contextpruner 0.1.0 → 0.3.0

package/README.md

@@ -1,13 +1,17 @@
 # contextpruner
 
 Lint your AI-context config files against your repo. `contextpruner lint` checks
-your `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / Copilot / Cursor rules against the
-files actually in your tree and reports:
+your `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / Copilot / Cursor rules — plus the
+enforced ignore artifacts (`.cursorignore` / `.geminiignore` / `.codeiumignore`
+and the Claude Code deny rules in `.claude/settings.json`) — against the files
+actually in your tree and reports:
 
 - **Missing** — junk the config doesn't ignore yet (with what it's costing you),
 - **Dead** — rules that match nothing,
 - **Drift** — rules in one config but not another,
-- **Conflict** — rules that contradict each other.
+- **Conflict** — rules that contradict each other, including an enforced rule
+  that hard-blocks a file you pinned Keep or Skim, or a path you declared
+  `keep:` in `.contextpruner`.
 
 It exits non-zero when it finds issues, so it drops straight into CI or a
 pre-commit hook.
@@ -19,16 +23,34 @@ export CONTEXTPRUNER_API_KEY=cp_live_...   # from https://contextpruner.app/acco
 npx contextpruner lint
 ```
 
+One subscription, one key: the same `cp_live_` key authorizes both this CLI and
+the ContextPruner config automation (the GitHub Action / pre-commit hook), so
+reuse the one you already have.
+
 ```
 contextpruner lint [--config <path>]... [--fix] [--json]
 ```
 
 - `--config <path>` — a config to lint (repeatable). Defaults to auto-detecting
-  the standard files at the repo root.
+  the standard files at the repo root: the advisory markdown configs plus the
+  four enforced artifacts. An explicit path's format is inferred from its
+  basename (`settings.json` → Claude settings, the `*ignore` files → gitignore
+  syntax, anything else → markdown).
 - `--fix` — rewrite each config's managed block in place to fix the issues. Your
   own content outside the block (and the "Exceptions" section) is left alone.
+  Enforced ignore files regenerate only the `# contextpruner:begin/end` block;
+  `.claude/settings.json` is merged via its sentinel-delimited deny span and is
+  skipped — never clobbered — when it has no recognized span or can't be merged
+  safely.
 - `--json` — emit the full report as JSON.
 
+If the repo root has a committed `.contextpruner` file, its
+`keep: <path-or-glob>` lines (enforcement exceptions — paths that must stay
+readable by agents, even untracked ones like docs inside `node_modules/`)
+drop any enforced rule covering them from the expected rule set, exactly as
+the generate automation does — so lint, `--fix`, and generation always agree.
+Unrecognized lines are reported as a warning and ignored.
+
 **Exit codes:** `0` clean · `1` issues found · `2` usage/auth error.
 
 ## In CI

package/dist/index.js

@@ -53,89 +53,6 @@ function parseArgs(argv) {
   return { command: "lint", configs, json, fix };
 }
 
-// ../../lib/shared/format.ts
-function formatPctReduction(ratio) {
-  return ratio >= 1 ? 100 : Math.min(99, Math.floor(Number((ratio * 100).toPrecision(12))));
-}
-
-// ../../lib/engine/generators/shared.ts
-function formatStatsLine(stats) {
-  const pct = stats.bytesTotal === 0 ? 0 : formatPctReduction(stats.bytesPruned / stats.bytesTotal);
-  return `${stats.filesPruned} of ${stats.filesTotal} files pruned (${pct}% smaller context)`;
-}
-var MANAGED_BLOCK_BEGIN = "<!-- contextpruner:begin -->";
-var MANAGED_BLOCK_END = "<!-- contextpruner:end -->";
-var MANAGED_BLOCK_NOTE = "<!-- generated block \u2014 edits inside are overwritten on regeneration -->";
-function generateMarkdownRules(filename, input) {
-  const lines = [
-    MANAGED_BLOCK_BEGIN,
-    MANAGED_BLOCK_NOTE,
-    "",
-    `# ${filename} \u2014 AI context rules (generated by ContextPruner)`,
-    "",
-    `Generated ${input.generatedAt}. ${formatStatsLine(input.stats)}.`,
-    "",
-    "## Ignore",
-    "",
-    "Do not read, index, or load these paths into context:",
-    ""
-  ];
-  for (const glob of input.excludeGlobs) {
-    lines.push(`- \`${glob}\``);
-  }
-  if (input.summarizeGlobs.length > 0) {
-    lines.push(
-      "",
-      "## Skim",
-      "",
-      "Summarize these instead of reading them in full:",
-      ""
-    );
-    for (const glob of input.summarizeGlobs) {
-      lines.push(`- \`${glob}\``);
-    }
-  }
-  if (input.priorityGlobs.length > 0) {
-    lines.push("", "## Focus", "", "Prioritize these paths when exploring:", "");
-    for (const glob of input.priorityGlobs) {
-      lines.push(`- \`${glob}\``);
-    }
-  }
-  if (input.keepOverridePaths.length > 0 || input.skimOverridePaths.length > 0 || input.pruneOverridePaths.length > 0) {
-    lines.push(
-      "",
-      "## Overrides",
-      "",
-      "The repo owner pinned these verdicts \u2014 they take precedence over every rule above:",
-      ""
-    );
-    for (const path of input.keepOverridePaths) {
-      lines.push(`- Keep (read normally): \`${path}\``);
-    }
-    for (const path of input.skimOverridePaths) {
-      lines.push(`- Skim (summarize only): \`${path}\``);
-    }
-    for (const path of input.pruneOverridePaths) {
-      lines.push(`- Prune (do not read): \`${path}\``);
-    }
-  }
-  lines.push(
-    "",
-    MANAGED_BLOCK_END,
-    "",
-    "## Exceptions (yours \u2014 edit freely)",
-    "",
-    "ContextPruner only sees paths and byte sizes \u2014 you know which",
-    "junk-shaped files actually matter in this repo. Rules you add here",
-    "are yours: when regenerating, replace only the marked block above",
-    "and keep this section.",
-    "",
-    "- _none yet \u2014 add repo-specific overrides here_",
-    ""
-  );
-  return lines.join("\n");
-}
-
 // ../../lib/shared/constants.ts
 var BYTES_PER_TOKEN_RATIO = 0.25;
 var USD_PER_1M_INPUT_TOKENS = 3;
@@ -146,6 +63,8 @@ var CONTEXT_SLICE_FACTOR = 0.05;
 var DEFAULT_CONTEXT_WINDOW_TOKENS = 1e6;
 var MONTHLY_SAVINGS_CAP_USD = 200;
 var MAX_MANIFEST_FILES = 2e4;
+var MAX_OVERRIDE_DECLARATIONS = 200;
+var MAX_PATH_LENGTH = 1024;
 var OVERSIZED_FILE_BYTES = 1048576;
 
 // ../../lib/engine/rules.ts
@@ -277,9 +196,18 @@ var SUMMARIZE_EXTENSIONS = /* @__PURE__ */ new Set([
   "txt",
   "adoc"
 ]);
+var ENV_EXEMPT_SUFFIXES = [".example", ".sample", ".template"];
+var ENFORCED_REASONS = /* @__PURE__ */ new Set([
+  "env-file",
+  "dependency-dir",
+  "vendored-deps",
+  "build-output",
+  "test-coverage",
+  "cache",
+  "binary-asset"
+]);
 
 // ../../lib/engine/classify.ts
-var ENV_EXEMPT_SUFFIXES = [".example", ".sample", ".template"];
 function classify(file) {
   const { path, sizeInBytes } = file;
   const segments = path.split("/");
@@ -322,6 +250,478 @@ function classify(file) {
   return entry("KEEP", "source", null);
 }
 
+// ../../lib/engine/globMatch.ts
+var ESCAPE = /[.+^${}()|[\]\\]/g;
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        const atSegmentStart = i === 0 || glob[i - 1] === "/";
+        if (glob[i + 2] === "/" && atSegmentStart) {
+          re += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          re += ".*";
+          i += 1;
+        }
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else {
+      re += c.replace(ESCAPE, "\\$&");
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function compileGlob(glob) {
+  const re = globToRegExp(glob);
+  return (path) => re.test(path);
+}
+
+// ../../lib/engine/enforce.ts
+var UNENFORCED_BINARY_EXTENSIONS = /* @__PURE__ */ new Set(["svg", "pdf"]);
+var ENV_ENFORCED_GLOB = "**/.env*";
+function enforcedDirSegments() {
+  return [...PRUNE_DIR_SEGMENT_REASONS.entries()].filter(([, reason]) => ENFORCED_REASONS.has(reason)).map(([segment]) => segment).sort();
+}
+function demoteEnforcedGlobs(candidates, protectedPaths) {
+  if (protectedPaths.length === 0) {
+    return { globs: [...candidates], demoted: [] };
+  }
+  const globs = [];
+  const demoted = [];
+  for (const candidate of candidates) {
+    const matches = compileGlob(candidate);
+    if (protectedPaths.some(matches)) {
+      demoted.push(candidate);
+    } else {
+      globs.push(candidate);
+    }
+  }
+  return { globs, demoted };
+}
+function effectivePinnedPaths(classified, pins) {
+  const naturalVerdicts = new Map(
+    classified.map((file) => [file.path, file.verdict])
+  );
+  const effective = /* @__PURE__ */ new Set();
+  for (const [paths, pinnedVerdict] of [
+    [pins.keep, "KEEP"],
+    [pins.skim, "SUMMARIZE"]
+  ]) {
+    for (const path of paths) {
+      const natural = naturalVerdicts.get(path);
+      if (natural !== void 0 && natural !== pinnedVerdict) {
+        effective.add(path);
+      }
+    }
+  }
+  return [...effective];
+}
+function deriveEnforcedRules(classified) {
+  const extGlobs = /* @__PURE__ */ new Set();
+  const protectedPaths = [];
+  for (const file of classified) {
+    if (file.overridden && file.verdict !== "PRUNE") {
+      protectedPaths.push(file.path);
+    }
+    if (!file.overridden && file.verdict === "PRUNE" && file.reason === "binary-asset" && file.glob !== null) {
+      const ext = file.glob.slice("**/*.".length);
+      if (!UNENFORCED_BINARY_EXTENSIONS.has(ext)) extGlobs.add(file.glob);
+    }
+  }
+  const candidates = [
+    ENV_ENFORCED_GLOB,
+    ...enforcedDirSegments().map((segment) => `**/${segment}/**`),
+    ...[...extGlobs].sort()
+  ];
+  return demoteEnforcedGlobs(candidates, protectedPaths);
+}
+var DIR_GLOB = /^\*\*\/([^*/]+)\/\*\*$/;
+var EXT_GLOB = /^\*\*\/\*\.([a-z0-9]+)$/;
+function gitignoreLinesFrom(globs) {
+  const lines = [];
+  for (const glob of globs) {
+    if (glob === ENV_ENFORCED_GLOB) {
+      lines.push(".env*");
+      for (const suffix of ENV_EXEMPT_SUFFIXES) {
+        lines.push(`!.env*${suffix}`);
+      }
+      continue;
+    }
+    const dir = glob.match(DIR_GLOB);
+    if (dir) {
+      lines.push(`${dir[1]}/`);
+      continue;
+    }
+    const ext = glob.match(EXT_GLOB);
+    if (ext) {
+      lines.push(`*.${ext[1]}`);
+      continue;
+    }
+    lines.push(glob);
+  }
+  return lines;
+}
+function denyEntriesFrom(globs) {
+  return globs.map((glob) => `Read(/${glob})`);
+}
+function engineGlobFromGitignoreLine(line) {
+  const trimmed = line.trim();
+  if (trimmed === "" || trimmed.startsWith("#")) return null;
+  if (trimmed === ".env*") return ENV_ENFORCED_GLOB;
+  const dirIdiom = trimmed.match(/^([^!*/\s]+)\/$/);
+  if (dirIdiom) return `**/${dirIdiom[1]}/**`;
+  const extIdiom = trimmed.match(/^\*\.([a-z0-9]+)$/);
+  if (extIdiom) return `**/*.${extIdiom[1]}`;
+  if (trimmed === ENV_ENFORCED_GLOB || DIR_GLOB.test(trimmed) || EXT_GLOB.test(trimmed)) {
+    return trimmed;
+  }
+  return null;
+}
+function engineGlobFromDenyEntry(entry) {
+  const inner = entry.match(/^Read\((.+)\)$/)?.[1];
+  if (!inner) return null;
+  const glob = inner.startsWith("/") ? inner.slice(1) : inner;
+  if (glob === ENV_ENFORCED_GLOB || DIR_GLOB.test(glob) || EXT_GLOB.test(glob)) {
+    return glob;
+  }
+  return null;
+}
+
+// ../../lib/engine/generators/claudeSettings.ts
+var CLAUDE_SENTINEL_BEGIN = "Read(contextpruner-managed-begin)";
+var CLAUDE_SENTINEL_END = "Read(contextpruner-managed-end)";
+function claudeManagedDenyBlock(input) {
+  return [
+    CLAUDE_SENTINEL_BEGIN,
+    ...denyEntriesFrom(input.enforcedGlobs),
+    CLAUDE_SENTINEL_END
+  ];
+}
+function generateClaudeSettings(input) {
+  const settings = {
+    permissions: {
+      deny: claudeManagedDenyBlock(input)
+    }
+  };
+  return `${JSON.stringify(settings, null, 2)}
+`;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeClaudeSettings(existing, input) {
+  const unchanged = (error) => ({
+    content: existing,
+    changed: false,
+    error
+  });
+  let root;
+  try {
+    root = JSON.parse(existing);
+  } catch {
+    return unchanged("existing settings file is not valid JSON");
+  }
+  if (!isPlainObject(root)) {
+    return unchanged("existing settings file is not a JSON object");
+  }
+  const permissions = root.permissions ?? {};
+  if (!isPlainObject(permissions)) {
+    return unchanged("existing `permissions` is not an object");
+  }
+  const deny = permissions.deny ?? [];
+  if (!Array.isArray(deny) || deny.some((e) => typeof e !== "string")) {
+    return unchanged("existing `permissions.deny` is not a string array");
+  }
+  const begin = deny.indexOf(CLAUDE_SENTINEL_BEGIN);
+  const end = deny.indexOf(CLAUDE_SENTINEL_END);
+  if (begin !== deny.lastIndexOf(CLAUDE_SENTINEL_BEGIN) || end !== deny.lastIndexOf(CLAUDE_SENTINEL_END)) {
+    return unchanged(
+      "managed sentinel appears more than once \u2014 fix .claude/settings.json by hand"
+    );
+  }
+  const block = claudeManagedDenyBlock(input);
+  let nextDeny;
+  if (begin === -1 && end === -1) {
+    nextDeny = [...deny, ...block];
+  } else if (begin !== -1 && end !== -1 && begin < end) {
+    nextDeny = [...deny.slice(0, begin), ...block, ...deny.slice(end + 1)];
+  } else {
+    return unchanged(
+      "managed sentinel pair is incomplete or out of order \u2014 fix .claude/settings.json by hand"
+    );
+  }
+  root.permissions = { ...permissions, deny: nextDeny };
+  const content = `${JSON.stringify(root, null, 2)}
+`;
+  return { content, changed: content !== existing };
+}
+
+// ../../lib/engine/generators/ignoreFiles.ts
+var IGNORE_BLOCK_BEGIN = "# contextpruner:begin";
+var IGNORE_BLOCK_END = "# contextpruner:end";
+var IGNORE_BLOCK_NOTE = "# generated block \u2014 edits inside are overwritten on regeneration";
+function generateIgnoreFile(filename, input) {
+  const lines = [
+    IGNORE_BLOCK_BEGIN,
+    IGNORE_BLOCK_NOTE,
+    `# ${filename} \u2014 enforced AI context rules (generated by ContextPruner)`,
+    "# Hard-blocks what the advisory configs can only ask agents to skip.",
+    ...gitignoreLinesFrom(input.enforcedGlobs),
+    IGNORE_BLOCK_END,
+    "",
+    "# Yours \u2014 edit freely. A !path line below re-allows files blocked by the",
+    "# extension and .env* rules above, but files inside an ignored directory",
+    "# can't be re-included one by one \u2014 add a !dir/ line for the directory,",
+    "# or pin the file KEEP to drop its rules from every enforced artifact.",
+    ""
+  ];
+  return lines.join("\n");
+}
+function generateCursorIgnore(input) {
+  return generateIgnoreFile(".cursorignore", input);
+}
+function generateGeminiIgnore(input) {
+  return generateIgnoreFile(".geminiignore", input);
+}
+function generateCodeiumIgnore(input) {
+  return generateIgnoreFile(".codeiumignore", input);
+}
+
+// ../../lib/shared/format.ts
+function formatPctReduction(ratio) {
+  return ratio >= 1 ? 100 : Math.min(99, Math.floor(Number((ratio * 100).toPrecision(12))));
+}
+
+// ../../lib/engine/generators/shared.ts
+function formatStatsLine(stats) {
+  const pct = stats.bytesTotal === 0 ? 0 : formatPctReduction(stats.bytesPruned / stats.bytesTotal);
+  return `${stats.filesPruned} of ${stats.filesTotal} files pruned (${pct}% smaller context)`;
+}
+var MANAGED_BLOCK_BEGIN = "<!-- contextpruner:begin -->";
+var MANAGED_BLOCK_END = "<!-- contextpruner:end -->";
+var MANAGED_BLOCK_NOTE = "<!-- generated block \u2014 edits inside are overwritten on regeneration -->";
+function generateMarkdownRules(filename, input) {
+  const lines = [
+    MANAGED_BLOCK_BEGIN,
+    MANAGED_BLOCK_NOTE,
+    "",
+    `# ${filename} \u2014 AI context rules (generated by ContextPruner)`,
+    "",
+    `Generated ${input.generatedAt}. ${formatStatsLine(input.stats)}.`,
+    "",
+    "## Ignore",
+    "",
+    "Do not read, index, or load these paths into context:",
+    ""
+  ];
+  for (const glob of input.excludeGlobs) {
+    lines.push(`- \`${glob}\``);
+  }
+  if (input.summarizeGlobs.length > 0) {
+    lines.push(
+      "",
+      "## Skim",
+      "",
+      "Summarize these instead of reading them in full:",
+      ""
+    );
+    for (const glob of input.summarizeGlobs) {
+      lines.push(`- \`${glob}\``);
+    }
+  }
+  if (input.priorityGlobs.length > 0) {
+    lines.push("", "## Focus", "", "Prioritize these paths when exploring:", "");
+    for (const glob of input.priorityGlobs) {
+      lines.push(`- \`${glob}\``);
+    }
+  }
+  if (input.keepOverridePaths.length > 0 || input.skimOverridePaths.length > 0 || input.pruneOverridePaths.length > 0) {
+    lines.push(
+      "",
+      "## Overrides",
+      "",
+      "The repo owner pinned these verdicts \u2014 they take precedence over every rule above:",
+      ""
+    );
+    for (const path of input.keepOverridePaths) {
+      lines.push(`- Keep (read normally): \`${path}\``);
+    }
+    for (const path of input.skimOverridePaths) {
+      lines.push(`- Skim (summarize only): \`${path}\``);
+    }
+    for (const path of input.pruneOverridePaths) {
+      lines.push(`- Prune (do not read): \`${path}\``);
+    }
+  }
+  lines.push(
+    "",
+    MANAGED_BLOCK_END,
+    "",
+    "## Exceptions (yours \u2014 edit freely)",
+    "",
+    "ContextPruner only sees paths and byte sizes \u2014 you know which",
+    "junk-shaped files actually matter in this repo. Rules you add here",
+    "are yours: when regenerating, replace only the marked block above",
+    "and keep this section.",
+    "",
+    "- _none yet \u2014 add repo-specific overrides here_",
+    ""
+  );
+  return lines.join("\n");
+}
+
+// ../../lib/engine/overridesFile.ts
+var OVERRIDES_FILENAME = ".contextpruner";
+var KEEP_LINE = /^keep:\s*(.+)$/;
+function isValidDeclaration(declaration) {
+  return declaration.length > 0 && declaration.length <= MAX_PATH_LENGTH && !declaration.includes("\0") && !declaration.includes("\\") && !declaration.startsWith("/") && declaration.split("/").every((seg) => seg !== "..");
+}
+function parseOverridesFile(source) {
+  const keep = [];
+  const seen = /* @__PURE__ */ new Set();
+  const unknownLines = [];
+  for (const raw of source.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    const match = KEEP_LINE.exec(line);
+    const declaration = match?.[1]?.trim();
+    if (declaration !== void 0 && isValidDeclaration(declaration)) {
+      if (!seen.has(declaration)) {
+        seen.add(declaration);
+        if (keep.length < MAX_OVERRIDE_DECLARATIONS) keep.push(declaration);
+      }
+    } else {
+      unknownLines.push(line);
+    }
+  }
+  return { keep, unknownLines };
+}
+function representativePathsFor(declaration) {
+  const literal = declaration.replace(/\*+/g, "cpx");
+  return declaration.includes("*") ? [literal] : [literal, `${literal}/cpx`];
+}
+
+// ../../lib/engine/parseConfig.ts
+var GLOB_BULLET = /^- `(.+)`$/;
+var OVERRIDE_BULLET = /^- (Keep|Skim|Prune) \([^)]*\): `(.+)`$/;
+var SECTION_HEADINGS = {
+  "## Ignore": "ignore",
+  "## Skim": "skim",
+  "## Focus": "focus",
+  "## Overrides": "overrides"
+};
+function empty(hasManagedBlock) {
+  return {
+    hasManagedBlock,
+    excludeGlobs: [],
+    summarizeGlobs: [],
+    priorityGlobs: [],
+    overrides: { keep: [], skim: [], prune: [] }
+  };
+}
+function parseConfig(source) {
+  const begin = source.indexOf(MANAGED_BLOCK_BEGIN);
+  if (begin === -1) return empty(false);
+  const end = source.indexOf(MANAGED_BLOCK_END, begin + MANAGED_BLOCK_BEGIN.length);
+  if (end === -1) return empty(false);
+  const config = empty(true);
+  const block = source.slice(begin + MANAGED_BLOCK_BEGIN.length, end);
+  let section = null;
+  for (const raw of block.split("\n")) {
+    const line = raw.trimEnd();
+    const heading = SECTION_HEADINGS[line];
+    if (heading) {
+      section = heading;
+      continue;
+    }
+    if (line.startsWith("## ")) {
+      section = null;
+      continue;
+    }
+    if (section === null) continue;
+    if (section === "overrides") {
+      const match2 = OVERRIDE_BULLET.exec(line);
+      if (!match2) continue;
+      const bucket = match2[1] === "Keep" ? "keep" : match2[1] === "Skim" ? "skim" : "prune";
+      config.overrides[bucket].push(match2[2]);
+      continue;
+    }
+    const match = GLOB_BULLET.exec(line);
+    if (!match) continue;
+    const glob = match[1];
+    if (section === "ignore") config.excludeGlobs.push(glob);
+    else if (section === "skim") config.summarizeGlobs.push(glob);
+    else config.priorityGlobs.push(glob);
+  }
+  return config;
+}
+
+// ../../lib/engine/parseEnforced.ts
+var NONE = {
+  recognized: false,
+  engineGlobs: [],
+  foreignLines: []
+};
+var ENV_NEGATION = new RegExp(
+  `^!\\.env\\*?(${ENV_EXEMPT_SUFFIXES.map((s) => s.replace(/\./g, "\\.")).join("|")})$`
+);
+function parseIgnoreFile(source) {
+  const begin = source.indexOf(IGNORE_BLOCK_BEGIN);
+  if (begin === -1) return NONE;
+  const end = source.indexOf(IGNORE_BLOCK_END, begin + IGNORE_BLOCK_BEGIN.length);
+  if (end === -1) return NONE;
+  const engineGlobs = [];
+  const foreignLines = [];
+  const block = source.slice(begin + IGNORE_BLOCK_BEGIN.length, end);
+  for (const raw of block.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (ENV_NEGATION.test(line)) continue;
+    const glob = engineGlobFromGitignoreLine(line);
+    if (glob !== null) engineGlobs.push(glob);
+    else foreignLines.push(line);
+  }
+  return { recognized: true, engineGlobs, foreignLines };
+}
+function parseClaudeSettings(source) {
+  let root;
+  try {
+    root = JSON.parse(source);
+  } catch {
+    return NONE;
+  }
+  if (typeof root !== "object" || root === null || Array.isArray(root)) {
+    return NONE;
+  }
+  const deny = root.permissions?.deny;
+  if (!Array.isArray(deny) || deny.some((e) => typeof e !== "string")) {
+    return NONE;
+  }
+  const entries = deny;
+  const begin = entries.indexOf(CLAUDE_SENTINEL_BEGIN);
+  const end = entries.indexOf(CLAUDE_SENTINEL_END);
+  if (begin === -1 || end === -1 || begin >= end || entries.indexOf(CLAUDE_SENTINEL_BEGIN, begin + 1) !== -1 || entries.indexOf(CLAUDE_SENTINEL_END, end + 1) !== -1) {
+    return NONE;
+  }
+  const engineGlobs = [];
+  const foreignLines = [];
+  for (const entry of entries.slice(begin + 1, end)) {
+    const glob = engineGlobFromDenyEntry(entry);
+    if (glob !== null) engineGlobs.push(glob);
+    else foreignLines.push(entry);
+  }
+  return { recognized: true, engineGlobs, foreignLines };
+}
+function parseEnforcedConfig(source, format) {
+  return format === "gitignore" ? parseIgnoreFile(source) : parseClaudeSettings(source);
+}
+
 // ../../lib/engine/generators/agentsMd.ts
 function generateAgentsMd(input) {
   return generateMarkdownRules("AGENTS.md", input);
@@ -386,7 +786,13 @@ function computeSavings(bytesTotal, bytesKept, options = {}) {
 // ../../lib/engine/prune.ts
 var MAX_PRIORITY_GLOBS = 5;
 function prune(files, options = {}) {
-  const overrides = options.verdictOverrides ?? {};
+  const declarations = options.keepDeclarations ?? [];
+  const overrides = {
+    ...Object.fromEntries(
+      declarations.filter((declaration) => !declaration.includes("*")).map((path) => [path, "KEEP"])
+    ),
+    ...options.verdictOverrides
+  };
   const classified = files.map((file) => {
     const base = classify(file);
     const pinned = Object.hasOwn(overrides, file.path) ? overrides[file.path] : void 0;
@@ -449,6 +855,15 @@ function prune(files, options = {}) {
     windowClamped: pinnedSavings.windowClamped
   };
   for (const glob of options.extraExcludeGlobs ?? []) excludeGlobs.add(glob);
+  const pinDemoted = deriveEnforcedRules(classified);
+  const declDemoted = demoteEnforcedGlobs(
+    pinDemoted.globs,
+    declarations.flatMap(representativePathsFor)
+  );
+  const enforced = {
+    globs: declDemoted.globs,
+    demoted: [...pinDemoted.demoted, ...declDemoted.demoted]
+  };
   const priorityGlobs = [...keptBytesByDir.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, MAX_PRIORITY_GLOBS).map(([dir]) => `${dir}/**`);
   const generatorInput = {
     generatedAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
@@ -458,7 +873,10 @@ function prune(files, options = {}) {
     priorityGlobs,
     keepOverridePaths: classified.filter((f) => f.overridden && f.verdict === "KEEP").map((f) => f.path).sort(),
     skimOverridePaths: classified.filter((f) => f.overridden && f.verdict === "SUMMARIZE").map((f) => f.path).sort(),
-    pruneOverridePaths: classified.filter((f) => f.overridden && f.verdict === "PRUNE").map((f) => f.path).sort()
+    pruneOverridePaths: classified.filter((f) => f.overridden && f.verdict === "PRUNE").map((f) => f.path).sort(),
+    // Static-baseline + derived enforce-set; independent of extraExcludeGlobs
+    // (the baseline already names every canonical untracked junk dir).
+    enforcedGlobs: enforced.globs
   };
   const verdicts = classified.map(
     ({ path, verdict, reason, sizeInBytes, overridden }) => ({
@@ -474,12 +892,17 @@ function prune(files, options = {}) {
     generatedAt: generatorInput.generatedAt,
     stats,
     verdicts,
+    demotedEnforcedGlobs: enforced.demoted,
     artifacts: {
       agentsMd: generateAgentsMd(generatorInput),
       claudeMd: generateClaudeMd(generatorInput),
       cursorMdc: generateCursorMdc(generatorInput),
       copilotInstructionsMd: generateCopilotInstructions(generatorInput),
-      geminiMd: generateGeminiMd(generatorInput)
+      geminiMd: generateGeminiMd(generatorInput),
+      cursorIgnore: generateCursorIgnore(generatorInput),
+      geminiIgnore: generateGeminiIgnore(generatorInput),
+      codeiumIgnore: generateCodeiumIgnore(generatorInput),
+      claudeSettings: generateClaudeSettings(generatorInput)
     }
   };
 }
@@ -513,8 +936,14 @@ function buildFixedConfig(files, userConfig, now, preserveExcludeGlobs) {
     return { fixable: false, changed: false, fixed: userConfig };
   }
   const artifact = detectArtifact(userBlock);
+  const { overrides } = parseConfig(userConfig);
+  const verdictOverrides = {};
+  for (const path of overrides.keep) verdictOverrides[path] = "KEEP";
+  for (const path of overrides.skim) verdictOverrides[path] = "SUMMARIZE";
+  for (const path of overrides.prune) verdictOverrides[path] = "PRUNE";
   const corrected = prune(files, {
     ...now ? { now } : {},
+    verdictOverrides,
     extraExcludeGlobs: preserveExcludeGlobs
   }).artifacts[artifact];
   const canonicalBlock = managedBlock(corrected);
@@ -526,92 +955,47 @@ function buildFixedConfig(files, userConfig, now, preserveExcludeGlobs) {
   const fixed = userConfig.slice(0, begin) + canonicalBlock + userConfig.slice(end);
   return { fixable: true, changed: fixed !== userConfig, fixed };
 }
-
-// ../../lib/engine/parseConfig.ts
-var GLOB_BULLET = /^- `(.+)`$/;
-var OVERRIDE_BULLET = /^- (Keep|Skim|Prune) \([^)]*\): `(.+)`$/;
-var SECTION_HEADINGS = {
-  "## Ignore": "ignore",
-  "## Skim": "skim",
-  "## Focus": "focus",
-  "## Overrides": "overrides"
+var IGNORE_GENERATOR_BY_TITLE = {
+  ".cursorignore": generateCursorIgnore,
+  ".geminiignore": generateGeminiIgnore,
+  ".codeiumignore": generateCodeiumIgnore
 };
-function empty(hasManagedBlock) {
-  return {
-    hasManagedBlock,
-    excludeGlobs: [],
-    summarizeGlobs: [],
-    priorityGlobs: [],
-    overrides: { keep: [], skim: [], prune: [] }
-  };
-}
-function parseConfig(source) {
-  const begin = source.indexOf(MANAGED_BLOCK_BEGIN);
-  if (begin === -1) return empty(false);
-  const end = source.indexOf(MANAGED_BLOCK_END, begin + MANAGED_BLOCK_BEGIN.length);
-  if (end === -1) return empty(false);
-  const config = empty(true);
-  const block = source.slice(begin + MANAGED_BLOCK_BEGIN.length, end);
-  let section = null;
-  for (const raw of block.split("\n")) {
-    const line = raw.trimEnd();
-    const heading = SECTION_HEADINGS[line];
-    if (heading) {
-      section = heading;
-      continue;
+var IGNORE_TITLE_RE = /^# (\.[a-z]+ignore) — enforced AI context rules/m;
+function buildFixedEnforcedConfig(files, userConfig, format, pins = { keep: [], skim: [] }, keepDeclarations = []) {
+  const classified = files.map(classify);
+  const enforcedGlobs = demoteEnforcedGlobs(
+    deriveEnforcedRules(classified).globs,
+    [
+      ...effectivePinnedPaths(classified, pins),
+      ...keepDeclarations.flatMap(representativePathsFor)
+    ]
+  ).globs;
+  if (format === "claudeSettings") {
+    if (!parseEnforcedConfig(userConfig, "claudeSettings").recognized) {
+      return { fixable: false, changed: false, fixed: userConfig };
     }
-    if (line.startsWith("## ")) {
-      section = null;
-      continue;
-    }
-    if (section === null) continue;
-    if (section === "overrides") {
-      const match2 = OVERRIDE_BULLET.exec(line);
-      if (!match2) continue;
-      const bucket = match2[1] === "Keep" ? "keep" : match2[1] === "Skim" ? "skim" : "prune";
-      config.overrides[bucket].push(match2[2]);
-      continue;
+    const merged = mergeClaudeSettings(userConfig, { enforcedGlobs });
+    if (merged.error) {
+      return { fixable: false, changed: false, fixed: userConfig };
     }
-    const match = GLOB_BULLET.exec(line);
-    if (!match) continue;
-    const glob = match[1];
-    if (section === "ignore") config.excludeGlobs.push(glob);
-    else if (section === "skim") config.summarizeGlobs.push(glob);
-    else config.priorityGlobs.push(glob);
+    return { fixable: true, changed: merged.changed, fixed: merged.content };
   }
-  return config;
-}
-
-// ../../lib/engine/globMatch.ts
-var ESCAPE = /[.+^${}()|[\]\\]/g;
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        const atSegmentStart = i === 0 || glob[i - 1] === "/";
-        if (glob[i + 2] === "/" && atSegmentStart) {
-          re += "(?:[^/]+/)*";
-          i += 2;
-        } else {
-          re += ".*";
-          i += 1;
-        }
-      } else {
-        re += "[^/]*";
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-    } else {
-      re += c.replace(ESCAPE, "\\$&");
-    }
+  const begin = userConfig.indexOf(IGNORE_BLOCK_BEGIN);
+  const end = begin === -1 ? -1 : userConfig.indexOf(IGNORE_BLOCK_END, begin + IGNORE_BLOCK_BEGIN.length);
+  if (begin === -1 || end === -1) {
+    return { fixable: false, changed: false, fixed: userConfig };
   }
-  return new RegExp(`^${re}$`);
-}
-function compileGlob(glob) {
-  const re = globToRegExp(glob);
-  return (path) => re.test(path);
+  const block = userConfig.slice(begin, end + IGNORE_BLOCK_END.length);
+  const generate = IGNORE_GENERATOR_BY_TITLE[IGNORE_TITLE_RE.exec(block)?.[1] ?? ""] ?? generateCursorIgnore;
+  const corrected = generate({ enforcedGlobs });
+  const cBegin = corrected.indexOf(IGNORE_BLOCK_BEGIN);
+  const cEnd = corrected.indexOf(IGNORE_BLOCK_END, cBegin);
+  const canonicalBlock = corrected.slice(
+    cBegin,
+    cEnd + IGNORE_BLOCK_END.length
+  );
+  const fixed = userConfig.slice(0, begin) + canonicalBlock + userConfig.slice(end + IGNORE_BLOCK_END.length);
+  return { fixable: true, changed: fixed !== userConfig, fixed };
 }
 
 // ../../lib/engine/reconcile.ts
@@ -643,6 +1027,116 @@ function compileConfig({ name, source }) {
 function isAddressed(config, path) {
   return config.keepSet.has(path) || config.pruneSet.has(path) || config.skimSet.has(path) || config.excludeMatch(path) || config.summarizeMatch(path);
 }
+function dialectLine(glob, format) {
+  return format === "claudeSettings" ? denyEntriesFrom([glob])[0] : gitignoreLinesFrom([glob])[0];
+}
+function expectedEnforcedGlobs(classified, pinnedPaths) {
+  return demoteEnforcedGlobs(deriveEnforcedRules(classified).globs, pinnedPaths).globs;
+}
+function enforcedFindings(classified, paths, enforced, pinnedPaths, keepDeclarations) {
+  const findings = [];
+  const expected = expectedEnforcedGlobs(classified, [
+    ...pinnedPaths,
+    ...keepDeclarations.flatMap(representativePathsFor)
+  ]);
+  const expectedSet = new Set(expected);
+  const declarationReps = keepDeclarations.map(
+    (declaration) => [declaration, representativePathsFor(declaration)]
+  );
+  for (const config of enforced) {
+    const have = new Set(config.engineGlobs);
+    for (const glob of expected) {
+      if (!have.has(glob)) {
+        findings.push({
+          kind: "missing",
+          severity: "medium",
+          glob,
+          message: `Enforced rule \`${dialectLine(glob, config.format)}\` is missing from ${config.name}`
+        });
+      }
+    }
+    for (const glob of config.engineGlobs) {
+      if (expectedSet.has(glob)) continue;
+      if (!paths.some(compileGlob(glob))) {
+        findings.push({
+          kind: "dead",
+          severity: "low",
+          glob,
+          message: `Rule \`${dialectLine(glob, config.format)}\` in ${config.name} matches no files and isn't in the enforce-set`
+        });
+      }
+    }
+    for (const glob of config.engineGlobs) {
+      const matches = compileGlob(glob);
+      for (const path of pinnedPaths) {
+        if (matches(path)) {
+          findings.push({
+            kind: "conflict",
+            severity: "high",
+            glob,
+            path,
+            message: `\`${path}\` is pinned Keep/Skim but ${config.name} hard-blocks it via \`${dialectLine(glob, config.format)}\``
+          });
+        }
+      }
+      for (const [declaration, representatives] of declarationReps) {
+        if (representatives.some(matches)) {
+          findings.push({
+            kind: "conflict",
+            severity: "high",
+            glob,
+            path: declaration,
+            message: `\`${declaration}\` is declared keep in ${OVERRIDES_FILENAME} but ${config.name} still hard-blocks it via \`${dialectLine(glob, config.format)}\``
+          });
+        }
+      }
+    }
+    for (const line of config.foreignLines) {
+      findings.push({
+        kind: "conflict",
+        severity: "low",
+        message: `Hand-written line inside ${config.name}'s managed block will be overwritten on regeneration: \`${line}\``
+      });
+    }
+  }
+  const base = enforced[0];
+  if (base) {
+    const baseSet = new Set(base.engineGlobs);
+    for (const other of enforced.slice(1)) {
+      const otherSet = new Set(other.engineGlobs);
+      for (const glob of base.engineGlobs) {
+        if (!otherSet.has(glob)) {
+          findings.push({
+            kind: "drift",
+            severity: "medium",
+            glob,
+            message: `Enforced \`${glob}\` is in ${base.name} but not ${other.name}`
+          });
+        }
+      }
+      for (const glob of other.engineGlobs) {
+        if (!baseSet.has(glob)) {
+          findings.push({
+            kind: "drift",
+            severity: "medium",
+            glob,
+            message: `Enforced \`${glob}\` is in ${other.name} but not ${base.name}`
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+function compileEnforced(configs) {
+  const entries = [];
+  for (const { name, source, format } of configs) {
+    if (format !== "gitignore" && format !== "claudeSettings") continue;
+    const parsed = parseEnforcedConfig(source, format);
+    if (parsed.recognized) entries.push({ ...parsed, name, format });
+  }
+  return entries;
+}
 function reconcile(files, configs, options = {}) {
   const primary = configs[0];
   const empty2 = {
@@ -655,11 +1149,72 @@ function reconcile(files, configs, options = {}) {
     findings: []
   };
   if (!primary) return empty2;
-  const config = compileConfig(primary);
-  if (!config.hasManagedBlock) return empty2;
   const classified = files.map((file) => ({ ...classify(file) }));
   const paths = files.map((f) => f.path);
   const bytesTotal = files.reduce((sum, f) => sum + f.sizeInBytes, 0);
+  const markdownConfigs = configs.filter(
+    (c) => (c.format ?? "markdown") === "markdown"
+  );
+  const enforced = compileEnforced(configs);
+  const keepPins = [];
+  const skimPins = [];
+  for (const c of markdownConfigs) {
+    const parsed = parseConfig(c.source);
+    if (!parsed.hasManagedBlock) continue;
+    keepPins.push(...parsed.overrides.keep);
+    skimPins.push(...parsed.overrides.skim);
+  }
+  const pinnedPaths = effectivePinnedPaths(classified, {
+    keep: keepPins,
+    skim: skimPins
+  });
+  const declarations = options.keepDeclarations ?? [];
+  const demotionPaths = [
+    ...pinnedPaths,
+    ...declarations.flatMap(representativePathsFor)
+  ];
+  if ((primary.format ?? "markdown") !== "markdown") {
+    const parsedPrimary = parseEnforcedConfig(
+      primary.source,
+      primary.format
+    );
+    if (!parsedPrimary.recognized) return empty2;
+    const findings2 = enforcedFindings(
+      classified,
+      paths,
+      enforced,
+      pinnedPaths,
+      declarations
+    );
+    const expected = expectedEnforcedGlobs(classified, demotionPaths);
+    const have = new Set(parsedPrimary.engineGlobs);
+    const present = expected.filter((glob) => have.has(glob)).length;
+    const coveragePct2 = expected.length === 0 ? 100 : Math.floor(present / expected.length * 100);
+    const missingMatchers = expected.filter((glob) => !have.has(glob)).map(compileGlob);
+    let missingBytes = 0;
+    for (const file of classified) {
+      if (file.verdict === "PRUNE" && missingMatchers.some((matches) => matches(file.path))) {
+        missingBytes += file.sizeInBytes;
+      }
+    }
+    const dollarsLeaking2 = Math.floor(
+      computeSavings(bytesTotal, bytesTotal - missingBytes, options).usdSavedPerMonth * 100
+    ) / 100;
+    findings2.sort(
+      (a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || a.kind.localeCompare(b.kind) || (a.glob ?? "").localeCompare(b.glob ?? "")
+    );
+    return {
+      configName: primary.name,
+      configRecognized: true,
+      filesTotal: files.length,
+      grade: gradeFor(coveragePct2),
+      coveragePct: coveragePct2,
+      dollarsLeaking: dollarsLeaking2,
+      findings: findings2
+    };
+  }
+  const config = compileConfig(primary);
+  if (!config.hasManagedBlock) return empty2;
   const findings = [];
   const missingBytesByGlob = /* @__PURE__ */ new Map();
   for (const file of classified) {
@@ -764,6 +1319,9 @@ function reconcile(files, configs, options = {}) {
       }
     }
   }
+  findings.push(
+    ...enforcedFindings(classified, paths, enforced, pinnedPaths, declarations)
+  );
   let junkBytes = 0;
   let prunedBytes = 0;
   for (const file of classified) {
@@ -900,12 +1458,26 @@ async function verifyKey(opts) {
 
 // src/run.ts
 var DEFAULT_CONFIG_PATHS = [
+  // Advisory markdown configs first — the primary (grade/coverage) config.
   "AGENTS.md",
   "CLAUDE.md",
   "GEMINI.md",
   ".github/copilot-instructions.md",
-  ".cursor/rules/contextpruner.mdc"
+  ".cursor/rules/contextpruner.mdc",
+  // Enforced artifacts — linted against the same enforce-set the generators emit.
+  ".cursorignore",
+  ".geminiignore",
+  ".codeiumignore",
+  ".claude/settings.json"
 ];
+function formatForPath(path) {
+  const base = path.split("/").pop() ?? path;
+  if (base === ".cursorignore" || base === ".geminiignore" || base === ".codeiumignore") {
+    return "gitignore";
+  }
+  if (base === "settings.json") return "claudeSettings";
+  return "markdown";
+}
 var CREATE_KEY = "Set CONTEXTPRUNER_API_KEY (create one at https://contextpruner.app/account).";
 function dirNameOf(glob) {
   return glob.match(/^([^*/]+)\/\*\*$/)?.[1] ?? glob.match(/^\*\*\/([^*/]+)\/\*\*$/)?.[1] ?? null;
@@ -915,7 +1487,14 @@ function isFalseDead(finding) {
   const dir = dirNameOf(finding.glob);
   return dir !== null && PRUNE_DIR_SEGMENT_REASONS.has(dir);
 }
-function hasRuleChange(before, after) {
+function hasRuleChange(before, after, format) {
+  if (format === "claudeSettings") {
+    try {
+      return JSON.stringify(JSON.parse(before)) !== JSON.stringify(JSON.parse(after));
+    } catch {
+      return before !== after;
+    }
+  }
   const normalize = (s) => s.replace(/Generated \S+Z\./, "Generated <ts>.");
   return normalize(before) !== normalize(after);
 }
@@ -933,7 +1512,9 @@ async function runLint(deps) {
   const configs = [];
   for (const path of deps.configPaths) {
     const source = deps.readConfig(path);
-    if (source !== null) configs.push({ name: path, source });
+    if (source !== null) {
+      configs.push({ name: path, source, format: formatForPath(path) });
+    }
   }
   if (configs.length === 0) {
     return {
@@ -953,52 +1534,78 @@ async function runLint(deps) {
   if (files.length === 0) {
     return { text: "No tracked files found.", exitCode: 2, channel: "stderr" };
   }
+  const overridesSource = deps.readConfig(OVERRIDES_FILENAME);
+  const parsedOverrides = parseOverridesFile(overridesSource ?? "");
+  const overridesWarning = parsedOverrides.unknownLines.length > 0 ? `
+  \u26A0 ${OVERRIDES_FILENAME}: ignored ${parsedOverrides.unknownLines.length} unrecognized line${parsedOverrides.unknownLines.length === 1 ? "" : "s"} (${parsedOverrides.unknownLines.map((l) => `"${l}"`).join(", ")}) \u2014 only \`keep: <path-or-glob>\` lines are read.
+` : "";
   if (deps.fix) {
+    const pins = { keep: [], skim: [] };
+    for (const c of configs) {
+      if (c.format !== "markdown") continue;
+      const parsed = parseConfig(c.source);
+      if (!parsed.hasManagedBlock) continue;
+      pins.keep.push(...parsed.overrides.keep);
+      pins.skim.push(...parsed.overrides.skim);
+    }
     const fixed = [];
     const unfixable = [];
-    for (const { name, source } of configs) {
-      const spared = parseConfig(source).excludeGlobs.filter((glob) => {
-        const dir = dirNameOf(glob);
-        return dir !== null && PRUNE_DIR_SEGMENT_REASONS.has(dir);
-      });
-      const result = buildFixedConfig(files, source, void 0, spared);
+    for (const { name, source, format } of configs) {
+      let result;
+      if (format === "markdown") {
+        const spared = parseConfig(source).excludeGlobs.filter((glob) => {
+          const dir = dirNameOf(glob);
+          return dir !== null && PRUNE_DIR_SEGMENT_REASONS.has(dir);
+        });
+        result = buildFixedConfig(files, source, void 0, spared);
+      } else {
+        result = buildFixedEnforcedConfig(
+          files,
+          source,
+          format,
+          pins,
+          parsedOverrides.keep
+        );
+      }
       if (!result.fixable) {
         unfixable.push(name);
-      } else if (hasRuleChange(source, result.fixed)) {
+      } else if (hasRuleChange(source, result.fixed, format)) {
         deps.writeConfig(name, result.fixed);
         fixed.push(name);
       }
     }
     if (fixed.length > 0) {
       return {
-        text: `Fixed ${fixed.join(", ")}. Re-run without --fix to confirm.`,
+        text: `${overridesWarning}Fixed ${fixed.join(", ")}. Re-run without --fix to confirm.`,
         exitCode: 0,
         channel: "stdout"
       };
     }
     if (unfixable.length === configs.length) {
       return {
-        text: `Nothing to fix \u2014 ${unfixable.join(", ")} ${unfixable.length === 1 ? "has" : "have"} no ContextPruner managed block.`,
+        text: `${overridesWarning}Nothing to fix \u2014 ${unfixable.join(", ")} ${unfixable.length === 1 ? "has" : "have"} no ContextPruner managed block (or, for .claude/settings.json, could not be merged safely).`,
         exitCode: 2,
         channel: "stderr"
       };
     }
-    const skipped = unfixable.length > 0 ? ` Skipped ${unfixable.join(", ")} (no ContextPruner managed block).` : "";
+    const skipped = unfixable.length > 0 ? ` Skipped ${unfixable.join(", ")} (no ContextPruner managed block, or unmergeable).` : "";
     return {
-      text: `Nothing to fix \u2014 your configs already match the tree.${skipped}`,
+      text: `${overridesWarning}Nothing to fix \u2014 your configs already match the tree.${skipped}`,
       exitCode: 0,
       channel: "stdout"
     };
   }
-  const report = reconcile(files, configs);
+  const report = reconcile(files, configs, {
+    keepDeclarations: parsedOverrides.keep
+  });
   const kept = report.findings.filter((f) => !isFalseDead(f));
   const filtered = { ...report, findings: kept };
-  const text = deps.json ? JSON.stringify(filtered, null, 2) : formatReport(filtered);
+  const text = deps.json ? JSON.stringify(filtered, null, 2) : `${overridesWarning}${formatReport(filtered)}`;
   return { text, exitCode: exitCodeFor(filtered), channel: "stdout" };
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
+var VERSION = "0.3.0";
 var HELP = `contextpruner lint \u2014 check your AI-context config against your repo
 
 Usage:
@@ -1006,13 +1613,21 @@ Usage:
 
 Options:
   --config <path>   A config to lint (repeatable). Default: auto-detect
-                    AGENTS.md, CLAUDE.md, GEMINI.md, Copilot, and Cursor rules.
+                    AGENTS.md, CLAUDE.md, GEMINI.md, Copilot, and Cursor rules,
+                    plus the enforced .cursorignore, .geminiignore,
+                    .codeiumignore, and .claude/settings.json.
   --fix             Rewrite each config's managed block in place to fix the
-                    issues. Your own content outside the block is left alone.
+                    issues \u2014 enforced files too, via their managed block. Your
+                    own content outside the block is left alone.
   --json            Emit the full report as JSON.
   -h, --help        Show this help.
   -v, --version     Show the version.
 
+Exceptions:
+  \`keep: <path-or-glob>\` lines in a committed .contextpruner file mark paths
+  that must stay readable by agents. Lint expects their covering enforced
+  rules to be absent, and --fix keeps those rules out.
+
 Auth:
   export CONTEXTPRUNER_API_KEY=cp_live_...   (create one at
   https://contextpruner.app/account). Only your key is sent \u2014 the file tree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contextpruner",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Lint your AI-context config files (AGENTS.md, CLAUDE.md, GEMINI.md, Cursor rules) against your repo — find missing, dead, drifting, and conflicting rules.",
   "keywords": [
     "AGENTS.md",
@@ -27,6 +27,6 @@
     "prepublishOnly": "node build.mjs"
   },
   "devDependencies": {
-    "esbuild": "^0.24.0"
+    "esbuild": "^0.25.0"
   }
 }