claude-slim 2.12.3 → 2.13.0

package/README.md

@@ -249,13 +249,15 @@ Token counts come from [js-tiktoken](https://github.com/nicolo-ribaudo/js-tiktok
 
 ---
 
-## v2.12.3 — What's new
+## v2.13.0 — What's new
 
-- **Fixed: the startup total counted a plugin's skills once per cached version.** `claude plugin update` leaves the old version behind as a symlink to the new one (`4.9.1 -> 4.15.4`), and the scan followed both as if they were separate installs — inflating the one number this tool exists to report. Both scanners now resolve the version a session actually loads. Measured here: plugin skill entries 148 → 107, startup total 13,435 → **12,504**.
-- **Fixed: every per-plugin cost was doubled when two versions were cached.** The breakdown showed one version's skill count beside two versions' tokens. `oh-my-claudecode` read as ~6,074 tokens against 41 skills; it is ~3,037.
-- **Corrected: v2.12.2 reported this issue as "1,944 tokens, 14.5%". It is 931 tokens, 6.9%.** That estimate mistook two distinct plugins shipping identical skill names (`document-skills` and `example-skills` share all 16) for duplicates.
+- **Changed: the startup estimate no longer counts disabled plugins.** Their skills are not in the session catalog, so they are not a startup cost — but they were being added to a number labelled "tokens at session start". Verified against a live session rather than assumed: skills from every disabled plugin were absent from the prompt, while every enabled one's were present. Measured here: **12,504 → 9,836**, a 21% correction.
+- **Added `disabledPluginSkillTokens`**, shown under the overhead line and in `--json` — what re-enabling everything would cost. A headline number that drops by a fifth with no explanation reads like a bug.
+- **Fixed: plugin skills are attributed to their plugin, not their marketplace.** One marketplace can host several plugins with different enabled states, so the two had to be told apart.
 
-Tests: 445 → 452 (+7).
+Only plugins *explicitly reported disabled* are excluded. `claude plugin list` has a third state — `✘ failed to load` — and a plugin in it still loads its skills, so anything unrecognised keeps counting.
+
+Tests: 452 → 461 (+9).
 
 For older release notes, see [CHANGELOG.md](CHANGELOG.md).
 

package/dist/report.js

@@ -251,6 +251,12 @@ export function formatScanSummary(result) {
     // --- SUMMARY ---
     lines.push('');
     lines.push(`\x1b[1m  ESTIMATED OVERHEAD\x1b[0m: ~${result.totalTokensBefore.toLocaleString()} tokens at session start`);
+    if (result.disabledPluginSkillTokens > 0) {
+        // Stated rather than silently omitted: the figure moved out of the total in
+        // 2.13.0, and a total that drops with no explanation reads like a bug.
+        lines.push(`  \x1b[90mexcludes ~${result.disabledPluginSkillTokens.toLocaleString()} tokens of disabled-plugin skills — ` +
+            `not loaded, so not a startup cost\x1b[0m`);
+    }
     if (result.issues.length > 0) {
         // Stated next to the total it is a fraction of, because the numbers on the
         // issue rows below are body sizes, not startup cost, and adding them up

package/dist/scanner/index.js

@@ -90,7 +90,39 @@ export async function scan(opts = {}) {
     // measured from each file's frontmatter description rather than assumed
     // (see scanner/skill-listing.ts) — the real spread is 30–500+ tokens apiece.
     const sumListing = (entries) => entries.reduce((sum, e) => sum + e.listingTokens, 0);
-    const skillListingTokens = sumListing(localSkills) + sumListing(pluginSkills);
+    // A disabled plugin's skills are not in the session catalog, so they cost
+    // nothing at startup. Verified against a live session: skills from every
+    // disabled plugin here (document-skills, superpowers, telegram, …) were
+    // absent from the prompt, while enabled ones were present. Counting them put
+    // 3,397 tokens — 27% of the total — into a number labelled "at session start".
+    //
+    // Only names reported *explicitly disabled* are dropped. `claude plugin list`
+    // also emits `failed to load`, which the parser matches as neither enabled nor
+    // disabled: railway reports it (a hook clash) and its twelve skills still
+    // load. Treating anything unrecognised as disabled would have silently
+    // deleted those from the total, so anything not known-disabled still counts.
+    // Keyed on `<plugin>@<marketplace>`, not the bare name: the same plugin name
+    // can be installed from two marketplaces in different states, and a name-only
+    // set would drop the enabled copy along with the disabled one. `pluginName`
+    // is the cache directory, which is the marketplace.
+    //
+    // An identity enabled anywhere is treated as enabled. `claude plugin list`
+    // emits one row per scope, so the same identity legitimately appears twice —
+    // and counting a live plugin is the safe error to make, not dropping it.
+    const pluginIdentity = (plugin, marketplace) => `${plugin}@${marketplace}`;
+    const enabledIdentities = new Set(installed.filter((p) => p.enabled).map((p) => pluginIdentity(p.name, p.marketplace)));
+    const disabledIdentities = new Set(installed
+        .filter((p) => !p.enabled)
+        .map((p) => pluginIdentity(p.name, p.marketplace))
+        .filter((id) => !enabledIdentities.has(id)));
+    const isLoadedAtStartup = (s) => {
+        if (s.plugin === undefined || s.pluginName === undefined)
+            return true;
+        return !disabledIdentities.has(pluginIdentity(s.plugin, s.pluginName));
+    };
+    const activePluginSkills = pluginSkills.filter(isLoadedAtStartup);
+    const disabledPluginSkillTokens = sumListing(pluginSkills.filter((s) => !isLoadedAtStartup(s)));
+    const skillListingTokens = sumListing(localSkills) + sumListing(activePluginSkills);
     const agentListingTokens = sumListing(userSurfaces.agents);
     const commandListingTokens = sumListing(userSurfaces.commands);
     // Memory is per-project: a session loads ~/.claude/projects/<slug>/memory/
@@ -138,6 +170,7 @@ export async function scan(opts = {}) {
         currentProjectMemoryTokens,
         allProjectsMemoryTokens,
         recoverableStartupTokens,
+        disabledPluginSkillTokens,
     };
 }
 async function pathExists(p) {

package/dist/scanner/plugin-skills.js

@@ -4,17 +4,6 @@ import { getPluginsDir } from '../paths.js';
 import { safeReadFile, safeReaddir, isDirectory, getDirSize, safeStat } from './fs-walk.js';
 import { pickActiveVersion } from './plugin-versions.js';
 import { listingTokensFromContent } from './skill-listing.js';
-/**
- * The directories under a marketplace whose skills a session would load — one
- * per plugin, never two versions of the same one.
- *
- * The cache is laid out `<marketplace>/<plugin>/<version>/`. A plugin whose
- * content sits directly under `<plugin>/` is returned as-is; otherwise its
- * children are versions and only the active one counts. That distinction is
- * drawn by looking for a `skills` directory rather than by pattern-matching
- * version names, so a plugin that ships no skills is simply walked as before
- * and contributes nothing either way.
- */
 async function resolveContentRoots(pluginBaseDir) {
     const entries = await safeReaddir(pluginBaseDir);
     // Flat layout: the cache entry holds content directly, with no plugin or
@@ -23,7 +12,7 @@ async function resolveContentRoots(pluginBaseDir) {
     // a candidate version, then picks exactly one — which is not a miscount but a
     // silent disappearance: the whole entry reported zero skills.
     if (entries.includes('skills'))
-        return [pluginBaseDir];
+        return [{ dir: pluginBaseDir }];
     const roots = [];
     for (const entry of entries) {
         const pluginDir = join(pluginBaseDir, entry);
@@ -32,7 +21,7 @@ async function resolveContentRoots(pluginBaseDir) {
         const children = await safeReaddir(pluginDir);
         if (children.includes('skills')) {
             // Content root, not a version container.
-            roots.push(pluginDir);
+            roots.push({ dir: pluginDir, plugin: entry });
             continue;
         }
         const versions = [];
@@ -46,11 +35,11 @@ async function resolveContentRoots(pluginBaseDir) {
         const active = pickActiveVersion(versions);
         // No subdirectories at all: hand back the plugin dir so the walk behaves
         // exactly as it did before rather than silently dropping the plugin.
-        roots.push(active ? active.dir : pluginDir);
+        roots.push({ dir: active ? active.dir : pluginDir, plugin: entry });
     }
     // A marketplace with no plugin subdirectories still needs walking — some
     // caches put content directly under the top level.
-    return roots.length > 0 ? roots : [pluginBaseDir];
+    return roots.length > 0 ? roots : [{ dir: pluginBaseDir }];
 }
 export async function scanPluginSkills() {
     const skills = [];
@@ -69,7 +58,7 @@ export async function scanPluginSkills() {
             return;
         }
         const pluginSkillNames = [];
-        const walkDir = async (dir) => {
+        const walkDir = async (dir, plugin) => {
             // Kept generic: a plugin's content root is normally
             // `<plugin>/<version>/`, but the walk also has to reach skills nested
             // deeper. Version selection happens before we get here — see
@@ -97,17 +86,18 @@ export async function scanPluginSkills() {
                                 listingTokens: listingTokensFromContent(skillDir, content),
                                 source: 'plugin',
                                 pluginName,
+                                plugin,
                             });
                         }
                     }
                 }
                 else {
-                    await walkDir(entryPath);
+                    await walkDir(entryPath, plugin);
                 }
             }
         };
         for (const root of await resolveContentRoots(pluginDir)) {
-            await walkDir(root);
+            await walkDir(root.dir, root.plugin);
         }
         if (pluginSkillNames.length > 0) {
             plugins.push({

package/dist/types.d.ts

@@ -14,7 +14,20 @@ export interface SkillInfo {
      */
     listingTokens: number;
     source: 'local' | 'plugin';
+    /**
+     * Cache directory this skill was found under — the *marketplace*, not the
+     * plugin. Kept as-is because `plugins[]` and the `disabled_plugin` detector
+     * match cache directories by this name (see parseDisabledPlugins).
+     */
     pluginName?: string;
+    /**
+     * The actual plugin, e.g. `oh-my-claudecode` where `pluginName` is `omc`.
+     *
+     * Needed because enabled/disabled state is reported per plugin, not per
+     * marketplace, and one marketplace can host both. Absent when the cache entry
+     * has no plugin level to read it from.
+     */
+    plugin?: string;
 }
 export interface BrokenSymlink {
     name: string;
@@ -109,6 +122,14 @@ export interface ScanResult {
      * against a 13,434-token startup total. This field is the honest number.
      */
     recoverableStartupTokens: number;
+    /**
+     * Skill-listing tokens belonging to plugins reported as disabled.
+     *
+     * Excluded from `totalTokensBefore` because a disabled plugin's skills are
+     * not in the session catalog. Reported separately so the number does not just
+     * vanish: it is what re-enabling everything would cost.
+     */
+    disabledPluginSkillTokens: number;
 }
 export interface ManifestEntry {
     date: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.12.3",
+  "version": "2.13.0",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {