prehello 0.0.0-stage → 0.1.0

package/dist/mcp/configs.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_MCP_SERVERS = void 0;
+exports.parseMcpMap = parseMcpMap;
+exports.parseCodexToml = parseCodexToml;
+const smol_toml_1 = require("smol-toml");
+const fmt_1 = require("../util/fmt");
+function isObj(x) {
+    return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+function guessPkg(entry) {
+    const args = Array.isArray(entry.args) ? entry.args.filter((a) => typeof a === "string") : [];
+    const cmd = typeof entry.command === "string" ? entry.command : "";
+    if (!/(^|\/)(npx|bunx|pnpx|uvx|pipx)$/.test(cmd) && !/^(npx|bunx|pnpx|uvx|pipx)$/.test(cmd))
+        return undefined;
+    const a = args.find((x) => !x.startsWith("-"));
+    return a ? a.replace(/@[\w.^~<>=*-]+$/, (m) => (a.startsWith("@") && a.indexOf("@", 1) === -1 ? m : "")) : undefined;
+}
+/** A real config has a handful of servers. A hostile one with 200,000 entries must not become a 180 MB report. */
+exports.MAX_MCP_SERVERS = 500;
+/** Extract server definitions from a `{ mcpServers: {...} }`-style map. Values (env, headers, args) are never retained. */
+function parseMcpMap(map, warn) {
+    if (!isObj(map))
+        return [];
+    const out = [];
+    const names = Object.keys(map);
+    if (names.length > exports.MAX_MCP_SERVERS)
+        warn?.(`an MCP config lists ${names.length} servers; only the first ${exports.MAX_MCP_SERVERS} were read, so MCP counts are a lower bound`);
+    for (const name of names.slice(0, exports.MAX_MCP_SERVERS)) {
+        const v = map[name];
+        if (!isObj(v))
+            continue;
+        const t = typeof v.type === "string" ? v.type : typeof v.transport === "string" ? v.transport : undefined;
+        const transport = t === "http" || t === "streamable-http" ? "http" : t === "sse" ? "sse" : t === "stdio" || typeof v.command === "string" ? "stdio" : typeof v.url === "string" ? "http" : "unknown";
+        out.push({ name: (0, fmt_1.sanitize)(name, 60), transport, pkg: guessPkg(v), disabled: v.disabled === true || v.enabled === false });
+    }
+    return out;
+}
+function parseCodexToml(text, warn) {
+    const cfg = (0, smol_toml_1.parse)(text);
+    return { servers: parseMcpMap(cfg.mcp_servers, warn), config: cfg };
+}

package/dist/model.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOAD_MODES = exports.ALL_AGENTS = exports.AGENT_NAMES = exports.SCHEMA_VERSION = void 0;
+exports.SCHEMA_VERSION = 1;
+exports.AGENT_NAMES = {
+    "claude-code": "Claude Code",
+    cursor: "Cursor",
+    codex: "Codex",
+};
+exports.ALL_AGENTS = ["claude-code", "cursor", "codex"];
+exports.LOAD_MODES = ["always", "conditional", "deferred", "on-demand", "unknown"];

package/dist/platform.js

@@ -0,0 +1,115 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isWinAbsolute = isWinAbsolute;
+exports.resolveHomeDir = resolveHomeDir;
+exports.isWindowsReservedName = isWindowsReservedName;
+exports.hasWindowsStream = hasWindowsStream;
+exports.unicodeSupported = unicodeSupported;
+exports.toAscii = toAscii;
+exports.toPosix = toPosix;
+exports.makeGlobMatcher = makeGlobMatcher;
+exports.isInsideWith = isInsideWith;
+exports.decodeUserText = decodeUserText;
+/**
+ * Platform helpers: everything that differs between Linux, macOS and Windows lives here, as pure functions that take the
+ * platform (and a `path` implementation) as arguments, so the Windows behaviour can be unit-tested on any machine.
+ */
+const node_path_1 = __importDefault(require("node:path"));
+const picomatch_1 = __importDefault(require("picomatch"));
+/** Is `p` an absolute path in the Windows sense (C:\x, C:/x, \\server\share)? Works on any host. */
+function isWinAbsolute(p) {
+    return node_path_1.default.win32.isAbsolute(p) && /^(?:[a-zA-Z]:[\\/]|\\\\|\/\/)/.test(p);
+}
+/**
+ * The home directory the AGENTS use. Claude Code, Cursor (Electron) and Codex all take it from the OS, not from $HOME:
+ * on Windows that is %USERPROFILE%. Git Bash sets HOME to a POSIX-style "/c/Users/me" that Node cannot open, and a network HOME
+ * ("H:\") can differ from the profile folder the agents read, so on Windows HOME is only a last resort.
+ */
+function resolveHomeDir(env, platform, osHomedir) {
+    if (platform === "win32") {
+        if (env.USERPROFILE && isWinAbsolute(env.USERPROFILE))
+            return env.USERPROFILE;
+        if (env.HOMEDRIVE && env.HOMEPATH && isWinAbsolute(env.HOMEDRIVE + env.HOMEPATH))
+            return env.HOMEDRIVE + env.HOMEPATH;
+        if (env.HOME && isWinAbsolute(env.HOME))
+            return env.HOME;
+        return osHomedir();
+    }
+    if (env.HOME && node_path_1.default.posix.isAbsolute(env.HOME))
+        return env.HOME;
+    return osHomedir();
+}
+/** Windows device names: opening "nul.svg" or "COM1.md" writes to a device (silently discarding the report), whatever the extension. */
+function isWindowsReservedName(file) {
+    const base = file.split(/[\\/]/).pop() ?? "";
+    const stem = base.split(".")[0].replace(/[ .]+$/, "");
+    return /^(con|prn|aux|nul|conin\$|conout\$|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3])$/i.test(stem);
+}
+/** On Windows a ":" after the drive letter is an NTFS alternate data stream ("report.md:hidden"): never write one. */
+function hasWindowsStream(file) {
+    return file.replace(/^(?:\\\\\?\\)?[a-zA-Z]:/, "").includes(":");
+}
+/**
+ * Can this terminal draw the box/block/arrow glyphs prehello uses? Mirrors the widely used "is-unicode-supported" rule:
+ * the Linux virtual console (TERM=linux) and the legacy Windows console host (cmd.exe / classic PowerShell window) cannot,
+ * Windows Terminal, VS Code, JetBrains, ConEmu, Alacritty and modern xterm-likes can.
+ */
+function unicodeSupported(env, platform) {
+    if (env.PREHELLO_ASCII === "1")
+        return false;
+    if (platform !== "win32")
+        return env.TERM !== "linux";
+    return (!!env.WT_SESSION ||
+        !!env.TERMINUS_SUBLIME ||
+        env.ConEmuTask === "{cmd::Cmder}" ||
+        env.TERM_PROGRAM === "vscode" ||
+        env.TERM_PROGRAM === "Terminus-Sublime" ||
+        env.TERM === "xterm-256color" ||
+        env.TERM === "alacritty" ||
+        env.TERMINAL_EMULATOR === "JetBrains-JediTerm");
+}
+const ASCII_MAP = {
+    "·": "-", "–": "-", "—": "-", "−": "-", "…": "...", "≥": ">=", "≤": "<=", "→": "->", "⚠": "!", "ℹ": "i", "•": "*",
+    "█": "#", "▌": "=", "‘": "'", "’": "'", "“": '"', "”": '"', "≈": "~", "×": "x",
+};
+/** Replace every non-ASCII glyph prehello prints with an ASCII stand-in (accents and other letters become "?"). */
+function toAscii(s) {
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/[^\x00-\x7f]/gu, (c) => ASCII_MAP[c] ?? "?");
+}
+function toPosix(p) {
+    return p.replace(/\\/g, "/");
+}
+/**
+ * Glob matcher for settings such as claudeMdExcludes. Always matches forward-slash paths: a Windows path is converted first,
+ * and backslashes in a pattern are path separators there (not escapes). Windows paths are case-insensitive.
+ */
+function makeGlobMatcher(patterns, platform) {
+    const win = platform === "win32";
+    const pats = win ? patterns.map(toPosix) : patterns;
+    const m = (0, picomatch_1.default)(pats, { dot: true, windows: false, nocase: win });
+    return (file) => m(win ? toPosix(file) : file);
+}
+/** True if `child` is `parent` or inside it. A directory called "..foo" is inside; "../x" is not. */
+function isInsideWith(pm, child, parent) {
+    const rel = pm.relative(parent, child);
+    return rel === "" || (rel !== ".." && !rel.startsWith(".." + pm.sep) && !pm.isAbsolute(rel));
+}
+/**
+ * Text a USER hands to prehello (--mcp-catalog file, --paste-user-rules file or stdin). Windows editors and PowerShell 5 write
+ * a UTF-8 BOM or UTF-16: both are decoded here instead of failing as "malformed JSON" or counting a BOM as a token.
+ * CRLF is normalised to LF for pasted rules so the same text counts the same on every platform.
+ */
+function decodeUserText(buf) {
+    let s;
+    if (buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe)
+        s = buf.subarray(2).toString("utf16le");
+    else if (buf.length >= 2 && buf[0] === 0xfe && buf[1] === 0xff)
+        s = Buffer.from(buf.subarray(2)).swap16().toString("utf16le");
+    else
+        s = buf.toString("utf8");
+    return s.replace(/^\ufeff/, "");
+}

package/dist/redact.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scrubSecrets = exports.findSecretLines = void 0;
+exports.displayPath = displayPath;
+const node_path_1 = __importDefault(require("node:path"));
+const fmt_1 = require("./util/fmt");
+const secrets_1 = require("./util/secrets");
+Object.defineProperty(exports, "findSecretLines", { enumerable: true, get: function () { return secrets_1.findSecretLines; } });
+Object.defineProperty(exports, "scrubSecrets", { enumerable: true, get: function () { return secrets_1.scrubSecrets; } });
+/** True when `rel` (from path.relative) leaves its base: "..", "../x", but not a child called "..foo". */
+function escapes(pm, rel) {
+    return rel === ".." || rel.startsWith(".." + pm.sep) || pm.isAbsolute(rel);
+}
+/** Display form of a path: ./relative inside the project, ~/ inside HOME, else absolute. Always forward slashes. Sanitised + scrubbed. */
+function displayPath(p, c) {
+    const pm = c.pathMod ?? node_path_1.default;
+    const slash = (x) => x.split(pm.sep).join("/");
+    let out;
+    const rel = pm.relative(c.cwd, p);
+    if (rel === "")
+        out = ".";
+    else if (!escapes(pm, rel))
+        out = "./" + slash(rel);
+    else {
+        const hr = pm.relative(c.home, p);
+        if (hr === "")
+            out = "~";
+        else if (!escapes(pm, hr))
+            out = "~/" + slash(hr);
+        else if (rel.split(pm.sep).filter((x) => x === "..").length <= 4 && !pm.isAbsolute(rel))
+            out = slash(rel); // ../../CLAUDE.md (ancestor directory)
+        else
+            out = slash(p); // absolute elsewhere; on Windows "C:/Users/..." rather than backslashes (JSON/markdown-safe)
+    }
+    return (0, secrets_1.scrubSecrets)((0, fmt_1.sanitize)(out, 200));
+}

package/dist/render/card.js

@@ -0,0 +1,305 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CARD_FONT = exports.THEMES = exports.AT_LEAST = exports.MIN_CUT_HEADLINE_TOKENS = void 0;
+exports.buildHeadline = buildHeadline;
+exports.assertHeadline = assertHeadline;
+exports.pickCardAgent = pickCardAgent;
+exports.wrapLabel = wrapLabel;
+exports.renderCard = renderCard;
+const fmt_1 = require("../util/fmt");
+const treemap_1 = require("./treemap");
+const savings_1 = require("../analyze/savings");
+const secrets_1 = require("../util/secrets");
+/** A saving smaller than this (estimated tokens) is noise, not a headline. Same threshold as the cut list itself. */
+exports.MIN_CUT_HEADLINE_TOKENS = 500;
+/** Wording of the lower-bound marker. Words, not a glyph: "≥" is missing from several fallback fonts used by SVG renderers. */
+exports.AT_LEAST = "at least";
+/**
+ * Headline templates. Each one is selected by data and re-validated by assertHeadline():
+ * no claim is rendered unless it is true for the scanned data (plan §10.1 guard).
+ */
+function buildHeadline(a, window, variant = "cut") {
+    const t = a.totals.always;
+    const lower = a.lowerBound ? `${exports.AT_LEAST} ` : "";
+    // The cut headline needs measured always-on data AND a saving that is worth saying out loud; otherwise the total headline is used.
+    if (variant === "cut" && a.savings && t.measuredItems > 0 && a.savings.topTokens >= exports.MIN_CUT_HEADLINE_TOKENS) {
+        const sv = a.savings;
+        const what = sv.top.some((c) => c.kind === "mcp") ? "Skills, plugins & MCP" : "Skills & plugins";
+        return {
+            id: "cut-list",
+            hero: `${what} cost ${lower}~${(0, fmt_1.fmtTok)(sv.groupsTokens)} tokens before hello`,
+            sub: `${sv.n === sv.groupsCount ? `all ${sv.n} group${sv.n > 1 ? "s" : ""}` : `top ${sv.n} of ${sv.groupsCount} groups`}: cut ${sv.n > 1 ? "them" : "it"}, save ~${(0, fmt_1.fmtTok)(sv.topTokens)} (estimate)`,
+        };
+    }
+    if (t.measuredItems > 0 && t.est > 0) {
+        const pct = (t.est / window) * 100;
+        return {
+            id: "tokens-before-hello",
+            hero: `${lower}~${(0, fmt_1.fmtTok)(t.est)} tokens load before hello`,
+            sub: `${pct < 0.1 ? (a.lowerBound ? "under 0.1% so far" : "under 0.1%") : (a.lowerBound ? exports.AT_LEAST + " " : "about ") + (0, fmt_1.fmtPct)(pct)} of a ${(0, fmt_1.fmtWindow)(window)} window · ${a.name} · estimate`,
+        };
+    }
+    if (t.unmeasuredItems > 0) {
+        const n = t.unmeasuredItems;
+        // only claim "MCP servers" when every unmeasured always-on item really is one (an unreadable CLAUDE.md is not a server)
+        const un = a.items.filter((i) => i.loadMode === "always" && i.tokens === null);
+        const mcpOnly = un.length > 0 && un.every((i) => i.kind === "mcp-server");
+        return { id: "mcp-unmeasured", hero: mcpOnly ? `${n} MCP server${n > 1 ? "s" : ""} load before hello` : `${n} always-loaded item${n > 1 ? "s" : ""} could not be measured`, sub: `${a.name} · token cost unmeasured (not zero)` };
+    }
+    return null;
+}
+function assertHeadline(h, a, window) {
+    const t = a.totals.always;
+    if (h.id === "tokens-before-hello") {
+        if (!(t.measuredItems > 0 && t.est > 0))
+            throw new Error("headline guard: tokens claim without measured always-on data");
+        if (a.lowerBound && !h.hero.startsWith(exports.AT_LEAST))
+            throw new Error("headline guard: lower-bound marker missing");
+        if (!h.hero.includes("~"))
+            throw new Error("headline guard: estimate marker missing");
+        if (/%/.test(h.hero))
+            throw new Error("headline guard: unexpected percentage in hero");
+    }
+    else if (h.id === "cut-list") {
+        if (!a.savings || !(t.measuredItems > 0))
+            throw new Error("headline guard: cut-list claim without savings data");
+        if (a.savings.topTokens < exports.MIN_CUT_HEADLINE_TOKENS)
+            throw new Error("headline guard: cut-list claim below the minimum saving");
+        if (!h.hero.includes("~") || !/estimate/.test(h.sub))
+            throw new Error("headline guard: estimate marker missing");
+        if (a.lowerBound && !/ cost at least /.test(h.hero))
+            throw new Error("headline guard: lower-bound marker missing");
+    }
+    else if (h.id === "mcp-unmeasured") {
+        if (t.measuredItems > 0 || t.unmeasuredItems === 0)
+            throw new Error("headline guard: mcp claim without unmeasured-only data");
+        if (/\d+(\.\d+)?k? tokens/.test(h.hero + h.sub))
+            throw new Error("headline guard: token number for unmeasured data");
+    }
+    void window;
+}
+function pickCardAgent(r, want) {
+    const shown = r.agents.filter((a) => !a.presentInRepoOnly);
+    if (want)
+        return shown.find((a) => a.id === want) ?? null;
+    const withData = shown.filter((a) => buildHeadline(a, r.scan.window));
+    withData.sort((a, b) => b.totals.always.est - a.totals.always.est || b.totals.always.unmeasuredItems - a.totals.always.unmeasuredItems);
+    return withData[0] ?? null;
+}
+const FILLS = ["#1f6feb", "#8250df", "#1a7f37", "#9a6700", "#bf3989", "#0a7a8a", "#bc4c00"];
+const OTHER_FILL = "#57606a";
+exports.THEMES = {
+    dark: { bg: "#0d1117", text: "#e6edf3", muted: "#9da7b3", chip: "#21262d", border: "#30363d" },
+    light: { bg: "#ffffff", text: "#1f2328", muted: "#4b5563", chip: "#eef1f4", border: "#d0d7de" },
+};
+function fit(text, maxChars) {
+    if (text.length <= maxChars)
+        return text;
+    return maxChars <= 3 ? text.slice(0, Math.max(0, maxChars)) : text.slice(0, maxChars - 3) + "...";
+}
+/**
+ * Font stack with sane fallbacks: SVG renderers (browsers, rsvg, Inkscape, link-preview bots) differ in which of these exist,
+ * and `system-ui` is unknown to some of them. It always ends in the generic `sans-serif`, and every width estimate below assumes
+ * a wide face (DejaVu Sans is ~0.62 em per character) so text still fits when the fallback is the widest one.
+ */
+exports.CARD_FONT = "system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Liberation Sans', 'DejaVu Sans', sans-serif";
+const DEFAULT_CHAR_EM = 0.62;
+/** Greedy wrap of a tile label at spaces and after hyphens; the last allowed line ends in "..." when text is left over. Never returns an empty list. */
+function wrapLabel(label, maxChars, maxLines) {
+    const toks = label.split(/(?<=-)|\s+/).filter(Boolean);
+    const lines = [];
+    let cur = "";
+    const rest = [];
+    for (let i = 0; i < toks.length; i++) {
+        const t = toks[i];
+        const joined = cur ? (cur.endsWith("-") ? cur + t : `${cur} ${t}`) : t;
+        if (!cur || joined.length <= maxChars)
+            cur = joined;
+        else {
+            lines.push(cur);
+            cur = t;
+        }
+        if (lines.length === maxLines) {
+            rest.push(...toks.slice(i));
+            cur = "";
+            break;
+        }
+    }
+    if (cur)
+        lines.push(cur);
+    if (lines.length > maxLines)
+        lines.length = maxLines;
+    const out = lines.map((l) => (l.length > maxChars ? fit(l, maxChars) : l));
+    if (rest.length > 0)
+        out[out.length - 1] = fit(out[out.length - 1] + "...", maxChars);
+    return out.length ? out : [fit(label, maxChars)];
+}
+/** Greedy wrap on " · " boundaries so a footer never runs off the card. */
+function wrapSegments(segments, maxChars) {
+    const lines = [];
+    let cur = "";
+    for (const seg of segments) {
+        const next = cur ? `${cur} · ${seg}` : seg;
+        if (cur && next.length > maxChars) {
+            lines.push(cur);
+            cur = seg;
+        }
+        else
+            cur = next;
+    }
+    if (cur)
+        lines.push(cur);
+    return lines.map((l) => fit(l, maxChars));
+}
+/** No paths or file contents by construction: only cut-list group names (plugin / MCP server names; anonymisable), generic labels (cardLabel), counts, the version and a date reach the SVG. */
+function renderCard(r, a, o) {
+    const CHAR_EM = o.charEm ?? DEFAULT_CHAR_EM;
+    const maxCharsFor = (px, fontSize) => Math.max(1, Math.floor(px / (fontSize * CHAR_EM)));
+    const head = buildHeadline(a, r.scan.window, o.headline ?? "cut") ?? buildHeadline(a, r.scan.window, "total");
+    if (!head)
+        throw new Error("nothing measurable to put on a card");
+    assertHeadline(head, a, r.scan.window);
+    const th = exports.THEMES[o.theme];
+    const og = o.size === "og";
+    const W = og ? 1200 : 1080;
+    const H = og ? 630 : 1080;
+    const pad = og ? 48 : 56;
+    const innerW = W - pad * 2;
+    const font = o.fontFamily ?? exports.CARD_FONT;
+    const heroMax = og ? 64 : 72;
+    let heroLines = [head.hero];
+    let heroSize = Math.min(heroMax, Math.floor(innerW / (head.hero.length * CHAR_EM)));
+    // Square cards have the room for a two-line hero: split it at the space nearest the middle when one line would be small.
+    if (!og && heroSize < 52 && head.hero.includes(" ")) {
+        const mid = head.hero.length / 2;
+        const cut = [...head.hero.matchAll(/ /g)].map((m) => m.index).sort((x, y) => Math.abs(x - mid) - Math.abs(y - mid))[0];
+        heroLines = [head.hero.slice(0, cut), head.hero.slice(cut + 1)];
+        heroSize = Math.min(heroMax, Math.floor(innerW / (Math.max(...heroLines.map((l) => l.length)) * CHAR_EM)));
+    }
+    const heroLineH = Math.round(heroSize * 1.12);
+    const heroY = og ? 168 : heroLines.length > 1 ? 196 : 214;
+    const subSize = og ? 26 : 30;
+    const subY = heroY + (heroLines.length - 1) * heroLineH + (og ? 46 : 52);
+    const showStrip = !!a.savings && head.id !== "cut-list";
+    const tmY = subY + (og ? 36 : 56);
+    // footer: wrap on segment boundaries, anchored to the bottom edge
+    const unvalidated = a.profile.id.startsWith("claude") || a.profile.id === "cursor-mixed" || a.profile.id === "heuristic";
+    const footSize = og ? 17 : 20;
+    const footLines = wrapSegments(["prehello", "local-only scan", `estimate band: ${a.profile.band}${unvalidated ? " (unvalidated)" : ""}`, `window ${(0, fmt_1.fmtWindow)(r.scan.window)}`, ...(r.partial ? ["PARTIAL scan"] : [])], maxCharsFor(innerW, footSize));
+    const footLineH = footSize + 6;
+    const footTop = H - (og ? 30 : 44) - (footLines.length - 1) * footLineH;
+    // Layout flows upward from the footer so a wrapped (2-3 line) footer can never collide with the chips or the treemap.
+    const chipH = 38;
+    const limit = footTop - footSize - (og ? 14 : 24);
+    const stripBlock = showStrip ? (og ? 40 : 52) : 0;
+    const tmH = Math.max(og ? 120 : 200, Math.min(og ? 400 : 640, limit - chipH - (og ? 22 : 30) - stripBlock - tmY));
+    const stripY = tmY + tmH + (og ? 30 : 42);
+    const chipsY = tmY + tmH + (og ? 22 : 30) + stripBlock;
+    // Treemap: the same groups as "what to cut" (plugin posthog, 18 Cursor-managed skills, ...) plus the always-on items that are not removable
+    // (rules, instruction files). Small tiles are merged into "other" so every visible tile is big enough to read.
+    const tiles = (0, savings_1.cardTiles)(a.items, !!o.anonymize);
+    const tilesTotal = tiles.reduce((s, t) => s + t.tokens, 0);
+    const MAX_TILES = og ? 7 : 8;
+    const MIN_SHARE = 0.04;
+    const shown = tiles.filter((t, k) => k < MAX_TILES && t.tokens / tilesTotal >= MIN_SHARE);
+    const restTiles = tiles.filter((t) => !shown.includes(t));
+    if (restTiles.length === 1 && restTiles[0].tokens / tilesTotal >= MIN_SHARE)
+        shown.push(restTiles.pop());
+    const rest = restTiles.reduce((s, t) => s + t.tokens, 0);
+    const cells = shown.map((t, k) => ({ label: t.named ? (0, secrets_1.scrubSecrets)(t.label) : t.label, v: t.tokens, fill: FILLS[k % FILLS.length] }));
+    if (rest > 0)
+        cells.push({ label: restTiles.length > 1 ? `other (${restTiles.length} smaller)` : "other", v: rest, fill: OTHER_FILL });
+    const rects = (0, treemap_1.squarify)(cells.map((c) => c.v), pad, tmY, innerW, tmH);
+    const totalCells = cells.reduce((s, c) => s + c.v, 0);
+    const parts = [];
+    parts.push(`<svg xmlns="http://www.w3.org/2000/svg" width="${W}" height="${H}" viewBox="0 0 ${W} ${H}" role="img" aria-labelledby="t d">`);
+    parts.push(`<title id="t">${(0, fmt_1.xmlEscape)(head.hero)}</title><desc id="d">${(0, fmt_1.xmlEscape)(head.sub)}. Generated by prehello ${(0, fmt_1.xmlEscape)(r.tool.version)}. Token counts are estimates.</desc>`);
+    parts.push(`<rect width="${W}" height="${H}" fill="${th.bg}"/>`);
+    parts.push(`<text x="${pad}" y="${pad + 20}" font-family="${font}" font-size="28" font-weight="700" fill="${th.text}">prehello <tspan font-weight="400" fill="${th.muted}" font-size="20">v${(0, fmt_1.xmlEscape)(r.tool.version)} · ${(0, fmt_1.xmlEscape)(r.generatedAt.slice(0, 10))}</tspan></text>`);
+    if (a.grade) {
+        const gx = W - pad - 36;
+        const gy = pad + 14;
+        parts.push(`<circle cx="${gx}" cy="${gy}" r="34" fill="none" stroke="${th.muted}" stroke-width="3"/>`);
+        parts.push(`<text x="${gx}" y="${gy + 16}" text-anchor="middle" font-family="${font}" font-size="46" font-weight="800" fill="${th.text}">${(0, fmt_1.xmlEscape)(a.grade.letter)}</text>`);
+        parts.push(`<text x="${W - pad}" y="${gy + 54}" text-anchor="end" font-family="${font}" font-size="14" fill="${th.muted}">Context Grade${a.grade.provisional ? " (provisional)" : ""}</text>`);
+    }
+    heroLines.forEach((line, k) => parts.push(`<text x="${pad}" y="${heroY + k * heroLineH}" font-family="${font}" font-size="${heroSize}" font-weight="800" fill="${th.text}">${(0, fmt_1.xmlEscape)(line)}</text>`));
+    parts.push(`<text x="${pad}" y="${subY}" font-family="${font}" font-size="${subSize}" fill="${th.muted}">${(0, fmt_1.xmlEscape)(fit(head.sub, maxCharsFor(innerW, subSize)))}</text>`);
+    rects.forEach((rc) => {
+        const c = cells[rc.i];
+        const g = 3;
+        const rx = rc.x + g / 2, ry = rc.y + g / 2, rw = Math.max(0, rc.w - g), rh = Math.max(0, rc.h - g);
+        parts.push(`<rect x="${rx.toFixed(1)}" y="${ry.toFixed(1)}" width="${rw.toFixed(1)}" height="${rh.toFixed(1)}" rx="6" fill="${c.fill}"/>`);
+        // label size follows cell size: big cells get a big label, token count and share; small cells get the number only
+        const big = rw >= 240 && rh >= 110;
+        const mid = rw >= 120 && rh >= 64;
+        const lf0 = big ? 26 : mid ? 20 : 15;
+        if (rw >= 64 && rh >= 34) {
+            const avail = rw - 18;
+            // shrink the label to fit before wrapping or truncating it (never below 11 px)
+            let lf = Math.max(11, Math.min(lf0, Math.floor(avail / (Math.max(1, c.label.length) * CHAR_EM))));
+            let lines = [c.label];
+            if (c.label.length * lf * CHAR_EM > avail) {
+                // still too wide at the smallest size: wrap onto up to 3 lines at spaces and hyphens, ellipsis only if it still does not fit
+                lf = Math.min(lf0, 14);
+                const withSub = Math.floor((rh - 14 - (13 + 8)) / (lf + 3));
+                const maxLines = Math.min(3, withSub >= 1 ? withSub : Math.max(1, Math.floor((rh - 8) / (lf + 3))));
+                lines = wrapLabel(c.label, maxCharsFor(avail, lf), maxLines);
+            }
+            const lineH = lf + 3;
+            const tf = Math.max(13, lf - 4);
+            lines.forEach((ln, k) => parts.push(`<text x="${(rx + 10).toFixed(1)}" y="${(ry + lf + 6 + k * lineH).toFixed(1)}" font-family="${font}" font-size="${lf}" font-weight="600" fill="#ffffff">${(0, fmt_1.xmlEscape)(ln)}</text>`));
+            const subY = ry + lf + 6 + (lines.length - 1) * lineH + tf + 6;
+            if (lines.length === 1 ? rh >= lf + tf + 22 : subY <= ry + rh - 6) {
+                const pct = totalCells ? ` · ${(0, fmt_1.fmtPct)((c.v / totalCells) * 100)}` : "";
+                const ty = lines.length === 1 ? ry + lf + tf + 12 : subY;
+                parts.push(`<text x="${(rx + 10).toFixed(1)}" y="${ty.toFixed(1)}" font-family="${font}" font-size="${tf}" fill="#ffffff">${(0, fmt_1.xmlEscape)(fit(`~${(0, fmt_1.fmtTok)(c.v)}${big ? pct : ""}`, maxCharsFor(avail, tf)))}</text>`);
+            }
+        }
+        else if (rw >= 24 && rh >= 90) {
+            // a tall, narrow tile: the name and size read bottom-to-top instead of being dropped
+            const tx = rx + rw / 2 + 4.5;
+            const ty = ry + rh - 10;
+            parts.push(`<text transform="rotate(-90 ${tx.toFixed(1)} ${ty.toFixed(1)})" x="${tx.toFixed(1)}" y="${ty.toFixed(1)}" font-family="${font}" font-size="13" font-weight="600" fill="#ffffff">${(0, fmt_1.xmlEscape)(fit(`${c.label} · ~${(0, fmt_1.fmtTok)(c.v)}`, maxCharsFor(rh - 20, 13)))}</text>`);
+        }
+        else if (rw >= 40 && rh >= 22) {
+            parts.push(`<text x="${(rx + 6).toFixed(1)}" y="${(ry + rh / 2 + 5).toFixed(1)}" font-family="${font}" font-size="13" fill="#ffffff">${(0, fmt_1.xmlEscape)(fit(`~${(0, fmt_1.fmtTok)(c.v)}`, maxCharsFor(rw - 8, 13)))}</text>`);
+        }
+    });
+    if (showStrip && a.savings) {
+        const sv = a.savings;
+        const kindWord = sv.top.every((c) => c.kind === "mcp") ? "MCP server" : sv.top.some((c) => c.kind === "mcp") ? "skill/plugin/MCP group" : "skill/plugin group";
+        const line = `Cut the top ${sv.n} ${kindWord}${sv.n > 1 ? "s" : ""}: save ~${(0, fmt_1.fmtTok)(sv.topTokens)} tokens (estimate)`;
+        const ss = og ? 22 : 24;
+        parts.push(`<text x="${pad}" y="${stripY}" font-family="${font}" font-size="${ss}" font-weight="700" fill="${th.text}">${(0, fmt_1.xmlEscape)(fit(line, maxCharsFor(innerW, ss)))}</text>`);
+    }
+    // chips (only for data that exists)
+    const chips = [];
+    // the cut headline does not show the total itself, so the total always appears as the first chip
+    if (head.id === "cut-list")
+        chips.push(`always-on ${a.lowerBound ? exports.AT_LEAST + " " : ""}~${(0, fmt_1.fmtTok)(a.totals.always.est)} · ${(0, fmt_1.fmtPct)((a.totals.always.est / r.scan.window) * 100)} of ${(0, fmt_1.fmtWindow)(r.scan.window)}`);
+    const mode = (m) => a.totals[m];
+    for (const m of ["deferred", "conditional", "on-demand"])
+        if (mode(m).measuredItems)
+            chips.push(`${m} ~${(0, fmt_1.fmtTok)(mode(m).est)}`);
+    const unm = a.totals.always.unmeasuredItems + a.totals.deferred.unmeasuredItems;
+    if (unm)
+        chips.push(`unmeasured: ${unm} item${unm > 1 ? "s" : ""}`);
+    if (a.id === "cursor")
+        chips.push("unmeasured: User Rules");
+    if (r.partial)
+        chips.unshift("partial scan");
+    let cx = pad;
+    const chipSize = 18;
+    for (const chip of chips) {
+        const cw = chip.length * chipSize * CHAR_EM + 28;
+        if (cx + cw > W - pad)
+            break;
+        parts.push(`<rect x="${cx}" y="${chipsY}" width="${cw.toFixed(0)}" height="${chipH}" rx="19" fill="${th.chip}" stroke="${th.border}"/>`);
+        parts.push(`<text x="${(cx + 14).toFixed(0)}" y="${chipsY + 25}" font-family="${font}" font-size="${chipSize}" fill="${th.text}">${(0, fmt_1.xmlEscape)(chip)}</text>`);
+        cx += cw + 12;
+    }
+    footLines.forEach((l, k) => parts.push(`<text x="${pad}" y="${footTop + k * footLineH}" font-family="${font}" font-size="${footSize}" fill="${th.muted}">${(0, fmt_1.xmlEscape)(l)}</text>`));
+    parts.push(`</svg>`);
+    return parts.join("\n") + "\n";
+}

package/dist/render/fix.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderFix = renderFix;
+const fmt_1 = require("../util/fmt");
+/** Dry-run plan. This function only formats text; there is no code path in 0.1 that modifies user files. */
+function renderFix(r) {
+    const lines = [];
+    const items = r.findings.filter((f) => f.fix);
+    const total = items.reduce((s, f) => s + (f.savingsTokens ?? 0), 0);
+    lines.push(`Fix plan (dry run): ${items.length} suggestion${items.length === 1 ? "" : "s"}${total ? `, ~${(0, fmt_1.fmtInt)(total)} always-on tokens could be saved (estimate)` : ""} · 0 files changed`);
+    lines.push("");
+    items.forEach((f, i) => {
+        lines.push(` ${i + 1}. [${f.id}] ${(0, fmt_1.sanitize)(f.message, 200)}`);
+        lines.push(`    suggestion: ${(0, fmt_1.sanitize)(f.fix ?? "", 240)}`);
+        lines.push(`    savings: ${f.savingsTokens ? "~" + (0, fmt_1.fmtInt)(f.savingsTokens) + " tokens (estimate)" : "none measurable (clarity/correctness)"} · confidence: ${f.confidence}`);
+    });
+    if (!items.length)
+        lines.push(" Nothing to suggest from the rules implemented in 0.1 (F1, F2, F4, F5, F7, F8, F9).");
+    lines.push("");
+    lines.push("Nothing was modified. prehello 0.1 has no --apply or --patch: changes are yours to make. Content-level rewrites are never auto-applied.");
+    return lines.join("\n") + "\n";
+}

package/dist/render/json.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toJson = toJson;
+exports.numberedLabels = numberedLabels;
+const redact_1 = require("../redact");
+function numberedLabels(agent, only) {
+    const list = only ?? agent.items;
+    // privacy-safe labels: cardLabel, numbered when repeated ("MCP server 2")
+    const totals = new Map();
+    for (const it of list)
+        totals.set(it.cardLabel, (totals.get(it.cardLabel) ?? 0) + 1);
+    const seen = new Map();
+    const out = new Map();
+    for (const it of list) {
+        const n = (seen.get(it.cardLabel) ?? 0) + 1;
+        seen.set(it.cardLabel, n);
+        out.set(it.id, (totals.get(it.cardLabel) ?? 1) > 1 ? `${it.cardLabel} ${n}` : it.cardLabel);
+    }
+    return out;
+}
+/** Serialise the Report. NEVER includes file contents. `strict` drops paths/names entirely (use before sharing). */
+/** Defence in depth: user-controlled names (skill `name:`, MCP server keys, …) must never carry a secret-shaped string into JSON. */
+function scrubDeep(v) {
+    if (typeof v === "string")
+        return (0, redact_1.scrubSecrets)(v);
+    if (Array.isArray(v))
+        return v.map(scrubDeep);
+    if (v && typeof v === "object")
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [(0, redact_1.scrubSecrets)(k), scrubDeep(x)]));
+    return v;
+}
+function toJson(r, c, strict) {
+    return scrubDeep(toJsonRaw(r, c, strict));
+}
+function toJsonRaw(r, c, strict) {
+    const dp = (p) => (0, redact_1.displayPath)(p, c);
+    return {
+        schemaVersion: r.schemaVersion,
+        tool: r.tool,
+        generatedAt: r.generatedAt,
+        redacted: strict ? "strict" : "paths-shortened (~ and ./ prefixes); server and file names kept",
+        scan: { ...r.scan, cwd: strict ? "project" : dp(r.scan.cwd) },
+        agents: r.agents.map((a) => {
+            const labels = numberedLabels(a);
+            return {
+                id: a.id,
+                name: a.name,
+                detected: a.detected,
+                detectedBy: a.detectedBy,
+                presentInRepoOnly: a.presentInRepoOnly,
+                profile: a.profile,
+                totals: a.totals,
+                percentOfWindowAlways: a.percentOfWindowAlways,
+                alwaysIsLowerBound: a.lowerBound,
+                savings: a.savings
+                    ? {
+                        ...a.savings,
+                        top: a.savings.top.map((c, i) => (strict ? { label: `group ${i + 1}`, kind: c.kind, tokens: c.tokens, count: c.count } : c)),
+                        note: "estimate: what removing these groups would save; not a promise",
+                    }
+                    : null,
+                grade: a.grade,
+                ...(a.gradeNote ? { gradeNote: a.gradeNote } : {}),
+                coverage: a.coverage,
+                installedButNothingFound: a.items.length === 0 && !a.presentInRepoOnly,
+                offenders: a.offenders.map((x) => (strict ? { kind: x.kind, loadMode: x.loadMode, tokens: x.tokens } : { label: x.label, path: dp(x.path), kind: x.kind, loadMode: x.loadMode, tokens: x.tokens, ...(x.note ? { note: x.note } : {}) })),
+                mcpServers: a.mcpServers.map((m, i) => (strict ? { n: i + 1, transport: m.transport, scope: m.scope, measured: m.measured } : { name: m.name, source: dp(m.source), scope: m.scope, transport: m.transport, measured: m.measured })),
+                unmeasuredBanner: a.unmeasuredBanner,
+                items: a.items.map((it) => ({
+                    id: it.id,
+                    kind: it.kind,
+                    scope: it.scope,
+                    loadMode: it.loadMode,
+                    label: strict ? labels.get(it.id) : it.label,
+                    ...(strict ? {} : { path: dp(it.path) }),
+                    tokens: it.tokens,
+                    unmeasured: it.tokens === null,
+                    ...(it.unmeasuredReason ? { unmeasuredReason: it.unmeasuredReason } : {}),
+                    chars: it.chars,
+                    lines: it.lines,
+                    ...(it.breakdown && !strict ? { breakdown: it.breakdown } : {}),
+                    ...(it.parts && !strict ? { parts: it.parts } : {}),
+                    confidence: it.confidence,
+                    evidence: it.evidence,
+                    notes: strict ? it.notes.filter((n) => !/["'`\/\\@]/.test(n) && !/\bplugin\b/i.test(n)) : it.notes,
+                })),
+            };
+        }),
+        excluded: strict ? r.excluded.map((e) => ({ agent: e.agent, reason: e.reason.replace(/"[^"]*"/g, '"…"') })) : r.excluded.map((e) => ({ agent: e.agent, path: dp(e.path), reason: e.reason })),
+        findings: r.findings.map((f) => strict
+            ? { id: f.id, severity: f.severity, agent: f.agent, savingsTokens: f.savingsTokens, confidence: f.confidence, fileCount: f.paths.length }
+            : { id: f.id, severity: f.severity, agent: f.agent, message: f.message, paths: f.paths.map(dp), savingsTokens: f.savingsTokens, confidence: f.confidence, fix: f.fix }),
+        warnings: strict ? r.warnings.length : r.warnings,
+        notMeasurable: r.notMeasurable,
+        partial: r.partial ?? null,
+    };
+}