fix: v0.45.1 — refuse multi-repo workspace parent (cross-project index bleed) (#45)

start.sh always passes an explicit project root, so startServer's git-root
narrowing (the `!explicitRoot` branch) never runs. When the session starts
from a non-git workspace parent nesting several project repos (e.g.
/work/loom holding token-pilot, loom-host, aimux), the raw parent was used
verbatim and ast-index indexed every sibling into one index — find_usages /
read_symbol then bled matches across unrelated projects. isDangerousRoot only
caught system/home dirs, so the parent slipped through.

Add isMultiRepoParent(root) guard (core/validation.ts): a non-git dir with
>=2 immediate child git repos. On match, ast-index is disabled (skipAstIndex)
and a warning tells the user to set CLAUDE_PROJECT_DIR to the specific
project — fail safe instead of bleeding. Wired into startServer and the
server.ts MCP-roots auto-detect. Single-repo roots, monorepos, and roots
that are themselves a git repo are unaffected.

Tests: tests/core/multi-repo-parent.test.ts (7 cases). tsc clean.

Co-authored-by: shahinyanm <mher.shahinyan@12go.asia>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Token Pilot — save 60-90% tokens when AI reads code",
-    "version": "0.45.0"
+    "version": "0.45.1"
   },
   "plugins": [
     {
       "name": "token-pilot",
       "source": "./",
       "description": "Reduces token consumption by 60-90% via AST-aware lazy file reading, structural symbol navigation, and cross-session tool-usage analytics. 23 MCP tools + 25 subagents + budget watchdog hooks.",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "author": {
         "name": "Digital-Threads"
       },

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "token-pilot",
-  "version": "0.45.0",
+  "version": "0.45.1",
   "description": "Saves 60-90% tokens on AI code reading. AST-aware lazy reads, symbol navigation, find_usages, structural git diff/log, edit-safety guard, Task-routing matcher, cross-session telemetry (errors + diagnostics), 25 tp-* subagents tiered to haiku/sonnet/opus with budget watchdog.",
   "author": {
     "name": "Digital-Threads",

CHANGELOG.md

@@ -5,7 +5,28 @@ All notable changes to Token Pilot will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.45.0] - 2026-06-11
+## [0.45.1] - 2026-06-11
+
+### Fixed — refuse a multi-repo workspace parent (cross-project index bleed)
+
+`start.sh` always passes an explicit project root (`${CLAUDE_PROJECT_DIR:-$USER_CWD}`)
+to the server, so `startServer`'s git-root **narrowing only runs in the
+`!explicitRoot` branch — which is never taken**. When the session is launched
+from a non-git workspace parent that nests several project repos (e.g.
+`/work/loom` holding `token-pilot`, `loom-host`, `aimux`, …), the raw parent was
+used verbatim and ast-index indexed **every** sibling into one index. Symbol
+lookups then bled across projects — `find_usages` / `read_symbol` returning
+matches from the wrong repo, or `symbol not found`. `isDangerousRoot` only
+caught system/home dirs, so the parent slipped through.
+
+New guard `isMultiRepoParent(root)` (in `core/validation.ts`) detects a non-git
+directory with ≥2 immediate child git repos. When the resolved root matches,
+ast-index is disabled (`skipAstIndex`) and a warning tells the user to set
+`CLAUDE_PROJECT_DIR` to the specific project — fail safe instead of bleeding.
+Wired into `startServer` and the `server.ts` MCP-roots auto-detect. Single-repo
+roots, monorepos, and roots that are themselves a git repo are unaffected.
+
+
 
 ### Changed — default tool profile is now `full` (adoption fix)
 

agents/tp-api-surface-tracker.md

@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__read_symbol
   - Bash
 model: haiku
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: dd184501203fa7f3c73f419c4ffbe33c4be75400cb64a7a51733a3fe23f6e085
 requiredMcpServers:
   - "token-pilot"

agents/tp-audit-scanner.md

@@ -11,7 +11,7 @@ tools:
   - Grep
   - Read
 model: sonnet
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: d172f600bf32277ea6eb4cbbee4542ddd698a986dcd96997d33930561964569b
 requiredMcpServers:
   - "token-pilot"

agents/tp-commit-writer.md

@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__test_summary
   - mcp__token-pilot__outline
   - Bash
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: de64a406b5176de19f7422619c7de7949b1f28865f225402c9cea9255f377428
 requiredMcpServers:
   - "token-pilot"

agents/tp-context-engineer.md

@@ -13,7 +13,7 @@ tools:
   - Edit
   - Glob
 model: sonnet
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: 68b32af2dacd82ebe52c4eec93edb903d452688274c3065218270627c564d8b0
 requiredMcpServers:
   - "token-pilot"

agents/tp-dead-code-finder.md

@@ -11,7 +11,7 @@ tools:
   - Grep
   - Read
 model: sonnet
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: d9b7f5b7ae6f4ae21305c775361bcab097cc774370a6d976c093571d46d55021
 requiredMcpServers:
   - "token-pilot"

agents/tp-debugger.md

@@ -12,7 +12,7 @@ tools:
   - Read
   - Bash
 model: sonnet
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: 052413de8d92377edcde6ae5c823f5378db304baccfa29e8866467f42553a500
 requiredMcpServers:
   - "token-pilot"

agents/tp-dep-health.md

@@ -9,7 +9,7 @@ tools:
   - Bash
   - Read
 model: haiku
-token_pilot_version: "0.45.0"
+token_pilot_version: "0.45.1"
 token_pilot_body_hash: e14dc57493d816f8c2e017963e2ef5f66bea50fd0b805a80e8a0d97c968427e7
 requiredMcpServers:
   - "token-pilot"