claude-slim 2.13.0 → 2.14.0

package/README.md

@@ -94,21 +94,21 @@ That's slower responses. Hitting your usage cap faster. Paying for context you'r
 **Report** — Shows exactly what changed:
 
 ```
-╭──────────────────────────────────────────╮
-│  claude-slim report                      │
-│                                          │
-│  Before: 14,510 tokens at startup        │
-│  After:   5,181 tokens at startup        │
-│  Saved:   9,329 tokens (64.3%)           │
-│                                          │
-│  Top offenders removed:                  │
-│  • office-hours              23,008 tok  │
-│  • harness                    7,902 tok  │
-│  • manpower                   4,764 tok  │
-│                                          │
-│  Est. monthly savings: ~$1.68            │
-│  (2 sessions/day × $0.003/1K tok)        │
-╰──────────────────────────────────────────╯
+╭────────────────────────────────────────╮
+│  claude-slim report                    │
+│                                        │
+│  Before: 14,510 tokens at startup      │
+│  After:   5,181 tokens at startup      │
+│  Saved:   9,329 tokens (64.3%)         │
+│                                        │
+│  Top offenders removed:                │
+│  • office-hours              23,008 tok│
+│  • harness                    7,902 tok│
+│  • manpower                   4,764 tok│
+│                                        │
+│  Est. monthly savings: ~$1.68          │
+│  (2 sessions/day × $0.003/1K tok)      │
+╰────────────────────────────────────────╯
 
   ┌──────────────────┬──────────┬──────────┬────────────┐
   │                  │  Before  │  After   │  Saved     │
@@ -139,6 +139,14 @@ claude plugin install claude-slim
 
 Then just type `/claude-slim` in any session.
 
+Or install it through the [skills.sh](https://skills.sh) directory, which can also place
+the skill into Codex, Cursor, and OpenCode. What claude-slim *analyzes* is unchanged:
+`~/.claude/` and `~/.codex/`.
+
+```bash
+npx skills add iops-leo/claude-slim
+```
+
 ---
 
 ## Usage
@@ -249,15 +257,14 @@ Token counts come from [js-tiktoken](https://github.com/nicolo-ribaudo/js-tiktok
 
 ---
 
-## v2.13.0 — What's new
+## v2.13.1 — What's new
 
-- **Changed: the startup estimate no longer counts disabled plugins.** Their skills are not in the session catalog, so they are not a startup cost — but they were being added to a number labelled "tokens at session start". Verified against a live session rather than assumed: skills from every disabled plugin were absent from the prompt, while every enabled one's were present. Measured here: **12,504 → 9,836**, a 21% correction.
-- **Added `disabledPluginSkillTokens`**, shown under the overhead line and in `--json` — what re-enabling everything would cost. A headline number that drops by a fifth with no explanation reads like a bug.
-- **Fixed: plugin skills are attributed to their plugin, not their marketplace.** One marketplace can host several plugins with different enabled states, so the two had to be told apart.
+- **Fixed: `scan` promised the tool never touches `~/.codex/`, while `clean --auto` deletes from it permanently.** The Codex summary closed with `Reported only — claude-slim never modifies ~/.codex/.` That was true in v2.10 and false from **v2.11** on, when `clean` gained the Codex tiers. Measured here: `clean --dry-run` selects `[Auto] [codex] temp_cache: .tmp (146MB of install leftovers) (permanent)` — Tier 1, which `--auto` applies without prompting and no `restore` undoes.
+- The summary now says what actually happens: `scan` only reads, `clean` acts under the same tiers as `~/.claude/`, moves land in `~/.codex/skills.disabled/` and reverse with `restore`, and Tier 1 install leftovers are deleted permanently.
 
-Only plugins *explicitly reported disabled* are excluded. `claude plugin list` has a third state — `✘ failed to load` — and a plugin in it still loads its skills, so anything unrecognised keeps counting.
+A test was holding the false claim in place. It asserted the summary *must* say "never modifies", so the line could not be corrected without a test failing — and all 461 tests stayed green across four releases that contradicted it. The assertion is now inverted: the summary must not promise `~/.codex/` is left alone, and must name the permanent deletion and `--auto`.
 
-Tests: 452 → 461 (+9).
+Tests: 461 → 462.
 
 For older release notes, see [CHANGELOG.md](CHANGELOG.md).
 

package/dist/cli.js

@@ -50,8 +50,9 @@ program
         lookbackDays: parseNonNegativeInt(opts.lookbackDays, 60),
         projectDir,
     });
-    // Codex is scanned when present. Reported only — it is never modified, and
-    // unused-skill detection is suppressed there for lack of a usage signal.
+    // Codex is scanned when present. `scan` only reads; `clean` has acted here
+    // since v2.11 under the same tiers. Unused-skill detection stays suppressed
+    // for lack of a usage signal.
     // commander maps `--no-codex` to `opts.codex === false`, not `opts.noCodex`.
     const codex = opts.codex === false ? null : await scanCodex();
     await flushCache();

package/dist/codex/report.js

@@ -44,13 +44,15 @@ export function formatCodexSummary(result) {
             lines.push(`    ${b.name.length > 30 ? `${b.name.slice(0, 29)}…` : b.name.padEnd(30)} ` +
                 `${String(b.listingTokens).padStart(5)} tok  \x1b[90m${b.backupArtifact}\x1b[0m`);
         }
-        lines.push(`    \x1b[90mNot removed — ~/.codex/ is read-only here. Delete manually if stale.\x1b[0m`);
+        lines.push(`    \x1b[90mOffered by clean as Tier 2 — moved to ~/.codex/skills.disabled/, reversible with restore.\x1b[0m`);
     }
     lines.push('');
     lines.push(`  \x1b[33m!\x1b[0m Unused-skill detection unavailable for Codex.`);
     lines.push(`    \x1b[90m${result.unusedDetectionReason}\x1b[0m`);
     lines.push('');
-    lines.push(`  \x1b[90mReported only — claude-slim never modifies ~/.codex/.\x1b[0m`);
+    lines.push(`  \x1b[90mscan only reads. Since v2.11 clean also acts here, under the same tiers as ~/.claude/:\x1b[0m`);
+    lines.push(`  \x1b[90mmoves go to ~/.codex/skills.disabled/ and reverse with restore, but Tier 1 install\x1b[0m`);
+    lines.push(`  \x1b[90mleftovers (~/.codex/.tmp) are deleted permanently, and --auto applies Tier 1 unprompted.\x1b[0m`);
     lines.push('');
     return lines.join('\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {
@@ -65,6 +65,6 @@
     "@types/node": "^22.20.1",
     "tmp-promise": "^3.0.3",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }

package/skills/claude-slim/SKILL.md

@@ -18,16 +18,38 @@ Analyze the user's Claude Code environment for token waste and perform non-destr
 
 ---
 
+## Running the CLI
+
+Every command block below opens with a `claude_slim()` resolver. It is repeated in full each
+time on purpose: each Bash invocation is a fresh shell, so a function defined in one
+block does not survive into the next. It resolves in three tiers — the plugin's own
+`dist/cli.js` when `CLAUDE_PLUGIN_ROOT` is set, then a `claude-slim` on `PATH`, then
+`npx`. That last tier is what makes the skill work when it was installed by
+`npx skills add` rather than `claude plugin install`, where no plugin root exists.
+
+Do not shorten the name. A two-letter `cs` collides with claude-squad's binary, and a
+shell function is invisible to `timeout`, `env`, and `xargs` — a wrapped call would
+silently run that other program instead. Call `claude_slim` directly, never through a
+wrapper.
+
+---
+
 ## Phase 0 — Version gate (run before every scan)
 
 An outdated claude-slim does not merely lack features — it reports **wrong numbers**. Versions before 2.8.0 summed memory across every project on disk and inflated the startup estimate roughly 8×. Presenting those figures as fact is worse than not running at all, so check first:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" check-update --json
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim check-update --json
 ```
 
 The check is cached for 24h and fails open — if it errors, times out, or returns `"latest": null`, **proceed silently**. Never block the user because a version lookup failed.
 
+The response carries `installMethod`. When it is `"npx"` the gate is structurally
+inert — the CLI was just fetched at the tag it is being compared against, so `outdated`
+can never be true. Note that the version was resolved at run time and move on; do not
+present the gate as a safeguard it is not.
+
 If `"outdated": true`, stop and tell the user before scanning:
 
 > 설치된 claude-slim이 {installed}이고 최신은 {latest}입니다.
@@ -39,7 +61,7 @@ If `"outdated": true`, stop and tell the user before scanning:
 
 Then honour their answer. If they choose to continue, run the scan but **label the numbers as coming from an outdated version** in your report.
 
-**Plugin installs need a restart.** `claude plugin update` writes the new version to disk, but the running session keeps the loaded copy. Tell the user this explicitly — otherwise they update, re-run, and see the same stale numbers with no idea why.
+**Plugin installs need a restart** (only when `installMethod` is `"plugin"`). `claude plugin update` writes the new version to disk, but the running session keeps the loaded copy. Tell the user this explicitly — otherwise they update, re-run, and see the same stale numbers with no idea why.
 
 If `"outdated": false`, say nothing and continue to Phase 1.
 
@@ -50,20 +72,27 @@ If `"outdated": false`, say nothing and continue to Phase 1.
 Run the CLI to collect environment data:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" scan --json
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim scan --json
 ```
 
-If `CLAUDE_PLUGIN_ROOT` is not set:
-```bash
-PLUGIN_DIR=$(find ~/.claude/plugins -path "*/claude-slim/dist/cli.js" -type f 2>/dev/null | head -1 | xargs dirname | xargs dirname)
-node "$PLUGIN_DIR/dist/cli.js" scan --json
-```
+If that command fails for **any** reason — `node` missing, or the `npx` tier unable to
+reach the npm registry because the machine is offline or behind a proxy — fall back to
+the legacy bash scanner. It needs neither node nor a network:
 
-If `node` is not available, fall back to the legacy bash scanner:
 ```bash
-bash "${CLAUDE_PLUGIN_ROOT}/skills/claude-slim/scripts/scan.sh"
+for d in "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/skills/claude-slim}" "$HOME/.claude/skills/claude-slim" "./.claude/skills/claude-slim"; do
+  [ -n "$d" ] || continue
+  if [ -f "$d/scripts/scan.sh" ]; then bash "$d/scripts/scan.sh" json; exit $?; fi
+done
+echo "claude-slim: no scan.sh found in any known skill directory" >&2
+exit 1
 ```
 
+If this fails too, tell the user the scan could not run and **stop**. Never continue to
+Phase 2 without data: an empty scan is indistinguishable from a clean environment, and
+reporting zeros as fact is the one outcome worse than reporting nothing.
+
 ---
 
 ## Phase 2 — Interpret & Present
@@ -163,18 +192,21 @@ If subcommand is `scan`, stop here. Ask a localized equivalent of "Proceed with
 Run the interactive clean command:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" clean
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim clean
 ```
 
 Or with dry-run:
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" clean --dry-run
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim clean --dry-run
 ```
 
 After cleanup, re-run scan to get updated numbers, then show the savings report:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" report
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim report
 ```
 
 Present the report box AND the before/after breakdown table to the user.
@@ -186,7 +218,8 @@ Present the report box AND the before/after breakdown table to the user.
 When `/claude-slim restore` is invoked:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" restore
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim restore
 ```
 
 ## Doctor
@@ -194,7 +227,8 @@ node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" restore
 When `/claude-slim doctor` is invoked:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" doctor
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim doctor
 ```
 
 Explain warnings in the user's language. Pay special attention to session-log warnings because they explain why unused-skill detection may be suppressed.