fix: redact credentials in MCP replacement output + version bump (v5.7.12, PR #43)

Author: alexgreensh

.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "token-optimizer",
       "source": "./",
       "description": "Audit, fix, and monitor Claude Code context window usage. Find the ghost tokens.",
-      "version": "5.7.11",
+      "version": "5.7.12",
       "author": {
         "name": "Alex Greenshpun",
         "url": "https://linkedin.com/in/alexgreensh"

.claude-plugin/plugin.json

@@ -7,7 +7,7 @@
   },
   "homepage": "https://github.com/alexgreensh/token-optimizer",
   "repository": "https://github.com/alexgreensh/token-optimizer",
-  "version": "5.7.11",
+  "version": "5.7.12",
   "license": "PolyForm-Noncommercial-1.0.0",
   "keywords": ["token", "optimization", "context", "audit", "cost", "coach"]
 }

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "token-optimizer",
-  "version": "5.7.11",
+  "version": "5.7.12",
   "description": "Audit, monitor, and reduce Codex context waste with continuity helpers and explicit outline tools.",
   "skills": "./skills/",
   "interface": {

CHECKSUMS.sha256

@@ -1,7 +1,7 @@
 20255099ff8c12467d4e88e038431f9ff59071fef90c59c51c7bee777066a488  hooks/hooks.json
 eb21915a6aa520c464d5cde4e6997a44593a69b5b1fd0ce50929ff539af09f88  install.sh
 b1ccc6e69e2632966bc474db62027579966bba36e9fd33aed75233b71c921bcf  skills/token-optimizer/scripts/activity_tracker.py
-695ae7b7f0fc45ccd8808b91a2c38243ce380ce953c2ac4f0b0f5162aec6976b  skills/token-optimizer/scripts/archive_result.py
+e254e37a01eb57b5f33f0c21eb8469b023c176449ca87ccb915f781ad1885568  skills/token-optimizer/scripts/archive_result.py
 b25a896016b517acc44997d0bd6b4dc161ff38d92bbd5dc8ff1348ef07044043  skills/token-optimizer/scripts/bash_compress.py
 90c219b68729a717edff8cda5764a06e2fa2b03d2efc3d4a1304afdf7aba3503  skills/token-optimizer/scripts/bash_hook.py
 e70da0fe35a36cdc657889419eac2f0aed48dd167f5085ce1b29b7c774090488  skills/token-optimizer/scripts/benchmark.py
@@ -29,7 +29,7 @@ b8345d767a48f40d275480973681baf56dc76329d8f3eaa6260966d6d6b787cd  skills/token-o
 fef4a2385caf3c9495987007d16edf73a022cddbd0aecf2293025e3d9599996d  skills/token-optimizer/scripts/detectors/websearch_routing.py
 6f023687c905db9be267aafcf2a85f08739bee8c0aae42b58eeae4b8889690b1  skills/token-optimizer/scripts/hook_io.py
 f647eabc7067499b74f72c4ba5c55738fdc18c6539a7a5b99c65d03126016d8d  skills/token-optimizer/scripts/injection.py
-1ead10af8aa895448e92fce30507ecc0a504b4edf511d8ba3b9a4149014179a8  skills/token-optimizer/scripts/measure.py
+4fc08682e7b36b07f543aa412a569488a50c21ff306c920dabed1f44a9217954  skills/token-optimizer/scripts/measure.py
 bd27835f85c5fd45c9cf67cb8b969038489249c56182ec2638a4f1223799b98f  skills/token-optimizer/scripts/outline.py
 7e996f6c5d3c36ea0f0d70b8eec18080d0582c0155790637ac34abbd0b3e5057  skills/token-optimizer/scripts/plugin_env.py
 8f4b3675f890f0fbd2412faa76f61c048fc59cd152de521236e982a21fdceade  skills/token-optimizer/scripts/read_cache.py

skills/token-optimizer/scripts/archive_result.py

@@ -315,8 +315,8 @@ def archive_result(quiet: bool = False) -> None:
 
     # For MCP tools (tool_name contains "__"): output replacement via stdout
     if "__" in tool_name:
-        output_type = _detect_output_type(tool_response)
-        preview = _compress_mcp_preview(tool_response, output_type)
+        output_type = _detect_output_type(safe_response)
+        preview = _compress_mcp_preview(safe_response, output_type)
         suffix = f" ({output_type})" if output_type != "text" else ""
         if original_char_count > _ARCHIVE_MAX_SIZE:
             replacement = preview + f"\n\n[Full result archived ({original_char_count:,} chars{suffix}, truncated to 5MB).]"

skills/token-optimizer/scripts/measure.py

@@ -9414,7 +9414,7 @@ def setup_hook(dry_run=False):
 
 # ========== Persistent Dashboard Daemon ==========
 
-TOKEN_OPTIMIZER_VERSION = "5.7.11"  # Keep in sync with plugin.json + marketplace.json
+TOKEN_OPTIMIZER_VERSION = "5.7.12"  # Keep in sync with plugin.json + marketplace.json
 _DASHBOARD_CSP = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
 _DAEMON_RUNTIME = detect_runtime()
 _DAEMON_RUNTIME_SUFFIX = "codex" if _DAEMON_RUNTIME == "codex" else "claude"