deprecated-tracker 2.2.0 → 2.3.1

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to the "Deprecated Tracker" extension will be documented in this file.
 
+## [2.3.1]
+
+### Fixed
+
+- **`scan_files` missed edits made after a file was staged.** The MCP tool took its changed lines from the index, so an agent that staged a file and then kept editing was told its newest code was clean — the exact flow the tool exists for. It now reads the working tree for the files it was given, while `--files` on the command line stays on the index: a pre-commit hook must judge what is about to be committed, not what merely happens to be in the editor.
+- **`mcp install --scope project` could register the tool where no agent would look.** Project scope means the directory the command ran in, so running it from a home folder registered a "project" that is never opened, and the repo it was meant for got nothing. The install now names the directory it used and warns when that directory is not a git repository, pointing at `--scope user` for a registration that applies everywhere. Success messages say where the entry went, which the agents' own CLIs do not report.
+
+## [2.3.0]
+
+### Changed
+
+- **The bare `deprecated-tracker` now prints its help instead of scanning the working directory.** Typing the name to find out what a freshly installed tool does answered "0 item(s) — PASS" from whatever directory the shell was in, which reads like the scanner is broken. Ask for the current directory explicitly: `deprecated-tracker .`. Every invocation that already carries a path or a flag is unaffected, including `--update-baseline`, `--staged`, `--changed` and `--files`.
+
+### Fixed
+
+- **`mcp install` never used the agent's own CLI on Windows.** `claude` and `codex` are `.cmd` shims there, and Node refuses to `execFile` a `.cmd` without a shell (CVE-2024-27980) — the bare name failed with `ENOENT` and the shim with `EINVAL`, so every Windows machine silently fell through to the config-file writer. That path works, but for `--scope user` it rewrites the whole of `~/.claude.json`, reformatting preferences that have nothing to do with this tool.
+
 ## [2.2.0]
 
 ### Added

package/README.md

@@ -16,7 +16,7 @@ Failing a build on *any* deprecated code is useless once a codebase already has
 
 ```bash
 npx deprecated-tracker --update-baseline   # commit .deprecated-tracker-baseline.json
-npx deprecated-tracker                     # exits 1 only if the count went up
+npx deprecated-tracker .                   # exits 1 only if the count went up
 ```
 
 A first run with no baseline **passes** and tells you to record one. When the count falls it passes and prints how stale the baseline has become.
@@ -43,10 +43,28 @@ Recipes for husky, lefthook and the `pre-commit` framework (which has a `.pre-co
 Register it once and Claude Code or Codex can call the scanner by name:
 
 ```bash
-npx deprecated-tracker mcp install          # --agent claude-code|codex|all
+# Just you, every project you open
+npx deprecated-tracker mcp install --agent claude-code --scope user
+npx deprecated-tracker mcp install --agent codex --scope user
+
+# The whole team, committed with the repo — run it from inside the repo
+npx deprecated-tracker mcp install --agent claude-code --scope project
+npx deprecated-tracker mcp install --agent codex --scope project
+
+npx deprecated-tracker mcp install --agent all --scope project   # both at once
+npx deprecated-tracker mcp uninstall --agent all --scope user    # same flags to undo
 ```
 
-That exposes three tools — `scan_project`, `scan_changes` and `scan_files` — with schemas the agent can read, structured results, and no shell-approval prompt per call. Restart the agent afterwards; Claude Code will ask you to approve a project-scoped server the first time.
+That exposes three tools — `scan_project`, `scan_changes` and `scan_files` — with schemas the agent can read, structured results, and no shell-approval prompt per call.
+
+`--scope user` registers it for every project you open. `--scope project` is the default and registers it for **the directory you run the command in**, which is meant to be committed so a teammate has it after a clone — so run that one from inside the repo, not from your home folder, or you register a "project" no agent will ever open. The CLI prints which scope it used and where the entry went, and warns when a project install is happening outside a git repository. Where each lands:
+
+| Agent | `--scope project` | `--scope user` |
+|---|---|---|
+| `claude-code` | `.mcp.json` at the repo root | `mcpServers` in `~/.claude.json` |
+| `codex` | `.codex/config.toml` in the repo | `~/.codex/config.toml` |
+
+The agent's own CLI (`claude mcp add`, `codex mcp add`) is used when it is on PATH; otherwise the config file is merged, never replaced. Then **restart the agent** — and with project scope, Claude Code asks you to approve the server the first time it sees it (`/mcp` if you miss the prompt). `mcp uninstall` removes only the scope you name.
 
 No install needed either way: point `--files` at what the agent just wrote and read the JSON off stdout. Unstaged edits are covered, since a file with no staged hunks is read as entirely changed.
 

package/bin/deprecated-tracker.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 "use strict";
 
 const { run } = require("../out/cli.js");

package/docs/CLI.md

@@ -12,9 +12,13 @@ The `deprecated-tracker` CLI does the other thing: it records today's count as a
 ```bash
 npm run build                              # produces out/cli.js
 node bin/deprecated-tracker.js --update-baseline   # commit the baseline file
-node bin/deprecated-tracker.js             # exits 1 only if the count went up
+node bin/deprecated-tracker.js .           # exits 1 only if the count went up
 ```
 
+A scan needs a path or a flag; the bare name prints the help instead, so
+someone who types it to see what it does does not get a scan of whatever
+directory their shell was in.
+
 | Option | Effect |
 |---|---|
 | `--files <file...>` | Scan only these files; everything after is a path |
@@ -169,9 +173,10 @@ the verbs by name, a schema for each, structured results instead of parsed
 stdout, and calls that do not each trip a shell-command approval.
 
 ```bash
-npx deprecated-tracker mcp install               # every agent found, project scope
+npx deprecated-tracker mcp install --agent claude-code --scope user
 npx deprecated-tracker mcp install --agent codex --scope user
-npx deprecated-tracker mcp uninstall             # same flags, same targets
+npx deprecated-tracker mcp install               # every agent found, project scope
+npx deprecated-tracker mcp uninstall --agent all --scope user
 ```
 
 | Tool | What it does |
@@ -195,6 +200,13 @@ Project scope is the default: it gets committed, so the whole team has the tool
 after a clone. `uninstall` removes only from the scope you name — cleaning up a
 project never touches a user-level registration.
 
+**A project registration means the directory you ran the command in.** Run it
+from your home folder and the tool is registered for a "project" no agent will
+ever open — nothing appears in the repo you meant, and it looks as though the
+install did nothing. The CLI names the directory it used and warns when that
+directory is not a git repository. Use `--scope user` when you want it
+everywhere regardless of where you happen to be standing.
+
 The agent's own CLI (`claude mcp add`, `codex mcp add`) is used when it is on
 PATH; otherwise the config file is edited directly, merging rather than
 replacing. Two things to expect afterwards: