@yawlabs/ctxlint 0.9.19 → 0.9.20

package/dist/index.js

@@ -21934,11 +21934,11 @@ var init_protocol = __esm({
        *
        * The Protocol object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
        */
-      async connect(transport2) {
+      async connect(transport) {
         if (this._transport) {
           throw new Error("Already connected to a transport. Call close() before connecting to a new transport, or use a separate Protocol instance per connection.");
         }
-        this._transport = transport2;
+        this._transport = transport;
         const _onclose = this.transport?.onclose;
         this._transport.onclose = () => {
           _onclose?.();
@@ -26254,49 +26254,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse4(serialize(base, options), options);
-        relative4 = parse4(serialize(relative4, options), options);
+        relative5 = parse4(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -26304,7 +26304,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -30411,8 +30411,8 @@ var init_mcp = __esm({
        *
        * The `server` object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
        */
-      async connect(transport2) {
-        return await this.server.connect(transport2);
+      async connect(transport) {
+        return await this.server.connect(transport);
       }
       /**
        * Closes the connection.
@@ -34201,10 +34201,13 @@ globstar while`, t2, d, e, f, m), this.matchOne(t2.slice(d), e.slice(f), s)) ret
 // src/utils/fs.ts
 import * as fs2 from "node:fs";
 import * as path from "node:path";
+function stripBom(content) {
+  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+}
 function loadPackageJson(projectRoot) {
   if (pkgJsonCache?.root === projectRoot) return pkgJsonCache.data;
   try {
-    const content = fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8");
+    const content = stripBom(fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8"));
     const data = JSON.parse(content);
     pkgJsonCache = { root: projectRoot, data };
     return data;
@@ -34247,7 +34250,7 @@ function readSymlinkTarget(filePath) {
 }
 function readFileContent(filePath) {
   try {
-    return fs2.readFileSync(filePath, "utf-8");
+    return stripBom(fs2.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -40656,10 +40659,9 @@ var init_git = __esm({
 });
 
 // src/core/mcp-parser.ts
-async function parseMcpConfig(file2, projectRoot, scopeOverride) {
+async function parseMcpConfig(file2, projectRoot, scope) {
   const content = readFileContent(file2.absolutePath);
   const client = detectClient(file2.relativePath);
-  const scope = scopeOverride ?? detectScope(file2.relativePath);
   const expectedRootKey = client === "vscode" ? "servers" : "mcpServers";
   const isGitTracked = await checkGitTracked(file2.absolutePath, projectRoot);
   const result = {
@@ -40703,10 +40705,10 @@ async function parseMcpConfig(file2, projectRoot, scopeOverride) {
     }
     const raw = value;
     const line = findServerLine(lines, name);
-    const transport2 = inferTransport(raw);
+    const transport = inferTransport(raw);
     const entry = {
       name,
-      transport: transport2,
+      transport,
       line,
       raw
     };
@@ -40718,7 +40720,7 @@ async function parseMcpConfig(file2, projectRoot, scopeOverride) {
     if (typeof raw.disabled === "boolean") entry.disabled = raw.disabled;
     if (Array.isArray(raw.autoApprove)) entry.autoApprove = raw.autoApprove.map(String);
     if (typeof raw.timeout === "number") entry.timeout = raw.timeout;
-    if (typeof raw.oauth === "object" && raw.oauth !== null)
+    if (typeof raw.oauth === "object" && raw.oauth !== null && !Array.isArray(raw.oauth))
       entry.oauth = raw.oauth;
     if (typeof raw.headersHelper === "string") entry.headersHelper = raw.headersHelper;
     result.servers.push(entry);
@@ -40737,9 +40739,6 @@ function detectClient(relativePath) {
   }
   return "claude-code";
 }
-function detectScope(_relativePath) {
-  return "project";
-}
 function findRootKey(parsed) {
   if ("mcpServers" in parsed) return "mcpServers";
   if ("servers" in parsed) return "servers";
@@ -41746,9 +41745,9 @@ var init_main = __esm({
 });
 
 // src/core/mcph-parser.ts
-async function parseMchpConfig(file2, projectRoot, scopeOverride) {
+async function parseMcphConfig(file2, projectRoot, scopeOverride) {
   const content = readFileContent(file2.absolutePath);
-  const scope = scopeOverride ?? detectScope2(file2.relativePath);
+  const scope = scopeOverride ?? detectScope(file2.relativePath);
   const isGitTracked = await checkGitTracked2(file2.absolutePath, projectRoot);
   const isGitignored = await checkGitignored(file2.absolutePath, projectRoot);
   const result = {
@@ -41806,7 +41805,7 @@ async function parseMchpConfig(file2, projectRoot, scopeOverride) {
   }
   return result;
 }
-function detectScope2(relativePath) {
+function detectScope(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.startsWith("~/")) return "global";
   if (normalized.endsWith(".mcph.local.json")) return "project-local";
@@ -42168,29 +42167,33 @@ async function checkPaths(file2, projectRoot) {
 function findClosestMatch(target, files) {
   const targetNorm = target.replace(/\\/g, "/");
   const targetBase = path3.basename(targetNorm);
-  let bestMatch = null;
-  let bestDistance = Infinity;
+  let basenameMatch = null;
+  let basenameDistance = Infinity;
   for (const file2 of files) {
     const fileNorm = file2.replace(/\\/g, "/");
     if (path3.basename(fileNorm) === targetBase && fileNorm !== targetNorm) {
       const dist = levenshtein(targetNorm, fileNorm);
-      if (dist < bestDistance) {
-        bestDistance = dist;
-        bestMatch = fileNorm;
+      if (dist < basenameDistance) {
+        basenameDistance = dist;
+        basenameMatch = fileNorm;
       }
     }
   }
-  if (!bestMatch) {
-    for (const file2 of files) {
-      const fileNorm = file2.replace(/\\/g, "/");
-      const dist = levenshtein(targetNorm, fileNorm);
-      if (dist < bestDistance && dist <= Math.max(targetNorm.length * 0.4, 5)) {
-        bestDistance = dist;
-        bestMatch = fileNorm;
-      }
+  if (basenameMatch) return basenameMatch;
+  const absoluteCap = Math.max(targetNorm.length * 0.4, 5);
+  let fullPathMatch = null;
+  let fullPathDistance = Infinity;
+  for (const file2 of files) {
+    const fileNorm = file2.replace(/\\/g, "/");
+    const lenDelta = Math.abs(targetNorm.length - fileNorm.length);
+    if (lenDelta >= fullPathDistance || lenDelta > absoluteCap) continue;
+    const dist = levenshtein(targetNorm, fileNorm);
+    if (dist < fullPathDistance && dist <= absoluteCap) {
+      fullPathDistance = dist;
+      fullPathMatch = fileNorm;
     }
   }
-  return bestMatch;
+  return fullPathMatch;
 }
 var import_fast_levenshtein, levenshtein, cachedProjectFiles;
 var init_paths = __esm({
@@ -42208,6 +42211,24 @@ var init_paths = __esm({
 // src/core/checks/commands.ts
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
+function extractNpxPackage(cmd) {
+  if (!/^npx\b/.test(cmd)) return null;
+  const tokens = cmd.split(/\s+/).slice(1);
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const t2 = tokens[i2];
+    if (t2 === "-p" || t2 === "--package") {
+      const v2 = tokens[i2 + 1];
+      if (v2 && !v2.startsWith("-")) return v2;
+      continue;
+    }
+    if (t2.startsWith("-p=") || t2.startsWith("--package=")) {
+      return t2.slice(t2.indexOf("=") + 1) || null;
+    }
+    if (t2.startsWith("-")) continue;
+    return t2;
+  }
+  return null;
+}
 async function checkCommands(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42246,10 +42267,9 @@ async function checkCommands(file2, projectRoot) {
       }
       continue;
     }
-    const npxMatch = cmd.match(NPX_PATTERN);
-    if (npxMatch && pkgJson) {
-      const pkgName = npxMatch[1];
-      if (pkgName.startsWith("-")) continue;
+    if (/^npx\b/.test(cmd) && pkgJson) {
+      const pkgName = extractNpxPackage(cmd);
+      if (!pkgName) continue;
       const allDeps = {
         ...pkgJson.dependencies,
         ...pkgJson.devDependencies,
@@ -42324,7 +42344,7 @@ async function checkCommands(file2, projectRoot) {
 }
 function loadMakefile(projectRoot) {
   try {
-    return fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8");
+    return stripBom(fs4.readFileSync(path4.join(projectRoot, "Makefile"), "utf-8"));
   } catch {
     return null;
   }
@@ -42333,14 +42353,13 @@ function hasMakeTarget(makefile, target) {
   const pattern = new RegExp(`^${target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`, "m");
   return pattern.test(makefile);
 }
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN;
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN;
 var init_commands = __esm({
   "src/core/checks/commands.ts"() {
     "use strict";
     init_fs();
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|pnpm(?:\s+run)?|yarn(?:\s+run)?|bun(?:\s+run)?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+(\S+)/;
-    NPX_PATTERN = /^npx\s+(\S+)/;
   }
 });
 
@@ -42515,7 +42534,14 @@ function isAlwaysLoaded(file2) {
     return !hasPathsFrontmatter(file2.content);
   }
   const basename4 = rel.split("/").pop() ?? "";
-  return ALWAYS_LOADED_BASENAMES.has(basename4);
+  for (const name of ALWAYS_LOADED_NAMES) {
+    if (name.includes("/")) {
+      if (rel === name || rel.endsWith("/" + name)) return true;
+    } else if (basename4 === name) {
+      return true;
+    }
+  }
+  return false;
 }
 function computeSectionCosts(file2) {
   if (file2.sections.length === 0) return [];
@@ -42537,7 +42563,7 @@ function loadSettingsSources(projectRoot) {
   for (const p2 of candidates) {
     let content;
     try {
-      content = fs5.readFileSync(p2, "utf-8");
+      content = stripBom(fs5.readFileSync(p2, "utf-8"));
     } catch {
       continue;
     }
@@ -42553,9 +42579,17 @@ function canonicalizeCommand(backticked) {
   const beforeFlags = backticked.trim().split(/\s+--?/, 1)[0];
   return beforeFlags.replace(/\s+/g, " ");
 }
+function buildCommandPattern(cmd) {
+  const tokens = cmd.split(/\s+/).filter(Boolean);
+  const escaped = tokens.map((t2) => t2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  if (tokens.length === 1) {
+    return new RegExp(`(?<![A-Za-z0-9_\\-])${escaped[0]}(?![A-Za-z0-9_\\-])`, "i");
+  }
+  const body = escaped.join("[\\s\\-_]+");
+  return new RegExp(`(?<![A-Za-z0-9])${body}(?![A-Za-z0-9])`, "i");
+}
 function commandIsEnforced(cmd, settings) {
-  const escaped = cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`\\b${escaped}\\b`, "i");
+  const pattern = buildCommandPattern(cmd);
   for (const s of settings) {
     for (const entry of s.permissions?.deny ?? []) {
       if (pattern.test(entry)) return true;
@@ -42633,13 +42667,14 @@ function checkAggregateTierTokens(files) {
     suggestion: "Consider moving the largest files or their heaviest sections to on-demand tiers (skills, subagents, memory)."
   };
 }
-var ALWAYS_LOADED_BASENAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
+var ALWAYS_LOADED_NAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
 var init_tier_tokens = __esm({
   "src/core/checks/tier-tokens.ts"() {
     "use strict";
     init_tokens();
+    init_fs();
     init_tokens2();
-    ALWAYS_LOADED_BASENAMES = /* @__PURE__ */ new Set([
+    ALWAYS_LOADED_NAMES = [
       "CLAUDE.md",
       "CLAUDE.local.md",
       "AGENTS.md",
@@ -42654,15 +42689,42 @@ var init_tier_tokens = __esm({
       ".rules",
       ".goosehints",
       "replit.md",
-      "copilot-instructions.md",
-      "guidelines.md",
-      "instructions.md"
-    ]);
+      ".github/copilot-instructions.md",
+      ".junie/guidelines.md",
+      ".junie/AGENTS.md",
+      ".goose/instructions.md"
+    ];
     TOP_SECTIONS_TO_REPORT = 3;
     INVIOLABLE_WITH_COMMAND = /\b(NEVER|ALWAYS|DON'?T|DO NOT|MUST NOT)\b[^.!?`]{0,80}`([^`]+)`/i;
   }
 });
 
+// src/utils/similarity.ts
+function jaccardSimilarityFromSets(a, b2, opts = {}) {
+  const bothEmptyIsIdentical = opts.bothEmptyIsIdentical ?? false;
+  if (a.size === 0 && b2.size === 0) {
+    return bothEmptyIsIdentical ? 1 : 0;
+  }
+  if (a.size === 0 || b2.size === 0) return 0;
+  const [small, large] = a.size <= b2.size ? [a, b2] : [b2, a];
+  let intersection2 = 0;
+  for (const line of small) {
+    if (large.has(line)) intersection2++;
+  }
+  const unionSize = a.size + b2.size - intersection2;
+  return intersection2 / unionSize;
+}
+function toLineSet(text, minTokenLen) {
+  return new Set(
+    text.split("\n").map((l) => l.trim()).filter((l) => l.length > minTokenLen)
+  );
+}
+var init_similarity = __esm({
+  "src/utils/similarity.ts"() {
+    "use strict";
+  }
+});
+
 // src/core/checks/redundancy.ts
 import * as path7 from "node:path";
 function compilePatterns(allDeps) {
@@ -42685,6 +42747,20 @@ function compilePatterns(allDeps) {
   }
   return compiled;
 }
+function getCompiledPatterns(projectRoot, allDeps) {
+  const relevant = [];
+  for (const pkg of Object.keys(PACKAGE_TECH_MAP)) {
+    if (allDeps.has(pkg)) relevant.push(pkg);
+  }
+  relevant.sort();
+  const key = `${projectRoot}\0${relevant.join(" ")}`;
+  let compiled = compiledPatternsCache.get(key);
+  if (!compiled) {
+    compiled = compilePatterns(allDeps);
+    compiledPatternsCache.set(key, compiled);
+  }
+  return compiled;
+}
 async function checkRedundancy(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
@@ -42695,7 +42771,7 @@ async function checkRedundancy(file2, projectRoot) {
       ...Object.keys(pkgJson.peerDependencies || {}),
       ...Object.keys(pkgJson.optionalDependencies || {})
     ]);
-    const compiledPatterns = compilePatterns(allDeps);
+    const compiledPatterns = getCompiledPatterns(projectRoot, allDeps);
     const lines2 = file2.content.split("\n");
     for (let i2 = 0; i2 < lines2.length; i2++) {
       const line = lines2[i2];
@@ -42746,10 +42822,14 @@ async function checkRedundancy(file2, projectRoot) {
 }
 function checkDuplicateContent(files) {
   const issues = [];
-  const DUPLICATE_CONTENT_THRESHOLD = 0.6;
+  const lineSets = files.map((f) => toLineSet(f.content, DUPLICATE_CONTENT_MIN_TOKEN_LEN));
   for (let i2 = 0; i2 < files.length; i2++) {
+    const a = lineSets[i2];
+    if (a.size === 0) continue;
     for (let j3 = i2 + 1; j3 < files.length; j3++) {
-      const overlap = calculateLineOverlap(files[i2].content, files[j3].content);
+      const b2 = lineSets[j3];
+      if (b2.size === 0) continue;
+      const overlap = jaccardSimilarityFromSets(a, b2);
       if (overlap >= DUPLICATE_CONTENT_THRESHOLD) {
         issues.push({
           severity: "warning",
@@ -42764,29 +42844,15 @@ function checkDuplicateContent(files) {
   }
   return issues;
 }
-function calculateLineOverlap(contentA, contentB) {
-  const linesA = new Set(
-    contentA.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
-  );
-  const linesB = new Set(
-    contentB.split("\n").map((l) => l.trim()).filter((l) => l.length > 10)
-  );
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
-  }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
-}
 function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-var PACKAGE_TECH_MAP;
+var PACKAGE_TECH_MAP, compiledPatternsCache, DUPLICATE_CONTENT_THRESHOLD, DUPLICATE_CONTENT_MIN_TOKEN_LEN;
 var init_redundancy = __esm({
   "src/core/checks/redundancy.ts"() {
     "use strict";
     init_fs();
+    init_similarity();
     init_tokens();
     PACKAGE_TECH_MAP = {
       react: ["React", "react"],
@@ -42839,6 +42905,9 @@ var init_redundancy = __esm({
       cypress: ["Cypress"],
       puppeteer: ["Puppeteer"]
     };
+    compiledPatternsCache = /* @__PURE__ */ new Map();
+    DUPLICATE_CONTENT_THRESHOLD = 0.6;
+    DUPLICATE_CONTENT_MIN_TOKEN_LEN = 10;
   }
 });
 
@@ -43156,7 +43225,7 @@ var init_contradictions = __esm({
 function parseFrontmatter(content) {
   const lines = content.split("\n");
   if (lines[0]?.trim() !== "---") {
-    return { found: false, fields: {}, endLine: 0 };
+    return { found: false, fields: {}, endLine: 0, unclosed: false };
   }
   const fields = {};
   let endLine = 0;
@@ -43183,9 +43252,9 @@ function parseFrontmatter(content) {
     }
   }
   if (endLine === 0) {
-    return { found: true, fields, endLine: lines.length };
+    return { found: true, fields, endLine: lines.length, unclosed: true };
   }
-  return { found: true, fields, endLine };
+  return { found: true, fields, endLine, unclosed: false };
 }
 function isCursorMdc(file2) {
   return file2.relativePath.endsWith(".mdc");
@@ -43196,6 +43265,23 @@ function isCopilotInstructions(file2) {
 function isWindsurfRule(file2) {
   return file2.relativePath.includes(".windsurf/rules/") && file2.relativePath.endsWith(".md");
 }
+function hasUnbalancedBracketsOrQuotes(val) {
+  let square = 0;
+  let curly = 0;
+  for (const ch of val) {
+    if (ch === "[") square++;
+    else if (ch === "]") square--;
+    else if (ch === "{") curly++;
+    else if (ch === "}") curly--;
+    if (square < 0 || curly < 0) return true;
+  }
+  if (square !== 0 || curly !== 0) return true;
+  const doubleQuotes = (val.match(/"/g) || []).length;
+  const singleQuotes = (val.match(/'/g) || []).length;
+  if (doubleQuotes % 2 !== 0) return true;
+  if (singleQuotes % 2 !== 0) return true;
+  return false;
+}
 async function checkFrontmatter(file2, _projectRoot) {
   const issues = [];
   if (isCursorMdc(file2)) {
@@ -43207,9 +43293,23 @@ async function checkFrontmatter(file2, _projectRoot) {
   }
   return issues;
 }
+function unclosedFrontmatterIssue() {
+  return {
+    severity: "error",
+    check: "frontmatter",
+    ruleId: "frontmatter/unclosed",
+    line: 1,
+    message: "Frontmatter opens with `---` but is never closed",
+    suggestion: "Add a matching `---` line (with no leading whitespace) after the last frontmatter field"
+  };
+}
 function validateCursorMdc(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "warning",
@@ -43256,13 +43356,13 @@ function validateCursorMdc(file2) {
   }
   if ("globs" in fm.fields) {
     const val = fm.fields["globs"];
-    if (val && !val.startsWith("[") && !val.startsWith('"') && !val.includes("*") && !val.includes("/")) {
+    if (val && hasUnbalancedBracketsOrQuotes(val)) {
       issues.push({
         severity: "warning",
         check: "frontmatter",
         ruleId: "frontmatter/invalid-value",
         line: 1,
-        message: `Possibly invalid globs value: "${val}"`,
+        message: `Possibly malformed globs value: "${val}"`,
         suggestion: 'globs should be a glob pattern like "src/**/*.ts" or an array like ["*.ts", "*.tsx"]'
       });
     }
@@ -43272,6 +43372,10 @@ function validateCursorMdc(file2) {
 function validateCopilotInstructions(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "info",
@@ -43298,6 +43402,10 @@ function validateCopilotInstructions(file2) {
 function validateWindsurfRule(file2) {
   const issues = [];
   const fm = parseFrontmatter(file2.content);
+  if (fm.unclosed) {
+    issues.push(unclosedFrontmatterIssue());
+    return issues;
+  }
   if (!fm.found) {
     issues.push({
       severity: "info",
@@ -43469,6 +43577,10 @@ function isEnvVarRef(value) {
 function isKnownApiKey(value) {
   return API_KEY_PATTERNS.some((p2) => p2.test(value));
 }
+function nameSuggestsSecret(name) {
+  const upper = name.toUpperCase();
+  return SECRET_NAME_KEYWORDS.some((kw) => upper.includes(kw));
+}
 function isHighEntropySecret(value) {
   if (isEnvVarRef(value)) return false;
   return HIGH_ENTROPY_PATTERN.test(value);
@@ -43517,8 +43629,9 @@ async function checkMcpSecurity(config2, _projectRoot) {
       }
     }
     if (server2.env) {
-      for (const envValue of Object.values(server2.env)) {
-        if (!isEnvVarRef(envValue) && (isKnownApiKey(envValue) || isHighEntropySecret(envValue))) {
+      for (const [envName, envValue] of Object.entries(server2.env)) {
+        const isSecret = isKnownApiKey(envValue) || nameSuggestsSecret(envName) && isHighEntropySecret(envValue);
+        if (!isEnvVarRef(envValue) && isSecret) {
           const envVar = deriveEnvVarName(server2.name, "API_KEY");
           issues.push({
             severity: "error",
@@ -43565,7 +43678,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
   }
   return issues;
 }
-var API_KEY_PATTERNS, ENV_VAR_REF, HIGH_ENTROPY_PATTERN, URL_SECRET_PARAMS;
+var API_KEY_PATTERNS, ENV_VAR_REF, HIGH_ENTROPY_PATTERN, URL_SECRET_PARAMS, SECRET_NAME_KEYWORDS;
 var init_security = __esm({
   "src/core/checks/mcp/security.ts"() {
     "use strict";
@@ -43594,6 +43707,22 @@ var init_security = __esm({
     ENV_VAR_REF = /\$\{[^}]+\}/;
     HIGH_ENTROPY_PATTERN = /^[A-Za-z0-9+/=_-]{21,}$/;
     URL_SECRET_PARAMS = /[?&](key|token|api_key|apikey|secret|password|access_token)=/i;
+    SECRET_NAME_KEYWORDS = [
+      "KEY",
+      "TOKEN",
+      "SECRET",
+      "PASSWORD",
+      "PASSWD",
+      "PASS",
+      "AUTH",
+      "CREDENTIAL",
+      "CREDENTIALS",
+      "APIKEY",
+      "PRIVATE",
+      "SIGNING",
+      "SESSION",
+      "COOKIE"
+    ];
   }
 });
 
@@ -44360,6 +44489,12 @@ function extractPaths(content) {
       paths.push(p2);
     }
   }
+  for (const match of content.matchAll(BARE_FILE_PATH)) {
+    const p2 = match[1].replace(/[)}\]]+$/, "");
+    if (p2.length > 2 && !p2.startsWith("http")) {
+      paths.push(p2);
+    }
+  }
   return [...new Set(paths)];
 }
 function parseFrontmatter2(content) {
@@ -44389,7 +44524,7 @@ function parseFrontmatter2(content) {
   };
 }
 async function parseMemoryFile(filePath, projectDir) {
-  const content = await readFile(filePath, "utf-8");
+  const content = stripBom(await readFile(filePath, "utf-8"));
   const { name, description, type, body } = parseFrontmatter2(content);
   const referencedPaths = extractPaths(body);
   return {
@@ -44402,11 +44537,13 @@ async function parseMemoryFile(filePath, projectDir) {
     referencedPaths
   };
 }
-var PATH_PATTERN2;
+var PATH_PATTERN2, BARE_FILE_PATH;
 var init_session_parser = __esm({
   "src/core/session-parser.ts"() {
     "use strict";
+    init_fs();
     PATH_PATTERN2 = /(?:^|\s|['"`(])([.~/][^\s'"`),;:!?]+)/g;
+    BARE_FILE_PATH = /(?:^|[\s`"'(])([\w][\w-]*(?:\/[\w.-]+)+\.[a-zA-Z0-9]{1,8})\b/g;
   }
 });
 
@@ -44438,30 +44575,46 @@ async function parseJsonlFiltered(filePath, filter) {
   }
   return results;
 }
-async function readClaudeHistory() {
-  const historyPath = join5(home, ".claude", "history.jsonl");
-  return parseJsonlFiltered(historyPath, (entry) => {
-    if (!entry.display || !entry.project) return null;
+function pickField(entry, fields) {
+  for (const f of fields) {
+    const v2 = entry[f];
+    if (typeof v2 === "string" && v2.length > 0) return v2;
+  }
+  return "";
+}
+async function readJsonlHistory(opts) {
+  return parseJsonlFiltered(opts.historyPath, (parsed) => {
+    if (!parsed || typeof parsed !== "object") return null;
+    const entry = parsed;
+    const display = pickField(entry, opts.displayFields);
+    if (!display) return null;
+    const project = pickField(entry, opts.projectFields);
+    if (opts.requireProject && !project) return null;
     return {
-      display: entry.display,
-      timestamp: entry.timestamp || 0,
-      project: entry.project.replace(/\\/g, "/"),
-      sessionId: entry.sessionId || "",
-      provider: "claude-code"
+      display,
+      timestamp: typeof entry.timestamp === "number" ? entry.timestamp : 0,
+      project: project.replace(/\\/g, "/"),
+      sessionId: typeof entry.sessionId === "string" ? entry.sessionId : "",
+      provider: opts.provider
     };
   });
 }
+async function readClaudeHistory() {
+  return readJsonlHistory({
+    historyPath: join5(home, ".claude", "history.jsonl"),
+    provider: "claude-code",
+    displayFields: ["display"],
+    projectFields: ["project"],
+    requireProject: true
+  });
+}
 async function readCodexHistory() {
-  const historyPath = join5(home, ".codex", "history.jsonl");
-  return parseJsonlFiltered(historyPath, (entry) => {
-    if (!entry.display && !entry.command) return null;
-    return {
-      display: entry.display || entry.command || "",
-      timestamp: entry.timestamp || 0,
-      project: (entry.project || entry.cwd || "").replace(/\\/g, "/"),
-      sessionId: entry.sessionId || "",
-      provider: "codex-cli"
-    };
+  return readJsonlHistory({
+    historyPath: join5(home, ".codex", "history.jsonl"),
+    provider: "codex-cli",
+    displayFields: ["display", "command"],
+    projectFields: ["project", "cwd"],
+    requireProject: false
   });
 }
 async function readClaudeMemories() {
@@ -44526,47 +44679,29 @@ async function detectSiblings(projectRoot) {
       if (orgMatch) currentOrg = orgMatch[1];
     } catch {
     }
-    const gitCandidates = candidates.filter((c3) => existsSync(join5(c3.fullPath, ".git")));
-    const results = await Promise.all(
-      gitCandidates.map(async (c3) => {
-        const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
-        try {
-          const git = simpleGit(c3.fullPath);
-          const remotes = await git.getRemotes(true);
-          const origin = remotes.find((r2) => r2.name === "origin");
-          if (origin?.refs?.fetch) {
-            sibling.gitRemoteUrl = origin.refs.fetch;
-            const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
-            if (orgMatch) sibling.gitOrg = orgMatch[1];
-          }
-        } catch {
-        }
-        return sibling;
-      })
-    );
+    const results = await Promise.all(candidates.map((c3) => resolveSibling(c3)));
     if (currentOrg) {
-      return results.filter((s) => s.gitOrg === currentOrg);
+      return results.filter((s) => !s.gitOrg || s.gitOrg === currentOrg);
     }
     return results;
   }
-  const siblings = await Promise.all(
-    candidates.map(async (c3) => {
-      const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
-      try {
-        const git = simpleGit(c3.fullPath);
-        const remotes = await git.getRemotes(true);
-        const origin = remotes.find((r2) => r2.name === "origin");
-        if (origin?.refs?.fetch) {
-          sibling.gitRemoteUrl = origin.refs.fetch;
-          const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
-          if (orgMatch) sibling.gitOrg = orgMatch[1];
-        }
-      } catch {
-      }
-      return sibling;
-    })
-  );
-  return siblings;
+  return Promise.all(candidates.map((c3) => resolveSibling(c3)));
+}
+async function resolveSibling(c3) {
+  const sibling = { path: c3.entryPath.replace(/\\/g, "/"), name: c3.name };
+  if (!existsSync(join5(c3.fullPath, ".git"))) return sibling;
+  try {
+    const git = simpleGit(c3.fullPath);
+    const remotes = await git.getRemotes(true);
+    const origin = remotes.find((r2) => r2.name === "origin");
+    if (origin?.refs?.fetch) {
+      sibling.gitRemoteUrl = origin.refs.fetch;
+      const orgMatch = origin.refs.fetch.match(/github\.com[:/]([^/]+)\//);
+      if (orgMatch) sibling.gitOrg = orgMatch[1];
+    }
+  } catch {
+  }
+  return sibling;
 }
 async function scanSessionData(projectRoot) {
   const providers = detectProviders();
@@ -44686,48 +44821,57 @@ var init_missing_secret = __esm({
 });
 
 // src/core/checks/session/diverged-file.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { join as join6 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
-function calculateOverlap(a, b2) {
-  const linesA = new Set(
-    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
-  );
-  const linesB = new Set(
-    b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 3)
-  );
-  if (linesA.size === 0 && linesB.size === 0) return 1;
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
+async function loadLineSet(absPath) {
+  let mtimeMs;
+  let size;
+  try {
+    const stats = await stat2(absPath);
+    mtimeMs = stats.mtimeMs;
+    size = stats.size;
+  } catch {
+    return null;
   }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
+  const cached2 = lineSetCache.get(absPath);
+  if (cached2 && cached2.mtimeMs === mtimeMs && cached2.size === size) {
+    lineSetCache.delete(absPath);
+    lineSetCache.set(absPath, cached2);
+    return cached2.lineSet;
+  }
+  let content;
+  try {
+    content = stripBom(await readFile2(absPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const lineSet = toLineSet(content, MIN_TOKEN_LEN);
+  lineSetCache.set(absPath, { mtimeMs, size, lineSet });
+  if (lineSetCache.size > CACHE_MAX_ENTRIES) {
+    const oldest = lineSetCache.keys().next().value;
+    if (oldest !== void 0) lineSetCache.delete(oldest);
+  }
+  return lineSet;
 }
 async function checkDivergedFile(ctx) {
   const issues = [];
   for (const fileName of CANONICAL_FILES) {
     const currentPath = join6(ctx.currentProject, fileName);
     if (!existsSync2(currentPath)) continue;
-    let currentContent;
-    try {
-      currentContent = await readFile2(currentPath, "utf-8");
-    } catch {
-      continue;
-    }
+    const currentLineSet = await loadLineSet(currentPath);
+    if (!currentLineSet) continue;
     const diverged = [];
     for (const sib of ctx.siblings) {
       const sibPath = join6(sib.path, fileName);
       if (!existsSync2(sibPath)) continue;
-      try {
-        const sibContent = await readFile2(sibPath, "utf-8");
-        const overlap = calculateOverlap(currentContent, sibContent);
-        if (overlap >= 0.2 && overlap < 0.9) {
-          diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
-        }
-      } catch {
-        continue;
+      const sibLineSet = await loadLineSet(sibPath);
+      if (!sibLineSet) continue;
+      const overlap = jaccardSimilarityFromSets(currentLineSet, sibLineSet, {
+        bothEmptyIsIdentical: true
+      });
+      if (overlap >= 0.2 && overlap < 0.9) {
+        diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
       }
     }
     if (diverged.length > 0) {
@@ -44745,10 +44889,12 @@ async function checkDivergedFile(ctx) {
   }
   return issues;
 }
-var CANONICAL_FILES;
+var CANONICAL_FILES, MIN_TOKEN_LEN, CACHE_MAX_ENTRIES, lineSetCache;
 var init_diverged_file = __esm({
   "src/core/checks/session/diverged-file.ts"() {
     "use strict";
+    init_similarity();
+    init_fs();
     CANONICAL_FILES = [
       "release.sh",
       ".github/workflows/ci.yml",
@@ -44759,6 +44905,9 @@ var init_diverged_file = __esm({
       "tsconfig.json",
       ".gitignore"
     ];
+    MIN_TOKEN_LEN = 3;
+    CACHE_MAX_ENTRIES = 256;
+    lineSetCache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -44866,24 +45015,10 @@ var init_stale_memory = __esm({
 });
 
 // src/core/checks/session/duplicate-memory.ts
-function calculateLineOverlap2(a, b2) {
-  const linesA = new Set(
-    a.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
-  );
-  const linesB = new Set(
-    b2.split("\n").map((l) => l.trim()).filter((l) => l.length > 5)
-  );
-  if (linesA.size === 0 || linesB.size === 0) return 0;
-  let intersection2 = 0;
-  for (const line of linesA) {
-    if (linesB.has(line)) intersection2++;
-  }
-  const unionSize = linesA.size + linesB.size - intersection2;
-  return intersection2 / unionSize;
-}
 async function checkDuplicateMemory(ctx) {
   const issues = [];
   const reported = /* @__PURE__ */ new Set();
+  const lineSets = ctx.memories.map((m) => toLineSet(m.content, MIN_TOKEN_LEN2));
   for (let i2 = 0; i2 < ctx.memories.length; i2++) {
     for (let j3 = i2 + 1; j3 < ctx.memories.length; j3++) {
       const a = ctx.memories[i2];
@@ -44893,7 +45028,7 @@ async function checkDuplicateMemory(ctx) {
       const bIsCurrent = projectDirMatchesPath(b2.projectDir, ctx.currentProject);
       if (!aIsCurrent && !bIsCurrent) continue;
       if (a.content.length < 50 || b2.content.length < 50) continue;
-      const overlap = calculateLineOverlap2(a.content, b2.content);
+      const overlap = jaccardSimilarityFromSets(lineSets[i2], lineSets[j3]);
       if (overlap < 0.6) continue;
       const pairKey = [a.filePath, b2.filePath].sort().join("::");
       if (reported.has(pairKey)) continue;
@@ -44915,10 +45050,13 @@ async function checkDuplicateMemory(ctx) {
   }
   return issues;
 }
+var MIN_TOKEN_LEN2;
 var init_duplicate_memory = __esm({
   "src/core/checks/session/duplicate-memory.ts"() {
     "use strict";
     init_session_parser();
+    init_similarity();
+    MIN_TOKEN_LEN2 = 5;
   }
 });
 
@@ -45013,24 +45151,23 @@ var init_loop_detection = __esm({
 });
 
 // src/core/checks/session/memory-index-overflow.ts
-import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 import { join as join8 } from "node:path";
 async function checkMemoryIndexOverflow(ctx) {
   const home2 = process.env.HOME || process.env.USERPROFILE || "";
   if (!home2) return [];
   const encoded = encodeProjectDir(ctx.currentProject);
   const memoryFile = join8(home2, ".claude", "projects", encoded, "memory", "MEMORY.md");
-  let stats;
+  let content;
   try {
-    stats = await stat2(memoryFile);
+    content = stripBom(await readFile3(memoryFile, "utf-8"));
   } catch {
     return [];
   }
-  const content = await readFile3(memoryFile, "utf-8").catch(() => "");
   if (!content) return [];
   const lines = content.split("\n");
   const lineCount = lines.length;
-  const byteSize = stats.size;
+  const byteSize = Buffer.byteLength(content, "utf8");
   const issues = [];
   if (lineCount > MAX_LINES) {
     const excess = lineCount - MAX_LINES;
@@ -45063,6 +45200,7 @@ var init_memory_index_overflow = __esm({
   "src/core/checks/session/memory-index-overflow.ts"() {
     "use strict";
     init_session_parser();
+    init_fs();
     MAX_LINES = 200;
     MAX_BYTES = 25 * 1024;
   }
@@ -45089,7 +45227,7 @@ async function findReleaseWorkflows(projectRoot) {
       continue;
     }
     try {
-      const content = await readFile4(join9(workflowDir, f), "utf-8");
+      const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
       const nameMatch = content.match(/^name:\s*(.+)$/m);
       if (nameMatch && RELEASE_FILENAME_PATTERNS.some((p2) => p2.test(nameMatch[1]))) {
         releaseWorkflows.push(f);
@@ -45126,6 +45264,7 @@ var RELEASE_FILENAME_PATTERNS, RELEASE_DOC_PATTERNS;
 var init_ci_coverage = __esm({
   "src/core/checks/ci-coverage.ts"() {
     "use strict";
+    init_fs();
     RELEASE_FILENAME_PATTERNS = [/release/i, /deploy/i, /publish/i, /\bcd\b/i];
     RELEASE_DOC_PATTERNS = [
       /release\s+(process|workflow|steps|via|by|using)/i,
@@ -45160,7 +45299,7 @@ async function findSecretUsages(projectRoot) {
     if (!(f.endsWith(".yml") || f.endsWith(".yaml"))) continue;
     let content;
     try {
-      content = await readFile5(join10(workflowDir, f), "utf-8");
+      content = stripBom(await readFile5(join10(workflowDir, f), "utf-8"));
     } catch {
       continue;
     }
@@ -45177,7 +45316,7 @@ async function findSecretUsages(projectRoot) {
 }
 function contextMentionsSecret(files, secretName) {
   const escaped = secretName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[_\\s-]")}\\b`, "i");
+  const pattern = new RegExp(`\\b${escaped.replace(/_/g, "[ _-]")}\\b`, "i");
   return files.some((f) => pattern.test(f.content));
 }
 async function checkCiSecrets(files, projectRoot) {
@@ -45201,6 +45340,7 @@ var BUILTIN_SECRETS, SECRETS_REGEX;
 var init_ci_secrets = __esm({
   "src/core/checks/ci-secrets.ts"() {
     "use strict";
+    init_fs();
     BUILTIN_SECRETS = /* @__PURE__ */ new Set([
       "GITHUB_TOKEN",
       "ACTIONS_RUNTIME_TOKEN",
@@ -45221,7 +45361,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.19";
+  if (true) return "0.9.20";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -45245,6 +45385,11 @@ function hasMcphChecks(checks) {
 function hasSessionChecks(checks) {
   return checks.some((c3) => c3.startsWith("session-"));
 }
+function deriveChecksToRun(activeChecks, prefix, enabled, allChecks) {
+  const filtered = activeChecks.filter((c3) => c3.startsWith(prefix));
+  if (filtered.length > 0) return filtered;
+  return enabled ? [...allChecks] : [];
+}
 async function runAudit(projectRoot, activeChecks, options = {}) {
   const fileResults = [];
   const shouldRunContextChecks = !options.mcpOnly && !options.mcphOnly && !options.sessionOnly;
@@ -45325,8 +45470,12 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       );
       mcpConfigs.push(...globalConfigs);
     }
-    const activeMcpChecks = activeChecks.filter((c3) => c3.startsWith("mcp-"));
-    const mcpChecksToRun = activeMcpChecks.length > 0 ? activeMcpChecks : options.mcp || options.mcpGlobal || options.mcpOnly ? ALL_MCP_CHECKS : [];
+    const mcpChecksToRun = deriveChecksToRun(
+      activeChecks,
+      "mcp-",
+      Boolean(options.mcp || options.mcpGlobal || options.mcpOnly),
+      ALL_MCP_CHECKS
+    );
     for (const config2 of mcpConfigs) {
       const checkPromises = [];
       if (mcpChecksToRun.includes("mcp-schema"))
@@ -45372,7 +45521,7 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     const projectMcphFiles = await scanForMcphConfigs(projectRoot);
     const mcphConfigs = await Promise.all(
       projectMcphFiles.map(
-        (f) => parseMchpConfig(
+        (f) => parseMcphConfig(
           f,
           projectRoot,
           f.relativePath.endsWith(".mcph.local.json") ? "project-local" : "project"
@@ -45382,12 +45531,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     if (options.mcphGlobal) {
       const globalMcphFiles = await scanGlobalMcphConfigs();
       const globalMcphConfigs = await Promise.all(
-        globalMcphFiles.map((f) => parseMchpConfig(f, projectRoot, "global"))
+        globalMcphFiles.map((f) => parseMcphConfig(f, projectRoot, "global"))
       );
       mcphConfigs.push(...globalMcphConfigs);
     }
-    const activeMcphChecks = activeChecks.filter((c3) => c3.startsWith("mcph-"));
-    const mcphChecksToRun = activeMcphChecks.length > 0 ? activeMcphChecks : options.mcph || options.mcphGlobal || options.mcphOnly ? ALL_MCPH_CHECKS : [];
+    const mcphChecksToRun = deriveChecksToRun(
+      activeChecks,
+      "mcph-",
+      Boolean(options.mcph || options.mcphGlobal || options.mcphOnly),
+      ALL_MCPH_CHECKS
+    );
     for (const config2 of mcphConfigs) {
       const checkPromises = [];
       if (mcphChecksToRun.includes("mcph-token-security")) {
@@ -45411,14 +45564,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       }
       const results = await Promise.all(checkPromises);
       const issues = results.flat();
-      for (const err of config2.parseErrors) {
-        issues.push({
-          severity: "error",
-          check: "mcph-schema-conformance",
-          ruleId: "mcph-config/parse-error",
-          line: 1,
-          message: err
-        });
+      if (mcphChecksToRun.includes("mcph-schema-conformance")) {
+        for (const err of config2.parseErrors) {
+          issues.push({
+            severity: "error",
+            check: "mcph-schema-conformance",
+            ruleId: "mcph-config/parse-error",
+            line: 1,
+            message: err
+          });
+        }
       }
       const lines = config2.content.split("\n").length;
       fileResults.push({
@@ -45454,15 +45609,13 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
         sessionPromises.push(checkMemoryIndexOverflow(sessionCtx));
       const sessionResults = await Promise.all(sessionPromises);
       const sessionIssues = sessionResults.flat();
-      if (sessionIssues.length > 0) {
-        fileResults.push({
-          path: "~/.claude/ (session audit)",
-          isSymlink: false,
-          tokens: 0,
-          lines: 0,
-          issues: sessionIssues
-        });
-      }
+      fileResults.push({
+        path: "~/.claude/ (session audit)",
+        isSymlink: false,
+        tokens: 0,
+        lines: 0,
+        issues: sessionIssues
+      });
     }
   }
   let estimatedWaste = 0;
@@ -46219,11 +46372,22 @@ var init_fixer = __esm({
 
 // src/mcp/server.ts
 var server_exports = {};
+__export(server_exports, {
+  server: () => server,
+  startServer: () => startServer
+});
 import * as path10 from "node:path";
+function describeDisallowed(rawPath) {
+  const m = rawPath.match(PATH_DISALLOWED);
+  if (!m) return "unknown";
+  return JSON.stringify(m[0]);
+}
 function validateProjectPath(rawPath) {
   if (!rawPath) return process.cwd();
   if (PATH_DISALLOWED.test(rawPath)) {
-    throw new Error("projectPath contains disallowed characters");
+    throw new Error(
+      `projectPath contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
+    );
   }
   const resolved = path10.resolve(rawPath);
   if (!isDirectory(resolved)) {
@@ -46233,12 +46397,28 @@ function validateProjectPath(rawPath) {
 }
 function validateFilePathInput(rawPath) {
   if (PATH_DISALLOWED.test(rawPath)) {
-    throw new Error("path contains disallowed characters");
+    throw new Error(
+      `path contains disallowed character ${describeDisallowed(rawPath)} (control chars and shell metacharacters are rejected)`
+    );
   }
 }
-var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
+function resolveWithinRoot(filePath, root) {
+  const resolvedRoot = path10.resolve(root);
+  const resolved = path10.resolve(resolvedRoot, filePath);
+  const rel = path10.relative(resolvedRoot, resolved);
+  if (rel.startsWith("..") || path10.isAbsolute(rel)) {
+    throw new Error("path escapes the project root");
+  }
+  return resolved;
+}
+async function startServer() {
+  keepEncoderAlive(true);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+var contextCheckEnum, mcpCheckEnum, mcphCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server;
 var init_server3 = __esm({
-  async "src/mcp/server.ts"() {
+  "src/mcp/server.ts"() {
     "use strict";
     init_mcp();
     init_stdio2();
@@ -46312,7 +46492,7 @@ var init_server3 = __esm({
         try {
           validateFilePathInput(filePath);
           const root = validateProjectPath(projectPath);
-          const resolved = path10.resolve(root, filePath);
+          const resolved = resolveWithinRoot(filePath, root);
           const result = {
             path: filePath,
             exists: fileExists(resolved) || isDirectory(resolved)
@@ -46555,9 +46735,6 @@ var init_server3 = __esm({
         }
       }
     );
-    keepEncoderAlive(true);
-    transport = new StdioServerTransport();
-    await server.connect(transport);
   }
 });
 
@@ -53035,7 +53212,9 @@ var init_ora = __esm({
 
 // src/core/reporter.ts
 function classifyFile(f) {
+  if (f.path === "(project)") return "context";
   if (f.path === "(mcp)") return "mcp";
+  if (f.path === "(mcph)") return "mcph";
   if (f.path.includes("session audit")) return "session";
   for (const issue2 of f.issues) {
     if (issue2.check.startsWith("session-")) return "session";
@@ -53532,7 +53711,7 @@ function loadConfig(projectRoot) {
     const filePath = path11.join(projectRoot, filename);
     let content;
     try {
-      content = fs8.readFileSync(filePath, "utf-8");
+      content = stripBom(fs8.readFileSync(filePath, "utf-8"));
     } catch {
       continue;
     }
@@ -53543,7 +53722,7 @@ function loadConfig(projectRoot) {
 function loadConfigFromExplicitPath(configPath) {
   let content;
   try {
-    content = fs8.readFileSync(configPath, "utf-8");
+    content = stripBom(fs8.readFileSync(configPath, "utf-8"));
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(`could not load config from ${configPath}: ${detail}`, { cause: err });
@@ -53555,6 +53734,7 @@ var init_config2 = __esm({
   "src/core/config.ts"() {
     "use strict";
     import_fast_levenshtein2 = __toESM(require_levenshtein(), 1);
+    init_fs();
     levenshtein2 = import_fast_levenshtein2.default.get;
     KNOWN_CONFIG_KEYS = [
       "checks",
@@ -53999,7 +54179,8 @@ var init_cli = __esm({
 // src/index.ts
 var args = process.argv.slice(2);
 if (args[0] === "serve" || args.includes("--mcp-server")) {
-  await init_server3().then(() => server_exports);
+  const { startServer: startServer2 } = await Promise.resolve().then(() => (init_server3(), server_exports));
+  await startServer2();
 } else {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();