claude-slim 2.12.3 → 2.13.1

package/README.md

@@ -94,21 +94,21 @@ That's slower responses. Hitting your usage cap faster. Paying for context you'r
 **Report** — Shows exactly what changed:
 
 ```
-╭──────────────────────────────────────────╮
-│  claude-slim report                      │
-│                                          │
-│  Before: 14,510 tokens at startup        │
-│  After:   5,181 tokens at startup        │
-│  Saved:   9,329 tokens (64.3%)           │
-│                                          │
-│  Top offenders removed:                  │
-│  • office-hours              23,008 tok  │
-│  • harness                    7,902 tok  │
-│  • manpower                   4,764 tok  │
-│                                          │
-│  Est. monthly savings: ~$1.68            │
-│  (2 sessions/day × $0.003/1K tok)        │
-╰──────────────────────────────────────────╯
+╭────────────────────────────────────────╮
+│  claude-slim report                    │
+│                                        │
+│  Before: 14,510 tokens at startup      │
+│  After:   5,181 tokens at startup      │
+│  Saved:   9,329 tokens (64.3%)         │
+│                                        │
+│  Top offenders removed:                │
+│  • office-hours              23,008 tok│
+│  • harness                    7,902 tok│
+│  • manpower                   4,764 tok│
+│                                        │
+│  Est. monthly savings: ~$1.68          │
+│  (2 sessions/day × $0.003/1K tok)      │
+╰────────────────────────────────────────╯
 
   ┌──────────────────┬──────────┬──────────┬────────────┐
   │                  │  Before  │  After   │  Saved     │
@@ -249,13 +249,14 @@ Token counts come from [js-tiktoken](https://github.com/nicolo-ribaudo/js-tiktok
 
 ---
 
-## v2.12.3 — What's new
+## v2.13.1 — What's new
 
-- **Fixed: the startup total counted a plugin's skills once per cached version.** `claude plugin update` leaves the old version behind as a symlink to the new one (`4.9.1 -> 4.15.4`), and the scan followed both as if they were separate installs — inflating the one number this tool exists to report. Both scanners now resolve the version a session actually loads. Measured here: plugin skill entries 148 → 107, startup total 13,435 → **12,504**.
-- **Fixed: every per-plugin cost was doubled when two versions were cached.** The breakdown showed one version's skill count beside two versions' tokens. `oh-my-claudecode` read as ~6,074 tokens against 41 skills; it is ~3,037.
-- **Corrected: v2.12.2 reported this issue as "1,944 tokens, 14.5%". It is 931 tokens, 6.9%.** That estimate mistook two distinct plugins shipping identical skill names (`document-skills` and `example-skills` share all 16) for duplicates.
+- **Fixed: `scan` promised the tool never touches `~/.codex/`, while `clean --auto` deletes from it permanently.** The Codex summary closed with `Reported only — claude-slim never modifies ~/.codex/.` That was true in v2.10 and false from **v2.11** on, when `clean` gained the Codex tiers. Measured here: `clean --dry-run` selects `[Auto] [codex] temp_cache: .tmp (146MB of install leftovers) (permanent)` — Tier 1, which `--auto` applies without prompting and no `restore` undoes.
+- The summary now says what actually happens: `scan` only reads, `clean` acts under the same tiers as `~/.claude/`, moves land in `~/.codex/skills.disabled/` and reverse with `restore`, and Tier 1 install leftovers are deleted permanently.
 
-Tests: 445 → 452 (+7).
+A test was holding the false claim in place. It asserted the summary *must* say "never modifies", so the line could not be corrected without a test failing — and all 461 tests stayed green across four releases that contradicted it. The assertion is now inverted: the summary must not promise `~/.codex/` is left alone, and must name the permanent deletion and `--auto`.
+
+Tests: 461 → 462.
 
 For older release notes, see [CHANGELOG.md](CHANGELOG.md).
 

package/dist/cli.js

@@ -50,8 +50,9 @@ program
         lookbackDays: parseNonNegativeInt(opts.lookbackDays, 60),
         projectDir,
     });
-    // Codex is scanned when present. Reported only — it is never modified, and
-    // unused-skill detection is suppressed there for lack of a usage signal.
+    // Codex is scanned when present. `scan` only reads; `clean` has acted here
+    // since v2.11 under the same tiers. Unused-skill detection stays suppressed
+    // for lack of a usage signal.
     // commander maps `--no-codex` to `opts.codex === false`, not `opts.noCodex`.
     const codex = opts.codex === false ? null : await scanCodex();
     await flushCache();

package/dist/codex/report.js

@@ -44,13 +44,15 @@ export function formatCodexSummary(result) {
             lines.push(`    ${b.name.length > 30 ? `${b.name.slice(0, 29)}…` : b.name.padEnd(30)} ` +
                 `${String(b.listingTokens).padStart(5)} tok  \x1b[90m${b.backupArtifact}\x1b[0m`);
         }
-        lines.push(`    \x1b[90mNot removed — ~/.codex/ is read-only here. Delete manually if stale.\x1b[0m`);
+        lines.push(`    \x1b[90mOffered by clean as Tier 2 — moved to ~/.codex/skills.disabled/, reversible with restore.\x1b[0m`);
     }
     lines.push('');
     lines.push(`  \x1b[33m!\x1b[0m Unused-skill detection unavailable for Codex.`);
     lines.push(`    \x1b[90m${result.unusedDetectionReason}\x1b[0m`);
     lines.push('');
-    lines.push(`  \x1b[90mReported only — claude-slim never modifies ~/.codex/.\x1b[0m`);
+    lines.push(`  \x1b[90mscan only reads. Since v2.11 clean also acts here, under the same tiers as ~/.claude/:\x1b[0m`);
+    lines.push(`  \x1b[90mmoves go to ~/.codex/skills.disabled/ and reverse with restore, but Tier 1 install\x1b[0m`);
+    lines.push(`  \x1b[90mleftovers (~/.codex/.tmp) are deleted permanently, and --auto applies Tier 1 unprompted.\x1b[0m`);
     lines.push('');
     return lines.join('\n');
 }

package/dist/report.js

@@ -251,6 +251,12 @@ export function formatScanSummary(result) {
     // --- SUMMARY ---
     lines.push('');
     lines.push(`\x1b[1m  ESTIMATED OVERHEAD\x1b[0m: ~${result.totalTokensBefore.toLocaleString()} tokens at session start`);
+    if (result.disabledPluginSkillTokens > 0) {
+        // Stated rather than silently omitted: the figure moved out of the total in
+        // 2.13.0, and a total that drops with no explanation reads like a bug.
+        lines.push(`  \x1b[90mexcludes ~${result.disabledPluginSkillTokens.toLocaleString()} tokens of disabled-plugin skills — ` +
+            `not loaded, so not a startup cost\x1b[0m`);
+    }
     if (result.issues.length > 0) {
         // Stated next to the total it is a fraction of, because the numbers on the
         // issue rows below are body sizes, not startup cost, and adding them up

package/dist/scanner/index.js

@@ -90,7 +90,39 @@ export async function scan(opts = {}) {
     // measured from each file's frontmatter description rather than assumed
     // (see scanner/skill-listing.ts) — the real spread is 30–500+ tokens apiece.
     const sumListing = (entries) => entries.reduce((sum, e) => sum + e.listingTokens, 0);
-    const skillListingTokens = sumListing(localSkills) + sumListing(pluginSkills);
+    // A disabled plugin's skills are not in the session catalog, so they cost
+    // nothing at startup. Verified against a live session: skills from every
+    // disabled plugin here (document-skills, superpowers, telegram, …) were
+    // absent from the prompt, while enabled ones were present. Counting them put
+    // 3,397 tokens — 27% of the total — into a number labelled "at session start".
+    //
+    // Only names reported *explicitly disabled* are dropped. `claude plugin list`
+    // also emits `failed to load`, which the parser matches as neither enabled nor
+    // disabled: railway reports it (a hook clash) and its twelve skills still
+    // load. Treating anything unrecognised as disabled would have silently
+    // deleted those from the total, so anything not known-disabled still counts.
+    // Keyed on `<plugin>@<marketplace>`, not the bare name: the same plugin name
+    // can be installed from two marketplaces in different states, and a name-only
+    // set would drop the enabled copy along with the disabled one. `pluginName`
+    // is the cache directory, which is the marketplace.
+    //
+    // An identity enabled anywhere is treated as enabled. `claude plugin list`
+    // emits one row per scope, so the same identity legitimately appears twice —
+    // and counting a live plugin is the safe error to make, not dropping it.
+    const pluginIdentity = (plugin, marketplace) => `${plugin}@${marketplace}`;
+    const enabledIdentities = new Set(installed.filter((p) => p.enabled).map((p) => pluginIdentity(p.name, p.marketplace)));
+    const disabledIdentities = new Set(installed
+        .filter((p) => !p.enabled)
+        .map((p) => pluginIdentity(p.name, p.marketplace))
+        .filter((id) => !enabledIdentities.has(id)));
+    const isLoadedAtStartup = (s) => {
+        if (s.plugin === undefined || s.pluginName === undefined)
+            return true;
+        return !disabledIdentities.has(pluginIdentity(s.plugin, s.pluginName));
+    };
+    const activePluginSkills = pluginSkills.filter(isLoadedAtStartup);
+    const disabledPluginSkillTokens = sumListing(pluginSkills.filter((s) => !isLoadedAtStartup(s)));
+    const skillListingTokens = sumListing(localSkills) + sumListing(activePluginSkills);
     const agentListingTokens = sumListing(userSurfaces.agents);
     const commandListingTokens = sumListing(userSurfaces.commands);
     // Memory is per-project: a session loads ~/.claude/projects/<slug>/memory/
@@ -138,6 +170,7 @@ export async function scan(opts = {}) {
         currentProjectMemoryTokens,
         allProjectsMemoryTokens,
         recoverableStartupTokens,
+        disabledPluginSkillTokens,
     };
 }
 async function pathExists(p) {

package/dist/scanner/plugin-skills.js

@@ -4,17 +4,6 @@ import { getPluginsDir } from '../paths.js';
 import { safeReadFile, safeReaddir, isDirectory, getDirSize, safeStat } from './fs-walk.js';
 import { pickActiveVersion } from './plugin-versions.js';
 import { listingTokensFromContent } from './skill-listing.js';
-/**
- * The directories under a marketplace whose skills a session would load — one
- * per plugin, never two versions of the same one.
- *
- * The cache is laid out `<marketplace>/<plugin>/<version>/`. A plugin whose
- * content sits directly under `<plugin>/` is returned as-is; otherwise its
- * children are versions and only the active one counts. That distinction is
- * drawn by looking for a `skills` directory rather than by pattern-matching
- * version names, so a plugin that ships no skills is simply walked as before
- * and contributes nothing either way.
- */
 async function resolveContentRoots(pluginBaseDir) {
     const entries = await safeReaddir(pluginBaseDir);
     // Flat layout: the cache entry holds content directly, with no plugin or
@@ -23,7 +12,7 @@ async function resolveContentRoots(pluginBaseDir) {
     // a candidate version, then picks exactly one — which is not a miscount but a
     // silent disappearance: the whole entry reported zero skills.
     if (entries.includes('skills'))
-        return [pluginBaseDir];
+        return [{ dir: pluginBaseDir }];
     const roots = [];
     for (const entry of entries) {
         const pluginDir = join(pluginBaseDir, entry);
@@ -32,7 +21,7 @@ async function resolveContentRoots(pluginBaseDir) {
         const children = await safeReaddir(pluginDir);
         if (children.includes('skills')) {
             // Content root, not a version container.
-            roots.push(pluginDir);
+            roots.push({ dir: pluginDir, plugin: entry });
             continue;
         }
         const versions = [];
@@ -46,11 +35,11 @@ async function resolveContentRoots(pluginBaseDir) {
         const active = pickActiveVersion(versions);
         // No subdirectories at all: hand back the plugin dir so the walk behaves
         // exactly as it did before rather than silently dropping the plugin.
-        roots.push(active ? active.dir : pluginDir);
+        roots.push({ dir: active ? active.dir : pluginDir, plugin: entry });
     }
     // A marketplace with no plugin subdirectories still needs walking — some
     // caches put content directly under the top level.
-    return roots.length > 0 ? roots : [pluginBaseDir];
+    return roots.length > 0 ? roots : [{ dir: pluginBaseDir }];
 }
 export async function scanPluginSkills() {
     const skills = [];
@@ -69,7 +58,7 @@ export async function scanPluginSkills() {
             return;
         }
         const pluginSkillNames = [];
-        const walkDir = async (dir) => {
+        const walkDir = async (dir, plugin) => {
             // Kept generic: a plugin's content root is normally
             // `<plugin>/<version>/`, but the walk also has to reach skills nested
             // deeper. Version selection happens before we get here — see
@@ -97,17 +86,18 @@ export async function scanPluginSkills() {
                                 listingTokens: listingTokensFromContent(skillDir, content),
                                 source: 'plugin',
                                 pluginName,
+                                plugin,
                             });
                         }
                     }
                 }
                 else {
-                    await walkDir(entryPath);
+                    await walkDir(entryPath, plugin);
                 }
             }
         };
         for (const root of await resolveContentRoots(pluginDir)) {
-            await walkDir(root);
+            await walkDir(root.dir, root.plugin);
         }
         if (pluginSkillNames.length > 0) {
             plugins.push({

package/dist/types.d.ts

@@ -14,7 +14,20 @@ export interface SkillInfo {
      */
     listingTokens: number;
     source: 'local' | 'plugin';
+    /**
+     * Cache directory this skill was found under — the *marketplace*, not the
+     * plugin. Kept as-is because `plugins[]` and the `disabled_plugin` detector
+     * match cache directories by this name (see parseDisabledPlugins).
+     */
     pluginName?: string;
+    /**
+     * The actual plugin, e.g. `oh-my-claudecode` where `pluginName` is `omc`.
+     *
+     * Needed because enabled/disabled state is reported per plugin, not per
+     * marketplace, and one marketplace can host both. Absent when the cache entry
+     * has no plugin level to read it from.
+     */
+    plugin?: string;
 }
 export interface BrokenSymlink {
     name: string;
@@ -109,6 +122,14 @@ export interface ScanResult {
      * against a 13,434-token startup total. This field is the honest number.
      */
     recoverableStartupTokens: number;
+    /**
+     * Skill-listing tokens belonging to plugins reported as disabled.
+     *
+     * Excluded from `totalTokensBefore` because a disabled plugin's skills are
+     * not in the session catalog. Reported separately so the number does not just
+     * vanish: it is what re-enabling everything would cost.
+     */
+    disabledPluginSkillTokens: number;
 }
 export interface ManifestEntry {
     date: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.12.3",
+  "version": "2.13.1",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {
@@ -65,6 +65,6 @@
     "@types/node": "^22.20.1",
     "tmp-promise": "^3.0.3",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }