@yawlabs/ctxlint 0.9.20 → 0.10.0

package/dist/index.js

@@ -34452,6 +34452,8 @@ async function scanGlobalMcpConfigs() {
     } catch {
       continue;
     }
+    const isGeneralClaudeFile = normalized.endsWith(`${path2.sep}.claude.json`) || normalized.endsWith(`${path2.sep}.claude${path2.sep}settings.json`);
+    if (isGeneralClaudeFile && !mcpFileHasMcpKey(normalized)) continue;
     const symlink = isSymlink(normalized);
     const target = symlink ? readSymlinkTarget(normalized) : void 0;
     found.push({
@@ -34464,6 +34466,14 @@ async function scanGlobalMcpConfigs() {
   }
   return found.sort((a, b2) => a.relativePath.localeCompare(b2.relativePath));
 }
+function mcpFileHasMcpKey(filePath) {
+  try {
+    const content = fs3.readFileSync(filePath, "utf8");
+    return /"(mcpServers|servers)"\s*:/.test(content);
+  } catch {
+    return false;
+  }
+}
 var CONTEXT_FILE_PATTERNS, IGNORED_DIRS2, MCP_CONFIG_PATTERNS, MCPH_CONFIG_PATTERNS;
 var init_scanner = __esm({
   "src/core/scanner.ts"() {
@@ -40699,12 +40709,13 @@ async function parseMcpConfig(file2, projectRoot, scope) {
     return result;
   }
   const lines = content.split("\n");
+  const rootKeyLine = findRootKeyLine(lines, rootKey);
   for (const [name, value] of Object.entries(serversObj)) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
       continue;
     }
     const raw = value;
-    const line = findServerLine(lines, name);
+    const line = findServerLine(lines, name, rootKeyLine);
     const transport = inferTransport(raw);
     const entry = {
       name,
@@ -40755,15 +40766,24 @@ function inferTransport(raw) {
   if ("url" in raw) return "http";
   return "unknown";
 }
-function findServerLine(lines, serverName) {
-  const escaped = serverName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function findRootKeyLine(lines, rootKey) {
+  const escaped = rootKey.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const pattern = new RegExp(`"${escaped}"\\s*:`);
   for (let i2 = 0; i2 < lines.length; i2++) {
+    if (pattern.test(lines[i2])) return i2;
+  }
+  return -1;
+}
+function findServerLine(lines, serverName, rootKeyLine) {
+  const escaped = serverName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`"${escaped}"\\s*:`);
+  const start = rootKeyLine >= 0 ? rootKeyLine + 1 : 0;
+  for (let i2 = start; i2 < lines.length; i2++) {
     if (pattern.test(lines[i2])) {
       return i2 + 1;
     }
   }
-  return 1;
+  return rootKeyLine >= 0 ? rootKeyLine + 1 : 1;
 }
 function isStringRecord(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -41295,11 +41315,11 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
       onValue({ type: getNodeType(value), offset, length, parent: currentParent, value });
       ensurePropertyComplete(offset + length);
     },
-    onSeparator: (sep, offset, length) => {
+    onSeparator: (sep2, offset, length) => {
       if (currentParent.type === "property") {
-        if (sep === ":") {
+        if (sep2 === ":") {
           currentParent.colonOffset = offset;
-        } else if (sep === ",") {
+        } else if (sep2 === ",") {
           ensurePropertyComplete(offset);
         }
       }
@@ -41807,7 +41827,6 @@ async function parseMcphConfig(file2, projectRoot, scopeOverride) {
 }
 function detectScope(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
-  if (normalized.startsWith("~/")) return "global";
   if (normalized.endsWith(".mcph.local.json")) return "project-local";
   return "project";
 }
@@ -42424,26 +42443,21 @@ var init_staleness = __esm({
 });
 
 // src/core/checks/tokens.ts
-function setTokenThresholds(overrides) {
-  const merged = { ...DEFAULT_THRESHOLDS, ...overrides };
+function resolveTokenThresholds(overrides) {
+  if (!overrides) return DEFAULT_TOKEN_THRESHOLDS;
+  const merged = { ...DEFAULT_TOKEN_THRESHOLDS, ...overrides };
   if (merged.info >= merged.warning || merged.warning >= merged.error) {
     console.error(
       `Warning: token thresholds should satisfy info < warning < error (got ${merged.info}, ${merged.warning}, ${merged.error}) \u2014 using defaults`
     );
-    return;
+    return DEFAULT_TOKEN_THRESHOLDS;
   }
-  currentThresholds = merged;
+  return merged;
 }
-function resetTokenThresholds() {
-  currentThresholds = DEFAULT_THRESHOLDS;
-}
-function getTokenThresholds() {
-  return currentThresholds;
-}
-async function checkTokens(file2, _projectRoot) {
+async function checkTokens(file2, _projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const issues = [];
   const tokens = file2.totalTokens;
-  if (tokens >= currentThresholds.error) {
+  if (tokens >= thresholds.error) {
     issues.push({
       severity: "error",
       check: "tokens",
@@ -42452,7 +42466,7 @@ async function checkTokens(file2, _projectRoot) {
       message: `${tokens.toLocaleString()} tokens \u2014 consumes significant context window space`,
       suggestion: "Consider splitting into focused sections or removing redundant content."
     });
-  } else if (tokens >= currentThresholds.warning) {
+  } else if (tokens >= thresholds.warning) {
     issues.push({
       severity: "warning",
       check: "tokens",
@@ -42461,7 +42475,7 @@ async function checkTokens(file2, _projectRoot) {
       message: `${tokens.toLocaleString()} tokens \u2014 large context file`,
       suggestion: "Consider trimming \u2014 research shows diminishing returns past ~300 lines."
     });
-  } else if (tokens >= currentThresholds.info) {
+  } else if (tokens >= thresholds.info) {
     issues.push({
       severity: "info",
       check: "tokens",
@@ -42472,9 +42486,9 @@ async function checkTokens(file2, _projectRoot) {
   }
   return issues;
 }
-function checkAggregateTokens(files) {
+function checkAggregateTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const total = files.reduce((sum, f) => sum + f.tokens, 0);
-  if (total > currentThresholds.aggregate && files.length > 1) {
+  if (total > thresholds.aggregate && files.length > 1) {
     return {
       severity: "warning",
       check: "tokens",
@@ -42486,11 +42500,11 @@ function checkAggregateTokens(files) {
   }
   return null;
 }
-var DEFAULT_THRESHOLDS, currentThresholds;
+var DEFAULT_TOKEN_THRESHOLDS;
 var init_tokens2 = __esm({
   "src/core/checks/tokens.ts"() {
     "use strict";
-    DEFAULT_THRESHOLDS = {
+    DEFAULT_TOKEN_THRESHOLDS = {
       info: 1e3,
       warning: 3e3,
       error: 8e3,
@@ -42498,7 +42512,6 @@ var init_tokens2 = __esm({
       tierBreakdown: 1e3,
       tierAggregate: 4e3
     };
-    currentThresholds = DEFAULT_THRESHOLDS;
   }
 });
 
@@ -42624,10 +42637,10 @@ function checkHardEnforcement(file2, settings) {
   }
   return issues;
 }
-async function checkTierTokens(file2, projectRoot) {
+async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   if (!isAlwaysLoaded(file2)) return [];
   const issues = [];
-  const threshold = getTokenThresholds().tierBreakdown;
+  const threshold = thresholds.tierBreakdown;
   if (file2.totalTokens >= threshold) {
     const sectionCosts = computeSectionCosts(file2);
     if (sectionCosts.length > 0) {
@@ -42650,11 +42663,11 @@ async function checkTierTokens(file2, projectRoot) {
   issues.push(...checkHardEnforcement(file2, settings));
   return issues;
 }
-function checkAggregateTierTokens(files) {
+function checkAggregateTierTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const alwaysLoaded = files.filter(isAlwaysLoaded);
   if (alwaysLoaded.length < 2) return null;
   const total = alwaysLoaded.reduce((sum, f) => sum + f.totalTokens, 0);
-  const threshold = getTokenThresholds().tierAggregate;
+  const threshold = thresholds.tierAggregate;
   if (total < threshold) return null;
   const breakdown = alwaysLoaded.slice().sort((a, b2) => b2.totalTokens - a.totalTokens).slice(0, 5).map((f) => `  - ${f.relativePath}: ~${f.totalTokens.toLocaleString()} tokens`).join("\n");
   return {
@@ -43457,7 +43470,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "invalid-json",
+        ruleId: "mcp-schema/invalid-json",
         line: 1,
         message: `MCP config is not valid JSON: ${err}`
       });
@@ -43468,7 +43481,7 @@ async function checkMcpSchema(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcp-schema",
-      ruleId: "missing-root-key",
+      ruleId: "mcp-schema/missing-root-key",
       line: 1,
       message: `MCP config has no "${config2.expectedRootKey}" key`
     });
@@ -43479,7 +43492,7 @@ async function checkMcpSchema(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcp-schema",
-      ruleId: "wrong-root-key",
+      ruleId: "mcp-schema/wrong-root-key",
       line,
       message: `${config2.relativePath} must use "${config2.expectedRootKey}" as root key, not "${config2.actualRootKey}"`,
       fix: {
@@ -43494,7 +43507,7 @@ async function checkMcpSchema(config2, _projectRoot) {
     issues.push({
       severity: "info",
       check: "mcp-schema",
-      ruleId: "empty-servers",
+      ruleId: "mcp-schema/empty-servers",
       line: 1,
       message: "MCP config has no server entries"
     });
@@ -43505,7 +43518,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "no-name-field",
+        ruleId: "mcp-schema/no-name-field",
         line: server2.line,
         message: "Server name cannot be empty"
       });
@@ -43517,7 +43530,7 @@ async function checkMcpSchema(config2, _projectRoot) {
         issues.push({
           severity: "warning",
           check: "mcp-schema",
-          ruleId: "unknown-transport",
+          ruleId: "mcp-schema/unknown-transport",
           line: server2.line,
           message: `Server "${server2.name}" has unknown transport type "${typeVal}"`
         });
@@ -43527,7 +43540,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcp-schema",
-        ruleId: "ambiguous-transport",
+        ruleId: "mcp-schema/ambiguous-transport",
         line: server2.line,
         message: `Server "${server2.name}" has both "command" and "url" \u2014 transport is ambiguous`
       });
@@ -43536,7 +43549,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "missing-command",
+        ruleId: "mcp-schema/missing-command",
         line: server2.line,
         message: `Server "${server2.name}" has no "command" field`
       });
@@ -43545,7 +43558,7 @@ async function checkMcpSchema(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-schema",
-        ruleId: "missing-url",
+        ruleId: "mcp-schema/missing-url",
         line: server2.line,
         message: `Server "${server2.name}" has no "url" field`
       });
@@ -43604,7 +43617,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
               issues.push({
                 severity: "error",
                 check: "mcp-security",
-                ruleId: "hardcoded-bearer",
+                ruleId: "mcp-security/hardcoded-bearer",
                 line: server2.line,
                 message: `Server "${server2.name}" has a hardcoded Bearer token in a git-tracked file`,
                 fix: {
@@ -43621,7 +43634,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-security",
-            ruleId: "hardcoded-api-key",
+            ruleId: "mcp-security/hardcoded-api-key",
             line: server2.line,
             message: `Server "${server2.name}" has a hardcoded API key in a git-tracked file`
           });
@@ -43636,7 +43649,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-security",
-            ruleId: "hardcoded-api-key",
+            ruleId: "mcp-security/hardcoded-api-key",
             line: server2.line,
             message: `Server "${server2.name}" has a hardcoded API key in a git-tracked file`,
             fix: {
@@ -43653,7 +43666,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-security",
-        ruleId: "secret-in-url",
+        ruleId: "mcp-security/secret-in-url",
         line: server2.line,
         message: `Server "${server2.name}" has a secret in the URL query string`
       });
@@ -43666,7 +43679,7 @@ async function checkMcpSecurity(config2, _projectRoot) {
             issues.push({
               severity: "warning",
               check: "mcp-security",
-              ruleId: "http-no-tls",
+              ruleId: "mcp-security/http-no-tls",
               line: server2.line,
               message: `Server "${server2.name}" uses HTTP without TLS`
             });
@@ -43738,7 +43751,7 @@ async function checkMcpCommands(config2, projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-commands",
-        ruleId: "windows-npx-no-wrapper",
+        ruleId: "mcp-commands/windows-npx-no-wrapper",
         line: server2.line,
         message: `Server "${server2.name}": npx requires "cmd /c" wrapper on Windows`,
         suggestion: 'Change "command" to "cmd" and prepend "/c", "npx" to args \u2014 e.g. "args": ["/c", "npx", ...]'
@@ -43750,7 +43763,7 @@ async function checkMcpCommands(config2, projectRoot) {
         issues.push({
           severity: "warning",
           check: "mcp-commands",
-          ruleId: "command-not-found",
+          ruleId: "mcp-commands/command-not-found",
           line: server2.line,
           message: `Server "${server2.name}": command "${server2.command}" not found`
         });
@@ -43765,7 +43778,7 @@ async function checkMcpCommands(config2, projectRoot) {
             issues.push({
               severity: "warning",
               check: "mcp-commands",
-              ruleId: "args-path-missing",
+              ruleId: "mcp-commands/args-path-missing",
               line: server2.line,
               message: `Server "${server2.name}": arg "${arg}" looks like a file path but doesn't exist`
             });
@@ -43804,7 +43817,7 @@ async function checkMcpDeprecated(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcp-deprecated",
-        ruleId: "sse-transport",
+        ruleId: "mcp-deprecated/sse-transport",
         line,
         message: `Server "${server2.name}" uses deprecated SSE transport \u2014 use "http" (Streamable HTTP) instead`,
         fix: {
@@ -43900,7 +43913,7 @@ async function checkMcpEnv(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-env",
-            ruleId: "wrong-syntax",
+            ruleId: "mcp-env/wrong-syntax",
             line: server2.line,
             message: `Server "${server2.name}": Claude Code uses \${VAR}, not \${env:VAR}`,
             fix: buildSyntaxFix(config2, server2.line, value, "claude-code")
@@ -43912,7 +43925,7 @@ async function checkMcpEnv(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-env",
-            ruleId: "wrong-syntax",
+            ruleId: "mcp-env/wrong-syntax",
             line: server2.line,
             message: `Server "${server2.name}": Cursor uses \${env:VAR}, not \${VAR}`,
             fix: buildSyntaxFix(config2, server2.line, value, "cursor")
@@ -43924,7 +43937,7 @@ async function checkMcpEnv(config2, _projectRoot) {
           issues.push({
             severity: "error",
             check: "mcp-env",
-            ruleId: "wrong-syntax",
+            ruleId: "mcp-env/wrong-syntax",
             line: server2.line,
             message: `Server "${server2.name}": Continue uses \${{ secrets.VAR }}, not \${VAR}`,
             fix: buildSyntaxFix(config2, server2.line, value, "continue")
@@ -43940,7 +43953,7 @@ async function checkMcpEnv(config2, _projectRoot) {
             issues.push({
               severity: "info",
               check: "mcp-env",
-              ruleId: "unset-variable",
+              ruleId: "mcp-env/unset-variable",
               line: server2.line,
               message: `Server "${server2.name}": environment variable "${ref.varName}" is not set`
             });
@@ -43952,7 +43965,7 @@ async function checkMcpEnv(config2, _projectRoot) {
       issues.push({
         severity: "info",
         check: "mcp-env",
-        ruleId: "empty-env-block",
+        ruleId: "mcp-env/empty-env-block",
         line: server2.line,
         message: `Server "${server2.name}": empty "env" block can be removed`
       });
@@ -44008,7 +44021,7 @@ async function checkMcpUrls(config2, _projectRoot) {
       issues.push({
         severity: "error",
         check: "mcp-urls",
-        ruleId: "malformed-url",
+        ruleId: "mcp-urls/malformed-url",
         line: server2.line,
         message: `Server "${server2.name}": invalid URL "${server2.url}"`
       });
@@ -44018,7 +44031,7 @@ async function checkMcpUrls(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcp-urls",
-        ruleId: "localhost-in-project-config",
+        ruleId: "mcp-urls/localhost-in-project-config",
         line: server2.line,
         message: `Server "${server2.name}": localhost URL in project config won't work for teammates`
       });
@@ -44027,7 +44040,7 @@ async function checkMcpUrls(config2, _projectRoot) {
       issues.push({
         severity: "info",
         check: "mcp-urls",
-        ruleId: "missing-path",
+        ruleId: "mcp-urls/missing-path",
         line: server2.line,
         message: `Server "${server2.name}": URL has no path \u2014 most MCP servers expect /mcp`
       });
@@ -44075,7 +44088,7 @@ async function checkMcpConsistency(configs) {
           issues.push({
             severity: "warning",
             check: "mcp-consistency",
-            ruleId: "same-server-different-config",
+            ruleId: "mcp-consistency/same-server-different-config",
             line: a.line,
             message: `Server "${name}" is configured differently in ${a.config.relativePath} and ${b2.config.relativePath}`
           });
@@ -44101,7 +44114,7 @@ function checkMissingFromClient(configs) {
         issues.push({
           severity: "info",
           check: "mcp-consistency",
-          ruleId: "missing-from-client",
+          ruleId: "mcp-consistency/missing-from-client",
           line: primaryServer.line,
           message: `Server "${primaryServer.name}" is in .mcp.json but missing from ${other.relativePath}`
         });
@@ -44178,7 +44191,7 @@ function checkSingleFileIssues(configs) {
         issues.push({
           severity: "warning",
           check: "mcp-consistency",
-          ruleId: "duplicate-server-name",
+          ruleId: "mcp-consistency/duplicate-server-name",
           line: 1,
           message: `Duplicate server name "${name}" in ${config2.relativePath} \u2014 only the last definition is used`
         });
@@ -44202,7 +44215,7 @@ async function checkMcpRedundancy(configs) {
         issues.push({
           severity: "info",
           check: "mcp-redundancy",
-          ruleId: "disabled-server",
+          ruleId: "mcp-redundancy/disabled-server",
           line: server2.line,
           message: `Server "${server2.name}" is disabled \u2014 consider removing it if no longer needed`
         });
@@ -44232,7 +44245,7 @@ async function checkMcpRedundancy(configs) {
           issues.push({
             severity: "info",
             check: "mcp-redundancy",
-            ruleId: "identical-across-scopes",
+            ruleId: "mcp-redundancy/identical-across-scopes",
             line: projectServer.line,
             message: `Server "${projectServer.name}" is identically configured in both ${projectConfig.relativePath} and ${globalConfig2.relativePath}`
           });
@@ -44258,7 +44271,7 @@ async function checkMcphTokenSecurity(config2, _projectRoot, options = {}) {
     issues.push({
       severity: "error",
       check: "mcph-token-security",
-      ruleId: "mcph-config/invalid-token-format",
+      ruleId: "mcph-token-security/invalid-token-format",
       line: tokenPos.line,
       message: `"token" does not match expected format ^mcp_pat_[A-Za-z0-9_-]+$`,
       suggestion: `Check that the token was copied in full. A valid mcp.hosting PAT looks like: mcp_pat_aBcDeFg123...
@@ -44269,7 +44282,7 @@ If the token was truncated or wrapped in quotes elsewhere, re-issue it from http
     issues.push({
       severity: "error",
       check: "mcph-token-security",
-      ruleId: "mcph-config/token-in-project-scope",
+      ruleId: "mcph-token-security/token-in-project-scope",
       line: tokenPos.line,
       message: `"token" in a git-tracked project-scope .mcph.json \u2014 PAT will leak via git history`,
       suggestion: `Delete line ${tokenPos.line} (the "token" field) from ${config2.relativePath}.
@@ -44287,7 +44300,7 @@ If this token was already committed, ROTATE it now: https://mcp.hosting/settings
     issues.push({
       severity,
       check: "mcph-token-security",
-      ruleId: "mcph-config/prefer-env-token",
+      ruleId: "mcph-token-security/prefer-env-token",
       line: tokenPos.line,
       message: `prefer MCPH_TOKEN env var over a file-stored token in ${config2.relativePath}`,
       suggestion: `Delete line ${tokenPos.line} (the "token" field) and export instead:
@@ -44328,7 +44341,7 @@ async function checkMcphApibase(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcph-apibase",
-      ruleId: "mcph-config/invalid-apibase",
+      ruleId: "mcph-apibase/invalid-apibase",
       line: pos.line,
       message: `"apiBase" is not a valid URL: ${value}`,
       suggestion: `Use an absolute http(s) URL, e.g. "https://mcp.hosting".`
@@ -44339,7 +44352,7 @@ async function checkMcphApibase(config2, _projectRoot) {
     issues.push({
       severity: "warning",
       check: "mcph-apibase",
-      ruleId: "mcph-config/insecure-apibase",
+      ruleId: "mcph-apibase/insecure-apibase",
       line: pos.line,
       message: `"apiBase" uses plaintext HTTP to a public host (${parsed.hostname})`,
       suggestion: `Use https:// instead. Plaintext HTTP exposes your MCPH_TOKEN on the wire.
@@ -44375,7 +44388,7 @@ async function checkMcphSchemaConformance(config2, _projectRoot) {
     issues.push({
       severity: "warning",
       check: "mcph-schema-conformance",
-      ruleId: "mcph-config/unknown-field",
+      ruleId: "mcph-schema-conformance/unknown-field",
       line: field.position.line,
       message: `unknown field "${field.name}" \u2014 not in the mcph config schema`,
       suggestion: `Known fields: $schema, version, token, apiBase, servers, blocked. Check for typos (e.g. "tokens" vs "token", "blockList" vs "blocked").`
@@ -44387,7 +44400,7 @@ async function checkMcphSchemaConformance(config2, _projectRoot) {
     issues.push({
       severity: "info",
       check: "mcph-schema-conformance",
-      ruleId: "mcph-config/stale-version",
+      ruleId: "mcph-schema-conformance/stale-version",
       line: versionPos.line,
       message: `"version": ${version2} is older than the current schema version (${CURRENT_SCHEMA_VERSION})`,
       suggestion: `Update to "version": ${CURRENT_SCHEMA_VERSION}. Older versions continue to load but may miss newer fields.`
@@ -44415,7 +44428,7 @@ async function checkMcphLists(config2, _projectRoot) {
       issues.push({
         severity: "warning",
         check: "mcph-lists",
-        ruleId: "mcph-config/allowlist-denylist-conflict",
+        ruleId: "mcph-lists/allowlist-denylist-conflict",
         line: entry.position.line,
         message: `server "${entry.value}" is in both "servers" (allow-list) and "blocked" (deny-list)`,
         suggestion: `Remove "${entry.value}" from one of the two lists. "blocked" wins in practice (deny > allow), so the allow-list entry is dead weight.`
@@ -44431,7 +44444,7 @@ async function checkMcphLists(config2, _projectRoot) {
         issues.push({
           severity: "info",
           check: "mcph-lists",
-          ruleId: "mcph-config/duplicate-entries",
+          ruleId: "mcph-lists/duplicate-entries",
           line: entry.position.line,
           message: `"${entry.value}" appears multiple times in "${listName}" (first at line ${prevLine})`,
           suggestion: `Remove the duplicate entry at line ${entry.position.line}.`
@@ -44458,7 +44471,7 @@ async function checkMcphGitignore(config2, _projectRoot) {
     issues.push({
       severity: "error",
       check: "mcph-gitignore",
-      ruleId: "mcph-config/local-file-not-gitignored",
+      ruleId: "mcph-gitignore/local-file-not-gitignored",
       line: 1,
       message: `${basename4} is not covered by .gitignore \u2014 machine-local overrides can leak via git`,
       suggestion: `Add "${basename4}" to .gitignore in your project root.`
@@ -44801,7 +44814,7 @@ async function checkMissingSecret(ctx) {
       issues.push({
         severity: "error",
         check: "session-missing-secret",
-        ruleId: "session/missing-secret",
+        ruleId: "session-missing-secret/missing-secret",
         line: 0,
         message: `GitHub secret "${secretName}" is set on ${siblingMatches.length} sibling repos (${sibNames}) but not on this project`,
         suggestion: `Run: gh secret set ${secretName} --repo <owner>/<repo>`,
@@ -44879,7 +44892,7 @@ async function checkDivergedFile(ctx) {
       issues.push({
         severity: "warning",
         check: "session-diverged-file",
-        ruleId: "session/diverged-file",
+        ruleId: "session-diverged-file/diverged-file",
         line: 0,
         message: `${fileName} has diverged from sibling repos: ${details}`,
         suggestion: `Compare with sibling versions to identify unintentional drift`,
@@ -44951,7 +44964,7 @@ async function checkMissingWorkflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-missing-workflow",
-      ruleId: "session/missing-workflow",
+      ruleId: "session-missing-workflow/missing-workflow",
       line: 0,
       message: `GitHub Actions workflow "${workflow}" exists in ${siblings.length} sibling repos (${sibNames}) but not in this project`,
       suggestion: `Consider adding .github/workflows/${workflow} for consistency`,
@@ -44997,7 +45010,7 @@ async function checkStaleMemory(ctx) {
       issues.push({
         severity: "info",
         check: "session-stale-memory",
-        ruleId: "session/stale-memory",
+        ruleId: "session-stale-memory/stale-memory",
         line: 0,
         message: `Memory "${name}" references ${brokenPaths.length} path(s) that no longer exist: ${brokenPaths.join(", ")}`,
         suggestion: `Update or remove the memory file: ${mem.filePath}`,
@@ -45040,7 +45053,7 @@ async function checkDuplicateMemory(ctx) {
       issues.push({
         severity: "info",
         check: "session-duplicate-memory",
-        ruleId: "session/duplicate-memory",
+        ruleId: "session-duplicate-memory/duplicate-memory",
         line: 0,
         message: `Memory "${nameA}" (${projA}) and "${nameB}" (${projB}) have ${Math.round(overlap * 100)}% overlap`,
         suggestion: `Consider consolidating into a shared memory or removing the duplicate`,
@@ -45111,7 +45124,8 @@ function findCyclicPatterns(displays) {
 async function checkLoopDetection(ctx) {
   const issues = [];
   const currentNorm = normalizeProject(ctx.currentProject);
-  const entries = ctx.history.filter((e) => normalizeProject(e.project) === currentNorm).sort((a, b2) => a.timestamp - b2.timestamp);
+  const filtered = ctx.history.filter((e) => normalizeProject(e.project) === currentNorm).sort((a, b2) => a.timestamp - b2.timestamp);
+  const entries = filtered.length > MAX_HISTORY_ENTRIES ? filtered.slice(-MAX_HISTORY_ENTRIES) : filtered;
   if (entries.length < CONSECUTIVE_THRESHOLD) return issues;
   const displays = entries.map((e) => e.display);
   const repeats = findConsecutiveRepeats(displays);
@@ -45120,7 +45134,7 @@ async function checkLoopDetection(ctx) {
     issues.push({
       severity: "warning",
       check: "session-loop-detection",
-      ruleId: "session/consecutive-repeat",
+      ruleId: "session-loop-detection/consecutive-repeat",
       line: 0,
       message: `Command run ${count} times consecutively: "${truncated}"`,
       suggestion: "An agent may be looping on this command. Check history.jsonl for context on what went wrong"
@@ -45132,7 +45146,7 @@ async function checkLoopDetection(ctx) {
     issues.push({
       severity: "warning",
       check: "session-loop-detection",
-      ruleId: "session/cyclic-pattern",
+      ruleId: "session-loop-detection/cyclic-pattern",
       line: 0,
       message: `Cyclic pattern repeated ${reps} times: ${cycleStr}`,
       suggestion: "An agent may be stuck in a loop. Check if a context file is missing instructions for this workflow"
@@ -45140,13 +45154,14 @@ async function checkLoopDetection(ctx) {
   }
   return issues;
 }
-var CONSECUTIVE_THRESHOLD, CYCLE_REPEAT_THRESHOLD, MAX_CYCLE_LENGTH;
+var CONSECUTIVE_THRESHOLD, CYCLE_REPEAT_THRESHOLD, MAX_CYCLE_LENGTH, MAX_HISTORY_ENTRIES;
 var init_loop_detection = __esm({
   "src/core/checks/session/loop-detection.ts"() {
     "use strict";
     CONSECUTIVE_THRESHOLD = 3;
     CYCLE_REPEAT_THRESHOLD = 2;
     MAX_CYCLE_LENGTH = 3;
+    MAX_HISTORY_ENTRIES = 5e3;
   }
 });
 
@@ -45174,7 +45189,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/memory-index-overflow",
       line: MAX_LINES + 1,
       message: `MEMORY.md has ${lineCount.toLocaleString()} lines \u2014 only the first ${MAX_LINES} are loaded. ${excess.toLocaleString()} line(s) are effectively invisible to the agent.`,
       detail: `File: ${memoryFile}`,
@@ -45186,7 +45201,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/memory-index-overflow",
       line: 0,
       message: `MEMORY.md is ${byteSize.toLocaleString()} bytes \u2014 only the first ${MAX_BYTES.toLocaleString()} bytes are loaded. ~${excess.toLocaleString()} bytes are effectively invisible.`,
       detail: `File: ${memoryFile}`,
@@ -45253,7 +45268,7 @@ async function checkCiCoverage(files, projectRoot) {
     {
       severity: "info",
       check: "ci-coverage",
-      ruleId: "ci/no-release-docs",
+      ruleId: "ci-coverage/no-release-docs",
       line: 0,
       message: `Release workflow${releaseWorkflows.length > 1 ? "s" : ""} found (${releaseWorkflows.join(", ")}) but no context file documents the release process`,
       suggestion: `Document how releases work (e.g. "push a v* tag to trigger CI") in a context file so agents don't guess`
@@ -45328,7 +45343,7 @@ async function checkCiSecrets(files, projectRoot) {
     issues.push({
       severity: "info",
       check: "ci-secrets",
-      ruleId: "ci/undocumented-secret",
+      ruleId: "ci-secrets/undocumented-secret",
       line: 0,
       message: `CI secret "${name}" is used in ${workflows.join(", ")} but not mentioned in any context file`,
       suggestion: `Document what ${name} is and how to set it (e.g. "gh secret set ${name}") so agents don't create new tokens or guess`
@@ -45356,15 +45371,239 @@ var init_ci_secrets = __esm({
   }
 });
 
+// src/core/checks/content-secrets.ts
+function lineLooksLikePlaceholder(line) {
+  const lower = line.toLowerCase();
+  for (const tok of PLACEHOLDER_TOKENS) {
+    if (lower.includes(tok)) return true;
+  }
+  return false;
+}
+function isCommentedExample(line) {
+  if (!COMMENT_PREFIX.test(line)) return false;
+  const lower = line.toLowerCase();
+  return lower.includes("fake") || lower.includes("example");
+}
+function isPlaceholderWrapped(line, start, end) {
+  const before2 = line.slice(Math.max(0, start - 2), start);
+  const after2 = line.slice(end, end + 2);
+  if (before2.endsWith("<") && after2.startsWith(">")) return true;
+  if (before2.endsWith("${") && after2.startsWith("}")) return true;
+  if (before2.endsWith("{") && after2.startsWith("}")) return true;
+  const dollarOpen = line.lastIndexOf("${", start);
+  if (dollarOpen !== -1) {
+    const close = line.indexOf("}", dollarOpen);
+    if (close !== -1 && close >= end) return true;
+  }
+  const angleOpen = line.lastIndexOf("<", start);
+  if (angleOpen !== -1) {
+    const close = line.indexOf(">", angleOpen);
+    if (close !== -1 && close >= end) return true;
+  }
+  return false;
+}
+function computeFenceLanguages(lines) {
+  const out = new Array(lines.length).fill(null);
+  let activeMarker = null;
+  let activeLang = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed2 = line.trim();
+    if (activeMarker === null) {
+      const open = trimmed2.match(/^(```+|~~~+)(.*)$/);
+      if (open) {
+        activeMarker = open[1][0];
+        activeLang = open[2].trim().toLowerCase();
+        continue;
+      }
+    } else {
+      out[i2] = activeLang;
+      if (trimmed2.startsWith(activeMarker.repeat(3)) && trimmed2.replace(new RegExp(`^${activeMarker === "`" ? "`" : "~"}+`), "").trim() === "") {
+        activeMarker = null;
+        activeLang = null;
+      }
+    }
+  }
+  return out;
+}
+function redactedPrefix(value) {
+  const head = value.slice(0, 6);
+  return `${head}...`;
+}
+async function checkContentSecrets(file2, _projectRoot) {
+  const issues = [];
+  const lines = file2.content.split(/\r?\n/);
+  const fenceLangs = computeFenceLanguages(lines);
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const lineNo = i2 + 1;
+    if (isCommentedExample(line)) continue;
+    const fenceLang = fenceLangs[i2];
+    if (fenceLang !== null && ILLUSTRATIVE_FENCES.has(fenceLang)) continue;
+    if (lineLooksLikePlaceholder(line)) continue;
+    if (PRIVATE_KEY_HEADER.test(line)) {
+      issues.push({
+        severity: "error",
+        check: "content-secrets",
+        ruleId: "content-secrets/private-key-header",
+        line: lineNo,
+        message: `Private key header detected in ${file2.relativePath}`,
+        suggestion: "Move the secret to a `.env` or secret manager and reference it by name. If this token is real, rotate it immediately."
+      });
+      continue;
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const pattern of PATTERNS) {
+      const re2 = new RegExp(pattern.regex.source, pattern.regex.flags);
+      let m;
+      while ((m = re2.exec(line)) !== null) {
+        const matched = m[0];
+        const start = m.index;
+        const end = start + matched.length;
+        const key = `${start}:${pattern.ruleSlug}`;
+        if (seen.has(key)) continue;
+        let overlap = false;
+        for (const k3 of seen) {
+          const [s] = k3.split(":");
+          if (parseInt(s, 10) === start) {
+            overlap = true;
+            break;
+          }
+        }
+        if (overlap) continue;
+        if (isPlaceholderWrapped(line, start, end)) continue;
+        seen.add(key);
+        issues.push({
+          severity: "error",
+          check: "content-secrets",
+          ruleId: `content-secrets/${pattern.ruleSlug}`,
+          line: lineNo,
+          message: `${pattern.label} detected in ${file2.relativePath} (${redactedPrefix(matched)})`,
+          suggestion: "Move the secret to a `.env` or secret manager and reference it by name. If this token is real, rotate it immediately."
+        });
+      }
+    }
+  }
+  return issues;
+}
+var PATTERNS, PRIVATE_KEY_HEADER, PLACEHOLDER_TOKENS, COMMENT_PREFIX, ILLUSTRATIVE_FENCES;
+var init_content_secrets = __esm({
+  "src/core/checks/content-secrets.ts"() {
+    "use strict";
+    PATTERNS = [
+      // AWS access key (long-lived) -- AKIA prefix + 16 uppercase alphanum chars.
+      {
+        ruleSlug: "aws-access-key",
+        label: "AWS access key",
+        regex: /\bAKIA[0-9A-Z]{16}\b/g
+      },
+      // AWS STS temporary access key -- ASIA prefix.
+      {
+        ruleSlug: "aws-access-key",
+        label: "AWS access key",
+        regex: /\bASIA[0-9A-Z]{16}\b/g
+      },
+      // GitHub classic PAT.
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub personal access token",
+        regex: /\bghp_[A-Za-z0-9]{36,}\b/g
+      },
+      // GitHub fine-grained PAT.
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub personal access token",
+        regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g
+      },
+      // GitHub server-to-server / OAuth / user / refresh tokens.
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bghs_[A-Za-z0-9]{36,}\b/g
+      },
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bgho_[A-Za-z0-9]{36,}\b/g
+      },
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bghu_[A-Za-z0-9]{36,}\b/g
+      },
+      {
+        ruleSlug: "github-pat",
+        label: "GitHub token",
+        regex: /\bghr_[A-Za-z0-9]{36,}\b/g
+      },
+      // Anthropic API keys.
+      {
+        ruleSlug: "anthropic-key",
+        label: "Anthropic API key",
+        regex: /\bsk-ant-[A-Za-z0-9\-_]{20,}\b/g
+      },
+      // OpenAI API keys (project-scoped or classic). Match sk- or sk-proj- with at
+      // least 20 random chars to avoid catching `sk-...` ellipses in docs.
+      {
+        ruleSlug: "openai-key",
+        label: "OpenAI API key",
+        regex: /\bsk-(?:proj-)?[A-Za-z0-9_\-]{20,}\b/g
+      },
+      // npm automation tokens.
+      {
+        ruleSlug: "npm-token",
+        label: "npm token",
+        regex: /\bnpm_[A-Za-z0-9]{36,}\b/g
+      },
+      // Slack tokens (bot, user, app, admin, refresh).
+      {
+        ruleSlug: "slack-token",
+        label: "Slack token",
+        regex: /\bxox[bpoasr]-[A-Za-z0-9\-]{10,}\b/g
+      },
+      // mcp.hosting PAT -- consistent with mcph/token-security.ts.
+      {
+        ruleSlug: "mcph-pat",
+        label: "mcp.hosting PAT",
+        regex: /\bmcp_pat_[A-Za-z0-9]{32,}\b/g
+      },
+      // Google API keys.
+      {
+        ruleSlug: "google-api-key",
+        label: "Google API key",
+        regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g
+      },
+      // Stripe live secret keys.
+      {
+        ruleSlug: "stripe-secret",
+        label: "Stripe live secret key",
+        regex: /\bsk_live_[0-9a-zA-Z]{24,}\b/g
+      }
+    ];
+    PRIVATE_KEY_HEADER = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/;
+    PLACEHOLDER_TOKENS = [
+      "example",
+      "placeholder",
+      "your-key",
+      "<replace",
+      "redacted",
+      "xxxx",
+      "****"
+    ];
+    COMMENT_PREFIX = /^\s*(?:#|\/\/|--|<!--)/;
+    ILLUSTRATIVE_FENCES = /* @__PURE__ */ new Set(["text", "txt", "example", "pseudocode", "none", ""]);
+  }
+});
+
 // src/version.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.20";
+  if (true) return "0.10.0";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
   return pkg.version;
 }
 var VERSION;
@@ -45392,6 +45631,7 @@ function deriveChecksToRun(activeChecks, prefix, enabled, allChecks) {
 }
 async function runAudit(projectRoot, activeChecks, options = {}) {
   const fileResults = [];
+  const thresholds = resolveTokenThresholds(options.tokenThresholds);
   const shouldRunContextChecks = !options.mcpOnly && !options.mcphOnly && !options.sessionOnly;
   const shouldRunMcpChecks = options.mcp || options.mcpGlobal || options.mcpOnly || hasMcpChecks(activeChecks);
   const shouldRunMcphChecks = options.mcph || options.mcphGlobal || options.mcphOnly || hasMcphChecks(activeChecks);
@@ -45407,13 +45647,16 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       if (activeChecks.includes("paths")) checkPromises.push(checkPaths(file2, projectRoot));
       if (activeChecks.includes("commands")) checkPromises.push(checkCommands(file2, projectRoot));
       if (activeChecks.includes("staleness")) checkPromises.push(checkStaleness(file2, projectRoot));
-      if (activeChecks.includes("tokens")) checkPromises.push(checkTokens(file2, projectRoot));
+      if (activeChecks.includes("tokens"))
+        checkPromises.push(checkTokens(file2, projectRoot, thresholds));
       if (activeChecks.includes("tier-tokens"))
-        checkPromises.push(checkTierTokens(file2, projectRoot));
+        checkPromises.push(checkTierTokens(file2, projectRoot, thresholds));
       if (activeChecks.includes("redundancy"))
         checkPromises.push(checkRedundancy(file2, projectRoot));
       if (activeChecks.includes("frontmatter"))
         checkPromises.push(checkFrontmatter(file2, projectRoot));
+      if (activeChecks.includes("content-secrets"))
+        checkPromises.push(checkContentSecrets(file2, projectRoot));
       const results = await Promise.all(checkPromises);
       const issues = results.flat();
       fileResults.push({
@@ -45428,12 +45671,13 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
     const crossFileIssues = [];
     if (activeChecks.includes("tokens")) {
       const aggIssue = checkAggregateTokens(
-        fileResults.map((f) => ({ path: f.path, tokens: f.tokens }))
+        fileResults.map((f) => ({ path: f.path, tokens: f.tokens })),
+        thresholds
       );
       if (aggIssue) crossFileIssues.push(aggIssue);
     }
     if (activeChecks.includes("tier-tokens")) {
-      const tierAgg = checkAggregateTierTokens(parsed);
+      const tierAgg = checkAggregateTierTokens(parsed, thresholds);
       if (tierAgg) crossFileIssues.push(tierAgg);
     }
     if (activeChecks.includes("redundancy")) {
@@ -45569,7 +45813,7 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
           issues.push({
             severity: "error",
             check: "mcph-schema-conformance",
-            ruleId: "mcph-config/parse-error",
+            ruleId: "mcph-schema-conformance/parse-error",
             line: 1,
             message: err
           });
@@ -45690,6 +45934,7 @@ var init_audit = __esm({
     init_memory_index_overflow();
     init_ci_coverage();
     init_ci_secrets();
+    init_content_secrets();
     init_version2();
     ALL_CHECKS = [
       "paths",
@@ -45701,7 +45946,8 @@ var init_audit = __esm({
       "contradictions",
       "frontmatter",
       "ci-coverage",
-      "ci-secrets"
+      "ci-secrets",
+      "content-secrets"
     ];
     ALL_MCP_CHECKS = [
       "mcp-schema",
@@ -53214,7 +53460,6 @@ var init_ora = __esm({
 function classifyFile(f) {
   if (f.path === "(project)") return "context";
   if (f.path === "(mcp)") return "mcp";
-  if (f.path === "(mcph)") return "mcph";
   if (f.path.includes("session audit")) return "session";
   for (const issue2 of f.issues) {
     if (issue2.check.startsWith("session-")) return "session";
@@ -53477,6 +53722,11 @@ function buildRuleDescriptors() {
       shortDescription: { text: "CI secret not documented in context files" },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     },
+    {
+      id: "ctxlint/content-secrets",
+      shortDescription: { text: "Inline-pasted secret detected in a context file" },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
     {
       id: "ctxlint/mcp-schema",
       shortDescription: { text: "MCP config structural validation error" },
@@ -53673,7 +53923,8 @@ function suggestKey(unknown2) {
       best = known;
     }
   }
-  if (best && bestDist <= Math.max(2, Math.floor(unknown2.length / 3))) {
+  const threshold = Math.min(4, Math.max(2, Math.floor(unknown2.length / 3)));
+  if (best && bestDist <= threshold) {
     return best;
   }
   return null;
@@ -53801,7 +54052,8 @@ async function runCli() {
         mcphOnly: options.mcphOnly,
         mcphStrictEnvToken: options.mcphStrictEnvToken,
         session: options.session,
-        sessionOnly: options.sessionOnly
+        sessionOnly: options.sessionOnly,
+        tokenThresholds: config2?.tokenThresholds
       });
       spinner?.stop();
       if (result.files.length === 0) {
@@ -53894,7 +54146,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       resetGit();
       resetPathsCache();
       resetPackageJsonCache();
-      resetTokenThresholds();
     }
     if (opts.watch) {
       const chalk2 = (await Promise.resolve().then(() => (init_source(), source_exports))).default;
@@ -53956,11 +54207,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             console.error("Error reloading config:", err instanceof Error ? err.message : err);
           }
           try {
-            if (liveConfig?.tokenThresholds) {
-              setTokenThresholds(liveConfig.tokenThresholds);
-            } else {
-              resetTokenThresholds();
-            }
             const result = await runAudit(resolvedPath, liveActiveChecks, {
               depth: liveOptions.depth,
               extraPatterns: liveConfig?.contextFiles,
@@ -53972,7 +54218,8 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
               mcphOnly: liveOptions.mcphOnly,
               mcphStrictEnvToken: liveOptions.mcphStrictEnvToken,
               session: liveOptions.session,
-              sessionOnly: liveOptions.sessionOnly
+              sessionOnly: liveOptions.sessionOnly,
+              tokenThresholds: liveConfig?.tokenThresholds
             });
             if (result.files.length === 0) {
               console.log("\nNo context files found.\n");
@@ -53992,7 +54239,6 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
             resetGit();
             resetPathsCache();
             resetPackageJsonCache();
-            resetTokenThresholds();
           }
           console.log(chalk2.dim("\nWatching for changes... (Ctrl+C to stop)\n"));
         }, 300);
@@ -54136,9 +54382,6 @@ function resolveSession(resolvedPath, opts) {
     session: effectiveSession,
     sessionOnly
   };
-  if (config2?.tokenThresholds) {
-    setTokenThresholds(config2.tokenThresholds);
-  }
   const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
   return { config: config2, options, activeChecks };
 }
@@ -54158,7 +54401,6 @@ var init_cli = __esm({
     init_esm3();
     init_ora();
     init_paths();
-    init_tokens2();
     init_reporter();
     init_fixer();
     init_tokens();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.20",
+  "version": "0.10.0",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"