessionInChecks;
+  let checks;
+  if (explicitChecks) {
+    checks = explicitChecks;
+  } else if (sessionOnly) {
+    checks = ALL_SESSION_CHECKS;
+  } else if (mcpOnly) {
+    checks = ALL_MCP_CHECKS;
+  } else if (mcphOnly) {
+    checks = ALL_MCPH_CHECKS;
+  } else {
+    const base = config2?.checks || ALL_CHECKS;
+    checks = [
+      ...base,
+      ...effectiveMcp ? ALL_MCP_CHECKS : [],
+      ...effectiveMcph ? ALL_MCPH_CHECKS : [],
+      ...effectiveSession ? ALL_SESSION_CHECKS : []
+    ];
+  }
+  const options = {
+    projectPath: resolvedPath,
+    checks,
+    strict: opts.strict || config2?.strict || false,
+    format: opts.format,
+    verbose: opts.verbose,
+    fix: opts.fix,
+    ignore: opts.ignore ? validateCheckNames(
+      opts.ignore.split(",").map((c3) => c3.trim()),
+      "--ignore"
+    ) : config2?.ignore || [],
+    tokensOnly: opts.tokens,
+    quiet: opts.quiet,
+    depth: Math.max(0, Math.min(parseInt(opts.depth, 10) || 2, 10)),
+    mcp: effectiveMcp,
+    mcpOnly,
+    mcpGlobal,
+    mcph: effectiveMcph,
+    mcphOnly,
+    mcphGlobal,
+    mcphStrictEnvToken,
+    session: effectiveSession,
+    sessionOnly
+  };
+  if (config2?.tokenThresholds) {
+    setTokenThresholds(config2.tokenThresholds);
+  }
+  const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
+  return { config: config2, options, activeChecks };
+}
 function loadConfigFromPath(configPath) {
   try {
     return loadConfigFromExplicitPath(configPath);
@@ -53876,7 +54179,8 @@ var init_cli = __esm({
 // src/index.ts
 var args = process.argv.slice(2);
 if (args[0] === "serve" || args.includes("--mcp-server")) {
-  await init_server3().then(() => server_exports);
+  const { startServer: startServer2 } = await Promise.resolve().then(() => (init_server3(), server_exports));
+  await startServer2();
 } else {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();