v0.39.3: fix structuredClone crash on Node <17 (caught by error channel) (#37)

Shahinyanm · web-flow · commit 9cbc089d522f · 2026-06-04T11:06:02.000+04:00
The v0.33.0 error channel earned its keep. `token-pilot errors` on the
user's Mac surfaced 3 logged throws:

  ReferenceError: structuredClone is not defined
    at loadConfig (config/loader.js)
    nodeVersion: v16.17.1

Root cause: config/loader.ts used `structuredClone(DEFAULT_CONFIG)` —
a global added in Node 17. `engines: "&gt;=18"` is declared but NOT
enforced at runtime, and Claude Code spawns hooks with whatever `node`
is first on PATH. On a machine whose PATH resolved to Node 16,
loadConfig threw, killing EVERY hook that calls it (hook-read,
hook-session-start, hook-pre-bash, hook-pre-grep) on that machine —
silently, until the error channel recorded it.

Fix: replace both structuredClone calls with a JSON-round-trip clone
(`cloneDefaults()`). DEFAULT_CONFIG is plain JSON-serialisable (no
Dates/Maps/functions/cycles), so the round-trip is a correct,
fully-portable deep clone that works on every Node version.

Regression test: tests/config/loader.test.ts deletes the
structuredClone global to simulate a Node 16 runtime and confirms
loadConfig still returns correct, independent defaults on both the
no-config and merge paths.

NOTE — this is NOT the 0-task-events cause. post-task does not call
loadConfig (verified), so task telemetry failure is independent and
still needs the clean restarted-session test. This fix addresses a
separate, real, wild-caught crash on Node &lt;17 environments.

Tests: 1320/1320 pass (+1).
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Token Pilot \u2014 save 60-90% tokens when AI reads code",
-    "version": "0.39.2"
+    "version": "0.39.3"
   },
   "plugins": [
     {
       "name": "token-pilot",
       "source": "./",
       "description": "Reduces token consumption by 60-90% via AST-aware lazy file reading, structural symbol navigation, and cross-session tool-usage analytics. 22 MCP tools + 19 subagents + budget watchdog hooks.",
-      "version": "0.39.2",
+      "version": "0.39.3",
       "author": {
         "name": "Digital-Threads"
       },
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "token-pilot",
-  "version": "0.39.2",
+  "version": "0.39.3",
   "description": "Saves 60-90% tokens on AI code reading. AST-aware lazy reads, symbol navigation, find_usages, structural git diff/log, edit-safety guard, Task-routing matcher, cross-session telemetry (errors + diagnostics), 25 tp-* subagents tiered to haiku/sonnet/opus with budget watchdog.",
   "author": {
     "name": "Digital-Threads",
diff --git a/agents/tp-api-surface-tracker.md b/agents/tp-api-surface-tracker.md
@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__read_symbol
   - Bash
 model: haiku
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: dd184501203fa7f3c73f419c4ffbe33c4be75400cb64a7a51733a3fe23f6e085
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-audit-scanner.md b/agents/tp-audit-scanner.md
@@ -11,7 +11,7 @@ tools:
   - Grep
   - Read
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: d172f600bf32277ea6eb4cbbee4542ddd698a986dcd96997d33930561964569b
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-commit-writer.md b/agents/tp-commit-writer.md
@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__test_summary
   - mcp__token-pilot__outline
   - Bash
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: de64a406b5176de19f7422619c7de7949b1f28865f225402c9cea9255f377428
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-context-engineer.md b/agents/tp-context-engineer.md
@@ -13,7 +13,7 @@ tools:
   - Edit
   - Glob
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 68b32af2dacd82ebe52c4eec93edb903d452688274c3065218270627c564d8b0
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-dead-code-finder.md b/agents/tp-dead-code-finder.md
@@ -11,7 +11,7 @@ tools:
   - Grep
   - Read
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: d9b7f5b7ae6f4ae21305c775361bcab097cc774370a6d976c093571d46d55021
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-debugger.md b/agents/tp-debugger.md
@@ -12,7 +12,7 @@ tools:
   - Read
   - Bash
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 052413de8d92377edcde6ae5c823f5378db304baccfa29e8866467f42553a500
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-dep-health.md b/agents/tp-dep-health.md
@@ -9,7 +9,7 @@ tools:
   - Bash
   - Read
 model: haiku
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: e14dc57493d816f8c2e017963e2ef5f66bea50fd0b805a80e8a0d97c968427e7
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-doc-writer.md b/agents/tp-doc-writer.md
@@ -13,7 +13,7 @@ tools:
   - Edit
   - Glob
 model: haiku
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 57d741794ab40e31a7ac49c68ea39a9088f5827cdef866ce81bfca1b7c9180cf
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-history-explorer.md b/agents/tp-history-explorer.md
@@ -10,7 +10,7 @@ tools:
   - Bash
   - Read
 model: haiku
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 7b70fa76a60e3c58a1de4f56c32c0f166424137e203a0cf1c8654e7c9235d904
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-impact-analyzer.md b/agents/tp-impact-analyzer.md
@@ -12,7 +12,7 @@ tools:
   - mcp__token-pilot__read_symbols
   - Read
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 351a987e11eba63852f5431a16d8eb53104f4f689f82fdcc5a2bf4db948ba92f
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-incident-timeline.md b/agents/tp-incident-timeline.md
@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__read_symbol
   - Bash
 model: inherit
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: de5722bfea374eaab096c1ae635c37879e7a91370ee3cd0532f4240be03c91eb
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-incremental-builder.md b/agents/tp-incremental-builder.md
@@ -13,7 +13,7 @@ tools:
   - Edit
   - Bash
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 375a824d0d847bb5453ec594c7a62ad566ee7e4d92717b0473f771f1a0477c60
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-migration-scout.md b/agents/tp-migration-scout.md
@@ -11,7 +11,7 @@ tools:
   - Grep
   - Glob
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 0334de1bf99b431b65359637d125cda7c44c6f780eb92c57cc538715b1939536
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-onboard.md b/agents/tp-onboard.md
@@ -10,7 +10,7 @@ tools:
   - mcp__token-pilot__smart_read
   - mcp__token-pilot__smart_read_many
   - mcp__token-pilot__read_section
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 832e95633fbc8e9b0c10f3e540a327d4be062fb4b3f17a6cce6be13f414e2927
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-performance-profiler.md b/agents/tp-performance-profiler.md
@@ -11,7 +11,7 @@ tools:
   - Bash
   - Read
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: b61f06380d80798fa2e49d37bcba0653495bee04dd6bdbc1feff9a75607b0508
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-pr-reviewer.md b/agents/tp-pr-reviewer.md
@@ -11,7 +11,7 @@ tools:
   - mcp__token-pilot__read_for_edit
   - Read
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: f83f50d05b4f70285ae7afed2b1a406fc436df56e61a0aedbfb31edc7f2b6e66
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-refactor-planner.md b/agents/tp-refactor-planner.md
@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__outline
   - mcp__token-pilot__read_symbol
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: c5f6fc122c89e16e5cf774045f92169ee3468555320b898171ba13eca5323550
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-review-impact.md b/agents/tp-review-impact.md
@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__module_info
   - Bash
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 8ef3c3341cbfed4eb8dd130126a9683edc57e378c92ff0ca764d584fd941c55c
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-run.md b/agents/tp-run.md
@@ -16,7 +16,7 @@ tools:
   - Glob
   - Bash
 model: haiku
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 2b08618d34a61f00aafccbda9fed6d83243296dedb83440edbd2d5c28bb6dbc4
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-session-restorer.md b/agents/tp-session-restorer.md
@@ -9,7 +9,7 @@ tools:
   - mcp__token-pilot__session_budget
   - Bash
   - Read
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 529374ed728f5eed5b758b3be3da65624783c0bf0c1a253d7d661a843eb5f767
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-ship-coordinator.md b/agents/tp-ship-coordinator.md
@@ -11,7 +11,7 @@ tools:
   - Read
   - Grep
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: a60f6ae110eb3138064bce074e8ba26fa0ce5f4659df1624a9d9d3646803391b
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-spec-writer.md b/agents/tp-spec-writer.md
@@ -9,7 +9,7 @@ tools:
   - Read
   - Write
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: c7a4e8b39228fd5158528f389c924c5ff2d98c4b9b05ee0106d54a26c5dc1350
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-test-coverage-gapper.md b/agents/tp-test-coverage-gapper.md
@@ -10,7 +10,7 @@ tools:
   - mcp__token-pilot__test_summary
   - Glob
   - Grep
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: be81eed53a3720d146cf89e4a14a7a56577633f7c84c234c412ab70d64c05b11
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-test-triage.md b/agents/tp-test-triage.md
@@ -8,7 +8,7 @@ tools:
   - mcp__token-pilot__find_usages
   - mcp__token-pilot__read_symbol
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 362ecf4cb03b059421ea26933473700900073dc38b3a7fe271208dfb1ae14f90
 requiredMcpServers:
   - "token-pilot"
diff --git a/agents/tp-test-writer.md b/agents/tp-test-writer.md
@@ -13,7 +13,7 @@ tools:
   - Edit
   - Bash
 model: sonnet
-token_pilot_version: "0.39.2"
+token_pilot_version: "0.39.3"
 token_pilot_body_hash: 269f2fe22ff4517c277d3f56ca67d8a5527b93290ab21079a83ba7af22c1b5a9
 requiredMcpServers:
   - "token-pilot"
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "token-pilot",
-  "version": "0.39.2",
+  "version": "0.39.3",
   "description": "Save up to 80% tokens when AI reads code — MCP server for token-efficient code navigation, AST-aware structural reading instead of dumping full files into context window",
   "type": "module",
   "main": "dist/index.js",
diff --git a/src/config/loader.ts b/src/config/loader.ts
@@ -9,6 +9,27 @@ const VALID_HOOK_MODES: ReadonlySet<HookMode> = new Set([
   "deny-enhanced",
 ]);
 
+/**
+ * v0.39.3 — portable deep clone of the default config.
+ *
+ * The previous code used `structuredClone(DEFAULT_CONFIG)`, a global
+ * added in Node 17. Despite `engines: ">=18"`, the engines field is
+ * NOT enforced at runtime, and Claude Code spawns hooks with whatever
+ * `node` is first on PATH. On machines with a system / nvm-default
+ * Node 16 that resolved to v16.x, `loadConfig` threw
+ * `ReferenceError: structuredClone is not defined` — caught in the
+ * wild by the v0.33.0 error channel (hook-session-start, Node 16.17.1).
+ * That throw killed every hook that calls loadConfig (read,
+ * session-start, pre-bash, pre-grep) on those machines.
+ *
+ * DEFAULT_CONFIG is a plain JSON-serialisable object (no Dates, Maps,
+ * functions, or cycles), so a JSON round-trip is a correct, fully
+ * portable deep clone that works on every Node version.
+ */
+function cloneDefaults(): TokenPilotConfig {
+  return JSON.parse(JSON.stringify(DEFAULT_CONFIG)) as TokenPilotConfig;
+}
+
 export async function loadConfig(
   projectRoot: string,
 ): Promise<TokenPilotConfig> {
@@ -24,7 +45,7 @@ export async function loadConfig(
         `[token-pilot] Invalid config at ${configPath}: ${err?.message ?? err}. Using defaults.`,
       );
     }
-    return structuredClone(DEFAULT_CONFIG);
+    return cloneDefaults();
   }
 
   // Phase 6 subtask 6.4 — rewrite legacy `mode:"deny"` to `"advisory"`
@@ -33,7 +54,7 @@ export async function loadConfig(
   await applyLegacyDenyMigration(configPath, userConfig ?? {});
 
   const merged = deepMerge(
-    structuredClone(DEFAULT_CONFIG),
+    cloneDefaults(),
     userConfig ?? {},
   ) as TokenPilotConfig;
 
diff --git a/tests/config/loader.test.ts b/tests/config/loader.test.ts
@@ -84,4 +84,32 @@ describe("loadConfig — hooks.mode field (Phase 1 subtask 1.1/1.2)", () => {
     );
     stderrSpy.mockRestore();
   });
+
+  // v0.39.3 — regression for the Node <17 crash. loadConfig used
+  // structuredClone (a Node 17+ global); on a Node 16 runtime that CC
+  // spawned the hook with, it threw `structuredClone is not defined`
+  // and killed every loadConfig-dependent hook (caught in the wild by
+  // the error channel). The fix is a JSON-round-trip clone. This test
+  // deletes the global to simulate Node 16 and confirms loadConfig
+  // still returns correct, independent defaults on both paths.
+  it("does not depend on the structuredClone global (Node <17 safety)", async () => {
+    const g = globalThis as Record<string, unknown>;
+    const orig = g.structuredClone;
+    delete g.structuredClone;
+    try {
+      const a = await loadConfig(testDir); // no-config path
+      expect(a.hooks.mode).toBe("deny-enhanced");
+
+      await writeConfig({ hooks: { mode: "advisory" } }); // merge path
+      const b = await loadConfig(testDir);
+      expect(b.hooks.mode).toBe("advisory");
+
+      // mutating one result must not leak into the shared defaults
+      a.hooks.mode = "off";
+      const c = await loadConfig(join(testDir, "nope-subdir"));
+      expect(c.hooks.mode).toBe("deny-enhanced");
+    } finally {
+      if (orig !== undefined) g.structuredClone = orig;
+    }
+  });
 });

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "token-pilot",`
`3`		`- "version": "0.39.2",`
	`3`	`+ "version": "0.39.3",`
`4`	`4`	`"description": "Saves 60-90% tokens on AI code reading. AST-aware lazy reads, symbol navigation, find_usages, structural git diff/log, edit-safety guard, Task-routing matcher, cross-session telemetry (errors + diagnostics), 25 tp-* subagents tiered to haiku/sonnet/opus with budget watchdog.",`
`5`	`5`	`"author": {`
`6`	`6`	`"name": "Digital-Threads",`