@yawlabs/ctxlint 0.9.9 → 0.9.11

package/.pre-commit-hooks.yaml

@@ -1,7 +1,10 @@
 - id: ctxlint
   name: ctxlint
   description: Lint AI agent context files against your actual codebase
-  entry: npx @yawlabs/ctxlint --strict
+  # Version-pinned so a checkout at `rev: vX.Y.Z` runs exactly that release
+  # of ctxlint — matches the pinning done by `ctxlint init`. release.sh keeps
+  # this in sync with package.json on each bump.
+  entry: npx @yawlabs/ctxlint@0.9.11 --strict
   language: node
   always_run: true
   pass_filenames: false

package/AGENT_SESSION_LINT_SPEC.md

@@ -15,7 +15,7 @@ This specification defines a standard set of lint rules for validating agent ses
 
 The specification includes:
 - A reference of session data locations across 8 AI coding agents
-- 5 lint rules in the `session` category with defined severities
+- 7 lint rules in the `session` category with defined severities
 - A machine-readable rule catalog ([`agent-session-lint-rules.json`](./agent-session-lint-rules.json))
 - Sibling-repo detection for cross-project checks
 

package/MCP_CONFIG_LINT_SPEC.md

@@ -31,7 +31,7 @@ This spec is part of a family of open specifications maintained by Yaw Labs for
 | Spec | Scope | Input |
 |---|---|---|
 | **mcp-config-lint** (this spec) | Static analysis of MCP client config files | `.cursor/mcp.json`, `.vscode/mcp.json`, `.mcp.json`, etc. |
-| [**mcp-compliance**](https://github.com/YawLabs/mcp-compliance/blob/main/MCP_COMPLIANCE_SPEC.md) | Runtime testing of live MCP servers | A live server URL + transport |
+| [**mcp-compliance**](https://github.com/YawLabs/mcp-compliance/blob/master/MCP_COMPLIANCE_SPEC.md) | Runtime testing of live MCP servers | A live server URL + transport |
 
 The two are **complementary, not overlapping**. `mcp-config-lint` catches problems before deploy by reading JSON on disk; `mcp-compliance` catches problems after deploy by speaking the protocol to a running server. A production setup typically runs both.
 
@@ -199,7 +199,7 @@ Without this wrapper, the subprocess fails to spawn. This is the most common Win
 
 ## 2. Lint Rules
 
-43 rules organized into 8 categories. Each rule has a unique ID, severity level, trigger condition, and message template.
+27 rules organized into 8 categories. Each rule has a unique ID, severity level, trigger condition, and message template.
 
 Severity levels:
 - **error** — the config is broken or has a security issue. Should fail CI.

package/README.md

@@ -20,7 +20,7 @@ Multiply that across a team with 5 context files, 3 MCP configs, and 2 people wh
 
 ctxlint is a linter purpose-built for this. It reads your context files, cross-references them against your actual codebase, and catches the drift before your agent does.
 
-- **Instant startup** — ships as a single self-contained bundle with zero runtime dependencies. `npx` downloads ~200 KB and starts immediately
+- **Instant startup** — ships as a single self-contained bundle with zero runtime dependencies. `npx` downloads a ~400 KB tarball and starts immediately
 - **Catches real problems** — broken paths, wrong commands, stale references, contradictions across files
 - **Smart suggestions** — detects git renames and fuzzy-matches to suggest the right path
 - **Auto-fix** — `--fix` rewrites broken paths automatically using git history
@@ -215,7 +215,7 @@ Session checks are **opt-in** because they access files outside the project dire
 ## Example Output
 
 ```
-ctxlint v0.9.0
+ctxlint v0.9.10
 
 Scanning /Users/you/my-app...
 
@@ -351,7 +351,7 @@ Add to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/yawlabs/ctxlint
-    rev: v0.9.0
+    rev: v0.9.10
     hooks:
       - id: ctxlint
 ```

package/dist/index.js

@@ -34559,7 +34559,7 @@ function parseSections(lines) {
       if (sections.length > 0) {
         const prev = sections[sections.length - 1];
         if (prev.endLine === -1) {
-          prev.endLine = i2 - 1;
+          prev.endLine = i2;
         }
       }
       sections.push({
@@ -40512,7 +40512,10 @@ async function getCommitsSinceBatch(projectRoot, paths, since) {
       "log",
       `--since=${since.toISOString()}`,
       "--name-only",
-      `--format=${SENTINEL}`
+      // %n emits a newline; prefixing with a valid format placeholder is
+      // what keeps git from rejecting the sentinel as an invalid --pretty
+      // format ("fatal: invalid --pretty format: ___CTXLINT_COMMIT___").
+      `--format=%n${SENTINEL}`
     ]);
     const normalize3 = (p2) => p2.replace(/\\/g, "/");
     const requested = new Set(paths.map(normalize3));
@@ -41401,10 +41404,16 @@ function loadSettingsSources(projectRoot) {
     path6.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
   ];
   for (const p2 of candidates) {
+    let content;
     try {
-      const content = fs5.readFileSync(p2, "utf-8");
-      sources.push(JSON.parse(content));
+      content = fs5.readFileSync(p2, "utf-8");
     } catch {
+      continue;
+    }
+    try {
+      sources.push(JSON.parse(content));
+    } catch (err) {
+      console.warn(`ctxlint: could not parse ${p2}: ${err.message}`);
     }
   }
   return sources;
@@ -43842,7 +43851,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.9";
+  if (true) return "0.9.11";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -44718,7 +44727,7 @@ function applyFixes(result, options = {}) {
       let line = lines[lineIdx];
       for (const fix of lineFixes) {
         if (line.includes(fix.oldText)) {
-          line = line.replace(fix.oldText, fix.newText);
+          line = line.replaceAll(fix.oldText, fix.newText);
           totalFixes++;
           const prefix = dryRun ? source_default.cyan("  Would fix") : source_default.green("  Fixed");
           log(
@@ -44914,8 +44923,11 @@ var init_server3 = __esm({
         checks: external_exports3.array(checkEnum).optional().describe("Which checks to run before fixing. Defaults to all.")
       },
       {
+        // ctxlint_fix writes to disk via applyFixes() → fs.writeFileSync, so it
+        // must advertise destructiveHint: true. Hosts (Claude Code, Cursor, etc.)
+        // use this to decide whether to require user confirmation before the call.
         readOnlyHint: false,
-        destructiveHint: false,
+        destructiveHint: true,
         idempotentHint: true,
         openWorldHint: false
       },
@@ -51624,6 +51636,9 @@ function formatTokenReport(result) {
   lines.push("");
   return lines.join("\n");
 }
+function isSyntheticPath(p2) {
+  return p2.startsWith("(") || p2.startsWith("~");
+}
 function formatSarif(result) {
   const severityToLevel = {
     error: "error",
@@ -51633,25 +51648,31 @@ function formatSarif(result) {
   const results = [];
   for (const file2 of result.files) {
     for (const issue2 of file2.issues) {
+      const location = isSyntheticPath(file2.path) ? {
+        logicalLocations: [
+          {
+            name: file2.path,
+            kind: "resource"
+          }
+        ]
+      } : {
+        physicalLocation: {
+          artifactLocation: {
+            uri: file2.path,
+            uriBaseId: "%SRCROOT%"
+          },
+          region: {
+            startLine: Math.max(issue2.line, 1)
+          }
+        }
+      };
       const sarifResult = {
         ruleId: `ctxlint/${issue2.check}`,
         level: severityToLevel[issue2.severity] || "note",
         message: {
           text: issue2.message + (issue2.suggestion ? ` (${issue2.suggestion})` : "")
         },
-        locations: [
-          {
-            physicalLocation: {
-              artifactLocation: {
-                uri: file2.path,
-                uriBaseId: "%SRCROOT%"
-              },
-              region: {
-                startLine: Math.max(issue2.line, 1)
-              }
-            }
-          }
-        ]
+        locations: [location]
       };
       if (issue2.detail) {
         sarifResult.message.text += `
@@ -52171,6 +52192,7 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
         path11.join(resolvedPath, ".continue"),
         path11.join(resolvedPath, ".vscode")
       ];
+      const watchers = [];
       let debounceTimer = null;
       const rerun = () => {
         if (debounceTimer) clearTimeout(debounceTimer);
@@ -52212,16 +52234,28 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
       };
       for (const filePath of watchPaths) {
         try {
-          fs9.watch(filePath, rerun);
+          watchers.push(fs9.watch(filePath, rerun));
         } catch {
         }
       }
       for (const dir of watchDirs) {
         try {
-          fs9.watch(dir, { recursive: true }, rerun);
+          watchers.push(fs9.watch(dir, { recursive: true }, rerun));
         } catch {
         }
       }
+      const shutdown = () => {
+        if (debounceTimer) clearTimeout(debounceTimer);
+        for (const w of watchers) {
+          try {
+            w.close();
+          } catch {
+          }
+        }
+        process.exit(0);
+      };
+      process.once("SIGINT", shutdown);
+      process.once("SIGTERM", shutdown);
       await new Promise(() => {
       });
     }
@@ -52240,11 +52274,11 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
     const hookPath = path11.join(hooksDir, "pre-commit");
     const fullHookContent = `#!/bin/sh
 # ctxlint pre-commit hook
-npx @yawlabs/ctxlint --strict
+npx @yawlabs/ctxlint@${VERSION} --strict
 `;
     const appendHookContent = `
 # ctxlint pre-commit hook
-npx @yawlabs/ctxlint --strict
+npx @yawlabs/ctxlint@${VERSION} --strict
 `;
     if (fs9.existsSync(hookPath)) {
       const existing = fs9.readFileSync(hookPath, "utf-8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"
@@ -103,7 +103,7 @@
       "esbuild"
     ],
     "overrides": {
-      "hono": "^4.12.12",
+      "hono": "^4.12.14",
       "@hono/node-server": "^1.19.13",
       "vite": "^8.0.8"
     }