clikit-plugin 0.2.0 → 0.2.1

package/dist/cli.js

@@ -48,11 +48,25 @@ function parseConfig(configPath) {
     }
     const content = fs.readFileSync(configPath, "utf-8");
     const cleaned = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
-    return JSON.parse(cleaned);
-  } catch {
+    const cleanedTrailing = cleaned.replace(/,\s*([}\]])/g, "$1");
+    return JSON.parse(cleanedTrailing);
+  } catch (err) {
+    console.error(`Warning: Failed to parse config at ${configPath}: ${err}`);
     return {};
   }
 }
+function backupConfig(configPath) {
+  try {
+    if (!fs.existsSync(configPath)) {
+      return null;
+    }
+    const backupPath = `${configPath}.backup-${Date.now()}`;
+    fs.copyFileSync(configPath, backupPath);
+    return backupPath;
+  } catch {
+    return null;
+  }
+}
 function writeConfig(configPath, config) {
   ensureConfigDir();
   const tmpPath = `${configPath}.tmp`;
@@ -75,12 +89,20 @@ async function install() {
   }
   const configPath = getConfigPath();
   try {
-    const config = parseConfig(configPath) || {};
-    const plugins = config.plugin || [];
-    const filteredPlugins = plugins.filter((p) => p !== PLUGIN_NAME && !p.startsWith(`${PLUGIN_NAME}@`));
+    const backupPath = backupConfig(configPath);
+    if (backupPath) {
+      console.log(`  Backup created: ${backupPath}`);
+    }
+    const config = parseConfig(configPath);
+    const existingPlugins = Array.isArray(config.plugin) ? config.plugin : [];
+    const preservedKeys = Object.keys(config).filter((k) => k !== "plugin");
+    if (preservedKeys.length > 0) {
+      console.log(`  Preserving existing config: ${preservedKeys.join(", ")}`);
+    }
+    const filteredPlugins = existingPlugins.filter((p) => p !== PLUGIN_NAME && !p.startsWith(`${PLUGIN_NAME}@`));
     filteredPlugins.push(PLUGIN_NAME);
-    config.plugin = filteredPlugins;
-    writeConfig(configPath, config);
+    const newConfig = { ...config, plugin: filteredPlugins };
+    writeConfig(configPath, newConfig);
     console.log(`\u2713 Plugin added to ${configPath}`);
   } catch (err) {
     console.error(`\u2717 Failed to update OpenCode config: ${err}`);

package/dist/hooks/comment-checker.d.ts

@@ -11,7 +11,7 @@ export interface CommentCheckResult {
     totalLines: number;
     ratio: number;
 }
-export declare function checkCommentDensity(content: string, threshold?: number): CommentCheckResult;
-export declare function hasExcessiveAIComments(content: string): boolean;
+export declare function checkCommentDensity(content: unknown, threshold?: number): CommentCheckResult;
+export declare function hasExcessiveAIComments(content: unknown): boolean;
 export declare function formatCommentWarning(result: CommentCheckResult): string;
 //# sourceMappingURL=comment-checker.d.ts.map

package/dist/hooks/comment-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-checker.d.ts","sourceRoot":"","sources":["../../src/hooks/comment-checker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAY,GAAG,kBAAkB,CAkDhG;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAGvE"}
+{"version":3,"file":"comment-checker.d.ts","sourceRoot":"","sources":["../../src/hooks/comment-checker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,GAAE,MAAY,GAAG,kBAAkB,CAqDjG;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAYhE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAGvE"}

package/dist/hooks/compaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compaction.d.ts","sourceRoot":"","sources":["../../src/hooks/compaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAuFzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,SAAS,EAAE,CAyDlF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,GAAE,MAAa,GAAG,MAAM,CA2ChG;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,gBAAgB,GACxB,iBAAiB,CAYnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAMtE"}
+{"version":3,"file":"compaction.d.ts","sourceRoot":"","sources":["../../src/hooks/compaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAuFzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,SAAS,EAAE,CA2DlF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,GAAE,MAAa,GAAG,MAAM,CA4ChG;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,gBAAgB,GACxB,iBAAiB,CAYnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAMtE"}

package/dist/hooks/security-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-check.d.ts","sourceRoot":"","sources":["../../src/hooks/security-check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyBH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAkB7F;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAUzE"}
+{"version":3,"file":"security-check.d.ts","sourceRoot":"","sources":["../../src/hooks/security-check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyBH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAmB7F;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAUzE"}

package/dist/hooks/truncator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"truncator.d.ts","sourceRoot":"","sources":["../../src/hooks/truncator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAUT;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,eAAe,GACvB,cAAc,CA2EhB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAIlE"}
+{"version":3,"file":"truncator.d.ts","sourceRoot":"","sources":["../../src/hooks/truncator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAYT;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,eAAe,GACvB,cAAc,CAsFhB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAIlE"}

package/dist/index.js

@@ -3917,6 +3917,8 @@ var SENSITIVE_FILES = [
   /id_ed25519$/
 ];
 function scanContentForSecrets(content, filename) {
+  if (typeof content !== "string")
+    return { safe: true, findings: [] };
   const findings = [];
   const lines = content.split(`
 `);
@@ -3984,6 +3986,9 @@ var EXCESSIVE_COMMENT_PATTERNS = [
   /#\s*(?:This|The|A|An) (?:function|method|class|script)/i
 ];
 function checkCommentDensity(content, threshold = 0.3) {
+  if (typeof content !== "string") {
+    return { excessive: false, count: 0, totalLines: 0, ratio: 0 };
+  }
   const lines = content.split(`
 `);
   const totalLines = lines.filter((l) => l.trim().length > 0).length;
@@ -4026,6 +4031,9 @@ function checkCommentDensity(content, threshold = 0.3) {
   };
 }
 function hasExcessiveAIComments(content) {
+  if (typeof content !== "string") {
+    return false;
+  }
   let matches = 0;
   for (const pattern of EXCESSIVE_COMMENT_PATTERNS) {
     const found = content.match(new RegExp(pattern, "gm"));
@@ -4450,6 +4458,8 @@ var DEFAULT_MAX_LINES = 500;
 var DEFAULT_HEAD_LINES = 50;
 var DEFAULT_TAIL_LINES = 50;
 function shouldTruncate(content, config) {
+  if (typeof content !== "string")
+    return false;
   const maxChars = config?.max_output_chars ?? DEFAULT_MAX_CHARS;
   const maxLines = config?.max_output_lines ?? DEFAULT_MAX_LINES;
   if (content.length > maxChars)
@@ -4461,6 +4471,16 @@ function shouldTruncate(content, config) {
   return false;
 }
 function truncateOutput(content, config) {
+  if (typeof content !== "string") {
+    return {
+      truncated: false,
+      originalLength: 0,
+      truncatedLength: 0,
+      originalLines: 0,
+      truncatedLines: 0,
+      content: ""
+    };
+  }
   const maxChars = config?.max_output_chars ?? DEFAULT_MAX_CHARS;
   const maxLines = config?.max_output_lines ?? DEFAULT_MAX_LINES;
   const headLines = config?.preserve_head_lines ?? DEFAULT_HEAD_LINES;
@@ -4632,6 +4652,8 @@ function readMemoryRefs(projectDir, limit = 10) {
           const fullPath = path7.join(subdirPath, file);
           const stat = fs7.statSync(fullPath);
           const raw = fs7.readFileSync(fullPath, "utf-8");
+          if (typeof raw !== "string" || !raw.trim())
+            continue;
           let summary;
           const ext = path7.extname(file);
           if (ext === ".md") {
@@ -4639,7 +4661,8 @@ function readMemoryRefs(projectDir, limit = 10) {
             summary = headingMatch ? headingMatch[1] : raw.substring(0, 100).trim();
           } else if (ext === ".json") {
             const parsed = JSON.parse(raw);
-            summary = parsed.summary || parsed.title || parsed.content?.substring(0, 100) || "";
+            const content = parsed.content;
+            summary = parsed.summary || parsed.title || (typeof content === "string" ? content.substring(0, 100) : "") || "";
           } else {
             summary = raw.substring(0, 100).trim();
           }
@@ -4700,6 +4723,9 @@ Recent Memory References:`);
   lines.push("</compaction-context>");
   const block = lines.join(`
 `);
+  if (typeof block !== "string")
+    return `<compaction-context>
+</compaction-context>`;
   if (block.length > maxChars) {
     return block.substring(0, maxChars) + `
 ... [compaction context truncated]

package/memory/handoffs/2026-02-15-plugin-install-fix.md

@@ -0,0 +1,140 @@
+---
+date: 2026-02-15
+phase: implementing
+branch: main
+---
+
+# Handoff: CliKit Plugin Installation & Runtime Fixes
+
+---
+
+## Status Summary
+
+CliKit plugin published to npm (v0.1.9 → v0.2.0). Fixed snap/bun path detection and multiple runtime errors. **CRITICAL ISSUE IDENTIFIED**: Installer overwrites `opencode.json` instead of merging with existing config, deleting user's existing settings. Multiple `.split()`, `.substring()` errors still occurring in hooks due to non-string arguments.
+
+---
+
+## Artifacts
+
+| Type | Path | Status |
+|------|------|--------|
+| Handoff | `.opencode/memory/handoffs/2026-02-15-installing.md` | 📚 Previous |
+| Config | `~/.config/opencode/opencode.json` | ⚠️ Gets overwritten |
+
+---
+
+## Task Status
+
+### ✅ Completed
+- [x] T-001-T-007: Plugin implementation (10 agents, 19 commands, 48 skills, 14 hooks, 6 tools)
+- [x] Fix snap/bun path detection using `SNAP_REAL_HOME` and regex fallback
+- [x] Fix `buildErrorNotification` to handle Error objects
+- [x] Fix `buildIdleNotification` to handle non-string sessionId
+- [x] Fix `checkCommentDensity` and `hasExcessiveAIComments` to handle non-string content
+- [x] Published v0.1.7, v0.1.8, v0.1.9, v0.2.0 to npm
+
+### 🔄 In Progress
+- [ ] **CRITICAL**: Fix installer to MERGE with existing opencode.json instead of overwriting
+  - **Current state:** `parseConfig()` reads existing config, but may not preserve all keys
+  - **User report:** "nó ghi đè file opencode.json làm xóa config có sẵn của tôi"
+  - **Root cause:** Need to deep merge, not shallow overwrite
+  
+- [ ] Fix remaining runtime errors in hooks
+  - **Files needing defensive type checks:**
+    - `src/hooks/truncator.ts` - `shouldTruncate()`, `truncateOutput()`
+    - `src/hooks/security-check.ts` - `scanContentForSecrets()`
+    - `src/hooks/compaction.ts` - multiple `.substring()` calls
+  - **Pattern:** Add `if (typeof content !== "string") return defaultResult;` at function start
+
+### 📋 Not Started
+- [ ] T-009: Verify plugin loads when OpenCode starts
+- [ ] T-010: Test installation in fresh environment
+- [ ] Add automated tests for installer
+
+---
+
+## Files Modified
+
+| File | Status | Notes |
+|------|--------|-------|
+| `src/cli.ts` | Modified | Added `getRealHome()` for snap path detection |
+| `src/hooks/session-notification.ts` | Modified | Fixed `buildIdleNotification`, `buildErrorNotification` |
+| `src/hooks/comment-checker.ts` | Modified | Added type guards for content param |
+| `src/index.ts` | Modified | Pass raw error to `buildErrorNotification` |
+| `package.json` | Modified | Version bumps to 0.2.0 |
+
+---
+
+## Git State
+
+- **Branch:** `main`
+- **Last commit:** `31b200c` - Update README with simplified installation
+- **Uncommitted changes:** Yes (5 modified files)
+
+---
+
+## Known Issues
+
+1. **CRITICAL: Installer overwrites opencode.json** - deletes user's existing config (mcp, provider settings)
+   - Need to deep merge instead of shallow merge
+   - Should backup existing config before modifying
+
+2. **Runtime TypeError: `.split()`, `.substring()` on undefined**
+   - Multiple hooks receive non-string arguments from OpenCode events
+   - Need defensive type checks in ALL functions that call string methods
+
+3. **Snap/bun path mismatch** - partially fixed but user still sees wrong path
+   - `bun x` may cache old versions
+   - Need to verify `SNAP_REAL_HOME` detection works in user's environment
+
+---
+
+## Next Steps
+
+1. [ ] **FIX INSTALLER** - Merge with existing config, don't overwrite:
+   ```typescript
+   // In cli.ts, preserve existing config keys
+   const existingConfig = parseConfig(configPath);
+   const newConfig = { ...existingConfig, plugin: filteredPlugins };
+   writeConfig(configPath, newConfig);
+   ```
+
+2. [ ] Add defensive type checks to all hooks that use string methods:
+   - `truncator.ts`: `shouldTruncate()`, `truncateOutput()`
+   - `security-check.ts`: `scanContentForSecrets()`
+   - `compaction.ts`: All substring calls
+
+3. [ ] Publish v0.2.1 with fixes
+
+4. [ ] Test: `bun x clikit-plugin@latest install` should preserve existing config
+
+---
+
+## Context for Resumption
+
+### The Core Problem
+The installer's `writeConfig()` function writes the entire config object to disk. The current code does spread, but needs to ensure `parseConfig()` returns complete existing config.
+
+### Solution Approach
+```typescript
+// cli.ts - install() function:
+const existingConfig = parseConfig(configPath) || {};
+const plugins = Array.isArray(existingConfig.plugin) ? [...existingConfig.plugin] : [];
+// ... modify plugins array ...
+config.plugin = filteredPlugins;
+// existingConfig already has all keys, we just update plugin
+```
+
+### Files to Review
+- `src/cli.ts:55-108` — Installer logic
+- `src/hooks/truncator.ts` — Needs type guards
+- `src/hooks/security-check.ts` — Needs type guards
+
+---
+
+## Resume Command
+
+To resume, use `/resume` and it will:
+1. Load this handoff
+2. Check for drift
+3. Propose fixing installer merge logic first

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clikit-plugin",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "OpenCode plugin with 10 agents, 19 commands, 48 skills, 14 hooks",
   "type": "module",
   "main": "./dist/index.js",