token-pilot - npm Package Compare versions

Comparing version 0.50.1 to 0.50.2

hooks/run.sh

+#!/usr/bin/env bash
+# Hook launcher for the Claude Code plugin install.
+#
+# `dist/` is a build artifact and is not in git, but the marketplace
+# installs this plugin FROM git. start.sh builds it — except start.sh only
+# runs when the MCP server starts, and hooks are invoked directly. So on a
+# freshly installed or freshly updated plugin, every hook fired before the
+# first MCP server start hit a missing dist/index.js and died. Silently:
+# Claude Code treats a failed hook as "no decision", so enforcement simply
+# stopped existing until something else happened to build.
+#
+# This wrapper makes the hook path self-sufficient. Three rules:
+#
+#   1. Build if dist is missing — ~3s, and node_modules ships with the
+#      plugin so no install is needed.
+#   2. Guard the build with a lock. A session start fires several hooks at
+#      once; without this they would all run tsc into the same directory.
+#   3. Never block the user's tool call. If the build fails or another
+#      process is still building, exit 0 and let the call through. A hook
+#      that cannot decide must not become a hook that refuses.
+#
+# No `cd`: the hooks read process.cwd() as the project root, so this has to
+# exec from wherever Claude Code invoked it.
+
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+ENTRY="$PLUGIN_DIR/dist/index.js"
+
+if [ ! -f "$ENTRY" ]; then
+	LOCK="$PLUGIN_DIR/.build.lock"
+	if mkdir "$LOCK" 2>/dev/null; then
+		echo "[token-pilot] building plugin (first run after install)…" >&2
+		(cd "$PLUGIN_DIR" && npm run build >&2 2>&1) || true
+		rmdir "$LOCK" 2>/dev/null || true
+	else
+		# Another hook won the race — wait for it rather than build twice.
+		i=0
+		while [ ! -f "$ENTRY" ] && [ "$i" -lt 30 ]; do
+			sleep 1
+			i=$((i + 1))
+		done
+	fi
+fi
+
+# Still nothing to run: stay out of the way instead of failing the call.
+[ -f "$ENTRY" ] || exit 0
+
+exec node "$ENTRY" "$@"

.claude-plugin/marketplace.json

@@ -9,3 +9,3 @@ {
     "description": "Token Pilot — save 60-90% tokens when AI reads code",
-    "version": "0.50.1"
+    "version": "0.50.2"
   },
@@ -17,3 +17,3 @@ "plugins": [
       "description": "Reduces token consumption by 60-90% via AST-aware lazy file reading, structural symbol navigation, and cross-session tool-usage analytics. 25 MCP tools + 25 subagents + budget watchdog hooks.",
-      "version": "0.50.1",
+      "version": "0.50.2",
       "author": {
@@ -20,0 +20,0 @@ "name": "Digital-Threads"

.claude-plugin/plugin.json

 {
   "name": "token-pilot",
-  "version": "0.50.1",
+  "version": "0.50.2",
   "description": "Saves 60-90% tokens on AI code reading. AST-aware lazy reads, symbol navigation, find_usages, structural git diff/log, edit-safety guard, Task-routing matcher, cross-session telemetry (errors + diagnostics), 25 tp-* subagents tiered to haiku/sonnet/opus with budget watchdog.",
@@ -5,0 +5,0 @@ "author": {

agents/tp-api-surface-tracker.md

@@ -12,3 +12,3 @@ ---
 model: haiku
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: dd184501203fa7f3c73f419c4ffbe33c4be75400cb64a7a51733a3fe23f6e085
@@ -15,0 +15,0 @@ requiredMcpServers:

agents/tp-audit-scanner.md

@@ -14,3 +14,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: d172f600bf32277ea6eb4cbbee4542ddd698a986dcd96997d33930561964569b
@@ -17,0 +17,0 @@ requiredMcpServers:

agents/tp-commit-writer.md

@@ -11,3 +11,3 @@ ---
   - Bash
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: de64a406b5176de19f7422619c7de7949b1f28865f225402c9cea9255f377428
@@ -14,0 +14,0 @@ requiredMcpServers:

agents/tp-context-engineer.md

@@ -16,3 +16,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 68b32af2dacd82ebe52c4eec93edb903d452688274c3065218270627c564d8b0
@@ -19,0 +19,0 @@ requiredMcpServers:

agents/tp-dead-code-finder.md

@@ -14,3 +14,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: d9b7f5b7ae6f4ae21305c775361bcab097cc774370a6d976c093571d46d55021
@@ -17,0 +17,0 @@ requiredMcpServers:

agents/tp-debugger.md

@@ -15,3 +15,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 052413de8d92377edcde6ae5c823f5378db304baccfa29e8866467f42553a500
@@ -18,0 +18,0 @@ requiredMcpServers:

agents/tp-dep-health.md

@@ -12,3 +12,3 @@ ---
 model: haiku
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: e14dc57493d816f8c2e017963e2ef5f66bea50fd0b805a80e8a0d97c968427e7
@@ -15,0 +15,0 @@ requiredMcpServers:

agents/tp-doc-writer.md

@@ -16,3 +16,3 @@ ---
 model: haiku
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 57d741794ab40e31a7ac49c68ea39a9088f5827cdef866ce81bfca1b7c9180cf
@@ -19,0 +19,0 @@ requiredMcpServers:

agents/tp-history-explorer.md

@@ -13,3 +13,3 @@ ---
 model: haiku
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 7b70fa76a60e3c58a1de4f56c32c0f166424137e203a0cf1c8654e7c9235d904
@@ -16,0 +16,0 @@ requiredMcpServers:

agents/tp-impact-analyzer.md

@@ -15,3 +15,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 351a987e11eba63852f5431a16d8eb53104f4f689f82fdcc5a2bf4db948ba92f
@@ -18,0 +18,0 @@ requiredMcpServers:

agents/tp-incident-timeline.md

@@ -11,3 +11,3 @@ ---
 model: inherit
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: de5722bfea374eaab096c1ae635c37879e7a91370ee3cd0532f4240be03c91eb
@@ -14,0 +14,0 @@ requiredMcpServers:

agents/tp-incremental-builder.md

@@ -16,3 +16,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 375a824d0d847bb5453ec594c7a62ad566ee7e4d92717b0473f771f1a0477c60
@@ -19,0 +19,0 @@ requiredMcpServers:

agents/tp-migration-scout.md

@@ -14,3 +14,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 0334de1bf99b431b65359637d125cda7c44c6f780eb92c57cc538715b1939536
@@ -17,0 +17,0 @@ requiredMcpServers:

agents/tp-onboard.md

@@ -13,3 +13,3 @@ ---
   - mcp__token-pilot__read_section
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 832e95633fbc8e9b0c10f3e540a327d4be062fb4b3f17a6cce6be13f414e2927
@@ -16,0 +16,0 @@ requiredMcpServers:

agents/tp-performance-profiler.md

@@ -14,3 +14,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: b61f06380d80798fa2e49d37bcba0653495bee04dd6bdbc1feff9a75607b0508
@@ -17,0 +17,0 @@ requiredMcpServers:

agents/tp-pr-reviewer.md

@@ -14,3 +14,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: f83f50d05b4f70285ae7afed2b1a406fc436df56e61a0aedbfb31edc7f2b6e66
@@ -17,0 +17,0 @@ requiredMcpServers:

agents/tp-refactor-planner.md

@@ -11,3 +11,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: c5f6fc122c89e16e5cf774045f92169ee3468555320b898171ba13eca5323550
@@ -14,0 +14,0 @@ requiredMcpServers:

agents/tp-review-impact.md

@@ -12,3 +12,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 8ef3c3341cbfed4eb8dd130126a9683edc57e378c92ff0ca764d584fd941c55c
@@ -15,0 +15,0 @@ requiredMcpServers:

agents/tp-run.md

@@ -19,3 +19,3 @@ ---
 model: haiku
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 2b08618d34a61f00aafccbda9fed6d83243296dedb83440edbd2d5c28bb6dbc4
@@ -22,0 +22,0 @@ requiredMcpServers:

agents/tp-session-restorer.md

@@ -12,3 +12,3 @@ ---
   - Read
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 529374ed728f5eed5b758b3be3da65624783c0bf0c1a253d7d661a843eb5f767
@@ -15,0 +15,0 @@ requiredMcpServers:

agents/tp-ship-coordinator.md

@@ -14,3 +14,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: a60f6ae110eb3138064bce074e8ba26fa0ce5f4659df1624a9d9d3646803391b
@@ -17,0 +17,0 @@ requiredMcpServers:

agents/tp-spec-writer.md

@@ -12,3 +12,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: c7a4e8b39228fd5158528f389c924c5ff2d98c4b9b05ee0106d54a26c5dc1350
@@ -15,0 +15,0 @@ requiredMcpServers:

agents/tp-test-coverage-gapper.md

@@ -13,3 +13,3 @@ ---
   - Grep
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: be81eed53a3720d146cf89e4a14a7a56577633f7c84c234c412ab70d64c05b11
@@ -16,0 +16,0 @@ requiredMcpServers:

agents/tp-test-triage.md

@@ -11,3 +11,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 362ecf4cb03b059421ea26933473700900073dc38b3a7fe271208dfb1ae14f90
@@ -14,0 +14,0 @@ requiredMcpServers:

agents/tp-test-writer.md

@@ -16,3 +16,3 @@ ---
 model: sonnet
-token_pilot_version: "0.50.1"
+token_pilot_version: "0.50.2"
 token_pilot_body_hash: 269f2fe22ff4517c277d3f56ca67d8a5527b93290ab21079a83ba7af22c1b5a9
@@ -19,0 +19,0 @@ requiredMcpServers:

hooks/hooks.json

@@ -9,3 +9,3 @@ {
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-read"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-read"
           }
@@ -19,3 +19,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-edit"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-edit"
           }
@@ -29,3 +29,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-edit"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-edit"
           }
@@ -39,3 +39,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-pre-bash"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-pre-bash"
           }
@@ -49,3 +49,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-pre-grep"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-pre-grep"
           }
@@ -59,3 +59,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-pre-task"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-pre-task"
           }
@@ -70,3 +70,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-bootstrap",
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-bootstrap",
             "once": true,
@@ -81,3 +81,3 @@ "statusMessage": "Bootstrapping token-pilot..."
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-session-start"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-session-start"
           }
@@ -92,3 +92,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-user-prompt"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-user-prompt"
           }
@@ -104,3 +104,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-post-bash",
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-post-bash",
             "async": true
@@ -115,3 +115,3 @@ }
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-post-task"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-post-task"
           }
@@ -126,3 +126,3 @@ ]
             "type": "command",
-            "command": "node ${CLAUDE_PLUGIN_ROOT}/dist/index.js hook-subagent-stop"
+            "command": "sh ${CLAUDE_PLUGIN_ROOT}/hooks/run.sh hook-subagent-stop"
           }
@@ -129,0 +129,0 @@ ]

package.json

 {
   "name": "token-pilot",
-  "version": "0.50.1",
+  "version": "0.50.2",
   "description": "Save up to 80% tokens when AI reads code \u2014 MCP server for token-efficient code navigation, AST-aware structural reading instead of dumping full files into context window",
@@ -19,2 +19,3 @@ "type": "module",
     "hooks/hooks.json",
+    "hooks/run.sh",
     ".mcp.json",
@@ -21,0 +22,0 @@ "skills/",

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1515349

0.24%

Number of package files

274

0.37%

Worsened metrics

Number of low supply chain risk alerts

125

0.81%

No dependency changes