token-pilot 0.46.0 → 0.46.1

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Token Pilot — save 60-90% tokens when AI reads code",
-    "version": "0.46.0"
+    "version": "0.46.1"
   },
   "plugins": [
     {
       "name": "token-pilot",
       "source": "./",
       "description": "Reduces token consumption by 60-90% via AST-aware lazy file reading, structural symbol navigation, and cross-session tool-usage analytics. 23 MCP tools + 25 subagents + budget watchdog hooks.",
-      "version": "0.46.0",
+      "version": "0.46.1",
       "author": {
         "name": "Digital-Threads"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "token-pilot",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "Saves 60-90% tokens on AI code reading. AST-aware lazy reads, symbol navigation, find_usages, structural git diff/log, edit-safety guard, Task-routing matcher, cross-session telemetry (errors + diagnostics), 25 tp-* subagents tiered to haiku/sonnet/opus with budget watchdog.",
   "author": {
     "name": "Digital-Threads",

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Token Pilot will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.46.1] - 2026-06-18
+
+### Fixed — node:test (`node --test`) TAP output parsing
+
+`test_summary` did not recognise `node --test`: `detectRunner` had no `node`
+case, so node:test output fell through to the generic parser. node:test emits a
+TAP footer (`# pass N` / `# fail N`, number after the word) and `ok N - name`
+points (`ok` before the number), which the generic `<N> passed` regex never
+matches — a green 2/2 run was reported as 0 passed. Added a `node` runner:
+detected by command (`node --test` / `node:test`) or by the TAP footer, parsing
+pass/fail/skipped/tests from the footer with a fallback to counting `ok` /
+`not ok` lines; failure names come from `not ok N - name`. Purely additive — no
+existing parser touched.
+
+### Changed — dev-dependency security + decoupled registry publish (no shipped change)
+
+- Bump `vitest` / `@vitest/coverage-v8` to 4.x — clears the 6 remaining
+  dev-only high advisories in the vitest/vite/esbuild chain. `npm audit` now
+  reports **0 vulnerabilities** (dev + prod). No runtime/package change: dev
+  deps are not shipped to npm consumers; the full 1402-test suite is green on
+  vitest 4.
+- `publish-mcp.yml`: the MCP Registry job no longer hard-depends on npm-job
+  **success** (`if: !cancelled()`). A failed npm publish (e.g. EOTP on a
+  manual-token release) no longer blocks the registry update; re-run the job
+  via `workflow_dispatch` after a manual `npm publish`.
+
 ## [0.46.0] - 2026-06-13
 
 ### Added — UserPromptSubmit per-turn reinforcement (caveman-style awareness)

package/README.md

@@ -2,7 +2,7 @@
 
 **Token-efficient AI coding, enforced.** Cuts context consumption in AI coding assistants by up to **90%** without changing the way you work.
 
-> **Why it matters more now:** as frontier models move up in price — Claude's Fable 5 is the most capable (and most expensive-per-token) tier yet — the tokens you *don't* spend reading code are worth more, not less. The savings are in tokens; the value is in tokens × price. Token Pilot keeps the expensive main thread lean so the premium model spends its budget on reasoning, not on re-reading files.
+> **Why it matters more now:** as frontier models move up in price, the tokens you *don't* spend reading code are worth more, not less. The savings are in tokens; the value is in tokens × price. Token Pilot keeps the expensive main thread lean so the premium model spends its budget on reasoning, not on re-reading files.
 
 Three layers, each useful on its own, stronger together:
 

package/agents/tp-api-surface-tracker.md

@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__read_symbol
   - Bash
 model: haiku
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: dd184501203fa7f3c73f419c4ffbe33c4be75400cb64a7a51733a3fe23f6e085
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-audit-scanner.md

@@ -11,7 +11,7 @@ tools:
   - Grep
   - Read
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: d172f600bf32277ea6eb4cbbee4542ddd698a986dcd96997d33930561964569b
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-commit-writer.md

@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__test_summary
   - mcp__token-pilot__outline
   - Bash
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: de64a406b5176de19f7422619c7de7949b1f28865f225402c9cea9255f377428
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-context-engineer.md

@@ -13,7 +13,7 @@ tools:
   - Edit
   - Glob
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 68b32af2dacd82ebe52c4eec93edb903d452688274c3065218270627c564d8b0
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-dead-code-finder.md

@@ -11,7 +11,7 @@ tools:
   - Grep
   - Read
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: d9b7f5b7ae6f4ae21305c775361bcab097cc774370a6d976c093571d46d55021
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-debugger.md

@@ -12,7 +12,7 @@ tools:
   - Read
   - Bash
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 052413de8d92377edcde6ae5c823f5378db304baccfa29e8866467f42553a500
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-dep-health.md

@@ -9,7 +9,7 @@ tools:
   - Bash
   - Read
 model: haiku
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: e14dc57493d816f8c2e017963e2ef5f66bea50fd0b805a80e8a0d97c968427e7
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-doc-writer.md

@@ -13,7 +13,7 @@ tools:
   - Edit
   - Glob
 model: haiku
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 57d741794ab40e31a7ac49c68ea39a9088f5827cdef866ce81bfca1b7c9180cf
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-history-explorer.md

@@ -10,7 +10,7 @@ tools:
   - Bash
   - Read
 model: haiku
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 7b70fa76a60e3c58a1de4f56c32c0f166424137e203a0cf1c8654e7c9235d904
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-impact-analyzer.md

@@ -12,7 +12,7 @@ tools:
   - mcp__token-pilot__read_symbols
   - Read
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 351a987e11eba63852f5431a16d8eb53104f4f689f82fdcc5a2bf4db948ba92f
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-incident-timeline.md

@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__read_symbol
   - Bash
 model: inherit
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: de5722bfea374eaab096c1ae635c37879e7a91370ee3cd0532f4240be03c91eb
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-incremental-builder.md

@@ -13,7 +13,7 @@ tools:
   - Edit
   - Bash
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 375a824d0d847bb5453ec594c7a62ad566ee7e4d92717b0473f771f1a0477c60
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-migration-scout.md

@@ -11,7 +11,7 @@ tools:
   - Grep
   - Glob
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 0334de1bf99b431b65359637d125cda7c44c6f780eb92c57cc538715b1939536
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-onboard.md

@@ -10,7 +10,7 @@ tools:
   - mcp__token-pilot__smart_read
   - mcp__token-pilot__smart_read_many
   - mcp__token-pilot__read_section
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 832e95633fbc8e9b0c10f3e540a327d4be062fb4b3f17a6cce6be13f414e2927
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-performance-profiler.md

@@ -11,7 +11,7 @@ tools:
   - Bash
   - Read
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: b61f06380d80798fa2e49d37bcba0653495bee04dd6bdbc1feff9a75607b0508
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-pr-reviewer.md

@@ -11,7 +11,7 @@ tools:
   - mcp__token-pilot__read_for_edit
   - Read
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: f83f50d05b4f70285ae7afed2b1a406fc436df56e61a0aedbfb31edc7f2b6e66
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-refactor-planner.md

@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__outline
   - mcp__token-pilot__read_symbol
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: c5f6fc122c89e16e5cf774045f92169ee3468555320b898171ba13eca5323550
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-review-impact.md

@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__module_info
   - Bash
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 8ef3c3341cbfed4eb8dd130126a9683edc57e378c92ff0ca764d584fd941c55c
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-run.md

@@ -16,7 +16,7 @@ tools:
   - Glob
   - Bash
 model: haiku
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 2b08618d34a61f00aafccbda9fed6d83243296dedb83440edbd2d5c28bb6dbc4
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-session-restorer.md

@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__session_budget
   - Bash
   - Read
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 529374ed728f5eed5b758b3be3da65624783c0bf0c1a253d7d661a843eb5f767
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-ship-coordinator.md

@@ -11,7 +11,7 @@ tools:
   - Read
   - Grep
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: a60f6ae110eb3138064bce074e8ba26fa0ce5f4659df1624a9d9d3646803391b
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-spec-writer.md

@@ -9,7 +9,7 @@ tools:
   - Read
   - Write
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: c7a4e8b39228fd5158528f389c924c5ff2d98c4b9b05ee0106d54a26c5dc1350
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-test-coverage-gapper.md

@@ -10,7 +10,7 @@ tools:
   - mcp__token-pilot__test_summary
   - Glob
   - Grep
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: be81eed53a3720d146cf89e4a14a7a56577633f7c84c234c412ab70d64c05b11
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-test-triage.md

@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__find_usages
   - mcp__token-pilot__read_symbol
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 362ecf4cb03b059421ea26933473700900073dc38b3a7fe271208dfb1ae14f90
 requiredMcpServers:
   - "token-pilot"

package/agents/tp-test-writer.md

@@ -13,7 +13,7 @@ tools:
   - Edit
   - Bash
 model: sonnet
-token_pilot_version: "0.46.0"
+token_pilot_version: "0.46.1"
 token_pilot_body_hash: 269f2fe22ff4517c277d3f56ca67d8a5527b93290ab21079a83ba7af22c1b5a9
 requiredMcpServers:
   - "token-pilot"

package/dist/core/event-log.d.ts

@@ -56,6 +56,13 @@ export interface HookEvent {
      * Optional — absent when no workflow is active.
      */
     workflow_id?: string;
+    /**
+     * Loom spine link — id of the Loom task this event belongs to, when the
+     * session was launched by Loom (LOOM_TASK_ID set). Lets Loom attribute token
+     * savings to a task exactly. Optional — absent outside Loom, so standalone
+     * token-pilot events stay byte-identical to before.
+     */
+    task_id?: string;
     event: "denied" | "allowed" | "bypass" | "pass-through" | "task" | "diagnostic" | string;
     file: string;
     lines: number;

package/dist/core/event-log.js

@@ -115,8 +115,16 @@ export async function appendEvent(projectRoot, event) {
         const wf = event.workflow_id ??
             process.env.TOKEN_PILOT_WORKFLOW_ID ??
             process.env.CLAUDE_CODE_WORKFLOW_ID ??
+            process.env.LOOM_WORKFLOW_ID ??
             undefined;
-        const tagged = wf ? { ...event, workflow_id: wf } : event;
+        // Loom spine: tag the task id when the session was launched by Loom.
+        // Env-driven so call sites stay unchanged; absent outside Loom → no field.
+        const taskId = event.task_id ?? process.env.LOOM_TASK_ID ?? undefined;
+        let tagged = event;
+        if (wf)
+            tagged = { ...tagged, workflow_id: wf };
+        if (taskId)
+            tagged = { ...tagged, task_id: taskId };
         await ensureLogDir(projectRoot);
         await rotateIfNeeded(projectRoot);
         const line = JSON.stringify(tagged) + "\n";

package/dist/handlers/test-summary.js

@@ -73,6 +73,8 @@ export function detectRunner(command, output) {
         return 'rspec';
     if (cmd.includes('mocha'))
         return 'mocha';
+    if (cmd.includes('node --test') || cmd.includes('node:test'))
+        return 'node';
     // Detect from output
     const lower = output.toLowerCase();
     if (lower.includes('vitest') || lower.includes('vite'))
@@ -85,6 +87,9 @@ export function detectRunner(command, output) {
         return 'phpunit';
     if (lower.includes('--- fail:') || lower.includes('--- pass:') || lower.includes('ok  \t'))
         return 'go';
+    // node:test prints a TAP summary footer: "# tests N" + "# pass N" + "# fail N".
+    if (/^#\s*tests\s+\d+/m.test(output) && /^#\s*pass\s+\d+/m.test(output))
+        return 'node';
     return 'generic';
 }
 // ──────────────────────────────────────────────
@@ -103,6 +108,8 @@ export function parseTestOutput(output, runner) {
             return parseGoTest(output);
         case 'cargo':
             return parseCargoTest(output);
+        case 'node':
+            return parseNodeTest(output);
         default:
             return parseGeneric(output);
     }
@@ -243,6 +250,41 @@ function parseGoTest(output) {
     }
     return result;
 }
+function parseNodeTest(output) {
+    const result = { total: 0, passed: 0, failed: 0, skipped: 0, failures: [] };
+    // node:test (`node --test`) prints a TAP summary footer:
+    //   # tests 2
+    //   # pass 2
+    //   # fail 0
+    //   # skipped 0
+    const num = (re) => {
+        const m = output.match(re);
+        return m ? parseInt(m[1], 10) : null;
+    };
+    const pass = num(/^#\s*pass\s+(\d+)/m);
+    const fail = num(/^#\s*fail\s+(\d+)/m);
+    const skip = num(/^#\s*skipped\s+(\d+)/m);
+    const tests = num(/^#\s*tests\s+(\d+)/m);
+    if (pass !== null || fail !== null) {
+        result.passed = pass ?? 0;
+        result.failed = fail ?? 0;
+        result.skipped = skip ?? 0;
+        result.total = tests ?? result.passed + result.failed + result.skipped;
+    }
+    else {
+        // No footer (truncated output) — count the TAP point lines instead.
+        result.passed = (output.match(/^ok\s+\d+/gm) ?? []).length;
+        result.failed = (output.match(/^not ok\s+\d+/gm) ?? []).length;
+        result.total = result.passed + result.failed + result.skipped;
+    }
+    // Failure names come from the TAP point: "not ok 3 - the test name".
+    const failPattern = /^not ok\s+\d+\s*-\s*(.+)$/gm;
+    let match;
+    while ((match = failPattern.exec(output)) !== null) {
+        result.failures.push({ name: match[1].trim(), error: '' });
+    }
+    return result;
+}
 function parseCargoTest(output) {
     const result = { total: 0, passed: 0, failed: 0, skipped: 0, failures: [] };
     // test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-pilot",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "Save up to 80% tokens when AI reads code — MCP server for token-efficient code navigation, AST-aware structural reading instead of dumping full files into context window",
   "type": "module",
   "main": "dist/index.js",
@@ -67,15 +67,15 @@
   "mcpName": "io.github.Digital-Threads/token-pilot",
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
     "@ast-index/cli": "^3.44.0",
+    "@modelcontextprotocol/sdk": "^1.12.0",
     "chokidar": "^4.0.3"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^3.2.4",
     "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^4.1.8",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.8"
   },
   "engines": {
     "node": ">=18.0.0"