token-pilot 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Token Pilot will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.1] - 2026-03-08
+
+### Added
+- **ast-grep auto-install** — `@ast-grep/cli` added as optional dependency. `code_audit(check="pattern")` now works out-of-the-box without manual `brew install ast-grep`.
+- **MCP instructions: security audit guidance** — instructions now recommend Grep for security patterns (password, token, secret, credential) and `find_unused` for dead code detection.
+
+### Changed
+- **ast-index stats → JSON parsing** — `--format json` for reliable file count extraction instead of regex on text output.
+
 ## [0.8.0] - 2026-03-07
 
 ### Added

package/README.md

@@ -107,6 +107,10 @@ brew tap defendend/ast-index && brew install ast-index
 npx token-pilot install-ast-index
 ```
 
+### ast-grep (bundled)
+
+[ast-grep](https://ast-grep.github.io/) (`sg`) is included as optional dependency for structural code pattern search via `code_audit(check="pattern")`. Installs automatically with `npm i -g token-pilot`.
+
 ### PreToolUse Hook (Claude Code only)
 
 Optional hook that intercepts `Read` calls for large code files (>500 lines) and suggests `smart_read`. Claude Code only.

package/dist/ast-index/client.d.ts

@@ -21,7 +21,7 @@ export declare class AstIndexClient {
     private buildIndex;
     /** Mark index as oversized — disables index-dependent tools, outline still works */
     private handleOversizedIndex;
-    /** Extract file count from stats output */
+    /** Extract file count from stats output (JSON or text) */
     private parseFileCount;
     outline(filePath: string): Promise<FileStructure | null>;
     /**

package/dist/ast-index/client.js

@@ -75,9 +75,8 @@ export class AstIndexClient {
         // Check if index already exists and has files
         let existingFileCount = 0;
         try {
-            const stats = await this.exec(['stats']);
-            const filesMatch = stats.match(/Files:\s*(\d+)/);
-            existingFileCount = filesMatch ? parseInt(filesMatch[1], 10) : 0;
+            const stats = await this.exec(['--format', 'json', 'stats']);
+            existingFileCount = this.parseFileCount(stats);
         }
         catch { /* no index yet */ }
         // Guard: existing index is oversized (node_modules leak from previous build)
@@ -97,9 +96,7 @@ export class AstIndexClient {
                 await this.exec(['update'], 30000);
                 // Re-check count after update
                 try {
-                    const statsText = await this.exec(['stats']);
-                    const filesMatch = statsText.match(/Files:\s*(\d+)/);
-                    existingFileCount = filesMatch ? parseInt(filesMatch[1], 10) : existingFileCount;
+                    existingFileCount = this.parseFileCount(await this.exec(['--format', 'json', 'stats']));
                 }
                 catch { /* keep previous count */ }
                 // Guard: update may have grown index beyond limit
@@ -118,7 +115,7 @@ export class AstIndexClient {
         console.error('[token-pilot] ast-index: building index (this may take a moment)...');
         try {
             await this.exec(['rebuild'], 120000);
-            const fileCount = this.parseFileCount(await this.exec(['stats']).catch(() => ''));
+            const fileCount = this.parseFileCount(await this.exec(['--format', 'json', 'stats']).catch(() => ''));
             // Guard: rebuild produced oversized index
             if (fileCount > AstIndexClient.MAX_INDEX_FILES) {
                 return this.handleOversizedIndex(fileCount);
@@ -130,7 +127,7 @@ export class AstIndexClient {
             // If rebuild failed due to lock, check if index is usable anyway
             const errMsg = buildErr instanceof Error ? buildErr.message : String(buildErr);
             if (errMsg.includes('lock') || errMsg.includes('already running')) {
-                const count = this.parseFileCount(await this.exec(['stats']).catch(() => ''));
+                const count = this.parseFileCount(await this.exec(['--format', 'json', 'stats']).catch(() => ''));
                 if (count > 0 && count <= AstIndexClient.MAX_INDEX_FILES) {
                     this.indexed = true;
                     console.error(`[token-pilot] ast-index: using existing index (${count} files, rebuild skipped due to lock)`);
@@ -158,8 +155,16 @@ export class AstIndexClient {
             `  → Tools disabled: find_unused, find_usages, related_files, project_overview\n` +
             `  → Tools still working: outline, smart_read, smart_read_many, read_symbol`);
     }
-    /** Extract file count from stats output */
+    /** Extract file count from stats output (JSON or text) */
     parseFileCount(statsText) {
+        // Try JSON first (--format json)
+        try {
+            const json = JSON.parse(statsText);
+            if (json?.stats?.file_count !== undefined)
+                return json.stats.file_count;
+        }
+        catch { /* not JSON, fall through */ }
+        // Fallback: text format
         const match = statsText.match(/Files:\s*(\d+)/);
         return match ? parseInt(match[1], 10) : 0;
     }

package/dist/server.js

@@ -193,8 +193,10 @@ export async function createServer(projectRoot, options) {
             '',
             'COMBINE BOTH for audits and code review:',
             '• Structure/navigation → Token Pilot (project_overview, outline, smart_read)',
+            '• Dead code detection → find_unused (finds unreferenced symbols)',
             '• Code issues → code_audit (TODOs, deprecated, structural patterns like bare except:)',
             '• Text pattern search/counting → Grep (regex, count mode)',
+            '• Security audit → Grep for: password, token, secret, credential, hardcoded, api_key, TODO.*security',
             '• Deep dive into specific code → read_symbol (after finding issues)',
             '',
             'WORKFLOW: project_overview → smart_read → read_symbol → read_for_edit → edit → read_diff',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "token-pilot",
-  "version": "0.8.0",
-  "description": "MCP server that reduces token consumption in AI coding assistants via AST-aware lazy file reading",
+  "version": "0.8.1",
+  "description": "Save 80% tokens when AI reads code — MCP server for token-efficient code navigation, AST-aware structural reading instead of dumping full files into context window",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -28,18 +28,24 @@
     "prepublishOnly": "npm run build && chmod +x dist/index.js"
   },
   "keywords": [
-    "mcp",
-    "token",
-    "ast",
-    "claude",
-    "cursor",
-    "codex",
-    "cline",
-    "ai",
-    "coding-assistant",
+    "token-savings",
+    "token-reduction",
+    "context-window",
+    "save-tokens",
+    "reduce-tokens",
+    "token-efficient",
+    "token-economy",
     "context-optimization",
+    "fewer-tokens",
+    "mcp",
+    "mcp-server",
     "model-context-protocol",
-    "token-savings"
+    "ast",
+    "code-reading",
+    "code-navigation",
+    "smart-read",
+    "ai-coding",
+    "llm-tools"
   ],
   "repository": {
     "type": "git",
@@ -69,5 +75,8 @@
     "ast-index": {
       "optional": true
     }
+  },
+  "optionalDependencies": {
+    "@ast-grep/cli": "^0.41.0"
   }
 }