@yawlabs/ctxlint 0.9.4 → 0.9.5

package/context-lint-rules.json

@@ -148,17 +148,6 @@
       "fixable": false,
       "stability": "stable"
     },
-    {
-      "id": "commands/npm-auth-trap",
-      "category": "commands",
-      "severity": "info",
-      "description": "Context file documents an npm write operation (deprecate, unpublish, dist-tag, access, owner) as a local CLI command. Under WebAuthn-only 2FA (no TOTP authenticator), these commands return 422 because npm treats CLI web-auth tokens as not-2FA-authenticated for writes. The npm website settings UI is the only path that works; CI-driven workflows are the scalable alternative.",
-      "trigger": "Context file references `npm deprecate`, `npm unpublish`, `npm dist-tag add/rm/set`, `npm access grant/revoke/2fa`, or `npm owner add/rm` as a command.",
-      "message": "\"{cmd}\" — npm {op} requires a 2FA-authenticated session; CLI returns 422 under WebAuthn-only auth",
-      "fixable": false,
-      "stability": "experimental",
-      "source": "https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification"
-    },
     {
       "id": "staleness/stale",
       "category": "staleness",

package/dist/index.js

@@ -35175,7 +35175,7 @@ var init_parser = __esm({
     "use strict";
     init_fs();
     await init_tokens();
-    PATH_PATTERN = /(?:^|[\s`"'(])((\.{0,2}\/)?(?:[\w@.-]+\/)+[\w.*-]+(?:\.\w+)?)(?=[\s`"'),;:]|$)/gm;
+    PATH_PATTERN = /(?:^|[\s`"'(])((\.{0,2}\/)?(?:[\w@.-]+\/)+[\w.*-]*(?:\.\w+)?)(?=[\s`"'),;:]|$)/gm;
     PATH_EXCLUDE = /^(https?:\/\/|ftp:\/\/|mailto:|n\/a|w\/o|I\/O|i\/o|e\.g\.|N\/A|\.deb\/|\.rpm[.\/]|\.tar[.\/]|\.zip[.\/])/i;
     COMMAND_PREFIXES = /^\s*[\$>]\s+(.+)$/;
     COMMON_COMMANDS = /^(npm|npx|pnpm|yarn|make|cargo|go\s+(run|build|test)|python|pytest|vitest|jest|bun|deno)\b/;
@@ -41488,21 +41488,6 @@ async function checkCommands(file2, projectRoot) {
   const makefile = loadMakefile(projectRoot);
   for (const ref of file2.references.commands) {
     const cmd = ref.value;
-    const writeMatch = cmd.match(NPM_WRITE_OP_PATTERN);
-    if (writeMatch) {
-      const op = writeMatch[1].split(/\s+/)[0];
-      if (op !== "publish") {
-        issues.push({
-          severity: "info",
-          check: "commands",
-          ruleId: "commands/npm-auth-trap",
-          line: ref.line,
-          message: `"${cmd}" \u2014 npm ${op} requires a 2FA-authenticated session; CLI returns 422 under WebAuthn-only auth`,
-          suggestion: "Under WebAuthn 2FA without a TOTP fallback, the npm website UI (npmjs.com/package/<pkg>/settings) is the only path that works. For recurring writes, prefer a CI-driven workflow using a granular NPM_TOKEN secret.",
-          detail: "npm treats CLI web-auth tokens as not-2FA-authenticated for writes; WebAuthn yields no TOTP code to satisfy the check."
-        });
-      }
-    }
     const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
     if (scriptMatch && pkgJson) {
       const scriptName = scriptMatch[1];
@@ -41622,7 +41607,7 @@ function hasMakeTarget(makefile, target) {
   const pattern = new RegExp(`^${target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`, "m");
   return pattern.test(makefile);
 }
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN, NPM_WRITE_OP_PATTERN;
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN;
 var init_commands = __esm({
   "src/core/checks/commands.ts"() {
     "use strict";
@@ -41630,7 +41615,6 @@ var init_commands = __esm({
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|pnpm(?:\s+run)?|yarn(?:\s+run)?|bun(?:\s+run)?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+(\S+)/;
     NPX_PATTERN = /^npx\s+(\S+)/;
-    NPM_WRITE_OP_PATTERN = /^npm\s+(publish|deprecate|unpublish|access\s+(grant|revoke|2fa)|dist-tag\s+(add|rm|set)|owner\s+(add|rm))\b/;
   }
 });
 
@@ -44153,7 +44137,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.4";
+  if (true) return "0.9.5";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"