@mbeato/contextscope 0.1.0

package/.next/standalone/DESIGN-EVAL-page-20260525-1015.md

@@ -0,0 +1,115 @@
+# Design Eval — page
+
+*generated 2026-05-25T15:15Z · component: app/page.tsx · variants: 4 · worktree: /Users/vtx/usage*
+
+## Score table
+
+| Variant | Slop | Spec | Faith | Distinct | Rhyme | Tokens | TOTAL | Verdict |
+|---|---|---|---|---|---|---|---|---|
+| linear-eyebrow  | 10/10 | 10/10 |  9/10 |  9/10 |  8/10 | 10/10 | 56/60 | ✓ ship |
+| attio-split     | 10/10 | 10/10 | 10/10 |  8/10 |  8/10 | 10/10 | 56/60 | ✓ ship |
+| posthog-canvas  | 10/10 | 10/10 | 10/10 |  9/10 |  7/10 | 10/10 | 56/60 | ✓ ship |
+| fusion          | 10/10 | 10/10 |  9/10 |  8/10 |  7/10 | 10/10 | 54/60 | ✓ ship |
+
+**Verdict bands:** ≥50 ship · 40–49 ship-with-caveats · <40 redo
+
+All four variants are in the ship band. No dimension scored ≤6 anywhere, so no lessons were extracted to the store this round.
+
+## Per-variant findings
+
+### linear-eyebrow — 56/60
+
+**Header decisions reproduced?**
+- *Numbered eyebrow `01`/`02`/... + hairline rule above each section*: ✓ — 27 `tabular-nums` instances (the eyebrow numbers + the tabular data they label) confirm the eyebrow rendered. `border-t` on `<Section>` confirmed at the section helper.
+- *Section title `text-2xl font-semibold tracking-tight`, NOT uppercase-tracking*: ✓ — 2 matches (one for the masthead at `text-5xl`, two for section titles at `text-2xl`). Deliberately breaks with the legacy `text-sm uppercase tracking-wider` pattern.
+- *Bare tables — no `rounded-lg border overflow-hidden` chrome*: ✓ — the 3 grep hits for `rounded-lg border` are in code comments explaining what the variant replaces, not actual JSX. `BareTable` helper has only `border-b` thead + `border-t` row rules.
+
+**Slop tells visible:** none — variant escapes the canonical AI defaults. No gradients, no glassmorphism, no shadows, no animated background, no symmetrical 3-col card grid, no pyramid composition.
+
+**Source faithfulness:** the Linear /home signatures (numerical ordinal eyebrows + type-led editorial single column + bare data tables with hairline rules) are all visible in the rendered screenshot. The 1-point deduction is for the masthead `text-5xl` which is slightly larger than Linear's home actually uses — Linear's display sizes are more restrained.
+
+**Sibling differentiation:** the only variant without a left rail or internal column-split — the cleanest type-led silhouette of the four. Most easily distinguishable in a thumbnail comparison.
+
+**Token / vocabulary issues:** none. 0 hex literals, 0 forbidden fonts, 0 forbidden libs, 0 non-palette ramps, 0 gradients, 0 shadows, 0 bespoke keyframes. Only `transition-colors` for hover.
+
+### attio-split — 56/60
+
+**Header decisions reproduced?**
+- *40/60 horizontal split per section via `grid grid-cols-[minmax(0,1fr)_2fr]`*: ✓ — exact syntax appears 4× in the file, one per major section block.
+- *Left column: S01/S02 eyebrow + title + intent + inline action*: ✓ — 4 `max-w-sm` constraints confirm the explainer column caps. Underline action buttons present.
+- *Right column hairline rules instead of card chrome*: ✓ — 9× `divide-y divide-zinc-200 dark:divide-zinc-800` plus `border-y` on row containers replace all rounded-lg card containers.
+
+**Slop tells visible:** none.
+
+**Source faithfulness:** the Attio /home structural signature (40/60 left-explainer + right-data per feature block, no top-of-section heading) is reproduced literally in syntax. Highest faithfulness of the four.
+
+**Sibling differentiation:** distinct from linear-eyebrow (which has full-width content, no internal column split). Slightly less distinct from fusion at the section level (both 40/60), but attio has no left rail so page-level silhouette differs.
+
+**Token / vocabulary issues:** none.
+
+### posthog-canvas — 56/60
+
+**Header decisions reproduced?**
+- *Persistent left-rail TOC at `w-56 sticky top-0 h-screen`*: ✓ — 2 matches for that exact selector (the nav itself + 1 sub-element).
+- *Anchor links jumping to `<section id="...">`*: ✓ — 11 `scroll-mt-` instances confirm the per-section anchor target with breathing room.
+- *Compact in-rail summary stats at top of rail*: ✓ — 5× `tracking-widest text-zinc-500` label instances + `text-2xl` stat values in the rail header.
+
+**Slop tells visible:** none.
+
+**Source faithfulness:** the PostHog /surveys slide-rail pattern (persistent left nav + main canvas with id-anchored sections) is the strongest page-level silhouette change in the set.
+
+**Sibling differentiation:** the only variant with a different page-level shell (rail + canvas). High differentiation from linear and attio.
+
+**Token / vocabulary issues:** none.
+
+### fusion — 54/60
+
+**Header decisions reproduced?**
+- *Backbone — PostHog rail (2-pane shell)*: ✓ — sticky rail confirmed via `w-56` selector.
+- *Typography — Attio 40/60 split inside each section*: ✓ — implemented as `md:grid-cols-5` with `md:col-span-2` (left explainer, `max-w-sm`) + `md:col-span-3` (right data). Proportionally identical to attio-split's `[minmax(0,1fr)_2fr]` syntax, different shape.
+- *Signature — Linear numbered eyebrows + hairline rule*: ✓ — 22 `tabular-nums` instances confirm dynamic eyebrow numbering (`padStart(2, "0")` for `00`/`01`/...). Section ordinals stay in sync because numbering is computed dynamically, not hardcoded.
+- *Unified intent stated*: ✓ — one-sentence intent line covers the integration thesis.
+
+**Slop tells visible:** none.
+
+**Source faithfulness:** all three sources independently verifiable in the JSX. Slight 1-point deduction because the Attio split is implemented via a 5-column grid + `col-span-2`/`col-span-3` rather than Attio's literal `[minmax(0,1fr)_2fr]` syntax — proportionally identical, but a designer comparing line-by-line would notice the indirection.
+
+**Sibling differentiation:** the closest pair in the set is fusion ↔ posthog-canvas (both have left rails). Fusion differentiates via inner 40/60 splits + numbered eyebrows that posthog-canvas doesn't have. Still readable as a different design, but less of a thumbnail gulf than linear ↔ posthog.
+
+**Token / vocabulary issues:** none.
+
+## Lessons extracted (0)
+
+No dimension scored ≤6 across any variant — the lowest individual score was 7/10 on `rhyme` for posthog-canvas and fusion (see Recommendations). Per the eval contract, lessons are only extracted on dim ≤6, so the store was not appended to this round.
+
+## Cross-variant observations (not lessons, but worth noting)
+
+- **Loading-state rhyme gap for shell-changing variants.** `app/loading.tsx` is a skeleton modeled on the original long-scroll page. If posthog-canvas or fusion ship, the skeleton becomes a layout-mismatch flash during cold load — user sees the old shape pulsing, then the new shell snaps in. Not a slop issue, but a real UX regression. If shipping either, update `loading.tsx` to skeleton the new shell.
+- **Pattern IDs missing from `pipeline.ts` output.** The corpus retrieval (`/tmp/refs.json`) returned objects without an `id` field, so the success log step below can't credit specific pattern_ids — only app slugs.
+
+## Success log
+
+Skipping because the retrieval output didn't include pattern_ids. The corpus query that seeded these variants is reproducible from the conversation context if you want to re-run with a more specific brief.
+
+If you `pick N and ship`, the minimum log entry that compiles:
+
+```bash
+bun run ~/.claude/design-corpus/scripts/log-success.ts \
+  --project=contextscope \
+  --component=page \
+  --query="developer audit dashboard with recommendations banner, stat-card grid, dense data tables with toggle-to-disable rows, bar-chart histograms, and session analytics in monospace terminal aesthetic" \
+  --variant=<slug-chosen> --seeded-by=linear,attio,posthog --score=9.3
+```
+
+## Distillation status
+
+`bun run lessons.ts count`: total=12, since_last_distill=12, last_distill_count=0
+
+**`since_last_distill` (12) exceeds the threshold (≥10).** Run `/distill-lessons` when convenient — it'll propose new bullets for the `<anti_slop_guardrails>` block in `~/.claude/commands/design.md` based on accumulated patterns from past `/design-eval` runs.
+
+## Recommendations
+
+- **All four are shippable.** No variant scored below the ship band; no slop tells visible in any of them; zero hard-floor violations across the board.
+- **If shipping posthog-canvas or fusion**: also update `app/loading.tsx` to skeleton the 2-pane shell, otherwise the loading state mismatches the rendered layout and produces a snap on first load.
+- **If shipping linear-eyebrow**: it's the most aesthetically distinct from the current dashboard — also closest in spirit to the project's stated `terminal-aesthetic` tag. Lowest risk of "looks like a different app" complaint because the type-led-single-column shape rhymes with terminal CLI output (the design system's intentional reference).
+- **Fusion has the highest design ambition but the densest canvas.** Worth a manual user-test pass before shipping to confirm the rail + inner split + eyebrows together don't overwhelm.

package/.next/standalone/DESIGN.md

@@ -0,0 +1,126 @@
+# contextscope — design system
+
+Local audit dashboard. Single-page Next.js 16 App Router app. Styled with Tailwind v4 (CSS-first, no config file) — no component library, no icon library committed.
+
+## Aesthetic
+
+Terminal-aesthetic dev dashboard. Mono-typography throughout, flat surfaces, hairline borders instead of shadows. Reads like a thoughtfully styled CLI output. No marketing chrome. No display fonts. No gradients.
+
+## Typography
+
+**One stack: system mono.** Every surface uses `font-mono` — the dashboard is intentionally typewriter-styled. Tailwind v4 resolves this to the user's system mono (SF Mono / Cascadia Mono / DejaVu Sans Mono / Menlo). No web font is loaded.
+
+- **Page title (`h1`):** `text-3xl font-semibold tracking-tight`
+- **Section heading (`h2`):** `text-sm uppercase tracking-wider text-zinc-500`
+- **Body / table:** `text-sm` (table) or `text-xs` (footnotes, hints)
+- **Stat values:** `text-xl font-semibold`
+- **Stat labels:** `text-xs uppercase tracking-wider text-zinc-500`
+- **Code references:** wrapped in `<code class="text-xs">`
+
+No display faces. No serif. No bespoke type ramps.
+
+## Color tokens
+
+Tailwind palette only. Semantic mapping is the convention — variants must respect these meanings, not improvise.
+
+- **Neutral / chrome:** `zinc-50` / `zinc-100` / `zinc-200` / `zinc-500` / `zinc-700` / `zinc-800` / `zinc-900` / `zinc-950`
+- **Positive / enabled / used:** `emerald-100` / `emerald-500` / `emerald-600` / `emerald-800` / `emerald-950`
+- **Warning / recommendations / hooks:** `amber-50` / `amber-100` / `amber-200` / `amber-300` / `amber-800` / `amber-900` / `amber-950`
+- **Danger / never-used / errors:** `red-50` / `red-100` / `red-200` / `red-300` / `red-400` / `red-500` / `red-600` / `red-700` / `red-800` / `red-900` / `red-950`
+- **Info / tools / charts:** `sky-500` / `sky-600`
+
+Dark mode is parallel: `dark:bg-zinc-950 dark:text-zinc-100` etc. Every surface MUST support both modes.
+
+Forbidden:
+- Hex literals (`#fff`, `#000`, etc.)
+- Other palette ramps (blue, violet, fuchsia, rose, orange, yellow, lime, green, teal, cyan, indigo, purple, pink, slate, gray, stone, neutral)
+- Gradients of any kind
+- Any non-Tailwind color value
+
+## Spacing
+
+Tailwind defaults. Workhorses:
+
+- **Page gutter:** `max-w-6xl mx-auto px-6 py-12`
+- **Section bottom:** `mb-10`
+- **Card padding:** `px-4 py-3`
+- **Table cell padding:** `px-4 py-2`
+- **Header bottom:** `mb-6`
+- **Grid gap:** `gap-4`
+
+Arbitrary spacing values forbidden.
+
+## Radii
+
+- `rounded` (table cells / small chips) — 4px
+- `rounded-md` (banner) — 6px
+- `rounded-lg` (cards, table containers) — 8px
+- `rounded-full` (toggle pills, dot indicators)
+
+No other radii.
+
+## Borders + surfaces
+
+- Always **1px borders, never shadows.** `border border-zinc-200 dark:border-zinc-800` is the universal chrome.
+- Hover: row background to `hover:bg-zinc-50 dark:hover:bg-zinc-900/50` — never elevation, never border-color change.
+- Recommendations: amber-tinted border + bg (`border-amber-300 dark:border-amber-900/50 bg-amber-50/50 dark:bg-amber-950/10`)
+- Disable candidates (never-used rows): red-tinted bg (`bg-red-50/40 dark:bg-red-950/20`)
+- Disabled rows: `opacity-50`
+
+No shadows. No glassmorphism. No `backdrop-blur`.
+
+## Motion
+
+Single canonical keyframe: `pulse` (Tailwind default, used on loading skeletons).
+
+Forbidden:
+- Bespoke `@keyframes`
+- `transition-all`
+- Gradient animations
+- Shimmer effects
+
+Hover transitions use `transition-colors` (color change only, no transform).
+
+## Components
+
+**No primitives library committed.** All UI is raw HTML + Tailwind classes inline. Tables use bare `<table>` / `<thead>` / `<tbody>` / `<tr>` / `<td>` elements. Buttons are bare `<button>` elements. Form actions are inline `<form action={...}>` blocks per Next.js server-action conventions.
+
+This is intentional. The dashboard is small enough that primitive extraction would add abstraction tax without reuse payoff. Variants should NOT introduce a component library.
+
+## Iconography
+
+**None currently.** No icon library is installed or used. The current page has zero icons — pure type and color blocks.
+
+If a variant needs icons, the chosen library is `@tabler/icons-react` (per `.claude/design.config.json`). Variants that introduce icons must:
+1. Note the dependency add in the variant header comment
+2. Use only `@tabler/icons-react` — never Lucide, Hero Icons, or bespoke SVG
+
+## Layout patterns
+
+Currently a single long-scroll page. Section order:
+
+1. Header (title + one-line description)
+2. Restart-needed banner (sticky amber)
+3. Recommendations (amber cards with bulk actions)
+4. Recent toggle activity (table)
+5. Top stat cards (4-up grid)
+6. Sessions section (4-up sub-stats + daily burn bars + top-10 table)
+7. Burn by project (table)
+8. Tool call histogram (bar list)
+9. By plugin (table with toggles)
+10. All items (table with per-row toggles)
+11. CLAUDE.md / MEMORY.md (table)
+12. Hooks (table)
+13. MCP servers (table)
+14. Footer (constraint disclosures)
+
+Variants can re-arrange, regroup, or replace this layout — that's the whole point of a redesign. But each section's DATA must remain (no dropping numbers; redesign is purely visual).
+
+## Reference look
+
+The dashboard's existing visual language is intentionally similar to:
+- **ccusage** terminal output — tabular numbers, mono type
+- **htop** / **lazygit** — dense data, semantic colors, no chrome
+- **GitHub Actions** logs — section headings, monospace timestamps
+
+Variants should rhyme with this terminal-tool sensibility, NOT with marketing-page dashboards.

package/.next/standalone/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/.next/standalone/PLAN.md

@@ -0,0 +1,109 @@
+# Plan: `usage` dashboard
+
+## Goal
+
+Build a local web UI that audits Claude Code's per-turn token baseline at skill / agent / plugin granularity and lets the user disable unused items with one click. Personal tool for one user (max), local-only, no auth, no hosting.
+
+## Success criteria
+
+- Page loads in < 1s on filesystem read
+- Tokenized cost per skill/agent within ~10% of Anthropic's count (use `js-tiktoken` cl100k_base as proxy — Anthropic doesn't publish theirs)
+- Lists every installed skill + agent across user dirs + plugin dirs
+- Cross-references with last 30 days of JSONL transcripts to mark "never invoked"
+- Toggle writes to `~/.claude/settings.json` and survives next session
+- Projected savings calculation: `(skill cost) × (estimated turns per day from ccusage)` → daily / monthly delta
+
+## Stack (recommendation, push back if you disagree)
+
+- **Next.js 16 App Router** + React 19 + Tailwind v4 — matches `anv`, fast scaffold via `create-next-app`
+- **shadcn/ui** for the table + toggle components
+- **`js-tiktoken`** for token counting (cl100k_base — best public proxy for Anthropic's tokenizer)
+- **No DB** — read filesystem on each request; ~/.claude is small enough
+- **Runs at `localhost:3939`** (memorable, unused)
+
+Alternative considered: Bun + Hono + vanilla HTML. Half the code, no framework overhead. Rejected because shadcn/ui + Tailwind + React is the right surface for the planned interactivity (sortable tables, toggles, projected-savings calculator), and Max already lives in this stack.
+
+## Data sources
+
+| What | Where | Notes |
+|---|---|---|
+| User skills | `~/.claude/skills/*.md` | May not exist; check first |
+| User agents | `~/.claude/agents/*.md` | Individual delete is allowed |
+| Plugin skills | `~/.claude/plugins/cache/*/[plugin]/[version]/skills/*/SKILL.md` | Bundled — can't disable individually |
+| Plugin agents | `~/.claude/plugins/cache/*/[plugin]/[version]/agents/*.md` | Same constraint |
+| Built-in skills | (in CC binary) | Out of scope — can't introspect |
+| Enabled plugins | `~/.claude/settings.json` → `enabledPlugins` | Plugin-level on/off |
+| Usage transcripts | `~/.claude/projects/*/*.jsonl` | Parse `tool_use` events for skill/agent names |
+| Daily token totals | reuse `ccusage` JSON output | `npx ccusage@latest --json` |
+
+## Known constraint: individual skill disable
+
+**Plugin skills cannot be individually disabled in Claude Code's current model.** You can only enable/disable the whole plugin via `enabledPlugins`. This affects ~80% of skills (the `gsd:*`, `superpowers:*`, `frontend-design:*` ones).
+
+Workarounds for v1:
+- Plugin-level toggle (fully supported)
+- For per-skill: rename `SKILL.md` → `SKILL.md.disabled` in the plugin cache directory (works but is brittle — plugin updates will overwrite it)
+- User-level skills (`~/.claude/skills/`, `~/.claude/agents/`) CAN be moved/deleted
+
+v1 surfaces this honestly: "Plugin-bundled — disable requires turning off whole plugin (`X` other skills also affected)".
+
+## Phases
+
+### Phase 1 — Static analysis (MVP, ~half day)
+
+Read-only dashboard. No usage data, no toggles. Just: "here's every skill/agent and what it costs."
+
+- Scan filesystem, build skill/agent inventory
+- Tokenize each with `js-tiktoken`
+- Sortable table: name, type (skill/agent), source (user/plugin), token cost, plugin name
+- Group view: total cost per plugin
+- Grand total = "per-turn baseline you can see"
+
+**Goal of phase 1: surface the bloat. Just seeing the numbers is value.**
+
+### Phase 2 — Usage data overlay
+
+Parse JSONL transcripts to get invocation counts. Cross-reference with the inventory.
+
+- Last-N-days filter (default 30)
+- Add columns: invocations, last used, "loaded but unused" flag
+- Color-code: green = used frequently, yellow = rarely, red = never invoked but always loaded
+- "Bloat score" = cost ÷ (invocations + 1) → sortable
+
+### Phase 3 — Click-to-disable
+
+- Plugin toggle: writes `enabledPlugins` in `settings.json`
+- For user-level skills/agents: move file to `.disabled/` subfolder
+- Projected savings panel: "Disabling these N items saves ~X tokens per turn → ~Y tokens/day at your current pace"
+- Use ccusage to get current turns/day for the projection
+
+### Phase 4 — Polish
+
+- Recommendation engine: "These 12 GSD skills have 0 invocations in 30 days"
+- Trend chart: per-skill invocation over time
+- Diff view: "before / after" of pending toggle changes
+- Per-MCP-server breakdown (count tool names contributed)
+
+## Open questions
+
+1. **How big is the actual savings?** Need a baseline number from Phase 1 before deciding if Phase 3 is worth building.
+2. **Tokenizer accuracy.** cl100k_base may diverge from Anthropic's tokenizer enough that absolute numbers are misleading. Relative ranking should still be correct.
+3. **JSONL schema stability.** Claude Code changes its transcript format occasionally. Need defensive parsing.
+4. **Can we measure agent system-prompt cost separately from agent description?** Agents are loaded as descriptions in the main system prompt, but their full content only loads when invoked. The description block is what compounds per turn.
+
+## Out of scope (v1)
+
+- Built-in Claude Code skills (can't read them)
+- MCP server tool inventory (separate problem — though we just consolidated all of yours behind PTC)
+- Multi-user / hosted version
+- History / time travel of toggle changes
+
+## First commit
+
+1. `npx create-next-app@latest usage --typescript --tailwind --app --no-src-dir --turbopack`
+2. Install `shadcn/ui`, `js-tiktoken`, `gray-matter`
+3. Drop a `lib/inventory.ts` that returns the skill/agent list as JSON
+4. Render the table at `app/page.tsx`
+5. Run, screenshot, look at numbers, decide if Phase 2 is worth it
+
+That's the MVP. Should be ~3 hours.

package/.next/standalone/README.md

@@ -0,0 +1,97 @@
+# contextscope
+
+A local dashboard that audits the **per-turn token context** Claude Code loads on every conversation turn — and gives you toggle-based control to disable what you don't use.
+
+`/stats`, `/cost`, and `ccusage` show **aggregate** spend. None of them break down what's *inside* the per-turn baseline or let you act on the audit. At 1M-context Opus, every unused skill, agent, command, or hook output that lives in the available-list block is paying full cache-read cost on every turn — for a heavy user, that's hundreds of millions of tokens per month.
+
+## Install + run
+
+```bash
+npx @mbeato/contextscope
+```
+
+Picks a free port starting at 3939, opens your browser, audits in real time.
+
+Or install globally so the `contextscope` command stays around:
+
+```bash
+npm install -g @mbeato/contextscope
+contextscope
+```
+
+Flags:
+- `--port <n>` — pin a port
+- `--no-open` — don't auto-open the browser
+- `--help` — full usage
+
+## Optional: Claude Code slash command
+
+After installing globally, run:
+
+```bash
+contextscope install-plugin
+```
+
+This copies a `/usage` slash command into `~/.claude/commands/usage.md`. Restart Claude Code, then `/usage` in any session asks Claude to launch the dashboard in the background and report the URL. Remove with `contextscope uninstall-plugin`.
+
+## What it shows
+
+- **Skills, agents, slash commands** (user + plugin) — per-turn description cost + body cost on invocation
+- **CLAUDE.md** (global + every project) + **MEMORY.md** (per-project auto-memory) — full token count, where loaded
+- **SessionStart + UserPromptSubmit hook output** — dry-run with sample input, output tokenized
+- **MCP servers** — direct + PTC-proxied downstream
+- **Session analytics** — top expensive sessions, daily burn, cache hit ratio, output:input ratio, p75/p95
+- **Invocation counts** per skill/agent over the last 30 days from JSONL transcripts
+- **Recommendation engine** — bulk-disable unused user items in one click, surface long-session patterns
+
+## What it does
+
+- Toggles individual user-level skills / agents / commands (renames file with `.disabled` suffix — reversible)
+- Toggles whole plugins (flips `enabledPlugins[<plugin>@<marketplace>]` in `~/.claude/settings.json`)
+- Backs up `settings.json` before every mutation (`~/.claude/settings.json.usage-bak-<timestamp>`, 5 most recent kept)
+- Bulk-disables every user item never invoked in the last 30 days
+
+> **Toggles take effect on the next Claude Code restart** — CC reads skills, agents, commands, and `settings.json` at startup. There's no hot-reload mechanism.
+
+## Known constraint
+
+Plugin-bundled skills/agents (e.g. `superpowers:brainstorming`, `gsd:plan-phase`) **cannot be individually disabled** in Claude Code's current model — you can only toggle the whole plugin. The "By plugin" table handles this; individual plugin items in the main table show `(plugin)` as their toggle status.
+
+## How it measures tokens
+
+Uses [`js-tiktoken`](https://github.com/dqbd/tiktoken) with the `cl100k_base` encoder as a proxy for Anthropic's tokenizer (not publicly released). Expect ~5–10% absolute deviation; relative rankings should be accurate.
+
+## What it can't measure
+
+- The base Claude Code system prompt (built into the binary)
+- Tool-call results that compound mid-session
+- The `available skills` / `available agents` wrapper blocks the harness adds around your descriptions
+
+## Development
+
+```bash
+git clone <repo> contextscope
+cd contextscope
+npm install
+npm run dev       # localhost:3000 — slow page loads from Next.js dev bundling
+npm run prod      # build + start in production mode — ~0.6s warm reload
+```
+
+Requires Node 18+. macOS/Linux paths; Windows untested but uses `os.homedir()` throughout.
+
+## Architecture
+
+- **`lib/transcripts.ts`** — unified single-pass JSONL parser with per-file mtime cache; consumed by `usage.ts` + `sessions.ts`
+- **`lib/inventory.ts`** — scans skills, agents, commands; detects `.disabled` siblings; reads `enabledPlugins`
+- **`lib/usage.ts`** — invocation counts per skill/agent from transcripts
+- **`lib/sessions.ts`** — per-session token aggregation + summary stats
+- **`lib/files.ts`** — CLAUDE.md + MEMORY.md scanner with denylist for dependency-bundled noise
+- **`lib/hooks.ts`** — reads settings.json hooks, parallel dry-runs SessionStart + UserPromptSubmit
+- **`lib/mcp.ts`** — reads `.claude.json` mcpServers, parses PTC's downstream config.yaml
+- **`app/actions.ts`** — server actions for toggles + bulk disable; backs up settings before write
+- **`app/page.tsx`** — single server-rendered page; filesystem re-read on every load (cached internally)
+- **`bin/cli.js`** — CLI entry: spawns Next.js standalone server, opens browser, ships subcommands
+
+## License
+
+MIT

package/.next/standalone/app/actions.ts

@@ -0,0 +1,141 @@
+"use server";
+
+import { readdir, readFile, realpath, rename, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve, sep } from "node:path";
+import { revalidatePath } from "next/cache";
+
+const HOME = homedir();
+const CLAUDE_DIR = join(HOME, ".claude");
+const SETTINGS_PATH = join(CLAUDE_DIR, "settings.json");
+const MAX_BACKUPS = 5;
+
+// Lexical resolve at module load. Allowed dirs themselves are NOT realpath'd
+// here because the dirs may not exist on a fresh ~/.claude install; we realpath
+// them lazily inside the check.
+const ALLOWED_DIRS = [
+  resolve(CLAUDE_DIR, "skills"),
+  resolve(CLAUDE_DIR, "agents"),
+  resolve(CLAUDE_DIR, "commands"),
+];
+
+async function realpathOrLexical(p: string): Promise<string> {
+  try {
+    return await realpath(p);
+  } catch {
+    // File doesn't exist yet (e.g. checking the .disabled sibling before rename).
+    // Fall back to realpath'ing the deepest existing ancestor + joining the rest,
+    // so a malicious "exists/<symlink>/../escape" can't slip through but a
+    // legitimate not-yet-created sibling still resolves correctly.
+    const parent = dirname(p);
+    if (parent === p) return resolve(p);
+    const realParent = await realpathOrLexical(parent);
+    return join(realParent, p.slice(parent.length + 1));
+  }
+}
+
+/**
+ * Strict allowlist check. Follows symlinks via realpath() and confirms the
+ * canonical absolute path lives under one of the allowed dirs. Defends against
+ * both lexical traversal (`~/.claude/skills/../../.zshrc`) and symlink escape
+ * (a `~/.claude/skills/foo` symlink pointing outside).
+ */
+async function safeUserPath(p: string): Promise<boolean> {
+  if (typeof p !== "string" || p.length === 0) return false;
+  const real = await realpathOrLexical(resolve(p));
+  // Realpath the allowed-dir prefixes too — if the user has symlinked
+  // ~/.claude/skills itself, both sides need to canonicalize the same way.
+  for (const allowed of ALLOWED_DIRS) {
+    let realAllowed: string;
+    try {
+      realAllowed = await realpath(allowed);
+    } catch {
+      realAllowed = allowed; // dir doesn't exist on this install — match lexically
+    }
+    if (real === realAllowed || real.startsWith(realAllowed + sep)) return true;
+  }
+  return false;
+}
+
+async function backupSettings(): Promise<void> {
+  try {
+    const raw = await readFile(SETTINGS_PATH, "utf8");
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const bakPath = join(CLAUDE_DIR, `settings.json.usage-bak-${stamp}`);
+    await writeFile(bakPath, raw, "utf8");
+    // Garbage-collect older backups beyond MAX_BACKUPS
+    const entries = await readdir(CLAUDE_DIR, { withFileTypes: true });
+    const baks = entries
+      .filter((e) => e.isFile() && e.name.startsWith("settings.json.usage-bak-"))
+      .map((e) => join(CLAUDE_DIR, e.name));
+    if (baks.length > MAX_BACKUPS) {
+      const withMtime = await Promise.all(
+        baks.map(async (p) => ({ p, mt: (await stat(p)).mtimeMs }))
+      );
+      withMtime.sort((a, b) => a.mt - b.mt);
+      const toDelete = withMtime.slice(0, withMtime.length - MAX_BACKUPS);
+      const { unlink } = await import("node:fs/promises");
+      await Promise.all(toDelete.map((x) => unlink(x.p)));
+    }
+  } catch {
+    // best-effort: don't block the actual write if backup fails
+  }
+}
+
+export async function toggleUserItem(filePath: string): Promise<void> {
+  if (!(await safeUserPath(filePath))) {
+    throw new Error(
+      `Refusing to toggle file outside ~/.claude/skills, /agents, or /commands: ${filePath}`
+    );
+  }
+  const newPath = filePath.endsWith(".disabled")
+    ? filePath.slice(0, -".disabled".length)
+    : `${filePath}.disabled`;
+  await rename(filePath, newPath);
+  // Invalidate every route below the root layout so toggles from /items,
+  // /sessions, /context, and / all see fresh state on next navigation.
+  revalidatePath("/", "layout");
+}
+
+export async function togglePlugin(pluginKey: string): Promise<void> {
+  await backupSettings();
+  const raw = await readFile(SETTINGS_PATH, "utf8");
+  const parsed = JSON.parse(raw) as Record<string, unknown>;
+  const ep = (parsed.enabledPlugins ?? {}) as Record<string, boolean>;
+  const current = ep[pluginKey] !== false;
+  ep[pluginKey] = !current;
+  parsed.enabledPlugins = ep;
+  await writeFile(SETTINGS_PATH, JSON.stringify(parsed, null, 2) + "\n", "utf8");
+  // Invalidate every route below the root layout so toggles from /items,
+  // /sessions, /context, and / all see fresh state on next navigation.
+  revalidatePath("/", "layout");
+}
+
+/**
+ * Bulk-disable every user-level skill/agent/command file passed in. Plugin items
+ * are not handled here — use togglePlugin for those.
+ */
+export async function disableUserItems(filePaths: string[]): Promise<{ moved: number; skipped: number }> {
+  let moved = 0;
+  let skipped = 0;
+  for (const fp of filePaths) {
+    if (!(await safeUserPath(fp))) {
+      skipped++;
+      continue;
+    }
+    if (fp.endsWith(".disabled")) {
+      skipped++;
+      continue;
+    }
+    try {
+      await rename(fp, `${fp}.disabled`);
+      moved++;
+    } catch {
+      skipped++;
+    }
+  }
+  // Invalidate every route below the root layout so toggles from /items,
+  // /sessions, /context, and / all see fresh state on next navigation.
+  revalidatePath("/", "layout");
+  return { moved, skipped };
+}

package/.next/standalone/app/components/Nav.tsx

@@ -0,0 +1,47 @@
+"use client";
+
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+
+const ROUTES = [
+  { href: "/items", label: "items" },
+  { href: "/sessions", label: "sessions" },
+  { href: "/context", label: "context" },
+];
+
+export function Nav() {
+  const pathname = usePathname();
+
+  return (
+    <nav className="border-b border-zinc-200 dark:border-zinc-800 bg-zinc-50 dark:bg-zinc-950 sticky top-0 z-10">
+      <div className="max-w-6xl mx-auto px-6 h-12 flex items-center gap-8 text-sm">
+        <Link
+          href="/"
+          className={`font-semibold tracking-tight ${
+            pathname === "/" ? "text-zinc-900 dark:text-zinc-100" : "text-zinc-500 hover:text-zinc-900 dark:hover:text-zinc-100"
+          } transition-colors`}
+        >
+          contextscope
+        </Link>
+        <div className="flex items-center gap-5">
+          {ROUTES.map((r) => {
+            const active = pathname === r.href || pathname.startsWith(r.href + "/");
+            return (
+              <Link
+                key={r.href}
+                href={r.href}
+                className={`${
+                  active
+                    ? "text-zinc-900 dark:text-zinc-100 underline underline-offset-[6px] decoration-zinc-400 decoration-1"
+                    : "text-zinc-500 hover:text-zinc-900 dark:hover:text-zinc-100"
+                } transition-colors`}
+              >
+                {r.label}
+              </Link>
+            );
+          })}
+        </div>
+      </div>
+    </nav>
+  );
+}