Audit coding-agent instruction files for conflicts

Instructree audits a repository's coding-agent instruction files locally, without calling a model or uploading repository content, to establish which files exist, which may apply to a given target, and whether their metadata, links, or recursive imports are malformed. It covers common formats: AGENTS.md, CLAUDE.md, Copilot instructions, agent skills, custom agents, Cursor rules, and Windsurf rules. From the repository root it prefers an already-installed instructree command or the checked-out package's local binary, and only falls back to a pinned, explicitly approved npx github:...#<commit> download if neither is available - --yes is never added unless the user authorized non-interactive package downloads. Its commands scope from broad to narrow: instructree scan . --json inventories every supported file and emits stable diagnostics, instructree explain <file> --root . shows which instructions may apply to one target, adding --effective includes recursive Copilot CLI @path imports, instructree imports . --json audits that import graph on its own, and instructree scan . --sarif emits SARIF 2.1.0 for code-scanning integrations - --strict is added only when warnings should fail the check.

Use it before changing code in a repository that has any of the supported instruction formats, when a user asks which instructions may apply to one target file, or when auditing recursive Copilot CLI imports or exporting diagnostics to CI. It does not establish the exact precedence rules or runtime behavior of any specific agent client, does not prove instruction content is correct, safe, or effective, and never edits an instruction file unless the user explicitly asked for that change - always/never conflicts are reported as possible conflicts needing human review, not as proof of how an agent will actually behave.

Input is the repository root and, for explain, one target file path. Output is a set of file paths, line numbers, diagnostic codes, and the command's exit status - schema or path errors kept separate from warnings, and heuristic findings labeled as such - either as readable JSON or as a SARIF 2.1.0 report for a code-scanning pipeline.

The instructree CLI itself (local binary or a pinned, reviewed npx fallback); SARIF 2.1.0 output for existing code-scanning tooling. It performs no model calls and no repository upload - scans are strictly read-only and local.

Developers and teams maintaining multiple agent instruction files across formats (AGENTS.md, CLAUDE.md, Cursor/Windsurf rules) who need to know which instructions actually apply to a file before editing it, or want that check running in CI rather than discovered by accident.