prehello 0.0.0-stage → 0.1.0

package/dist/text/comments.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitFences = splitFences;
+exports.stripHtmlComments = stripHtmlComments;
+/** Split markdown into alternating [prose, fence, prose, fence...] segments (``` or ~~~ fences). */
+function splitFences(text) {
+    const lines = text.split("\n");
+    const out = [];
+    let cur = [];
+    let inFence = false;
+    let marker = "";
+    const flush = (code) => {
+        if (cur.length)
+            out.push({ code, text: cur.join("\n") });
+        cur = [];
+    };
+    for (const line of lines) {
+        const fm = /^\s{0,3}(`{3,}|~{3,})/.exec(line);
+        if (!inFence && fm) {
+            flush(false);
+            inFence = true;
+            marker = fm[1][0];
+            cur.push(line);
+        }
+        else if (inFence && fm && fm[1][0] === marker && /^\s{0,3}(`{3,}|~{3,})\s*$/.test(line)) {
+            cur.push(line);
+            flush(true);
+            inFence = false;
+        }
+        else {
+            cur.push(line);
+        }
+    }
+    flush(inFence);
+    return out;
+}
+/** Claude Code strips block-level HTML comments before injection; comments inside code fences are kept. */
+function stripHtmlComments(text) {
+    return splitFences(text)
+        .map((seg) => (seg.code ? seg.text : stripComments(seg.text)))
+        .join("\n");
+}
+/**
+ * Linear-time equivalent of text.replace(/<!--[\s\S]*?-->/g, ""). The regex form is quadratic on input such as "<!--" repeated
+ * (every start rescans to the end for a "-->" that never comes), which a hostile 4 MiB CLAUDE.md turns into a hang.
+ */
+function stripComments(text) {
+    let out = "";
+    let i = 0;
+    for (;;) {
+        const s = text.indexOf("<!--", i);
+        if (s < 0)
+            return out + text.slice(i);
+        const e = text.indexOf("-->", s + 4);
+        if (e < 0)
+            return out + text.slice(i); // an unclosed comment is left as it is, like the regex
+        out += text.slice(i, s);
+        i = e + 3;
+    }
+}

package/dist/text/frontmatter.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseFrontmatter = parseFrontmatter;
+exports.asList = asList;
+exports.asString = asString;
+function unquote(s) {
+    const t = s.trim();
+    if (t.length >= 2 && ((t[0] === '"' && t.endsWith('"')) || (t[0] === "'" && t.endsWith("'"))))
+        return t.slice(1, -1);
+    return t;
+}
+/** Tiny YAML-subset frontmatter parser: scalars, booleans, inline lists, "- item" lists, | and > block scalars. */
+function parseFrontmatter(text) {
+    const t = text.replace(/\r\n?/g, "\n");
+    if (!t.startsWith("---\n") && t !== "---")
+        return { data: Object.create(null), body: t, hasFrontmatter: false };
+    const rest = t.slice(4);
+    const m = /(^|\n)---[ \t]*(\n|$)/.exec(rest);
+    if (!m)
+        return { data: Object.create(null), body: t, hasFrontmatter: false };
+    const header = rest.slice(0, m.index);
+    const body = rest.slice(m.index + m[0].length);
+    // no prototype: a key such as `__proto__: [a, b]` in an untrusted file must stay plain data
+    const data = Object.create(null);
+    const lines = header.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const km = /^([A-Za-z_][\w-]*)\s*:\s*(.*)$/.exec(line);
+        if (!km)
+            continue;
+        const key = km[1];
+        const val = km[2].trim();
+        if (val === "|" || val === ">" || val === "|-" || val === ">-") {
+            const parts = [];
+            while (i + 1 < lines.length && (/^\s+/.test(lines[i + 1]) || lines[i + 1] === ""))
+                parts.push(lines[++i].trim());
+            data[key] = parts.join(val.startsWith(">") ? " " : "\n").trim();
+        }
+        else if (val === "") {
+            const items = [];
+            while (i + 1 < lines.length && /^\s*-\s+/.test(lines[i + 1]))
+                items.push(unquote(lines[++i].replace(/^\s*-\s+/, "")));
+            data[key] = items.length ? items : "";
+        }
+        else if (val.startsWith("[") && val.endsWith("]")) {
+            data[key] = val
+                .slice(1, -1)
+                .split(",")
+                .map((x) => unquote(x))
+                .filter(Boolean);
+        }
+        else if (val === "true" || val === "false") {
+            data[key] = val === "true";
+        }
+        else {
+            // plain or quoted scalar that continues on indented lines (YAML folds the line breaks into spaces)
+            let full = val;
+            const q = full[0] === '"' || full[0] === "'" ? full[0] : "";
+            const closed = () => q === "" || full.indexOf(q, 1) !== -1;
+            while (i + 1 < lines.length && (!closed() || (/^[ \t]+\S/.test(lines[i + 1]) && !/^\s*-\s/.test(lines[i + 1])))) {
+                if (q && closed())
+                    break;
+                i++;
+                full += " " + lines[i].trim();
+                if (i > 4000)
+                    break;
+            }
+            data[key] = unquote(full);
+        }
+    }
+    return { data, body, hasFrontmatter: true };
+}
+/** Normalise a frontmatter value that may be a list or a comma-separated string. */
+function asList(v) {
+    if (v === undefined || typeof v === "boolean")
+        return [];
+    if (Array.isArray(v))
+        return v.filter(Boolean);
+    return v
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function asString(v) {
+    if (v === undefined)
+        return "";
+    if (typeof v === "boolean")
+        return String(v);
+    return Array.isArray(v) ? v.join(", ") : v;
+}

package/dist/text/imports.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInside = void 0;
+exports.expandImports = expandImports;
+const node_path_1 = __importDefault(require("node:path"));
+const fs_safe_1 = require("../fs-safe");
+Object.defineProperty(exports, "isInside", { enumerable: true, get: function () { return fs_safe_1.isInside; } });
+const comments_1 = require("./comments");
+const MAX_DEPTH = 4;
+/** Upper bound on @path candidates examined per file tree; a hostile file with 150,000 of them would otherwise cost seconds of stat calls. */
+const MAX_CANDIDATES = 2000;
+function candidates(prose) {
+    // Drop inline code spans first, then find @path tokens.
+    const noCode = prose.replace(/`[^`\n]*`/g, " ");
+    const out = [];
+    const re = /(^|[\s(])@([^\s)]+)/g;
+    let m;
+    while ((m = re.exec(noCode))) {
+        let spec = m[2].replace(/[.,;:!?]+$/, "");
+        if (!spec)
+            continue;
+        const looksLikePath = spec.includes("/") || /\.[A-Za-z0-9]{1,8}$/.test(spec);
+        if (!looksLikePath || /^[\w.-]+@[\w.-]+$/.test(spec))
+            continue; // @mentions / emails
+        out.push(spec);
+    }
+    return out;
+}
+/**
+ * Expand Claude-style `@path` imports (depth ≤ 4, cycle-safe, code spans/fences skipped).
+ * Imports do NOT reduce cost, so imported text is added to the total.
+ * `allowed(realPath)` restricts which files may be read (project tree / home).
+ */
+function expandImports(fileText, filePath, home, allowed, opts) {
+    const seen = new Set([(0, fs_safe_1.realpathOrSelf)(filePath)]);
+    const skipped = [];
+    let imported = 0;
+    let tried = 0;
+    const parts = [];
+    const walk = (text, from, depth) => {
+        const prose = (0, comments_1.splitFences)(text)
+            .filter((s) => !s.code)
+            .map((s) => s.text)
+            .join("\n");
+        for (const spec of candidates(prose)) {
+            if (++tried > MAX_CANDIDATES) {
+                if (tried === MAX_CANDIDATES + 1)
+                    skipped.push({ spec: "(more)", reason: `more than ${MAX_CANDIDATES} @imports; the rest were not followed` });
+                continue;
+            }
+            const target = spec.startsWith("~/") ? node_path_1.default.join(home, spec.slice(2)) : node_path_1.default.resolve(node_path_1.default.dirname(from), spec);
+            const real = (0, fs_safe_1.realpathOrSelf)(target);
+            if (seen.has(real))
+                continue;
+            if (depth >= MAX_DEPTH) {
+                skipped.push({ spec, reason: "depth>4" });
+                continue;
+            }
+            if (!allowed(real)) {
+                skipped.push({ spec, reason: "outside allowed roots" });
+                continue;
+            }
+            const r = (opts.read ?? ((t) => (0, fs_safe_1.readTextSafe)(t)))(target);
+            if (!r.ok) {
+                if (r.reason !== "missing")
+                    skipped.push({ spec, reason: r.reason });
+                continue;
+            }
+            seen.add(real);
+            imported++;
+            const t = opts.stripComments ? (0, comments_1.stripHtmlComments)(r.text) : r.text;
+            parts.push(t);
+            walk(t, target, depth + 1);
+        }
+    };
+    walk(fileText, filePath, 0);
+    return { text: [fileText, ...parts].join("\n"), imported, skipped };
+}

package/dist/tokens/counter.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeCounter = makeCounter;
+function heuristicCount(text) {
+    if (!text)
+        return 0;
+    const jsonish = (text.match(/[{}\[\]":,]/g) || []).length / text.length > 0.08;
+    return Math.ceil(text.length / (jsonish ? 3.0 : 3.5));
+}
+function makeCounter(requested) {
+    if (requested === "auto") {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const enc = require("gpt-tokenizer/encoding/o200k_base");
+            // Verify it works (and that special-token text such as "<|endoftext|>" cannot throw).
+            enc.encode("hello", { disallowedSpecial: new Set() });
+            return {
+                method: "bpe-o200k",
+                note: "o200k BPE (gpt-tokenizer, bundled) with per-family scaling",
+                count(text) {
+                    if (!text)
+                        return 0;
+                    try {
+                        return enc.encode(text, { disallowedSpecial: new Set() }).length;
+                    }
+                    catch {
+                        return heuristicCount(text);
+                    }
+                },
+            };
+        }
+        catch {
+            /* fall through to heuristic */
+        }
+    }
+    return {
+        method: "heuristic",
+        note: requested === "auto" ? "BPE tokenizer unavailable; fell back to chars/3.5 heuristic" : "chars/3.5 (prose) or chars/3.0 (JSON/code) heuristic",
+        count: heuristicCount,
+    };
+}

package/dist/tokens/families.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileFor = profileFor;
+function sym(raw, factor, bandPct) {
+    const est = Math.round(raw * factor);
+    return { est, low: Math.round(est * (1 - bandPct)), high: Math.round(est * (1 + bandPct)) };
+}
+/**
+ * Priors from PRODUCT_PLAN §7.2. All Claude/heuristic factors and bands are UNVALIDATED priors until
+ * calibrated against ground truth (see docs/accuracy.md). The OpenAI band is for the BPE itself.
+ */
+function profileFor(agent, method, claude) {
+    if (method === "heuristic") {
+        return {
+            id: "heuristic",
+            label: "heuristic chars/3.5 (no tokenizer)",
+            band: "±35%",
+            apply: (raw) => sym(raw, 1, 0.35),
+            unvalidated: true,
+        };
+    }
+    if (agent === "codex") {
+        return { id: "openai-o200k", label: "o200k BPE (OpenAI-family)", band: "±3%", apply: (raw) => sym(raw, 1.0, 0.03), unvalidated: false };
+    }
+    const f = claude === "current" ? 1.5 : 1.2;
+    const claudeProfile = {
+        id: `claude-${claude}`,
+        label: `o200k × ${f} (Claude-${claude} prior)`,
+        band: "±20%",
+        apply: (raw) => sym(raw, f, 0.2),
+        unvalidated: true,
+    };
+    if (agent === "claude-code")
+        return claudeProfile;
+    // Cursor: model not discoverable from disk -> span GPT-like (×1.0, −3%) to Claude-like (×f, +20%); est = midpoint.
+    return {
+        id: "cursor-mixed",
+        label: `o200k; model unknown, so midpoint of GPT-like (×1.0) and Claude-like (×${f}) priors`,
+        band: "wide: GPT-like −3% to Claude-like +20%",
+        apply: (raw) => {
+            const lo = Math.round(raw * 0.97);
+            const hi = Math.round(raw * f * 1.2);
+            return { est: Math.round((raw * (1 + f)) / 2), low: lo, high: hi };
+        },
+        unvalidated: true,
+    };
+}

package/dist/util/fmt.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitize = sanitize;
+exports.fmtInt = fmtInt;
+exports.fmtTok = fmtTok;
+exports.fmtPct = fmtPct;
+exports.parseWindow = parseWindow;
+exports.fmtWindow = fmtWindow;
+exports.xmlEscape = xmlEscape;
+exports.wrap = wrap;
+exports.shortenLeft = shortenLeft;
+exports.shortenLabel = shortenLabel;
+exports.cmp = cmp;
+const secrets_1 = require("./secrets");
+/** Remove control characters / ANSI escapes so file names from untrusted repos cannot hijack the terminal or a downstream agent. */
+function sanitize(s, max = 120) {
+    // eslint-disable-next-line no-control-regex
+    let out = s.replace(/\u001b\[[0-9;?]*[ -\/]*[@-~]/g, "").replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, "?");
+    // Scrub BEFORE truncating: a cut-off key (sk-ant-…) would no longer match and would leak its prefix.
+    out = (0, secrets_1.scrubSecrets)(out);
+    if (out.length > max)
+        out = out.slice(0, max - 1) + "…";
+    return out;
+}
+function fmtInt(n) {
+    return Math.round(n).toLocaleString("en-US");
+}
+/** 16440 -> "16.4k", 950 -> "950". */
+function fmtTok(n) {
+    const r = Math.round(n);
+    if (r < 1000)
+        return String(r);
+    if (r < 100000)
+        return (r / 1000).toFixed(1).replace(/\.0$/, "") + "k";
+    if (r < 999500)
+        return Math.round(r / 1000) + "k";
+    return (r / 1_000_000).toFixed(r < 10_000_000 ? 2 : 1).replace(/\.?0+$/, "") + "M";
+}
+function fmtPct(x) {
+    if (x < 0.1)
+        return x === 0 ? "0%" : "< 0.1%";
+    return (x < 10 ? x.toFixed(1) : String(Math.round(x))) + "%";
+}
+function parseWindow(s) {
+    const m = /^(\d+(?:\.\d+)?)\s*([km]?)$/i.exec(s.trim());
+    if (!m)
+        return null;
+    const n = parseFloat(m[1]);
+    const mult = m[2].toLowerCase() === "k" ? 1000 : m[2].toLowerCase() === "m" ? 1_000_000 : 1;
+    const v = Math.round(n * mult);
+    return v >= 1000 ? v : null;
+}
+function fmtWindow(n) {
+    if (n >= 1_000_000 && n % 1_000_000 === 0)
+        return n / 1_000_000 + "M";
+    if (n >= 1000 && n % 1000 === 0)
+        return n / 1000 + "k";
+    return String(n);
+}
+function xmlEscape(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+}
+/** Greedy word wrap; first line gets `first`, continuation lines get `indent`. */
+function wrap(text, width, first = "", indent = "") {
+    const room = Math.max(20, width - Math.max(first.length, indent.length) - 1);
+    const words = text
+        .split(/\s+/)
+        .filter(Boolean)
+        .flatMap((w) => (w.length > room ? w.match(new RegExp(`[\\s\\S]{1,${room}}`, "gu")) ?? [w] : [w]));
+    const lines = [];
+    let cur = first;
+    let empty = true;
+    for (const w of words) {
+        if (!empty && cur.length + 1 + w.length > width) {
+            lines.push(cur);
+            cur = indent + w;
+        }
+        else {
+            cur += (empty ? "" : " ") + w;
+        }
+        empty = false;
+    }
+    lines.push(cur);
+    return lines;
+}
+/** Truncate from the LEFT, keeping the end (the file name) of a path-like label. */
+function shortenLeft(s, max) {
+    if (s.length <= max)
+        return s;
+    return "…" + s.slice(s.length - (max - 1));
+}
+/** Shorten a row label: paths keep their tail (the file name); prose keeps its start. */
+function shortenLabel(s, max) {
+    const t = s.replace(/^\.\//, "");
+    if (t.length <= max)
+        return t;
+    return /[\\/]/.test(t) && !/\s/.test(t) ? "…" + t.slice(t.length - (max - 1)) : t.slice(0, max - 1) + "…";
+}
+/** Locale-independent, ICU-independent string order (UTF-16 code units). Use instead of localeCompare for deterministic output. */
+function cmp(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}

package/dist/util/secrets.js

@@ -0,0 +1,35 @@
+"use strict";
+/** Secret-shaped string detection. Dependency-free so util/fmt can use it (sanitize() scrubs everything it displays). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_RES = void 0;
+exports.findSecretLines = findSecretLines;
+exports.scrubSecrets = scrubSecrets;
+exports.SECRET_RES = [
+    /AKIA[0-9A-Z]{16}/,
+    /gh[pousr]_[A-Za-z0-9]{30,}/,
+    /github_pat_[A-Za-z0-9_]{30,}/,
+    /sk-[A-Za-z0-9_-]{20,}/,
+    /xox[baprs]-[A-Za-z0-9-]{10,}/,
+    /AIza[0-9A-Za-z_-]{35}/,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+    /(api[_-]?key|secret|token|passwd|password)["']?\s*[:=]\s*["']?[A-Za-z0-9_\-\/+=.]{16,}/i,
+];
+/** 1-based line numbers containing something that looks like a secret. Values are never returned. */
+function findSecretLines(text) {
+    const out = [];
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length && out.length < 50; i++) {
+        if (lines[i].length > 4000)
+            continue;
+        if (exports.SECRET_RES.some((re) => re.test(lines[i])))
+            out.push(i + 1);
+    }
+    return out;
+}
+/** Replace anything secret-looking inside a string we are about to display. */
+function scrubSecrets(s) {
+    let out = s;
+    for (const re of exports.SECRET_RES)
+        out = out.replace(new RegExp(re.source, re.flags.includes("g") ? re.flags : re.flags + "g"), "[redacted]");
+    return out;
+}

package/package.json

@@ -1,6 +1,68 @@
 {
   "name": "prehello",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "See what your coding agent (Claude Code, Cursor, Codex) loads before you say hello, and what you could cut. Local-only, read-only, no API key.",
+  "license": "MIT",
+  "author": "Piyush Kumar",
+  "homepage": "https://github.com/PIYUSH-KUMAR1809/prehello#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PIYUSH-KUMAR1809/prehello.git"
+  },
+  "bugs": {
+    "url": "https://github.com/PIYUSH-KUMAR1809/prehello/issues"
+  },
+  "bin": {
+    "prehello": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "assets",
+    "spec",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && vitest run",
+    "prepack": "npm run clean && npm run build",
+    "prehello": "node dist/cli.js"
+  },
+  "keywords": [
+    "claude-code",
+    "cursor",
+    "codex",
+    "agents-md",
+    "ai-agents",
+    "context-window",
+    "tokens",
+    "token-counter",
+    "mcp",
+    "sarif",
+    "cli",
+    "developer-tools"
+  ],
+  "dependencies": {
+    "gpt-tokenizer": "^4.1.0",
+    "picomatch": "^4.0.7",
+    "smol-toml": "^1.9.1"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.43",
+    "@types/picomatch": "^4.0.3",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7"
+  },
+  "optionalDependencies": {
+    "@resvg/resvg-wasm": "^2.6.2"
+  }
+}

package/spec/claude-code.json

@@ -0,0 +1,22 @@
+{
+  "agent": "claude-code",
+  "verifiedAt": "2026-10-25",
+  "verifiedNote": "Skills (locations, combined 1,536-char description cap, disable-model-invocation, skillOverrides, nested lazy loading, commands merged into skills, claude.ai synced skills) and plugin install records (installed_plugins.json with installPath, enabledPlugins, plugins cache layout) are from Claude Code docs (fetched 2026-10-25). The 1% skill listing budget is documented but its unit (tokens vs characters) is unclear. managed-mcp.json is documented by name; its location inside the managed directory is assumed. Not re-verified against a real install.",
+  "docs": {
+    "memory": "https://code.claude.com/docs/en/memory",
+    "mcp": "https://code.claude.com/docs/en/mcp",
+    "skills": "https://code.claude.com/docs/en/skills",
+    "plugins": "https://code.claude.com/docs/en/plugins/loading"
+  },
+  "caps": {
+    "instructionFileGuidelineLines": 200,
+    "memoryMaxLines": 200,
+    "memoryMaxBytes": 25600,
+    "skillDescriptionMaxChars": 1536,
+    "skillListingBudgetFractionOfWindow": 0.01,
+    "importMaxDepth": 4
+  },
+  "minVersions": {
+    "agentsMdFallback": "2.1.277"
+  }
+}

package/spec/codex.json

@@ -0,0 +1,14 @@
+{
+  "agent": "codex",
+  "verifiedAt": "2026-10-25",
+  "verifiedNote": "AGENTS.md discovery, the 32 KiB default, skills locations (.agents/skills cwd\u2192repo root, ~/.agents/skills, /etc/codex/skills), the name+description+path listing and [[skills.config]] disabling are from OpenAI's docs (fetched 2026-10-25). ASSUMED: project .codex/config.toml MCP, MCP schema loading (modelled upfront), ~/.codex/skills as a legacy skills path. Token accuracy was never validated.",
+  "docs": {
+    "agentsMd": "https://learn.chatgpt.com/docs/agent-configuration/agents-md",
+    "mcp": "https://learn.chatgpt.com/docs/extend/mcp?surface=cli",
+    "skills": "https://learn.chatgpt.com/docs/build-skills",
+    "config": "https://learn.chatgpt.com/docs/config-file/config-reference"
+  },
+  "caps": {
+    "projectDocMaxBytesDefault": 32768
+  }
+}

package/spec/cursor.json

@@ -0,0 +1,15 @@
+{
+  "agent": "cursor",
+  "verifiedAt": "2026-10-25",
+  "verifiedNote": "Rule modes, skill locations (native + compat dirs), skill frontmatter (paths/globs, disable-model-invocation), plugin manifest/default component dirs, and lazy MCP loading (tool names static, descriptions on demand) are from Cursor's docs and blog (fetched 2026-10-25). UNVERIFIED (marked assumed): how Cursor injects agent-requested rule descriptions and the skills listing, ~/.cursor/skills-cursor (observed on a real Mac only), the plugin cache/marketplace on-disk layout and install state, and whether nested .cursor/rules apply (docs and forum disagree).",
+  "docs": {
+    "rules": "https://cursor.com/docs/rules",
+    "mcp": "https://cursor.com/docs/mcp",
+    "skills": "https://cursor.com/docs/skills",
+    "plugins": "https://cursor.com/docs/plugins",
+    "mcpLazy": "https://cursor.com/blog/dynamic-context-discovery"
+  },
+  "caps": {
+    "ruleGuidelineLines": 500
+  }
+}

package/spec/mcp-weights.json

@@ -0,0 +1,62 @@
+{
+  "version": 1,
+  "note": "MEASURED with scripts/measure-mcp.cjs: each server was installed from npm (--ignore-scripts), started offline in a network-less sandbox with a scrubbed env, and asked for tools/list over stdio. Tokens are o200k_base over the raw tool-list JSON (name; description+inputSchema). That is NOT the exact text any agent injects, and tool lists change between server versions, so treat these as ballpark for the stated version. measuredAt is a UTC date. Only servers that could be measured without credentials are listed; everything else stays unmeasured.",
+  "servers": [
+    {
+      "package": "@modelcontextprotocol/server-memory",
+      "tools": 9,
+      "nameTokens": 24,
+      "schemaTokens": 905,
+      "measuredAt": "2026-10-24",
+      "version": "1.0.0"
+    },
+    {
+      "package": "@modelcontextprotocol/server-filesystem",
+      "tools": 14,
+      "nameTokens": 36,
+      "schemaTokens": 1614,
+      "measuredAt": "2026-10-24",
+      "version": "1.0.0"
+    },
+    {
+      "package": "@modelcontextprotocol/server-sequential-thinking",
+      "tools": 1,
+      "nameTokens": 3,
+      "schemaTokens": 857,
+      "measuredAt": "2026-10-24",
+      "version": "1.0.0"
+    },
+    {
+      "package": "@modelcontextprotocol/server-everything",
+      "tools": 13,
+      "nameTokens": 48,
+      "schemaTokens": 997,
+      "measuredAt": "2026-10-24",
+      "version": "1.0.0"
+    },
+    {
+      "package": "@modelcontextprotocol/server-github",
+      "tools": 26,
+      "nameTokens": 76,
+      "schemaTokens": 3392,
+      "measuredAt": "2026-10-24",
+      "version": "2025.4.8"
+    },
+    {
+      "package": "@playwright/mcp",
+      "tools": 25,
+      "nameTokens": 70,
+      "schemaTokens": 3617,
+      "measuredAt": "2026-10-24",
+      "version": "0.0.83"
+    },
+    {
+      "package": "@upstash/context7-mcp",
+      "tools": 2,
+      "nameTokens": 6,
+      "schemaTokens": 1050,
+      "measuredAt": "2026-10-24",
+      "version": "4.4.4"
+    }
+  ]
+}