@yawlabs/ctxlint 0.9.19 → 0.10.0

package/dist/index.js

@@ -21934,11 +21934,11 @@ var init_protocol = __esm({
        *
        * The Protocol object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
        */
-      async connect(transport2) {
+      async connect(transport) {
         if (this._transport) {
           throw new Error("Already connected to a transport. Call close() before connecting to a new transport, or use a separate Protocol instance per connection.");
         }
-        this._transport = transport2;
+        this._transport = transport;
         const _onclose = this.transport?.onclose;
         this._transport.onclose = () => {
           _onclose?.();
@@ -26254,49 +26254,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse4(serialize(base, options), options);
-        relative4 = parse4(serialize(relative4, options), options);
+        relative5 = parse4(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -26304,7 +26304,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -30411,8 +30411,8 @@ var init_mcp = __esm({
        *
        * The `server` object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
        */
-      async connect(transport2) {
-        return await this.server.connect(transport2);
+      async connect(transport) {
+        return await this.server.connect(transport);
       }
       /**
        * Closes the connection.
@@ -34201,10 +34201,13 @@ globstar while`, t2, d, e, f, m), this.matchOne(t2.slice(d), e.slice(f), s)) ret
 // src/utils/fs.ts
 import * as fs2 from "node:fs";
 import * as path from "node:path";
+function stripBom(content) {
+  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+}
 function loadPackageJson(projectRoot) {
   if (pkgJsonCache?.root === projectRoot) return pkgJsonCache.data;
   try {
-    const content = fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8");
+    const content = stripBom(fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8"));
     const data = JSON.parse(content);
     pkgJsonCache = { root: projectRoot, data };
     return data;
@@ -34247,7 +34250,7 @@ function readSymlinkTarget(filePath) {
 }
 function readFileContent(filePath) {
   try {
-    return fs2.readFileSync(filePath, "utf-8");
+    return stripBom(fs2.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -34449,6 +34452,8 @@ async function scanGlobalMcpConfigs() {
     } catch {
       continue;
     }
+    const isGeneralClaudeFile = normalized.endsWith(`${path2.sep}.claude.json`) || normalized.endsWith(`${path2.sep}.claude${path2.sep}settings.json`);
+    if (isGeneralClaudeFile && !mcpFileHasMcpKey(normalized)) continue;
     const symlink = isSymlink(normalized);
     const target = symlink ? readSymlinkTarget(normalized) : void 0;
     found.push({
@@ -34461,6 +34466,14 @@ async function scanGlobalMcpConfigs() {
   }
   return found.sort((a, b2) => a.relativePath.localeCompare(b2.relativePath));
 }
+function mcpFileHasMcpKey(filePath) {
+  try {
+    const content = fs3.readFileSync(filePath, "utf8");
+    return /"(mcpServers|servers)"\s*:/.test(content);
+  } catch {
+    return false;
+  }
+}
 var CONTEXT_FILE_PATTERNS, IGNORED_DIRS2, MCP_CONFIG_PATTERNS, MCPH_CONFIG_PATTERNS;
 var init_scanner = __esm({
   "src/core/scanner.ts"() {
@@ -40656,10 +40669,9 @@ var init_git = __esm({
 });
 
 // src/core/mcp-parser.ts
-async function parseMcpConfig(file2, projectRoot, scopeOverride) {
+async function parseMcpConfig(file2, projectRoot, scope) {
   const content = readFileContent(file2.absolutePath);
   const client = detectClient(file2.relativePath);
-  const scope = scopeOverride ?? detectScope(file2.relativePath);
   const expectedRootKey = client === "vscode" ? "servers" : "mcpServers";
   const isGitTracked = await checkGitTracked(file2.absolutePath, projectRoot);
   const result = {
@@ -40697,16 +40709,17 @@ async function parseMcpConfig(file2, projectRoot, scopeOverride) {
     return result;
   }
   const lines = content.split("\n");
+  const rootKeyLine = findRootKeyLine(lines, rootKey);
   for (const [name, value] of Object.entries(serversObj)) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
       continue;
     }
     const raw = value;
-    const line = findServerLine(lines, name);
-    const transport2 = inferTransport(raw);
+    const line = findServerLine(lines, name, rootKeyLine);
+    const transport = inferTransport(raw);
     const entry = {
       name,
-      transport: transport2,
+      transport,
       line,
       raw
     };
@@ -40718,7 +40731,7 @@ async function parseMcpConfig(file2, projectRoot, scopeOverride) {
     if (typeof raw.disabled === "boolean") entry.disabled = raw.disabled;
     if (Array.isArray(raw.autoApprove)) entry.autoApprove = raw.autoApprove.map(String);
     if (typeof raw.timeout === "number") entry.timeout = raw.timeout;
-    if (typeof raw.oauth === "object" && raw.oauth !== null)
+    if (typeof raw.oauth === "object" && raw.oauth !== null && !Array.isArray(raw.oauth))
       entry.oauth = raw.oauth;
     if (typeof raw.headersHelper === "string") entry.headersHelper = raw.headersHelper;
     result.servers.push(entry);
@@ -40737,9 +40750,6 @@ function detectClient(relativePath) {
   }
   return "claude-code";
 }
-function detectScope(_relativePath) {
-  return "project";
-}
 function findRootKey(parsed) {
   if ("mcpServers" in parsed) return "mcpServers";
   if ("servers" in parsed) return "servers";
@@ -40756,15 +40766,24 @@ function inferTransport(raw) {
   if ("url" in raw) return "http";
   return "unknown";
 }
-function findServerLine(lines, serverName) {
-  const escaped = serverName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function findRootKeyLine(lines, rootKey) {
+  const escaped = rootKey.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const pattern = new RegExp(`"${escaped}"\\s*:`);
   for (let i2 = 0; i2 < lines.length; i2++) {
+    if (pattern.test(lines[i2])) return i2;
+  }
+  return -1;
+}
+function findServerLine(lines, serverName, rootKeyLine) {
+  const escaped = serverName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`"${escaped}"\\s*:`);
+  const start = rootKeyLine >= 0 ? rootKeyLine + 1 : 0;
+  for (let i2 = start; i2 < lines.length; i2++) {
     if (pattern.test(lines[i2])) {
       return i2 + 1;
     }
   }
-  return 1;
+  return rootKeyLine >= 0 ? rootKeyLine + 1 : 1;
 }
 function isStringRecord(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -41296,11 +41315,11 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
       onValue({ type: getNodeType(value), offset, length, parent: currentParent, value });
       ensurePropertyComplete(offset + length);
     },
-    onSeparator: (sep, offset, length) => {
+    onSeparator: (sep2, offset, length) => {
       if (currentParent.type === "property") {
-        if (sep === ":") {
+        if (sep2 === ":") {
           currentParent.colonOffset = offset;
-        } else if (sep === ",") {
+        } else if (sep2 === ",") {
           ensurePropertyComplete(offset);
         }
       }
@@ -41746,9 +41765,9 @@ var init_main = __esm({
 });
 
 // src/core/mcph-parser.ts
-async function parseMchpConfig(file2, projectRoot, scopeOverride) {
+async function parseMcphConfig(file2, projectRoot, scopeOverride) {
   const content = readFileContent(file2.absolutePath);
-  const scope = scopeOverride ?? detectScope2(file2.relativePath);
+  const scope = scopeOverride ?? detectScope(file2.relativePath);
   const isGitTracked = await checkGitTracked2(file2.absolutePath, projectRoot);
   const isGitignored = await checkGitignored(file2.absolutePath, projectRoot);
   const result = {
@@ -41806,9 +41825,8 @@ async function parseMchpConfig(file2, projectRoot, scopeOverride) {
   }
   return result;
 }
-function detectScope2(relativePath) {
+function detectScope(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
-  if (normalized.startsWith("~/")) return "global";
   if (normalized.endsWith(".mcph.local.json")) return "project-local";
   return "project";
 }
@@ -42168,29 +42186,33 @@ async function checkPaths(file2, projectRoot) {
 function findClosestMatch(target, files) {
   const targetNorm = target.replace(/\\/g, "/");
   const targetBase = path3.basename(targetNorm);
-  let bestMatch = null;
-  let bestDistance = Infinity;
+  let basenameMatch = null;
+  let basenameDistance = Infinity;
   for (const file2 of files) {
     const fileNorm = file2.replace(/\\/g, "/");
     if (path3.basename(fileNorm) === targetBase && fileNorm !== targetNorm) {
       const dist = levenshtein(targetNorm, fileNorm);
-      if (dist < bestDistance) {
-        bestDistance = dist;
-        bestMatch = fileNorm;
+      if (dist < basenameDistance) {
+        basenameDistance = dist;
+        basenameMatch = fileNorm;
       }
     }
   }
-  if (!bestMatch) {
-    for (const file2 of files) {
-      const fileNorm = file2.replace(/\\/g, "/");
-      const dist = levenshtein(targetNorm, fileNorm);
-      if (dist < bestDistance && dist <= Math.max(targetNorm.length * 0.4, 5)) {
-        bestDistance = dist;
-        bestMatch = fileNorm;
-      }
+  if (basenameMatch) return basenameMatch;
+  const absoluteCap = Math.max(targetNorm.length * 0.4, 5);
+  let fullPathMatch = null;
+  let fullPathDistance = Infinity;
+  for (const file2 of files) {
+    const fileNorm = file2.replace(/\\/g, "/");
+    const lenDelta = Math.abs(targetNorm.length - fileNorm.length);
+    if (lenDelta >= fullPathDistance || lenDelta > absoluteCap) continue;
+    const dist = levenshtein(targetNorm, fileNorm);
+    if (dist < fullPathDistance && dist <= absoluteCap) {
+      fullPathDistance = dist;
+      fullPathMatch = fileNorm;
     }
   }
-  return bestMatch;
+  return fullPathMatch;
 }
 var import_fast_levenshtein, levenshtein, cachedProjectFiles;
 var init_paths = __esm({
@@ -42208,6 +42230,24 @@ var init_paths = __esm({
 // src/core/checks/commands.ts
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
+function extractNpxPackage(cmd) {
+  if (!/^npx\b/.test(cmd)) return null;
+  const tokens = cmd.split(/\s+/).slice(1);
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const t2 = tokens[i2];
+    if (t2 === "-p" || t2 === "--package") {
+      const v2 = tokens[i2 + 1];
+      if (v2 && !v2.startsWith("-")) return v2;
+      continue;
+    }
+    if (t2.startsWith("-p=") || t2.startsWith("--package=")) {
+      return t2.slice(t2.indexOf("=") + 1) || null;
+    }
+    if (t2.startsWith("-")) continue;
+    return t2;
+  }
+  return null;
+}
 async function checkCommands(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42246,10 +42286,9 @@ async function checkCommands(file2, projectRoot) {
       }
       continue;
     }
-    const npxMatch = cmd.match(NPX_PATTERN);
-    if (npxMatch && pkgJson) {
-      const pkgName = npxMatch[1];
-      if (pkgName.startsWith("-")) continue;
+    if (/^npx\b/.test(cmd) && pkgJson) {
+      const pkgName = extractNpxPackage(cmd);
+      if (!pkgName) continue;
       const allDeps = {
         ...pkgJson.dependencies,
         ...pkgJson.devDependencies,
@@ -42324,7 +42363,7 @@ async function checkCommands(file2, projectRoot) {
 }
 function loadMakefile(projectRoot) {
   try {
-    return fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8");
+    return stripBom(fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8"));
   } catch {
     return null;
   }
@@ -42333,14 +42372,13 @@ function hasMakeTarget(makefile, target) {
   const pattern = new RegExp(`^${target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`, "m");
   return pattern.test(makefile);
 }
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN;
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN;
 var init_commands = __esm({
   "src/core/checks/commands.ts"() {
     "use strict";
     init_fs();
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|pnpm(?:\s+run)?|yarn(?:\s+run)?|bun(?:\s+run)?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+(\S+)/;
-    NPX_PATTERN = /^npx\s+(\S+)/;
   }
 });
 
@@ -42405,26 +42443,21 @@ var init_staleness = __esm({
 });
 
 // src/core/checks/tokens.ts
-function setTokenThresholds(overrides) {
-  const merged = { ...DEFAULT_THRESHOLDS, ...overrides };
+function resolveTokenThresholds(overrides) {
+  if (!overrides) return DEFAULT_TOKEN_THRESHOLDS;
+  const merged = { ...DEFAULT_TOKEN_THRESHOLDS, ...overrides };
   if (merged.info >= merged.warning || merged.warning >= merged.error) {
     console.error(
       `Warning: token thresholds should satisfy info < warning < error (got ${merged.info}, ${merged.warning}, ${merged.error}) \u2014 using defaults`
     );
-    return;
+    return DEFAULT_TOKEN_THRESHOLDS;
   }
-  currentThresholds = merged;
+  return merged;
 }
-function resetTokenThresholds() {
-  currentThresholds = DEFAULT_THRESHOLDS;
-}
-function getTokenThresholds() {
-  return currentThresholds;
-}
-async function checkTokens(file2, _projectRoot) {
+async function checkTokens(file2, _projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const issues = [];
   const tokens = file2.totalTokens;
-  if (tokens >= currentThresholds.error) {
+  if (tokens >= thresholds.error) {
     issues.push({
       severity: "error",
       check: "tokens",
@@ -42433,7 +42466,7 @@ async function checkTokens(file2, _projectRoot) {
       message: `${tokens.toLocaleString()} tokens \u2014 consumes significant context window space`,
       suggestion: "Consider splitting into focused sections or removing redundant content."
     });
-  } else if (tokens >= currentThresholds.warning) {
+  } else if (tokens >= thresholds.warning) {
     issues.push({
       severity: "warning",
       check: "tokens",
@@ -42442,7 +42475,7 @@ async function checkTokens(file2, _projectRoot) {
       message: `${tokens.toLocaleString()} tokens \u2014 large context file`,
       suggestion: "Consider trimming \u2014 research shows diminishing returns past ~300 lines."
     });
-  } else if (tokens >= currentThresholds.info) {
+  } else if (tokens >= thresholds.info) {
     issues.push({
       severity: "info",
       check: "tokens",
@@ -42453,9 +42486,9 @@ async function checkTokens(file2, _projectRoot) {
   }
   return issues;
 }
-function checkAggregateTokens(files) {
+function checkAggregateTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const total = files.reduce((sum, f) => sum + f.tokens, 0);
-  if (total > currentThresholds.aggregate && files.length > 1) {
+  if (total > thresholds.aggregate && files.length > 1) {
     return {
       severity: "warning",
       check: "tokens",
@@ -42467,11 +42500,11 @@ function checkAggregateTokens(files) {
   }
   return null;
 }
-var DEFAULT_THRESHOLDS, currentThresholds;
+var DEFAULT_TOKEN_THRESHOLDS;
 var init_tokens2 = __esm({
   "src/core/checks/tokens.ts"() {
     "use strict";
-    DEFAULT_THRESHOLDS = {
+    DEFAULT_TOKEN_THRESHOLDS = {
       info: 1e3,
       warning: 3e3,
       error: 8e3,
@@ -42479,7 +42512,6 @@ var init_tokens2 = __esm({
       tierBreakdown: 1e3,
       tierAggregate: 4e3
     };
-    currentThresholds = DEFAULT_THRESHOLDS;
   }
 });
 
@@ -42515,7 +42547,14 @@ function isAlwaysLoaded(file2) {
     return !hasPathsFrontmatter(file2.content);
   }
   const basename4 = rel.split("/").pop() ?? "";
-  return ALWAYS_LOADED_BASENAMES.has(basename4);
+  for (const name of ALWAYS_LOADED_NAMES) {
+    if (name.includes("/")) {
+      if (rel === name || rel.endsWith("/" + name)) return true;
+    } else if (basename4 === name) {
+      return true;
+    }
+  }
+  return false;
 }
 function computeSectionCosts(file2) {
   if (file2.sections.length === 0) return [];
@@ -42537,7 +42576,7 @@ function loadSettingsSources(projectRoot) {
   for (const p2 of candidates) {
     let content;
     try {
-      content = fs5.readFileSync(p2, "utf-8");
+      content = stripBom(fs5.readFileSync(p2, "utf-8"));
     } catch {
       continue;
     }
@@ -42553,9 +42592,17 @@ function canonicalizeCommand(backticked) {
   const beforeFlags = backticked.trim().split(/\s+--?/, 1)[0];
   return beforeFlags.replace(/\s+/g, " ");
 }
+function buildCommandPattern(cmd) {
+  const tokens = cmd.split(/\s+/).filter(Boolean);
+  const escaped = tokens.map((t2) => t2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  if (tokens.length === 1) {
+    return new RegExp(`(?<![A-Za-z0-9_\\-])${escaped[0]}(?![A-Za-z0-9_\\-])`, "i");
+  }
+  const body = escaped.join("[\\s\\-_]+");
+  return new RegExp(`(?<![A-Za-z0-9])${body}(?![A-Za-z0-9])`, "i");
+}
 function commandIsEnforced(cmd, settings) {
-  const escaped = cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`\\b${escaped}\\b`, "i");
+  const pattern = buildCommandPattern(cmd);
   for (const s of settings) {
     for (const entry of s.permissions?.deny ?? []) {
       if (pattern.test(entry)) return true;
@@ -42590,10 +42637,10 @@ function checkHardEnforcement(file2, settings) {
   }
   return issues;
 }
-async function checkTierTokens(file2, projectRoot) {
+async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   if (!isAlwaysLoaded(file2)) return [];
   const issues = [];
-  const threshold = getTokenThresholds().tierBreakdown;
+  const threshold = thresholds.tierBreakdown;
   if (file2.totalTokens >= threshold) {
     const sectionCosts = computeSectionCosts(file2);
     if (sectionCosts.length > 0) {
@@ -42616,11 +42663,11 @@ async function checkTierTokens(file2, projectRoot) {
   issues.push(...checkHardEnforcement(file2, settings));
   return issues;
 }
-function checkAggregateTierTokens(files) {
+function checkAggregateTierTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const alwaysLoaded = files.filter(isAlwaysLoaded);
   if (alwaysLoaded.length < 2) return null;
   const total = alwaysLoaded.reduce((sum, f) => sum + f.totalTokens, 0);
-  const threshold = getTokenThresholds().tierAggregate;
+  const threshold = thresholds.tierAggregate;
   if (total < threshold) return null;
   const breakdown = alwaysLoaded.slice().sort((a, b2) => b2.totalTokens - a.totalTokens).slice(0, 5).map((f) => `  - ${f.relativePath}: ~${f.totalTokens.toLocaleString()} tokens`).join("\n");
   return {
@@ -42633,13 +42680,14 @@ function checkAggregateTierTokens(files) {
     suggestion: "Consider moving the largest files or their heaviest sections to on-demand tiers (skills, subagents, memory)."
   };
 }
-var ALWAYS_LOADED_BASENAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
+var ALWAYS_LOADED_NAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
 var init_tier_tokens = __esm({
   "src/core/checks/tier-tokens.ts"() {
     "use strict";
     init_tokens();
+    init_fs();
     init_tokens2();
-    ALWAYS_LOADED_BASENAMES = /* @__PURE__ */ new Set([
+    ALWAYS_LOADED_NAMES = [
       "CLAUDE.md",
       "CLAUDE.local.md",
       "AGENTS.md",
@@ -42654,15 +42702,42 @@ var init_tier_tokens = __esm({
       ".rules",
       ".goosehints",
       "replit.md",
-      "copilot-instructions.md",
-      "guidelines.md",
-      "instructions.md"
-    ]);
+      ".github/copilot-instructions.md",
+      ".junie/guidelines.md",
+      ".junie/AGENTS.md",
+      ".goose/instructions.md"
+    ];
     TOP_SECTIONS_TO_REPORT = 3;
     INVIOLABLE_WITH_COMMAND = /\b(NEVER|ALWAYS|DON'?T|DO NOT|MUST NOT)\b[^.!?`]{0,80}`([^`]+)`/i;
   }
 });
 
+// src/utils/similarity.ts
+function jaccardSimilarityFromSets(a, b2, opts = {}) {
+  const bothEmptyIsIdentical = opts.bothEmptyIsIdentical ?? false;
+  if (a.size === 0 && b2.size === 0) {
+    return bothEmptyIsIdentical ? 1 : 0;
+  }
+  if (a.size === 0 || b2.size === 0) return 0;
+  const [small, large] = a.size <= b2.size ? [a, b2] : [b2, a];
+  let intersection2 = 0;
+  for (const line of small) {
+    if (large.has(line)) intersection2++;
+  }
+  const unionSize = a.size + b2.size - intersection2;
+  return intersection2 / unionSize;
+}
+function toLineSet(text, minTokenLen) {
+  return new Set(
+    text.split("\n").map((l) => l.trim()).filter((l) => l.length > minTokenLen)
+  );
+}
+var init_similarity = __esm({
+  "src/utils/similarity.ts"() {
+    "use strict";
+  }
+});
+
 // src/core/checks/redundancy.ts
 import * as path7 from "node:path";
 function compilePatterns(allDeps) {
@@ -42685,6 +42760,20 @@ function compilePatterns(allDeps) {
   }
   return compiled;
 }
+function getCompiledPatterns(projectRoot, allDeps) {
+  const relevant = [];
+  for (const pkg of Object.keys(PACKAGE_TECH_MAP)) {
+    if (allDeps.has(pkg)) relevant.push(pkg);
+  }
+  relevant.sort();
+  const key = `${projectRoot}\0${relevant.join(" ")}`;
+  let compiled = compiledPatternsCache.get(key);
+  if (!compiled) {
+    compiled = compilePatterns(allDeps);
+    compiledPatternsCache.set(key, compiled);
+  }
+  return compiled;
+}
 async function checkRedundancy(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42695,7 +42784,7 @@ async function checkRedundancy(file2, projectRoot) {
       ...Object.keys(pkgJson.peerDependencies || {}),
       ...Object.keys(pkgJson.optionalDependencies || {})
     ]);
-    const compiledPatterns = compilePatterns(allDeps);
+    const compiledPatterns = getCompiledPatterns(projectRoot, allDeps);
     const lines2 = file2.content.split("\n");
     for (let i2 = 0; i2 < lines2.length; i2++) {
       const line = lines2[i2];
@@ -42746,10 +42835,14 @@ async function checkRedundancy(file2, projectRoot) {
 }
 function checkDuplicateContent(files) {
   const issues = [];
-  const DUPLICATE_CONTENT_THRESHOLD = 0.6;
+  const lineSets = files.map((f) => toLineSet(f.content, DUPLICATE_CONTENT_MIN_TOKEN_LEN));
   for (let i2 = 0; i2 < files.length; i2++) {
+    const a = lineSets[i2];
+    if (a.size === 0) continue;
     for (let j3 = i2 + 1; j3 < files.length; j3++) {
-      const overlap = calculateLineOverlap(files[i2].content, files[j3].content);
+      const b2 = lineSets[j3];
+      if (b2.size === 0) continue;
+      const overlap = jaccardSimilarityFromSets(a, b2);
       if (overlap >= DUPLICATE_CONTENT_THRESHOLD) {
         issues.push({
           severity: "warning",
@@ -42764,29 +42857,15 @@ function checkDuplicateContent(files) {
   }
   return issues;
 }
-function calculateLineOverlap(contentA, contentB) {
-  const linesA = new Set(
-    contentA.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
-  );
-  const linesB = new Set(
-    contentB.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
-  );
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
-  }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
-}
 function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-var PACKAGE_TECH_MAP;
+var PACKAGE_TECH_MAP, compiledPatternsCache, DUPLICATE_CONTENT_THRESHOLD, DUPLICATE_CONTENT_MIN_TOKEN_LEN;
 var init_redundancy = __esm({
   "src/core/checks/redundancy.ts"() {
     "use strict";
     init_fs();
+    init_similarity();
     init_tokens();
     PACKAGE_TECH_MAP = {
       react: ["React", "react"],
@@ -42839,6 +42918,9 @@ var init_redundancy = __esm({
       cypress: ["Cypress"],
       puppeteer: ["Puppeteer"]
     };
+    compiledPatternsCache = /* @__PURE__ */ new Map();
+    DUPLICATE_CONTENT_THRESHOLD = 0.6;
+    DUPLICATE_CONTENT_MIN_TOKEN_LEN = 10;
   }
 });
 
@@ -43156,7 +43238,7 @@ var init_contradictions = __esm({
 function parseFrontmatter(content) {
   const lines = content.split("\n");
   if (lines[0]?.trim() !== "---") {
-    return { found: false, fields: {}, endLine: 0 };
+    return { found: false, fields: {}, endLine: 0, unclosed: false };
   }
   const fields = {};
   let endLine = 0;
@@ -43183,9 +43265,9 @@ function parseFrontmatter(content) {
     }
   }
   if (endLine === 0) {
-    return { found: true, fields, endLine: lines.length };
+    return { found: true, fields, endLine: lines.length, unclosed: true };
   }
-  return { found: true, fields, endLine };
+  return { found: true, fields, endLine, unclosed: false };
 }
 function isCursorMdc(file2) {
   return file2.relativePath.endsWith(".mdc");
@@ -43196,6 +43278,23 @@ function isCopilotInstructions(file2) {
 function isWindsurfRule(file2) {
   return file2.relativePath.includes(".windsurf/rules/") && file2.relativePath.endsWith(".md");
 }
+function hasUnbalancedBracketsOrQuotes(val) {
+  let square = 0;
+  let curly = 0;
+  for (const ch of val) {
+    if (ch === "[") square++;
+    else if (ch === "]") square--;
+    else if (ch === "{") curly++;
+    else if (ch === "}") curly--;
+    if (square < 0 || curly < 0) return true;
+  }
+  if (square !== 0 || curly !== 0) return true;
+  const doubleQuotes = (val.match(/"/g) || []).length;
+  const singleQuotes = (val.match(/'/g) || []).length;
+  if (doubleQuotes % 2 !== 0) return true;
+  if (singleQuotes % 2 !== 0) return true;
+  return false;
+}
 async function checkFrontmatter(file2, _projectRoot) {
   const issues = [];
   if (isCursorMdc(file2)) {
@@ -43207,9 +43306,23 @@ async function checkFrontmatter(file2, _projectRoot) {
   }
   return issues;
 }
+function unclosedFrontmatterIssue() {
+  return {
+    severity: "error",
+    check: "frontmatter",
+    ruleId: "frontmatter/unclosed",
+    line: 1,
+    message: "Frontmatter opens with `---` but is never closed",
+    suggestion: "Add a matching `---` line (with no leading whitespace) after the last frontmatter field"
+  };
+}
 function validateCursorMdc(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "warning",
@@ -43256,13 +43369,13 @@ function validateCursorMdc(file2) {
   }
   if ("globs" in fm.fields) {
     const val = fm.fields["globs"];
-    if (val && !val.startsWith("[") && !val.startsWith('"') && !val.includes("*") && !val.includes("/")) {
+    if (val && hasUnbalancedBracketsOrQuotes(val)) {
       issues.push({
         severity: "warning",
         check: "frontmatter",
         ruleId: "frontmatter/invalid-value",
         line: 1,
-        message: `Possibly invalid globs value: "${val}"`,
+        message: `Possibly malformed globs value: "${val}"`,
         suggestion: 'globs should be a glob pattern like "src/**/*.ts" or an array like ["*.ts", "*.tsx"]'
       });
     }
@@ -43272,6 +43385,10 @@ function validateCursorMdc(file2) {
 function validateCopilotInstructions(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "info",
@@ -43298,6 +43415,10 @@ function validateCopilotInstructions(file2) {
 function validateWindsurfRule(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "info",
@@ -43349,7 +43470,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "invalid-json",
+        ruleId: "mcp-schema/invalid-json",
         line: 1,
         message: `MCP config is not valid JSON: ${err}`
       });
@@ -43360,7 +43481,7 @@ async function checkMcpSchema(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcp-schema",
-      ruleId: "missing-root-key",
+      ruleId: "mcp-schema/missing-root-key",
       line: 1,
       message: `MCP config has no "${config2.expectedRootKey}" key`
     });
@@ -43371,7 +43492,7 @@ async function checkMcpSchema(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcp-schema",
-      ruleId: "wrong-root-key",
+      ruleId: "mcp-schema/wrong-root-key",
       line,
       message: `${config2.relativePath} must use "${config2.expectedRootKey}" as root key, not "${config2.actualRootKey}"`,
       fix: {
@@ -43386,7 +43507,7 @@ async function checkMcpSchema(config2, _projectRoot) {
     issues.push({
       severity: "info",
       check: "mcp-schema",
-      ruleId: "empty-servers",
+      ruleId: "mcp-schema/empty-servers",
       line: 1,
       message: "MCP config has no server entries"
     });
@@ -43397,7 +43518,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "no-name-field",
+        ruleId: "mcp-schema/no-name-field",
         line: server2.line,
         message: "Server name cannot be empty"
       });
@@ -43409,7 +43530,7 @@ async function checkMcpSchema(config2, _projectRoot) {
         issues.push({
           severity: "warning",
           check: "mcp-schema",
-          ruleId: "unknown-transport",
+          ruleId: "mcp-schema/unknown-transport",
           line: server2.line,
           message: `Server "${server2.name}" has unknown transport type "${typeVal}"`
         });
@@ -43419,7 +43540,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcp-schema",
-        ruleId: "ambiguous-transport",
+        ruleId: "mcp-schema/ambiguous-transport",
         line: server2.line,
         message: `Server "${server2.name}" has both "command" and "url" \u2014 transport is ambiguous`
       });
@@ -43428,7 +43549,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "missing-command",
+        ruleId: "mcp-schema/missing-command",
         line: server2.line,
         message: `Server "${server2.name}" has no "command" field`
       });
@@ -43437,7 +43558,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "missing-url",
+        ruleId: "mcp-schema/missing-url",
         line: server2.line,
         message: `Server "${server2.name}" has no "url" field`
       });
@@ -43469,6 +43590,10 @@ function isEnvVarRef(value) {
 function isKnownApiKey(value) {
   return API_KEY_PATTERNS.some((p2) => p2.test(value));
 }
+function nameSuggestsSecret(name) {
+  const upper = name.toUpperCase();
+  return SECRET_NAME_KEYWORDS.some((kw) => upper.includes(kw));
+}
 function isHighEntropySecret(value) {
   if (isEnvVarRef(value)) return false;
   return HIGH_ENTROPY_PATTERN.test(value);
@@ -43492,7 +43617,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
               issues.push({
                 severity: "error",
                 check: "mcp-security",
-                ruleId: "hardcoded-bearer",
+                ruleId: "mcp-security/hardcoded-bearer",
                 line: server2.line,
                 message: `Server "${server2.name}" has a hardcoded Bearer token in a git-tracked file`,
                 fix: {
@@ -43509,7 +43634,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-security",
-            ruleId: "hardcoded-api-key",
+            ruleId: "mcp-security/hardcoded-api-key",
             line: server2.line,
             message: `Server "${server2.name}" has a hardcoded API key in a git-tracked file`
           });
@@ -43517,13 +43642,14 @@ async function checkMcpSecurity(config2, _projectRoot) {
       }
     }
     if (server2.env) {
-      for (const envValue of Object.values(server2.env)) {
-        if (!isEnvVarRef(envValue) && (isKnownApiKey(envValue) || isHighEntropySecret(envValue))) {
+      for (const [envName, envValue] of Object.entries(server2.env)) {
+        const isSecret = isKnownApiKey(envValue) || nameSuggestsSecret(envName) && isHighEntropySecret(envValue);
+        if (!isEnvVarRef(envValue) && isSecret) {
           const envVar = deriveEnvVarName(server2.name, "API_KEY");
           issues.push({
             severity: "error",
             check: "mcp-security",
-            ruleId: "hardcoded-api-key",
+            ruleId: "mcp-security/hardcoded-api-key",
             line: server2.line,
             message: `Server "${server2.name}" has a hardcoded API key in a git-tracked file`,
             fix: {
@@ -43540,7 +43666,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-security",
-        ruleId: "secret-in-url",
+        ruleId: "mcp-security/secret-in-url",
         line: server2.line,
         message: `Server "${server2.name}" has a secret in the URL query string`
       });
@@ -43553,7 +43679,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
             issues.push({
               severity: "warning",
               check: "mcp-security",
-              ruleId: "http-no-tls",
+              ruleId: "mcp-security/http-no-tls",
               line: server2.line,
               message: `Server "${server2.name}" uses HTTP without TLS`
             });
@@ -43565,7 +43691,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
   }
   return issues;
 }
-var API_KEY_PATTERNS, ENV_VAR_REF, HIGH_ENTROPY_PATTERN, URL_SECRET_PARAMS;
+var API_KEY_PATTERNS, ENV_VAR_REF, HIGH_ENTROPY_PATTERN, URL_SECRET_PARAMS, SECRET_NAME_KEYWORDS;
 var init_security = __esm({
   "src/core/checks/mcp/security.ts"() {
     "use strict";
@@ -43594,6 +43720,22 @@ var init_security = __esm({
     ENV_VAR_REF = /\$\{[^}]+\}/;
     HIGH_ENTROPY_PATTERN = /^[A-Za-z0-9+/=_-]{21,}$/;
     URL_SECRET_PARAMS = /[?&](key|token|api_key|apikey|secret|password|access_token)=/i;
+    SECRET_NAME_KEYWORDS = [
+      "KEY",
+      "TOKEN",
+      "SECRET",
+      "PASSWORD",
+      "PASSWD",
+      "PASS",
+      "AUTH",
+      "CREDENTIAL",
+      "CREDENTIALS",
+      "APIKEY",
+      "PRIVATE",
+      "SIGNING",
+      "SESSION",
+      "COOKIE"
+    ];
   }
 });
 
@@ -43609,7 +43751,7 @@ async function checkMcpCommands(config2, projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-commands",
-        ruleId: "windows-npx-no-wrapper",
+        ruleId: "mcp-commands/windows-npx-no-wrapper",
         line: server2.line,
         message: `Server "${server2.name}": npx requires "cmd /c" wrapper on Windows`,
         suggestion: 'Change "command" to "cmd" and prepend "/c", "npx" to args \u2014 e.g. "args": ["/c", "npx", ...]'
@@ -43621,7 +43763,7 @@ async function checkMcpCommands(config2, projectRoot) {
         issues.push({
           severity: "warning",
           check: "mcp-commands",
-          ruleId: "command-not-found",
+          ruleId: "mcp-commands/command-not-found",
           line: server2.line,
           message: `Server "${server2.name}": command "${server2.command}" not found`
         });
@@ -43636,7 +43778,7 @@ async function checkMcpCommands(config2, projectRoot) {
             issues.push({
               severity: "warning",
               check: "mcp-commands",
-              ruleId: "args-path-missing",
+              ruleId: "mcp-commands/args-path-missing",
               line: server2.line,
               message: `Server "${server2.name}": arg "${arg}" looks like a file path but doesn't exist`
             });
@@ -43675,7 +43817,7 @@ async function checkMcpDeprecated(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcp-deprecated",
-        ruleId: "sse-transport",
+        ruleId: "mcp-deprecated/sse-transport",
         line,
         message: `Server "${server2.name}" uses deprecated SSE transport \u2014 use "http" (Streamable HTTP) instead`,
         fix: {
@@ -43771,7 +43913,7 @@ async function checkMcpEnv(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-env",
-            ruleId: "wrong-syntax",
+            ruleId: "mcp-env/wrong-syntax",
             line: server2.line,
             message: `Server "${server2.name}": Claude Code uses \${VAR}, not \${env:VAR}`,
             fix: buildSyntaxFix(config2, server2.line, value, "claude-code")
@@ -43783,7 +43925,7 @@ async function checkMcpEnv(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-env",
-            ruleId: "wrong-syntax",
+            ruleId: "mcp-env/wrong-syntax",
             line: server2.line,
             message: `Server "${server2.name}": Cursor uses \${env:VAR}, not \${VAR}`,
             fix: buildSyntaxFix(config2, server2.line, value, "cursor")
@@ -43795,7 +43937,7 @@ async function checkMcpEnv(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-env",
-            ruleId: "wrong-syntax",
+            ruleId: "mcp-env/wrong-syntax",
             line: server2.line,
             message: `Server "${server2.name}": Continue uses \${{ secrets.VAR }}, not \${VAR}`,
             fix: buildSyntaxFix(config2, server2.line, value, "continue")
@@ -43811,7 +43953,7 @@ async function checkMcpEnv(config2, _projectRoot) {
             issues.push({
               severity: "info",
               check: "mcp-env",
-              ruleId: "unset-variable",
+              ruleId: "mcp-env/unset-variable",
               line: server2.line,
               message: `Server "${server2.name}": environment variable "${ref.varName}" is not set`
             });
@@ -43823,7 +43965,7 @@ async function checkMcpEnv(config2, _projectRoot) {
       issues.push({
         severity: "info",
         check: "mcp-env",
-        ruleId: "empty-env-block",
+        ruleId: "mcp-env/empty-env-block",
         line: server2.line,
         message: `Server "${server2.name}": empty "env" block can be removed`
       });
@@ -43879,7 +44021,7 @@ async function checkMcpUrls(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-urls",
-        ruleId: "malformed-url",
+        ruleId: "mcp-urls/malformed-url",
         line: server2.line,
         message: `Server "${server2.name}": invalid URL "${server2.url}"`
       });
@@ -43889,7 +44031,7 @@ async function checkMcpUrls(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcp-urls",
-        ruleId: "localhost-in-project-config",
+        ruleId: "mcp-urls/localhost-in-project-config",
         line: server2.line,
         message: `Server "${server2.name}": localhost URL in project config won't work for teammates`
       });
@@ -43898,7 +44040,7 @@ async function checkMcpUrls(config2, _projectRoot) {
       issues.push({
         severity: "info",
         check: "mcp-urls",
-        ruleId: "missing-path",
+        ruleId: "mcp-urls/missing-path",
         line: server2.line,
         message: `Server "${server2.name}": URL has no path \u2014 most MCP servers expect /mcp`
       });
@@ -43946,7 +44088,7 @@ async function checkMcpConsistency(configs) {
           issues.push({
             severity: "warning",
             check: "mcp-consistency",
-            ruleId: "same-server-different-config",
+            ruleId: "mcp-consistency/same-server-different-config",
             line: a.line,
             message: `Server "${name}" is configured differently in ${a.config.relativePath} and ${b2.config.relativePath}`
           });
@@ -43972,7 +44114,7 @@ function checkMissingFromClient(configs) {
         issues.push({
           severity: "info",
           check: "mcp-consistency",
-          ruleId: "missing-from-client",
+          ruleId: "mcp-consistency/missing-from-client",
           line: primaryServer.line,
           message: `Server "${primaryServer.name}" is in .mcp.json but missing from ${other.relativePath}`
         });
@@ -44049,7 +44191,7 @@ function checkSingleFileIssues(configs) {
         issues.push({
           severity: "warning",
           check: "mcp-consistency",
-          ruleId: "duplicate-server-name",
+          ruleId: "mcp-consistency/duplicate-server-name",
           line: 1,
           message: `Duplicate server name "${name}" in ${config2.relativePath} \u2014 only the last definition is used`
         });
@@ -44073,7 +44215,7 @@ async function checkMcpRedundancy(configs) {
         issues.push({
           severity: "info",
           check: "mcp-redundancy",
-          ruleId: "disabled-server",
+          ruleId: "mcp-redundancy/disabled-server",
           line: server2.line,
           message: `Server "${server2.name}" is disabled \u2014 consider removing it if no longer needed`
         });
@@ -44103,7 +44245,7 @@ async function checkMcpRedundancy(configs) {
           issues.push({
             severity: "info",
             check: "mcp-redundancy",
-            ruleId: "identical-across-scopes",
+            ruleId: "mcp-redundancy/identical-across-scopes",
             line: projectServer.line,
             message: `Server "${projectServer.name}" is identically configured in both ${projectConfig.relativePath} and ${globalConfig2.relativePath}`
           });
@@ -44129,7 +44271,7 @@ async function checkMcphTokenSecurity(config2, _projectRoot, options = {}) {
     issues.push({
       severity: "error",
       check: "mcph-token-security",
-      ruleId: "mcph-config/invalid-token-format",
+      ruleId: "mcph-token-security/invalid-token-format",
       line: tokenPos.line,
       message: `"token" does not match expected format ^mcp_pat_[A-Za-z0-9_-]+$`,
       suggestion: `Check that the token was copied in full. A valid mcp.hosting PAT looks like: mcp_pat_aBcDeFg123...
@@ -44140,7 +44282,7 @@ If the token was truncated or wrapped in quotes elsewhere, re-issue it from http
     issues.push({
       severity: "error",
       check: "mcph-token-security",
-      ruleId: "mcph-config/token-in-project-scope",
+      ruleId: "mcph-token-security/token-in-project-scope",
       line: tokenPos.line,
       message: `"token" in a git-tracked project-scope .mcph.json \u2014 PAT will leak via git history`,
       suggestion: `Delete line ${tokenPos.line} (the "token" field) from ${config2.relativePath}.
@@ -44158,7 +44300,7 @@ If this token was already committed, ROTATE it now: https://mcp.hosting/settings
     issues.push({
       severity,
       check: "mcph-token-security",
-      ruleId: "mcph-config/prefer-env-token",
+      ruleId: "mcph-token-security/prefer-env-token",
       line: tokenPos.line,
       message: `prefer MCPH_TOKEN env var over a file-stored token in ${config2.relativePath}`,
       suggestion: `Delete line ${tokenPos.line} (the "token" field) and export instead:
@@ -44199,7 +44341,7 @@ async function checkMcphApibase(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcph-apibase",
-      ruleId: "mcph-config/invalid-apibase",
+      ruleId: "mcph-apibase/invalid-apibase",
       line: pos.line,
       message: `"apiBase" is not a valid URL: ${value}`,
       suggestion: `Use an absolute http(s) URL, e.g. "https://mcp.hosting".`
@@ -44210,7 +44352,7 @@ async function checkMcphApibase(config2, _projectRoot) {
     issues.push({
       severity: "warning",
       check: "mcph-apibase",
-      ruleId: "mcph-config/insecure-apibase",
+      ruleId: "mcph-apibase/insecure-apibase",
       line: pos.line,
       message: `"apiBase" uses plaintext HTTP to a public host (${parsed.hostname})`,
       suggestion: `Use https:// instead. Plaintext HTTP exposes your MCPH_TOKEN on the wire.
@@ -44246,7 +44388,7 @@ async function checkMcphSchemaConformance(config2, _projectRoot) {
     issues.push({
       severity: "warning",
       check: "mcph-schema-conformance",
-      ruleId: "mcph-config/unknown-field",
+      ruleId: "mcph-schema-conformance/unknown-field",
       line: field.position.line,
       message: `unknown field "${field.name}" \u2014 not in the mcph config schema`,
       suggestion: `Known fields: $schema, version, token, apiBase, servers, blocked. Check for typos (e.g. "tokens" vs "token", "blockList" vs "blocked").`
@@ -44258,7 +44400,7 @@ async function checkMcphSchemaConformance(config2, _projectRoot) {
     issues.push({
       severity: "info",
       check: "mcph-schema-conformance",
-      ruleId: "mcph-config/stale-version",
+      ruleId: "mcph-schema-conformance/stale-version",
       line: versionPos.line,
       message: `"version": ${version2} is older than the current schema version (${CURRENT_SCHEMA_VERSION})`,
       suggestion: `Update to "version": ${CURRENT_SCHEMA_VERSION}. Older versions continue to load but may miss newer fields.`
@@ -44286,7 +44428,7 @@ async function checkMcphLists(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcph-lists",
-        ruleId: "mcph-config/allowlist-denylist-conflict",
+        ruleId: "mcph-lists/allowlist-denylist-conflict",
         line: entry.position.line,
         message: `server "${entry.value}" is in both "servers" (allow-list) and "blocked" (deny-list)`,
         suggestion: `Remove "${entry.value}" from one of the two lists. "blocked" wins in practice (deny > allow), so the allow-list entry is dead weight.`
@@ -44302,7 +44444,7 @@ async function checkMcphLists(config2, _projectRoot) {
         issues.push({
           severity: "info",
           check: "mcph-lists",
-          ruleId: "mcph-config/duplicate-entries",
+          ruleId: "mcph-lists/duplicate-entries",
           line: entry.position.line,
           message: `"${entry.value}" appears multiple times in "${listName}" (first at line ${prevLine})`,
           suggestion: `Remove the duplicate entry at line ${entry.position.line}.`
@@ -44329,7 +44471,7 @@ async function checkMcphGitignore(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcph-gitignore",
-      ruleId: "mcph-config/local-file-not-gitignored",
+      ruleId: "mcph-gitignore/local-file-not-gitignored",
       line: 1,
       message: `${basename4} is not covered by .gitignore \u2014 machine-local overrides can leak via git`,
       suggestion: `Add "${basename4}" to .gitignore in your project root.`
@@ -44360,6 +44502,12 @@ function extractPaths(content) {
       paths.push(p2);
     }
   }
+  for (const match of content.matchAll(BARE_FILE_PATH)) {
+    const p2 = match[1].replace(/[)}\]]+$/, "");
+    if (p2.length > 2 && !p2.startsWith("http")) {
+      paths.push(p2);
+    }
+  }
   return [...new Set(paths)];
 }
 function parseFrontmatter2(content) {
@@ -44389,7 +44537,7 @@ function parseFrontmatter2(content) {
   };
 }
 async function parseMemoryFile(filePath, projectDir) {
-  const content = await readFile(filePath, "utf-8");
+  const content = stripBom(await readFile(filePath, "utf-8"));
   const { name, description, type, body } = parseFrontmatter2(content);
   const referencedPaths = extractPaths(body);
   return {
@@ -44402,11 +44550,13 @@ async function parseMemoryFile(filePath, projectDir) {
     referencedPaths
   };
 }
-var PATH_PATTERN2;
+var PATH_PATTERN2, BARE_FILE_PATH;
 var init_session_parser = __esm({
   "src/core/session-parser.ts"() {
     "use strict";
+    init_fs();
     PATH_PATTERN2 = /(?:^|\s|['"`(])([.~/][^\s'"`),;:!?]+)/g;
+    BARE_FILE_PATH = /(?:^|[\s`"'(])([\w][\w-]*(?:\/[\w.-]+)+\.[a-zA-Z0-9]{1,8})\b/g;
   }
 });
 
@@ -44438,30 +44588,46 @@ async function parseJsonlFiltered(filePath, filter) {
   }
   return results;
 }
-async function readClaudeHistory() {
-  const historyPath = join5(home, ".claude", "history.jsonl");
-  return parseJsonlFiltered(historyPath, (entry) => {
-    if (!entry.display || !entry.project) return null;
+function pickField(entry, fields) {
+  for (const f of fields) {
+    const v2 = entry[f];
+    if (typeof v2 === "string" && v2.length > 0) return v2;
+  }
+  return "";
+}
+async function readJsonlHistory(opts) {
+  return parseJsonlFiltered(opts.historyPath, (parsed) => {
+    if (!parsed || typeof parsed !== "object") return null;
+    const entry = parsed;
+    const display = pickField(entry, opts.displayFields);
+    if (!display) return null;
+    const project = pickField(entry, opts.projectFields);
+    if (opts.requireProject && !project) return null;
     return {
-      display: entry.display,
-      timestamp: entry.timestamp || 0,
-      project: entry.project.replace(/\\/g, "/"),
-      sessionId: entry.sessionId || "",
-      provider: "claude-code"
+      display,
+      timestamp: typeof entry.timestamp === "number" ? entry.timestamp : 0,
+      project: project.replace(/\\/g, "/"),
+      sessionId: typeof entry.sessionId === "string" ? entry.sessionId : "",
+      provider: opts.provider
     };
   });
 }
+async function readClaudeHistory() {
+  return readJsonlHistory({
+    historyPath: join5(home, ".claude", "history.jsonl"),
+    provider: "claude-code",
+    displayFields: ["display"],
+    projectFields: ["project"],
+    requireProject: true
+  });
+}
 async function readCodexHistory() {
-  const historyPath = join5(home, ".codex", "history.jsonl");
-  return parseJsonlFiltered(historyPath, (entry) => {
-    if (!entry.display && !entry.command) return null;
-    return {
-      display: entry.display || entry.command || "",
-      timestamp: entry.timestamp || 0,
-      project: (entry.project || entry.cwd || "").replace(/\\/g, "/"),
-      sessionId: entry.sessionId || "",
-      provider: "codex-cli"
-    };
+  return readJsonlHistory({
+    historyPath: join5(home, ".codex", "history.jsonl"),
+    provider: "codex-cli",
+    displayFields: ["display", "command"],
+    projectFields: ["project", "cwd"],
+    requireProject: false
   });
 }
 async function readClaudeMemories() {
@@ -44526,47 +44692,29 @@ async function detectSiblings(projectRoot) {
       if (orgMatch) currentOrg = orgMatch[1];
     } catch {
     }
-    const gitCandidates = candidates.filter((c3) => existsSync(join5(c3.fullPath, ".git")));
-    const results = await Promise.all(
-      gitCandidates.map(async (c3) => {
-        const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
-        try {
-          const git = simpleGit(c3.fullPath);
-          const remotes = await git.getRemotes(true);
-          const origin = remotes.find((r2) => r2.name === "origin");
-          if (origin?.refs?.fetch) {
-            sibling.gitRemoteUrl = origin.refs.fetch;
-            const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
-            if (orgMatch) sibling.gitOrg = orgMatch[1];
-          }
-        } catch {
-        }
-        return sibling;
-      })
-    );
+    const results = await Promise.all(candidates.map((c3) => resolveSibling(c3)));
     if (currentOrg) {
-      return results.filter((s) => s.gitOrg === currentOrg);
+      return results.filter((s) => !s.gitOrg || s.gitOrg === currentOrg);
     }
     return results;
   }
-  const siblings = await Promise.all(
-    candidates.map(async (c3) => {
-      const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
-      try {
-        const git = simpleGit(c3.fullPath);
-        const remotes = await git.getRemotes(true);
-        const origin = remotes.find((r2) => r2.name === "origin");
-        if (origin?.refs?.fetch) {
-          sibling.gitRemoteUrl = origin.refs.fetch;
-          const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
-          if (orgMatch) sibling.gitOrg = orgMatch[1];
-        }
-      } catch {
-      }
-      return sibling;
-    })
-  );
-  return siblings;
+  return Promise.all(candidates.map((c3) => resolveSibling(c3)));
+}
+async function resolveSibling(c3) {
+  const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
+  if (!existsSync(join5(c3.fullPath, ".git"))) return sibling;
+  try {
+    const git = simpleGit(c3.fullPath);
+    const remotes = await git.getRemotes(true);
+    const origin = remotes.find((r2) => r2.name === "origin");
+    if (origin?.refs?.fetch) {
+      sibling.gitRemoteUrl = origin.refs.fetch;
+      const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
+      if (orgMatch) sibling.gitOrg = orgMatch[1];
+    }
+  } catch {
+  }
+  return sibling;
 }
 async function scanSessionData(projectRoot) {
   const providers = detectProviders();
@@ -44666,7 +44814,7 @@ async function checkMissingSecret(ctx) {
       issues.push({
         severity: "error",
         check: "session-missing-secret",
-        ruleId: "session/missing-secret",
+        ruleId: "session-missing-secret/missing-secret",
         line: 0,
         message: `GitHub secret "${secretName}" is set on ${siblingMatches.length} sibling repos (${sibNames}) but not on this project`,
         suggestion: `Run: gh secret set ${secretName} --repo <owner>/<repo>`,
@@ -44686,48 +44834,57 @@ var init_missing_secret = __esm({
 });
 
 // src/core/checks/session/diverged-file.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { join as join6 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
-function calculateOverlap(a, b2) {
-  const linesA = new Set(
-    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
-  );
-  const linesB = new Set(
-    b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
-  );
-  if (linesA.size === 0 && linesB.size === 0) return 1;
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
+async function loadLineSet(absPath) {
+  let mtimeMs;
+  let size;
+  try {
+    const stats = await stat2(absPath);
+    mtimeMs = stats.mtimeMs;
+    size = stats.size;
+  } catch {
+    return null;
   }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
+  const cached2 = lineSetCache.get(absPath);
+  if (cached2 && cached2.mtimeMs === mtimeMs && cached2.size === size) {
+    lineSetCache.delete(absPath);
+    lineSetCache.set(absPath, cached2);
+    return cached2.lineSet;
+  }
+  let content;
+  try {
+    content = stripBom(await readFile2(absPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const lineSet = toLineSet(content, MIN_TOKEN_LEN);
+  lineSetCache.set(absPath, { mtimeMs, size, lineSet });
+  if (lineSetCache.size > CACHE_MAX_ENTRIES) {
+    const oldest = lineSetCache.keys().next().value;
+    if (oldest !== void 0) lineSetCache.delete(oldest);
+  }
+  return lineSet;
 }
 async function checkDivergedFile(ctx) {
   const issues = [];
   for (const fileName of CANONICAL_FILES) {
     const currentPath = join6(ctx.currentProject, fileName);
     if (!existsSync2(currentPath)) continue;
-    let currentContent;
-    try {
-      currentContent = await readFile2(currentPath, "utf-8");
-    } catch {
-      continue;
-    }
+    const currentLineSet = await loadLineSet(currentPath);
+    if (!currentLineSet) continue;
     const diverged = [];
     for (const sib of ctx.siblings) {
       const sibPath = join6(sib.path, fileName);
       if (!existsSync2(sibPath)) continue;
-      try {
-        const sibContent = await readFile2(sibPath, "utf-8");
-        const overlap = calculateOverlap(currentContent, sibContent);
-        if (overlap >= 0.2 && overlap < 0.9) {
-          diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
-        }
-      } catch {
-        continue;
+      const sibLineSet = await loadLineSet(sibPath);
+      if (!sibLineSet) continue;
+      const overlap = jaccardSimilarityFromSets(currentLineSet, sibLineSet, {
+        bothEmptyIsIdentical: true
+      });
+      if (overlap >= 0.2 && overlap < 0.9) {
+        diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
       }
     }
     if (diverged.length > 0) {
@@ -44735,7 +44892,7 @@ async function checkDivergedFile(ctx) {
       issues.push({
         severity: "warning",
         check: "session-diverged-file",
-        ruleId: "session/diverged-file",
+        ruleId: "session-diverged-file/diverged-file",
         line: 0,
         message: `${fileName} has diverged from sibling repos: ${details}`,
         suggestion: `Compare with sibling versions to identify unintentional drift`,
@@ -44745,10 +44902,12 @@ async function checkDivergedFile(ctx) {
   }
   return issues;
 }
-var CANONICAL_FILES;
+var CANONICAL_FILES, MIN_TOKEN_LEN, CACHE_MAX_ENTRIES, lineSetCache;
 var init_diverged_file = __esm({
   "src/core/checks/session/diverged-file.ts"() {
     "use strict";
+    init_similarity();
+    init_fs();
     CANONICAL_FILES = [
       "release.sh",
       ".github/workflows/ci.yml",
@@ -44759,6 +44918,9 @@ var init_diverged_file = __esm({
       "tsconfig.json",
       ".gitignore"
     ];
+    MIN_TOKEN_LEN = 3;
+    CACHE_MAX_ENTRIES = 256;
+    lineSetCache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -44802,7 +44964,7 @@ async function checkMissingWorkflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-missing-workflow",
-      ruleId: "session/missing-workflow",
+      ruleId: "session-missing-workflow/missing-workflow",
       line: 0,
       message: `GitHub Actions workflow "${workflow}" exists in ${siblings.length} sibling repos (${sibNames}) but not in this project`,
       suggestion: `Consider adding .github/workflows/${workflow} for consistency`,
@@ -44848,7 +45010,7 @@ async function checkStaleMemory(ctx) {
       issues.push({
         severity: "info",
         check: "session-stale-memory",
-        ruleId: "session/stale-memory",
+        ruleId: "session-stale-memory/stale-memory",
         line: 0,
         message: `Memory "${name}" references ${brokenPaths.length} path(s) that no longer exist: ${brokenPaths.join(", ")}`,
         suggestion: `Update or remove the memory file: ${mem.filePath}`,
@@ -44866,24 +45028,10 @@ var init_stale_memory = __esm({
 });
 
 // src/core/checks/session/duplicate-memory.ts
-function calculateLineOverlap2(a, b2) {
-  const linesA = new Set(
-    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
-  );
-  const linesB = new Set(
-    b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
-  );
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
-  }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
-}
 async function checkDuplicateMemory(ctx) {
   const issues = [];
   const reported = /* @__PURE__ */ new Set();
+  const lineSets = ctx.memories.map((m) => toLineSet(m.content, MIN_TOKEN_LEN2));
   for (let i2 = 0; i2 < ctx.memories.length; i2++) {
     for (let j3 = i2 + 1; j3 < ctx.memories.length; j3++) {
       const a = ctx.memories[i2];
@@ -44893,7 +45041,7 @@ async function checkDuplicateMemory(ctx) {
       const bIsCurrent = projectDirMatchesPath(b2.projectDir, ctx.currentProject);
       if (!aIsCurrent && !bIsCurrent) continue;
       if (a.content.length < 50 || b2.content.length < 50) continue;
-      const overlap = calculateLineOverlap2(a.content, b2.content);
+      const overlap = jaccardSimilarityFromSets(lineSets[i2], lineSets[j3]);
       if (overlap < 0.6) continue;
       const pairKey = [a.filePath, b2.filePath].sort().join("::");
       if (reported.has(pairKey)) continue;
@@ -44905,7 +45053,7 @@ async function checkDuplicateMemory(ctx) {
       issues.push({
         severity: "info",
         check: "session-duplicate-memory",
-        ruleId: "session/duplicate-memory",
+        ruleId: "session-duplicate-memory/duplicate-memory",
         line: 0,
         message: `Memory "${nameA}" (${projA}) and "${nameB}" (${projB}) have ${Math.round(overlap * 100)}% overlap`,
         suggestion: `Consider consolidating into a shared memory or removing the duplicate`,
@@ -44915,10 +45063,13 @@ async function checkDuplicateMemory(ctx) {
   }
   return issues;
 }
+var MIN_TOKEN_LEN2;
 var init_duplicate_memory = __esm({
   "src/core/checks/session/duplicate-memory.ts"() {
     "use strict";
     init_session_parser();
+    init_similarity();
+    MIN_TOKEN_LEN2 = 5;
   }
 });
 
@@ -44973,7 +45124,8 @@ function findCyclicPatterns(displays) {
 async function checkLoopDetection(ctx) {
   const issues = [];
   const currentNorm = normalizeProject(ctx.currentProject);
-  const entries = ctx.history.filter((e) => normalizeProject(e.project) === currentNorm).sort((a, b2) => a.timestamp - b2.timestamp);
+  const filtered = ctx.history.filter((e) => normalizeProject(e.project) === currentNorm).sort((a, b2) => a.timestamp - b2.timestamp);
+  const entries = filtered.length > MAX_HISTORY_ENTRIES ? filtered.slice(-MAX_HISTORY_ENTRIES) : filtered;
   if (entries.length < CONSECUTIVE_THRESHOLD) return issues;
   const displays = entries.map((e) => e.display);
   const repeats = findConsecutiveRepeats(displays);
@@ -44982,7 +45134,7 @@ async function checkLoopDetection(ctx) {
     issues.push({
       severity: "warning",
       check: "session-loop-detection",
-      ruleId: "session/consecutive-repeat",
+      ruleId: "session-loop-detection/consecutive-repeat",
       line: 0,
       message: `Command run ${count} times consecutively: "${truncated}"`,
       suggestion: "An agent may be looping on this command. Check history.jsonl for context on what went wrong"
@@ -44994,7 +45146,7 @@ async function checkLoopDetection(ctx) {
     issues.push({
       severity: "warning",
       check: "session-loop-detection",
-      ruleId: "session/cyclic-pattern",
+      ruleId: "session-loop-detection/cyclic-pattern",
       line: 0,
       message: `Cyclic pattern repeated ${reps} times: ${cycleStr}`,
       suggestion: "An agent may be stuck in a loop. Check if a context file is missing instructions for this workflow"
@@ -45002,42 +45154,42 @@ async function checkLoopDetection(ctx) {
   }
   return issues;
 }
-var CONSECUTIVE_THRESHOLD, CYCLE_REPEAT_THRESHOLD, MAX_CYCLE_LENGTH;
+var CONSECUTIVE_THRESHOLD, CYCLE_REPEAT_THRESHOLD, MAX_CYCLE_LENGTH, MAX_HISTORY_ENTRIES;
 var init_loop_detection = __esm({
   "src/core/checks/session/loop-detection.ts"() {
     "use strict";
     CONSECUTIVE_THRESHOLD = 3;
     CYCLE_REPEAT_THRESHOLD = 2;
     MAX_CYCLE_LENGTH = 3;
+    MAX_HISTORY_ENTRIES = 5e3;
   }
 });
 
 // src/core/checks/session/memory-index-overflow.ts
-import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || "";
   if (!home2) return [];
   const encoded = encodeProjectDir(ctx.currentProject);
   const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
-  let stats;
+  let content;
   try {
-    stats = await stat2(memoryFile);
+    content = stripBom(await readFile3(memoryFile, "utf-8"));
   } catch {
     return [];
   }
-  const content = await readFile3(memoryFile, "utf-8").catch(() => "");
   if (!content) return [];
   const lines = content.split("\n");
   const lineCount = lines.length;
-  const byteSize = stats.size;
+  const byteSize = Buffer.byteLength(content, "utf8");
   const issues = [];
   if (lineCount > MAX_LINES) {
     const excess = lineCount - MAX_LINES;
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/memory-index-overflow",
       line: MAX_LINES + 1,
       message: `MEMORY.md has ${lineCount.toLocaleString()} lines \u2014 only the first ${MAX_LINES} are loaded. ${excess.toLocaleString()} line(s) are effectively invisible to the agent.`,
       detail: `File: ${memoryFile}`,
@@ -45049,7 +45201,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/memory-index-overflow",
       line: 0,
       message: `MEMORY.md is ${byteSize.toLocaleString()} bytes \u2014 only the first ${MAX_BYTES.toLocaleString()} bytes are loaded. ~${excess.toLocaleString()} bytes are effectively invisible.`,
       detail: `File: ${memoryFile}`,
@@ -45063,6 +45215,7 @@ var init_memory_index_overflow = __esm({
   "src/core/checks/session/memory-index-overflow.ts"() {
     "use strict";
     init_session_parser();
+    init_fs();
     MAX_LINES = 200;
     MAX_BYTES = 25 * 1024;
   }
@@ -45089,7 +45242,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = await readFile4(join9(workflowDir, f), "utf-8");
+      const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
       const nameMatch = content.match(/^name:\s*(.+)$/m);
       if (nameMatch && RELEASE_FILENAME_PATTERNS.some((p2) => p2.test(nameMatch[1]))) {
         releaseWorkflows.push(f);
@@ -45115,7 +45268,7 @@ async function checkCiCoverage(files, projectRoot) {
     {
       severity: "info",
       check: "ci-coverage",
-      ruleId: "ci/no-release-docs",
+      ruleId: "ci-coverage/no-release-docs",
       line: 0,
       message: `Release workflow${releaseWorkflows.length > 1 ? "s" : ""} found (${releaseWorkflows.join(", ")}) but no context file documents the release process`,
       suggestion: `Document how releases work (e.g. "push a v* tag to trigger CI") in a context file so agents don't guess`
@@ -45126,6 +45279,7 @@ var RELEASE_FILENAME_PATTERNS, RELEASE_DOC_PATTERNS;
 var init_ci_coverage = __esm({
   "src/core/checks/ci-coverage.ts"() {
     "use strict";
+    init_fs();
     RELEASE_FILENAME_PATTERNS = [/release/i, /deploy/i, /publish/i, /\bcd\b/i];
     RELEASE_DOC_PATTERNS = [
       /release\s+(process|workflow|steps|via|by|using)/i,
@@ -45160,7 +45314,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = await readFile5(join10(workflowDir, f), "utf-8");
+      content = stripBom(await readFile5(join10(workflowDir, f), "utf-8"));
     } catch {
       continue;
     }
@@ -45177,7 +45331,7 @@ async function findSecretUsages(projectRoot) {
 }
 function contextMentionsSecret(files, secretName) {
   const escaped = secretName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[_\\s-]")}\\b`, "i");
+  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[ _-]")}\\b`, "i");
   return files.some((f) => pattern.test(f.content));
 }
 async function checkCiSecrets(files, projectRoot) {
@@ -45189,7 +45343,7 @@ async function checkCiSecrets(files, projectRoot) {
     issues.push({
       severity: "info",
       check: "ci-secrets",
-      ruleId: "ci/undocumented-secret",
+      ruleId: "ci-secrets/undocumented-secret",
       line: 0,
       message: `CI secret "${name}" is used in ${workflows.join(", ")} but not mentioned in any context file`,
       suggestion: `Document what ${name} is and how to set it (e.g. "gh secret set ${name}") so agents don't create new tokens or guess`
@@ -45201,6 +45355,7 @@ var BUILTIN_SECRETS, SECRETS_REGEX;
 var init_ci_secrets = __esm({
   "src/core/checks/ci-secrets.ts"() {
     "use strict";
+    init_fs();
     BUILTIN_SECRETS = /* @__PURE__ */ new Set([
       "GITHUB_TOKEN",
       "ACTIONS_RUNTIME_TOKEN",
@@ -45216,15 +45371,239 @@ var init_ci_secrets = __esm({
   }
 });
 
+// src/core/checks/content-secrets.ts
+function lineLooksLikePlaceholder(line) {
+  const lower = line.toLowerCase();
+  for (const tok of PLACEHOLDER_TOKENS) {
+    if (lower.includes(tok)) return true;
+  }
+  return false;
+}
+function isCommentedExample(line) {
+  if (!COMMENT_PREFIX.test(line)) return false;
+  const lower = line.toLowerCase();
+  return lower.includes("fake") || lower.includes("example");
+}
+function isPlaceholderWrapped(line, start, end) {
+  const before2 = line.slice(Math.max(0, start - 2), start);
+  const after2 = line.slice(end, end + 2);
+  if (before2.endsWith("<") && after2.startsWith(">")) return true;
+  if (before2.endsWith("${") && after2.startsWith("}")) return true;
+  if (before2.endsWith("{") && after2.startsWith("}")) return true;
+  const dollarOpen = line.lastIndexOf("${", start);
+  if (dollarOpen !== -1) {
+    const close = line.indexOf("}", dollarOpen);
+    if (close !== -1 && close >= end) return true;
+  }
+  const angleOpen = line.lastIndexOf("<", start);
+  if (angleOpen !== -1) {
+    const close = line.indexOf(">", angleOpen);
+    if (close !== -1 && close >= end) return true;
+  }
+  return false;
+}
+function computeFenceLanguages(lines) {
+  const out = new Array(lines.length).fill(null);
+  let activeMarker = null;
+  let activeLang = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed2 = line.trim();
+    if (activeMarker === null) {
+      const open = trimmed2.match(/^(```+|~~~+)(.*)$/);
+      if (open) {
+        activeMarker = open[1][0];
+        activeLang = open[2].trim().toLowerCase();
+        continue;
+      }
+    } else {
+      out[i2] = activeLang;
+      if (trimmed2.startsWith(activeMarker.repeat(3)) && trimmed2.replace(new RegExp(`^${activeMarker === "`" ? "`" : "~"}+`), "").trim() === "") {
+        activeMarker = null;
+        activeLang = null;
+      }
+    }
+  }
+  return out;
+}
+function redactedPrefix(value) {
+  const head = value.slice(0, 6);
+  return `${head}...`;
+}
+async function checkContentSecrets(file2, _projectRoot) {
+  const issues = [];
+  const lines = file2.content.split(/\r?\n/);
+  const fenceLangs = computeFenceLanguages(lines);
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const lineNo = i2 + 1;
+    if (isCommentedExample(line)) continue;
+    const fenceLang = fenceLangs[i2];
+    if (fenceLang !== null && ILLUSTRATIVE_FENCES.has(fenceLang)) continue;
+    if (lineLooksLikePlaceholder(line)) continue;
+    if (PRIVATE_KEY_HEADER.test(line)) {
+      issues.push({
+        severity: "error",
+        check: "content-secrets",
+        ruleId: "content-secrets/private-key-header",
+        line: lineNo,
+        message: `Private key header detected in ${file2.relativePath}`,
+        suggestion: "Move the secret to a `.env` or secret manager and reference it by name. If this token is real, rotate it immediately."
+      });
+      continue;
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const pattern of PATTERNS) {
+      const re2 = new RegExp(pattern.regex.source, pattern.regex.flags);
+      let m;
+      while ((m = re2.exec(line)) !== null) {
+        const matched = m[0];
+        const start = m.index;
+        const end = start + matched.length;
+        const key = `${start}:${pattern.ruleSlug}`;
+        if (seen.has(key)) continue;
+        let overlap = false;
+        for (const k3 of seen) {
+          const [s] = k3.split(":");
+          if (parseInt(s, 10) === start) {
+            overlap = true;
+            break;
+          }
+        }
+        if (overlap) continue;
+        if (isPlaceholderWrapped(line, start, end)) continue;
+        seen.add(key);
+        issues.push({
+          severity: "error",
+          check: "content-secrets",
+          ruleId: `content-secrets/${pattern.ruleSlug}`,
+          line: lineNo,
+          message: `${pattern.label} detected in ${file2.relativePath} (${redactedPrefix(matched)})`,
+          suggestion: "Move the secret to a `.env` or secret manager and reference it by name. If this token is real, rotate it immediately."
+        });
+      }
+    }
+  }
+  return issues;
+}
+var PATTERNS, PRIVATE_KEY_HEADER, PLACEHOLDER_TOKENS, COMMENT_PREFIX, ILLUSTRATIVE_FENCES;
+var init_content_secrets = __esm({
+  "src/core/checks/content-secrets.ts"() {
+    "use strict";
+    PATTERNS = [
+      // AWS access key (long-lived) -- AKIA prefix + 16 uppercase alphanum chars.
+      {
+        ruleSlug: "aws-access-key",
+        label: "AWS access key",
+        regex: /\bAKIA[0-9A-Z]{16}\b/g
+      },
+      // AWS STS temporary access key -- ASIA prefix.
+      {
+        ruleSlug: "aws-access-key",
+        label: "AWS access key",
+        regex: /\bASIA[0-9A-Z]{16}\b/g
+      },
+      // GitHub classic PAT.
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub personal access token",
+        regex: /\bghp_[A-Za-z0-9]{36,}\b/g
+      },
+      // GitHub fine-grained PAT.
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub personal access token",
+        regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g
+      },
+      // GitHub server-to-server / OAuth / user / refresh tokens.
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bghs_[A-Za-z0-9]{36,}\b/g
+      },
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bgho_[A-Za-z0-9]{36,}\b/g
+      },
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bghu_[A-Za-z0-9]{36,}\b/g
+      },
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bghr_[A-Za-z0-9]{36,}\b/g
+      },
+      // Anthropic API keys.
+      {
+        ruleSlug: "anthropic-key",
+        label: "Anthropic API key",
+        regex: /\bsk-ant-[A-Za-z0-9\-_]{20,}\b/g
+      },
+      // OpenAI API keys (project-scoped or classic). Match sk- or sk-proj- with at
+      // least 20 random chars to avoid catching `sk-...` ellipses in docs.
+      {
+        ruleSlug: "openai-key",
+        label: "OpenAI API key",
+        regex: /\bsk-(?:proj-)?[A-Za-z0-9_\-]{20,}\b/g
+      },
+      // npm automation tokens.
+      {
+        ruleSlug: "npm-token",
+        label: "npm token",
+        regex: /\bnpm_[A-Za-z0-9]{36,}\b/g
+      },
+      // Slack tokens (bot, user, app, admin, refresh).
+      {
+        ruleSlug: "slack-token",
+        label: "Slack token",
+        regex: /\bxox[bpoasr]-[A-Za-z0-9\-]{10,}\b/g
+      },
+      // mcp.hosting PAT -- consistent with mcph/token-security.ts.
+      {
+        ruleSlug: "mcph-pat",
+        label: "mcp.hosting PAT",
+        regex: /\bmcp_pat_[A-Za-z0-9]{32,}\b/g
+      },
+      // Google API keys.
+      {
+        ruleSlug: "google-api-key",
+        label: "Google API key",
+        regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g
+      },
+      // Stripe live secret keys.
+      {
+        ruleSlug: "stripe-secret",
+        label: "Stripe live secret key",
+        regex: /\bsk_live_[0-9a-zA-Z]{24,}\b/g
+      }
+    ];
+    PRIVATE_KEY_HEADER = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/;
+    PLACEHOLDER_TOKENS = [
+      "example",
+      "placeholder",
+      "your-key",
+      "<replace",
+      "redacted",
+      "xxxx",
+      "****"
+    ];
+    COMMENT_PREFIX = /^\s*(?:#|\/\/|--|<!--)/;
+    ILLUSTRATIVE_FENCES = /* @__PURE__ */ new Set(["text", "txt", "example", "pseudocode", "none", ""]);
+  }
+});
+
 // src/version.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.19";
+  if (true) return "0.10.0";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
   return pkg.version;
 }
 var VERSION;
@@ -45245,8 +45624,14 @@ function hasMcphChecks(checks) {
 function hasSessionChecks(checks) {
   return checks.some((c3) => c3.startsWith("session-"));
 }
+function deriveChecksToRun(activeChecks, prefix, enabled, allChecks) {
+  const filtered = activeChecks.filter((c3) => c3.startsWith(prefix));
+  if (filtered.length > 0) return filtered;
+  return enabled ? [...allChecks] : [];
+}
 async function runAudit(projectRoot, activeChecks, options = {}) {
   const fileResults = [];
+  const thresholds = resolveTokenThresholds(options.tokenThresholds);
   const shouldRunContextChecks = !options.mcpOnly && !options.mcphOnly && !options.sessionOnly;
   const shouldRunMcpChecks = options.mcp || options.mcpGlobal || options.mcpOnly || hasMcpChecks(activeChecks);
   const shouldRunMcphChecks = options.mcph || options.mcphGlobal || options.mcphOnly || hasMcphChecks(activeChecks);
@@ -45262,13 +45647,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       if (activeChecks.includes("paths")) checkPromises.push(checkPaths(file2, projectRoot));
       if (activeChecks.includes("commands")) checkPromises.push(checkCommands(file2, projectRoot));
       if (activeChecks.includes("staleness")) checkPromises.push(checkStaleness(file2, projectRoot));
-      if (activeChecks.includes("tokens")) checkPromises.push(checkTokens(file2, projectRoot));
+      if (activeChecks.includes("tokens"))
+        checkPromises.push(checkTokens(file2, projectRoot, thresholds));
       if (activeChecks.includes("tier-tokens"))
-        checkPromises.push(checkTierTokens(file2, projectRoot));
+        checkPromises.push(checkTierTokens(file2, projectRoot, thresholds));
       if (activeChecks.includes("redundancy"))
         checkPromises.push(checkRedundancy(file2, projectRoot));
       if (activeChecks.includes("frontmatter"))
         checkPromises.push(checkFrontmatter(file2, projectRoot));
+      if (activeChecks.includes("content-secrets"))
+        checkPromises.push(checkContentSecrets(file2, projectRoot));
       const results = await Promise.all(checkPromises);
       const issues = results.flat();
       fileResults.push({
@@ -45283,12 +45671,13 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     const crossFileIssues = [];
     if (activeChecks.includes("tokens")) {
       const aggIssue = checkAggregateTokens(
-        fileResults.map((f) => ({ path: f.path, tokens: f.tokens }))
+        fileResults.map((f) => ({ path: f.path, tokens: f.tokens })),
+        thresholds
       );
       if (aggIssue) crossFileIssues.push(aggIssue);
     }
     if (activeChecks.includes("tier-tokens")) {
-      const tierAgg = checkAggregateTierTokens(parsed);
+      const tierAgg = checkAggregateTierTokens(parsed, thresholds);
       if (tierAgg) crossFileIssues.push(tierAgg);
     }
     if (activeChecks.includes("redundancy")) {
@@ -45325,8 +45714,12 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       );
       mcpConfigs.push(...globalConfigs);
     }
-    const activeMcpChecks = activeChecks.filter((c3) => c3.startsWith("mcp-"));
-    const mcpChecksToRun = activeMcpChecks.length > 0 ? activeMcpChecks : options.mcp || options.mcpGlobal || options.mcpOnly ? ALL_MCP_CHECKS : [];
+    const mcpChecksToRun = deriveChecksToRun(
+      activeChecks,
+      "mcp-",
+      Boolean(options.mcp || options.mcpGlobal || options.mcpOnly),
+      ALL_MCP_CHECKS
+    );
     for (const config2 of mcpConfigs) {
       const checkPromises = [];
       if (mcpChecksToRun.includes("mcp-schema"))
@@ -45372,7 +45765,7 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     const projectMcphFiles = await scanForMcphConfigs(projectRoot);
     const mcphConfigs = await Promise.all(
       projectMcphFiles.map(
-        (f) => parseMchpConfig(
+        (f) => parseMcphConfig(
           f,
           projectRoot,
           f.relativePath.endsWith(".mcph.local.json") ? "project-local" : "project"
@@ -45382,12 +45775,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     if (options.mcphGlobal) {
       const globalMcphFiles = await scanGlobalMcphConfigs();
       const globalMcphConfigs = await Promise.all(
-        globalMcphFiles.map((f) => parseMchpConfig(f, projectRoot, "global"))
+        globalMcphFiles.map((f) => parseMcphConfig(f, projectRoot, "global"))
       );
       mcphConfigs.push(...globalMcphConfigs);
     }
-    const activeMcphChecks = activeChecks.filter((c3) => c3.startsWith("mcph-"));
-    const mcphChecksToRun = activeMcphChecks.length > 0 ? activeMcphChecks : options.mcph || options.mcphGlobal || options.mcphOnly ? ALL_MCPH_CHECKS : [];
+    const mcphChecksToRun = deriveChecksToRun(
+      activeChecks,
+      "mcph-",
+      Boolean(options.mcph || options.mcphGlobal || options.mcphOnly),
+      ALL_MCPH_CHECKS
+    );
     for (const config2 of mcphConfigs) {
       const checkPromises = [];
       if (mcphChecksToRun.includes("mcph-token-security")) {
@@ -45411,14 +45808,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       }
       const results = await Promise.all(checkPromises);
       const issues = results.flat();
-      for (const err of config2.parseErrors) {
-        issues.push({
-          severity: "error",
-          check: "mcph-schema-conformance",
-          ruleId: "mcph-config/parse-error",
-          line: 1,
-          message: err
-        });
+      if (mcphChecksToRun.includes("mcph-schema-conformance")) {
+        for (const err of config2.parseErrors) {
+          issues.push({
+            severity: "error",
+            check: "mcph-schema-conformance",
+            ruleId: "mcph-schema-conformance/parse-error",
+            line: 1,
+            message: err
+          });
+        }
       }
       const lines = config2.content.split("\n").length;
       fileResults.push({
@@ -45454,15 +45853,13 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         sessionPromises.push(checkMemoryIndexOverflow(sessionCtx));
       const sessionResults = await Promise.all(sessionPromises);
       const sessionIssues = sessionResults.flat();
-      if (sessionIssues.length > 0) {
-        fileResults.push({
-          path: "~/.claude/ (session audit)",
-          isSymlink: false,
-          tokens: 0,
-          lines: 0,
-          issues: sessionIssues
-        });
-      }
+      fileResults.push({
+        path: "~/.claude/ (session audit)",
+        isSymlink: false,
+        tokens: 0,
+        lines: 0,
+        issues: sessionIssues
+      });
     }
   }
   let estimatedWaste = 0;
@@ -45537,6 +45934,7 @@ var init_audit = __esm({
     init_memory_index_overflow();
     init_ci_coverage();
     init_ci_secrets();
+    init_content_secrets();
     init_version2();
     ALL_CHECKS = [
       "paths",
@@ -45548,7 +45946,8 @@ var init_audit = __esm({
       "contradictions",
       "frontmatter",
       "ci-coverage",
-      "ci-secrets"
+      "ci-secrets",
+      "content-secrets"
     ];
     ALL_MCP_CHECKS = [
       "mcp-schema",
@@ -46219,11 +46618,22 @@ var init_fixer = __esm({
 
 // src/mcp/server.ts
 var server_exports = {};
+__export(server_exports, {
+  server: () => server,
+  startServer: () => startServer
+});
 import * as path10 from "node:path";
+function describeDisallowed(rawPath) {
+  const m = rawPath.match(PATH_DISALLOWED);
+  if (!m) return "unknown";
+  return JSON.stringify(m[0]);
+}
 function validateProjectPath(rawPath) {
   if (!rawPath) return process.cwd();
   if (PATH_DISALLOWED.test(rawPath)) {
-    throw new Error("projectPath contains disallowed characters");
+    throw new Error(
+      `projectPath contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
+    );
   }
   const resolved = path10.resolve(rawPath);
   if (!isDirectory(resolved)) {
@@ -46233,12 +46643,28 @@ function validateProjectPath(rawPath) {
 }
 function validateFilePathInput(rawPath) {
   if (PATH_DISALLOWED.test(rawPath)) {
-    throw new Error("path contains disallowed characters");
+    throw new Error(
+      `path contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
+    );
+  }
+}
+function resolveWithinRoot(filePath, root) {
+  const resolvedRoot = path10.resolve(root);
+  const resolved = path10.resolve(resolvedRoot, filePath);
+  const rel = path10.relative(resolvedRoot, resolved);
+  if (rel.startsWith("..") || path10.isAbsolute(rel)) {
+    throw new Error("path escapes the project root");
   }
+  return resolved;
 }
-var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
+async function startServer() {
+  keepEncoderAlive(true);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server;
 var init_server3 = __esm({
-  async "src/mcp/server.ts"() {
+  "src/mcp/server.ts"() {
     "use strict";
     init_mcp();
     init_stdio2();
@@ -46312,7 +46738,7 @@ var init_server3 = __esm({
         try {
           validateFilePathInput(filePath);
           const root = validateProjectPath(projectPath);
-          const resolved = path10.resolve(root, filePath);
+          const resolved = resolveWithinRoot(filePath, root);
           const result = {
             path: filePath,
             exists: fileExists(resolved) || isDirectory(resolved)
@@ -46555,9 +46981,6 @@ var init_server3 = __esm({
         }
       }
     );
-    keepEncoderAlive(true);
-    transport = new StdioServerTransport();
-    await server.connect(transport);
   }
 });
 
@@ -53035,6 +53458,7 @@ var init_ora = __esm({
 
 // src/core/reporter.ts
 function classifyFile(f) {
+  if (f.path === "(project)") return "context";
   if (f.path === "(mcp)") return "mcp";
   if (f.path.includes("session audit")) return "session";
   for (const issue2 of f.issues) {
@@ -53298,6 +53722,11 @@ function buildRuleDescriptors() {
       shortDescription: { text: "CI secret not documented in context files" },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     },
+    {
+      id: "ctxlint/content-secrets",
+      shortDescription: { text: "Inline-pasted secret detected in a context file" },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
     {
       id: "ctxlint/mcp-schema",
       shortDescription: { text: "MCP config structural validation error" },
@@ -53494,7 +53923,8 @@ function suggestKey(unknown2) {
       best = known;
     }
   }
-  if (best && bestDist <= Math.max(2, Math.floor(unknown2.length / 3))) {
+  const threshold = Math.min(4, Math.max(2, Math.floor(unknown2.length / 3)));
+  if (best && bestDist <= threshold) {
     return best;
   }
   return null;
@@ -53532,7 +53962,7 @@ function loadConfig(projectRoot) {
     const filePath = path11.join(projectRoot, filename);
     let content;
     try {
-      content = fs8.readFileSync(filePath, "utf-8");
+      content = stripBom(fs8.readFileSync(filePath, "utf-8"));
     } catch {
       continue;
     }
@@ -53543,7 +53973,7 @@ function loadConfig(projectRoot) {
 function loadConfigFromExplicitPath(configPath) {
   let content;
   try {
-    content = fs8.readFileSync(configPath, "utf-8");
+    content = stripBom(fs8.readFileSync(configPath, "utf-8"));
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(`could not load config from ${configPath}: ${detail}`, { cause: err });
@@ -53555,6 +53985,7 @@ var init_config2 = __esm({
   "src/core/config.ts"() {
     "use strict";
     import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
+    init_fs();
     levenshtein2 = import_fast_levenshtein2.default.get;
     KNOWN_CONFIG_KEYS = [
       "checks",
@@ -53621,7 +54052,8 @@ async function runCli() {
         mcphOnly: options.mcphOnly,
         mcphStrictEnvToken: options.mcphStrictEnvToken,
         session: options.session,
-        sessionOnly: options.sessionOnly
+        sessionOnly: options.sessionOnly,
+        tokenThresholds: config2?.tokenThresholds
       });
       spinner?.stop();
       if (result.files.length === 0) {
@@ -53714,7 +54146,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       resetGit();
       resetPathsCache();
       resetPackageJsonCache();
-      resetTokenThresholds();
     }
     if (opts.watch) {
       const chalk2 = (await Promise.resolve().then(() => (init_source(), source_exports))).default;
@@ -53776,11 +54207,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             console.error("Error reloading config:", err instanceof Error ? err.message : err);
           }
           try {
-            if (liveConfig?.tokenThresholds) {
-              setTokenThresholds(liveConfig.tokenThresholds);
-            } else {
-              resetTokenThresholds();
-            }
             const result = await runAudit(resolvedPath, liveActiveChecks, {
               depth: liveOptions.depth,
               extraPatterns: liveConfig?.contextFiles,
@@ -53792,7 +54218,8 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
               mcphOnly: liveOptions.mcphOnly,
               mcphStrictEnvToken: liveOptions.mcphStrictEnvToken,
               session: liveOptions.session,
-              sessionOnly: liveOptions.sessionOnly
+              sessionOnly: liveOptions.sessionOnly,
+              tokenThresholds: liveConfig?.tokenThresholds
             });
             if (result.files.length === 0) {
               console.log("\nNo context files found.\n");
@@ -53812,7 +54239,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             resetGit();
             resetPathsCache();
             resetPackageJsonCache();
-            resetTokenThresholds();
           }
           console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
         }, 300);
@@ -53956,9 +54382,6 @@ function resolveSession(resolvedPath, opts) {
     session: effectiveSession,
     sessionOnly
   };
-  if (config2?.tokenThresholds) {
-    setTokenThresholds(config2.tokenThresholds);
-  }
   const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
   return { config: config2, options, activeChecks };
 }
@@ -53978,7 +54401,6 @@ var init_cli = __esm({
     init_esm3();
     init_ora();
     init_paths();
-    init_tokens2();
     init_reporter();
     init_fixer();
     init_tokens();
@@ -53999,7 +54421,8 @@ var init_cli = __esm({
 // src/index.ts
 var args = process.argv.slice(2);
 if (args[0] === "serve" || args.includes("--mcp-server")) {
-  await init_server3().then(() => server_exports);
+  const { startServer: startServer2 } = await Promise.resolve().then(() => (init_server3(), server_exports));
+  await startServer2();
 } else {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();