claude-slim 2.14.2 → 2.14.3

package/dist/codex/index.js

@@ -4,6 +4,7 @@ import { countTokensCached } from '../tokenizer.js';
 import { listingTokens, listingTokensFromContent, parseFrontmatterDescription } from '../scanner/skill-listing.js';
 import { safeReadFile, safeReaddir, isDirectory, isBrokenSymlink } from '../scanner/fs-walk.js';
 import { detectBackupArtifact } from '../scanner/backup-artifacts.js';
+import { sanitizeUntrustedTree } from '../scanner/untrusted.js';
 // Codex support.
 //
 // The Claude Code scanner is deliberately left untouched: it is the
@@ -183,7 +184,11 @@ export async function scanCodex(contents) {
         : 0;
     const skills = [...local, ...plugin];
     const listing = (xs) => xs.reduce((sum, x) => sum + x.listingTokens, 0);
-    return {
+    // ~/.codex labels are authored by whoever wrote those skills and agents, and
+    // the CLI merges this tree into `scan --json` and prints skill names to the
+    // terminal. It never passes through the ~/.claude scanner, so it sanitizes on
+    // its own way out.
+    return sanitizeUntrustedTree({
         root: getCodexDir(),
         skills,
         agents,
@@ -192,7 +197,7 @@ export async function scanCodex(contents) {
         totalTokens: listing(skills) + listing(agents) + instructionsTokens,
         unusedDetectionAvailable: false,
         unusedDetectionReason: UNUSED_DETECTION_REASON,
-    };
+    });
 }
 /** Re-exported so callers can reuse the frontmatter parser without a deep import. */
 export { parseFrontmatterDescription };

package/dist/scanner/untrusted.d.ts

@@ -1,15 +1,22 @@
 import type { ScanResult } from '../types.js';
 /**
- * Names read off disk are written by whoever authored the skill, plugin, or
- * memory file — not by the user running the scan. They flow through the report
- * into the agent's context, which makes them an indirect prompt injection
- * surface: a skill directory or frontmatter `name:` can carry instructions
- * aimed at the model rather than a label aimed at a human.
+ * Names read off disk are written by whoever authored the skill, plugin, agent,
+ * or memory file — not by the person running the scan. They flow through the
+ * report into the agent's context, which makes them an indirect prompt
+ * injection surface: a directory name can carry instructions aimed at the model
+ * rather than a label aimed at a human.
  *
  * Snyk's audit of this skill (W011, medium 0.30) is about exactly this path.
  * The scan never emits file *bodies* — descriptions are measured for token cost
- * and then discarded — so what this module covers is the whole exposed surface,
- * not a sample of it.
+ * and then discarded — so labels are the whole exposed surface.
+ *
+ * v2.14.1 sanitized a hand-written list of fields and claimed that a single
+ * chokepoint could not be forgotten. That was wrong: the chokepoint was one
+ * function, but its contents were an enumeration, and the first version of it
+ * already missed `pluginSkills[].pluginName`, `pluginSkills[].plugin`, and the
+ * entire `codex` subtree — whose skill names are printed to the terminal too.
+ * So this walks the result instead of listing its fields. A field added later
+ * is covered because it exists, not because someone remembered it.
  */
 /** Longest label we render. Real names are far shorter; payloads are not. */
 export declare const MAX_NAME_LENGTH = 120;
@@ -21,10 +28,15 @@ export declare const MAX_NAME_LENGTH = 120;
  */
 export declare function sanitizeUntrusted(value: string, max?: number): string;
 /**
- * Return a copy of the scan with every outsider-authored label flattened.
+ * Return a copy of any scanned tree with every label flattened and bounded.
+ *
+ * Numbers and booleans pass through untouched; the input is not mutated.
  *
- * Applied once at the scanner's exit rather than at each of the dozen sites
- * that read a name off disk: one chokepoint cannot be forgotten by whoever adds
- * the next detector.
+ * Each scanner applies this at its own exit. There is more than one scanner:
+ * `scanCodex()` runs separately and the CLI merges it in at print time
+ * (`src/cli.ts`), so `~/.codex` labels never pass through the `~/.claude`
+ * scanner and have to be sanitized on their own way out.
  */
+export declare function sanitizeUntrustedTree<T>(value: T): T;
+/** The `~/.claude` scanner's exit. */
 export declare function sanitizeScanResult(result: ScanResult): ScanResult;

package/dist/scanner/untrusted.js

@@ -1,14 +1,21 @@
 /**
- * Names read off disk are written by whoever authored the skill, plugin, or
- * memory file — not by the user running the scan. They flow through the report
- * into the agent's context, which makes them an indirect prompt injection
- * surface: a skill directory or frontmatter `name:` can carry instructions
- * aimed at the model rather than a label aimed at a human.
+ * Names read off disk are written by whoever authored the skill, plugin, agent,
+ * or memory file — not by the person running the scan. They flow through the
+ * report into the agent's context, which makes them an indirect prompt
+ * injection surface: a directory name can carry instructions aimed at the model
+ * rather than a label aimed at a human.
  *
  * Snyk's audit of this skill (W011, medium 0.30) is about exactly this path.
  * The scan never emits file *bodies* — descriptions are measured for token cost
- * and then discarded — so what this module covers is the whole exposed surface,
- * not a sample of it.
+ * and then discarded — so labels are the whole exposed surface.
+ *
+ * v2.14.1 sanitized a hand-written list of fields and claimed that a single
+ * chokepoint could not be forgotten. That was wrong: the chokepoint was one
+ * function, but its contents were an enumeration, and the first version of it
+ * already missed `pluginSkills[].pluginName`, `pluginSkills[].plugin`, and the
+ * entire `codex` subtree — whose skill names are printed to the terminal too.
+ * So this walks the result instead of listing its fields. A field added later
+ * is covered because it exists, not because someone remembered it.
  */
 /** Longest label we render. Real names are far shorter; payloads are not. */
 export const MAX_NAME_LENGTH = 120;
@@ -20,82 +27,74 @@ const CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
  */
 const INVISIBLE = /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/g;
 /**
- * Collapse an untrusted label to a single bounded, printable line.
+ * Keys whose values are truncated only at their peril.
  *
- * Deliberately not an escape or an encoding: the value is a display label, and
- * a reversible transform would relocate a payload rather than remove it.
+ * Paths locate files that cleanup then acts on, so a shortened path is a wrong
+ * path. `currentProjectSlug` is matched against directory names. The two
+ * `*Reason` strings are our own prose and already run past the label bound.
+ * All of them are still flattened — that is the part that blocks injection.
  */
-export function sanitizeUntrusted(value, max = MAX_NAME_LENGTH) {
-    const flattened = value
+const FLATTEN_ONLY_KEYS = new Set([
+    'path',
+    'root',
+    'target',
+    'currentProjectSlug',
+    'unusedDetectionReason',
+]);
+/** Strip anything that could forge a row or hide from a human reader. */
+function flatten(value) {
+    return value
         .replace(CONTROL_CHARS, ' ')
         .replace(INVISIBLE, '')
         .replace(/\s+/g, ' ')
         .trim();
+}
+/**
+ * Collapse an untrusted label to a single bounded, printable line.
+ *
+ * Deliberately not an escape or an encoding: the value is a display label, and
+ * a reversible transform would relocate a payload rather than remove it.
+ */
+export function sanitizeUntrusted(value, max = MAX_NAME_LENGTH) {
+    const flattened = flatten(value);
     if (flattened.length <= max)
         return flattened;
     return `${flattened.slice(0, max)}…`;
 }
 /**
- * Paths are shown to the user and used to locate files for cleanup, so they are
- * flattened but never truncated — a shortened path would be a wrong path.
+ * Walk any scan value, sanitizing every string it contains.
+ *
+ * `key` is the property name the string arrived under; for arrays it is
+ * inherited from the property holding the array, so `mcpServerNames[]` and
+ * `plugins[].skills[]` are treated as the labels they are.
  */
-function sanitizePath(value) {
-    return value.replace(CONTROL_CHARS, ' ').replace(INVISIBLE, '').trim();
+function sanitizeDeep(value, key) {
+    if (typeof value === 'string') {
+        return FLATTEN_ONLY_KEYS.has(key) ? flatten(value) : sanitizeUntrusted(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => sanitizeDeep(entry, key));
+    }
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, sanitizeDeep(v, k)]));
+    }
+    // Numbers, booleans, null, undefined — nothing to sanitize, nothing to copy.
+    return value;
 }
 /**
- * Return a copy of the scan with every outsider-authored label flattened.
+ * Return a copy of any scanned tree with every label flattened and bounded.
  *
- * Applied once at the scanner's exit rather than at each of the dozen sites
- * that read a name off disk: one chokepoint cannot be forgotten by whoever adds
- * the next detector.
+ * Numbers and booleans pass through untouched; the input is not mutated.
+ *
+ * Each scanner applies this at its own exit. There is more than one scanner:
+ * `scanCodex()` runs separately and the CLI merges it in at print time
+ * (`src/cli.ts`), so `~/.codex` labels never pass through the `~/.claude`
+ * scanner and have to be sanitized on their own way out.
  */
+export function sanitizeUntrustedTree(value) {
+    return sanitizeDeep(value, '');
+}
+/** The `~/.claude` scanner's exit. */
 export function sanitizeScanResult(result) {
-    const skill = (s) => ({
-        ...s,
-        name: sanitizeUntrusted(s.name),
-        path: sanitizePath(s.path),
-    });
-    return {
-        ...result,
-        localSkills: result.localSkills.map(skill),
-        pluginSkills: result.pluginSkills.map(skill),
-        plugins: result.plugins.map((p) => ({
-            ...p,
-            name: sanitizeUntrusted(p.name),
-            skills: p.skills.map((s) => sanitizeUntrusted(s)),
-        })),
-        brokenSymlinks: result.brokenSymlinks.map((b) => ({
-            ...b,
-            name: sanitizeUntrusted(b.name),
-            path: sanitizePath(b.path),
-            target: sanitizeUntrusted(b.target),
-        })),
-        memoryFiles: result.memoryFiles.map((m) => ({
-            ...m,
-            project: sanitizeUntrusted(m.project),
-            name: sanitizeUntrusted(m.name),
-            path: sanitizePath(m.path),
-        })),
-        claudeMdSections: result.claudeMdSections.map((s) => ({
-            ...s,
-            name: sanitizeUntrusted(s.name),
-        })),
-        mcpServerNames: result.mcpServerNames.map((n) => sanitizeUntrusted(n)),
-        issues: result.issues.map((i) => ({
-            ...i,
-            name: sanitizeUntrusted(i.name),
-            path: sanitizePath(i.path),
-            ...(i.detail === undefined ? {} : { detail: sanitizeUntrusted(i.detail) }),
-            ...(i.marketplace === undefined
-                ? {}
-                : { marketplace: sanitizeUntrusted(i.marketplace) }),
-        })),
-        pluginBreakdown: result.pluginBreakdown.map((p) => ({
-            ...p,
-            name: sanitizeUntrusted(p.name),
-            marketplace: sanitizeUntrusted(p.marketplace),
-        })),
-        userAgents: result.userAgents.map((a) => ({ ...a, name: sanitizeUntrusted(a.name) })),
-        userCommands: result.userCommands.map((c) => ({ ...c, name: sanitizeUntrusted(c.name) })),
-    };
+    return sanitizeUntrustedTree(result);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.14.2",
+  "version": "2.14.3",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {

package/skills/claude-slim/SKILL.md

@@ -47,7 +47,7 @@ wrapper.
 An outdated claude-slim does not merely lack features — it reports **wrong numbers**. Versions before 2.8.0 summed memory across every project on disk and inflated the startup estimate roughly 8×. Presenting those figures as fact is worse than not running at all, so check first:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim check-update --json
 ```
 
@@ -80,7 +80,7 @@ If `"outdated": false`, say nothing and continue to Phase 1.
 Run the CLI to collect environment data:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim scan --json
 ```
 
@@ -200,20 +200,20 @@ If subcommand is `scan`, stop here. Ask a localized equivalent of "Proceed with
 Run the interactive clean command:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim clean
 ```
 
 Or with dry-run:
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim clean --dry-run
 ```
 
 After cleanup, re-run scan to get updated numbers, then show the savings report:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim report
 ```
 
@@ -226,7 +226,7 @@ Present the report box AND the before/after breakdown table to the user.
 When `/claude-slim restore` is invoked:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim restore
 ```
 
@@ -235,7 +235,7 @@ claude_slim restore
 When `/claude-slim doctor` is invoked:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.3' "$@"; fi; }
 claude_slim doctor
 ```