Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.npmignore:
- Around line 40-48: The package publish rules are inconsistent: package.json
explicitly lists dist/orchestrator/adopt.js and dist/orchestrator/history.js but
.npmignore contains patterns dist/orchestrator/adopt.* and
dist/orchestrator/history.* which exclude them from the tarball; fix by choosing
one of two actions—either remove the adopt.js and history.js entries from the
"files" array in package.json if they should not be published, or delete/adjust
the dist/orchestrator/adopt.* and dist/orchestrator/history.* lines from
.npmignore so those files are included; after making the change, verify with npm
pack --dry-run to confirm the tarball contains (or excludes) the intended files.

In `@src/fix/hook-generator.ts`:
- Line 64: The shell pipeline that sets CMD in hook-generator.ts (the line
starting with CMD=$(echo "$INPUT" | node -e ...)) silently falls back to an
empty command if node is not installed because of the "|| true" and redirection;
update the hook so it first guards for a Node.js runtime (e.g., check
availability of `node` or its version) and fail non‑zero with an explicit error
if not found, or restore a fallback parser (e.g., `python3`) only after
validating its presence; ensure the guard is adjacent to the CMD assignment so
the PreToolUse check never proceeds with an empty/unknown command when Node is
missing.

In `@src/scan/__tests__/integration.test.ts`:
- Line 15: The test currently reuses a single TMP directory (const TMP) for both
the fake user HOME and the repoRoot which causes getSettingsLocations() to
resolve user and project settings to the same file; change the setup to create
two distinct temp paths (e.g., TMP_HOME and TMP_REPO) and use TMP_HOME as
process.env.HOME and TMP_REPO as the repoRoot used in the tests (and update any
test helpers, cleanup, and assertions that reference TMP to use the appropriate
TMP_HOME or TMP_REPO); ensure references in this file to getSettingsLocations(),
any setup/teardown code, and all places that previously used TMP (lines noted in
the review) are adjusted so user-level files live under TMP_HOME/.claude and
project-level files under TMP_REPO/.claude.

In `@src/scan/efficiency.ts`:
- Around line 92-102: The function listSessionFiles currently fails the whole
mtime pass if any single statSync throws; change it to perform per-file statSync
inside a try/catch (or use a safe helper) so unreadable/missing .jsonl files are
skipped rather than causing an empty result, then sort the successfully-statted
entries by mtime, slice to 20 and return their paths; update the logic around
readdirSync/map/statSync (referencing listSessionFiles, readdirSync, statSync)
to skip errors (optionally logging them) and ensure the 20-most-recent cap is
applied after filtering.

In `@src/scan/index.ts`:
- Around line 78-87: The current code hardcodes settings_validation to { valid:
false, errors: [...] } causing runXRay() to always report a validation error;
change runXRay() (or the code that constructs settings_validation) to avoid
fabricating failures—either omit settings_validation when no validator ran or
set an explicit sentinel (e.g., settings_validation: { implemented: false } or
settings_validation: { status: "not_implemented", errors: [] }) so downstream
consumers can distinguish "not implemented" from a real validation failure;
update any consumers/tests that expect a boolean valid to handle the explicit
not-implemented representation.

In `@src/scan/utils.ts`:
- Around line 11-17: readJson currently returns any JSON value; update it so
after parsing it validates the top-level value is a plain object (non-null,
typeof === "object", and not an Array via Array.isArray) and return that
Record<string, unknown> only when valid, otherwise return null; keep the
try/catch around JSON.parse and treat parse errors the same, and reference the
readJson function to add the type checks and null-returns for non-object JSON
values.
- Around line 20-25: getHome currently reads only HOME/USERPROFILE env vars
which can fail even when the system can resolve a home directory; update getHome
to call Node's os.homedir() (importing os) and return that value, falling back
to throwing the same error if os.homedir() returns falsy. Locate the getHome
function and replace the manual env lookup with a call to os.homedir(), keep the
function signature and error behavior (throw "HOME or USERPROFILE environment
variable is required" if no home is found) so callers (settings resolution,
project detection, automation checks) continue to receive a string or an error.

---

Nitpick comments:
In `@README.md`:
- Around line 88-95: Add a verifiability guardrail for the comparison table by
appending a short “as of YYYY-MM-DD” timestamp and a brief source/methodology
note for the /refine and cclint columns; update the table caption or the final
row under the table (referencing the table header labels "X-Ray", "/refine", and
"cclint") to include the date and a parenthetical link or citation token for
each competitor that explains the criteria used (e.g., feature check,
documentation page, or test method) so readers can trace and update the claims.

In `@src/fix/safety-fixer.ts`:
- Around line 154-157: There is a duplicated resolveSettingsTarget
implementation in safety-fixer.ts and hook-generator.ts; extract and consolidate
it into the existing utils module that already contains readJson, getHome and
getSettingsLocations, export it (preserving its current signature), then update
safety-fixer.ts and hook-generator.ts to import and use the shared
resolveSettingsTarget from utils; ensure behavior for the failing
HOME/USERPROFILE check stays the same and update any imports/tests that
reference the old local implementations.

In `@src/scan/cli.ts`:
- Around line 141-145: The catch block in src/scan/cli.ts currently prints only
err.message and loses the error stack; update the handler that catches "err" to
print the full stack when verbose/debugging is enabled (e.g., via a new CLI flag
like --verbose or an environment flag DEBUG), falling back to the concise
message when not enabled; specifically, augment the catch around the CLI main
flow so that it checks the flag and logs err.stack (or the error object) to
console.error when set, otherwise keep the existing short message, and still
call process.exit(1).