claude-slim 2.12.0 → 2.12.1

package/README.md

@@ -248,12 +248,12 @@ Token counts come from [js-tiktoken](https://github.com/nicolo-ribaudo/js-tiktok
 
 ---
 
-## v2.12.0 — What's new
+## v2.12.1 — What's new
 
-- **`claude-slim update`** — runs the upgrade command for however this copy was installed, after showing it and asking. `--dry-run` to preview, `--yes` to skip the prompt. Plugin installs get the marketplace refresh first, then the qualified `claude-slim@claude-slim` id, and are reminded that a restart is needed. npx and source checkouts run nothing and say why — npx already resolves the latest every invocation, and pulling your own repository is not claude-slim's to do.
-- **This corrects v2.9.0's reasoning.** That release stopped at detection, arguing updating belonged to the package manager. Half held: claude-slim must not write into a directory `claude plugin` owns. The other half did not — invoking the package manager is something this tool already does during cleanup (`claude plugin disable`), so refusing to here was inconsistent. It still writes nothing itself.
+- **Fixed: the `/claude-slim` skill reported project memory as zero.** It invoked the CLI with `cd "${CLAUDE_PLUGIN_ROOT}"`, making `cwd` the plugin cache directory; the project slug resolved there, matched nothing, and every project-memory token silently left the startup total — **108,570** on the machine where this surfaced. `SKILL.md` no longer `cd`s. This hit the tool's primary entry point, and quietly: a zero reads as a clean result.
+- **`--project-dir <path>`** for callers that cannot run from the project directory, plus a warning when the CLI notices it is running from its own install without one.
 
-Tests: 374 → 392 (+18), pinning the safety properties — every argv a fixed literal, no shell metacharacters, executable only ever `claude` or `npm`, and a refusal to run unattended with no TTY and no `--yes`.
+Tests: 392 → 401 (+9).
 
 For older release notes, see [CHANGELOG.md](CHANGELOG.md).
 

package/dist/cli.js

@@ -10,6 +10,7 @@ import { cleanIssues, restoreItem } from './cleaner.js';
 import { readManifest } from './manifest.js';
 import { formatScanSummary, formatReportBox, calculateReport, } from './report.js';
 import { collectDoctorReport, formatDoctorReport } from './doctor.js';
+import { looksLikeToolInstallDir } from './paths.js';
 import { checkForUpdate, formatUpdateNotice } from './update-check.js';
 import { confirmDecision, planUpdate, renderStep, runUpdate } from './update-run.js';
 import { scanCodex } from './codex/index.js';
@@ -40,10 +41,15 @@ program
     .description('Scan environment and report issues')
     .option('--json', 'Output raw JSON')
     .option('--lookback-days <n>', 'Days of session history for skill-usage analysis', '60')
+    .option('--project-dir <path>', 'Directory whose project memory counts toward the total (default: cwd)')
     .option('--no-codex', 'Skip the ~/.codex scan even if Codex is installed')
     .action(async (opts) => {
     await initTokenizer();
-    const result = await scan({ lookbackDays: parseNonNegativeInt(opts.lookbackDays, 60) });
+    const projectDir = resolveProjectDir(opts.projectDir);
+    const result = await scan({
+        lookbackDays: parseNonNegativeInt(opts.lookbackDays, 60),
+        projectDir,
+    });
     // Codex is scanned when present. Reported only — it is never modified, and
     // unused-skill detection is suppressed there for lack of a usage signal.
     // commander maps `--no-codex` to `opts.codex === false`, not `opts.noCodex`.
@@ -185,6 +191,7 @@ program
     .option('--auto', 'Non-interactive: auto-select Tier 1 items only')
     .option('--sessions-per-day <n>', 'Sessions per day for savings estimate', '2')
     .option('--lookback-days <n>', 'Days of session history for skill-usage analysis', '60')
+    .option('--project-dir <path>', 'Directory whose project memory counts toward the total (default: cwd)')
     .option('--no-codex', 'Skip ~/.codex entirely')
     .action(async (opts) => {
     await runCleanPipeline({
@@ -193,6 +200,7 @@ program
         sessionsPerDay: parseNonNegativeInt(opts.sessionsPerDay, 2),
         lookbackDays: parseNonNegativeInt(opts.lookbackDays, 60),
         codex: opts.codex !== false,
+        projectDir: opts.projectDir,
     });
 });
 // --- restore ---
@@ -350,10 +358,28 @@ program.action(async () => {
     }
     await runCleanPipeline({ dryRun: false, auto: false, sessionsPerDay: 2, lookbackDays: 60, codex: true });
 });
+/**
+ * Resolve which directory's project memory counts toward the startup estimate.
+ *
+ * Warns when the CLI is running from its own install directory and no explicit
+ * directory was given: the slug would resolve to the plugin cache, match no
+ * project, and silently zero out every project-memory token. Warning beats
+ * guessing — we cannot know which project the user meant.
+ */
+function resolveProjectDir(explicit) {
+    if (explicit)
+        return explicit;
+    if (looksLikeToolInstallDir()) {
+        console.error('  \x1b[33m!\x1b[0m Running from claude-slim\'s own install directory, so project memory\n' +
+            '    cannot be attributed and is reported as 0. Pass --project-dir <path>\n' +
+            '    (or run from your project) for an accurate startup total.\n');
+    }
+    return undefined;
+}
 // --- shared clean pipeline ---
 async function runCleanPipeline(opts) {
     await initTokenizer();
-    const result = await scan({ lookbackDays: opts.lookbackDays });
+    const result = await scan({ lookbackDays: opts.lookbackDays, projectDir: resolveProjectDir(opts.projectDir) });
     // Codex issues join the same tiered list. They carry `agent: 'codex'`, which
     // is what keeps the cleaner's path guard pointed at ~/.codex/.
     const codexContents = new Map();

package/dist/paths.d.ts

@@ -12,6 +12,17 @@ export declare function getDisabledDir(): string;
  * the startup estimate must not sum memory across every project on disk.
  */
 export declare function getCurrentProjectSlug(cwd?: string): string;
+/**
+ * True when `cwd` sits inside claude-slim's own install rather than a project.
+ *
+ * The `/claude-slim` skill invokes the CLI with `cd "${CLAUDE_PLUGIN_ROOT}"`,
+ * which makes `process.cwd()` the plugin cache directory. The project slug then
+ * resolves to that path, no memory matches it, and the startup estimate silently
+ * drops every project-memory token — 108,570 of them on the machine where this
+ * was found. Detecting it lets the caller fail loudly or be told to pass
+ * `--project-dir` instead of quietly reporting zero.
+ */
+export declare function looksLikeToolInstallDir(cwd?: string): boolean;
 export declare function getManifestPath(): string;
 export declare function getLegacyManifestPath(): string;
 /** The agents claude-slim is allowed to touch. Adding one widens what every

package/dist/paths.js

@@ -26,6 +26,22 @@ export function getDisabledDir() {
 export function getCurrentProjectSlug(cwd = process.cwd()) {
     return resolve(cwd).replace(/\//g, '-');
 }
+/**
+ * True when `cwd` sits inside claude-slim's own install rather than a project.
+ *
+ * The `/claude-slim` skill invokes the CLI with `cd "${CLAUDE_PLUGIN_ROOT}"`,
+ * which makes `process.cwd()` the plugin cache directory. The project slug then
+ * resolves to that path, no memory matches it, and the startup estimate silently
+ * drops every project-memory token — 108,570 of them on the machine where this
+ * was found. Detecting it lets the caller fail loudly or be told to pass
+ * `--project-dir` instead of quietly reporting zero.
+ */
+export function looksLikeToolInstallDir(cwd = process.cwd()) {
+    const p = resolve(cwd).replace(/\\/g, '/');
+    return (p.includes('/.claude/plugins/') ||
+        p.includes('/_npx/') ||
+        /\/node_modules\/claude-slim(\/|$)/.test(p));
+}
 export function getManifestPath() {
     return join(getDisabledDir(), 'manifest.json');
 }

package/dist/scanner/index.d.ts

@@ -1,5 +1,14 @@
 import type { ScanResult } from '../types.js';
 export interface ScanOptions {
     lookbackDays?: number;
+    /**
+     * Directory whose project memory counts toward the startup estimate.
+     *
+     * Defaults to `process.cwd()`, which is wrong whenever the CLI is launched
+     * from its own install directory — the `/claude-slim` skill does exactly that
+     * via `cd "${CLAUDE_PLUGIN_ROOT}"`, and every project-memory token silently
+     * dropped out of the total as a result.
+     */
+    projectDir?: string;
 }
 export declare function scan(opts?: ScanOptions): Promise<ScanResult>;

package/dist/scanner/index.js

@@ -97,7 +97,7 @@ export async function scan(opts = {}) {
     // disk. Summing all of them (pre-2.8 behaviour) inflated the startup estimate
     // by a factor of however many projects the user had — 100k+ tokens on a busy
     // machine, for a number labelled "tokens at session start".
-    const currentProjectSlug = getCurrentProjectSlug();
+    const currentProjectSlug = getCurrentProjectSlug(opts.projectDir);
     const currentProjectMemoryTokens = memoryFiles
         .filter((m) => m.project === currentProjectSlug)
         .reduce((sum, m) => sum + m.tokens, 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.12.0",
+  "version": "2.12.1",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {

package/skills/claude-slim/SKILL.md

@@ -23,7 +23,7 @@ Analyze the user's Claude Code environment for token waste and perform non-destr
 An outdated claude-slim does not merely lack features — it reports **wrong numbers**. Versions before 2.8.0 summed memory across every project on disk and inflated the startup estimate roughly 8×. Presenting those figures as fact is worse than not running at all, so check first:
 
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js check-update --json
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" check-update --json
 ```
 
 The check is cached for 24h and fails open — if it errors, times out, or returns `"latest": null`, **proceed silently**. Never block the user because a version lookup failed.
@@ -50,13 +50,13 @@ If `"outdated": false`, say nothing and continue to Phase 1.
 Run the CLI to collect environment data:
 
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js scan --json
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" scan --json
 ```
 
 If `CLAUDE_PLUGIN_ROOT` is not set:
 ```bash
 PLUGIN_DIR=$(find ~/.claude/plugins -path "*/claude-slim/dist/cli.js" -type f 2>/dev/null | head -1 | xargs dirname | xargs dirname)
-cd "$PLUGIN_DIR" && node dist/cli.js scan --json
+node "$PLUGIN_DIR/dist/cli.js" scan --json
 ```
 
 If `node` is not available, fall back to the legacy bash scanner:
@@ -134,18 +134,18 @@ If subcommand is `scan`, stop here. Ask a localized equivalent of "Proceed with
 Run the interactive clean command:
 
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js clean
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" clean
 ```
 
 Or with dry-run:
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js clean --dry-run
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" clean --dry-run
 ```
 
 After cleanup, re-run scan to get updated numbers, then show the savings report:
 
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js report
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" report
 ```
 
 Present the report box AND the before/after breakdown table to the user.
@@ -157,7 +157,7 @@ Present the report box AND the before/after breakdown table to the user.
 When `/claude-slim restore` is invoked:
 
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js restore
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" restore
 ```
 
 ## Doctor
@@ -165,7 +165,7 @@ cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js restore
 When `/claude-slim doctor` is invoked:
 
 ```bash
-cd "${CLAUDE_PLUGIN_ROOT}" && node dist/cli.js doctor
+node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" doctor
 ```
 
 Explain warnings in the user's language. Pay special attention to session-log warnings because they explain why unused-skill detection may be suppressed.