config-audit/commands/manifest.md

name	description	argument-hint	allowed-tools	model
config-audit:manifest	Show ranked token-source manifest — every CLAUDE.md, rule, agent, skill, output style, MCP server, and hook ordered DESC by estimated tokens, each tagged with its load pattern (always-loaded vs on-demand vs external), plus an always-loaded subtotal	[path] [--json]	Read, Bash	sonnet

Config-Audit: Manifest

Produce a ranked, single-table view of every token source loaded for a given repo path. Where whats-active shows separate tables per category, manifest collapses everything into one ordered list — making it easy to see what's costing the most regardless of category.

Every source is tagged with its load pattern, derived from the published Claude Code loading model:

• always — enters context every turn before you type (project/user CLAUDE.md, unscoped rules, agents, output styles, MCP tool schemas). This is the cost that matters most: it is paid on every request.
• on-demand — loaded only when needed (skill bodies on invoke, path-scoped rules on a matching file read).
• external — runs outside the context window entirely (hooks).

The always-loaded subtotal is the headline number. Sources are component-level (a plugin contributes via its skills/rules/agents/output styles/hooks/MCP, each listed once — there is no coarse "plugin" roll-up, which would double-count).

UX Rules (MANDATORY — from .claude/rules/ux-rules.md)

1. Never show raw JSON or stderr output. Always use --output-file + 2>/dev/null.
2. Narrate before acting. Tell the user what you're about to do.
3. Read, don't dump. Read the JSON file and render a formatted table.
4. End with context-sensitive next steps.

Implementation

Step 1: Parse $ARGUMENTS

First non-flag argument is the path (default .). Recognized flags:

• --json — emit raw JSON instead of the rendered table.
• --raw — pass-through to the scanner; accepted for CLI surface consistency with the other config-audit commands. The manifest CLI is data-table only (no findings prose), so --raw is a no-op here, but the flag is still threaded through so users get uniform behaviour across --raw.

Step 2: Run the CLI silently

Tell the user: "Building token-source manifest for <path>..."

RAW_FLAG=""
if echo "$ARGUMENTS" | grep -q -- "--raw"; then RAW_FLAG="--raw"; fi
node ${CLAUDE_PLUGIN_ROOT}/scanners/manifest.mjs "<path>" --output-file /tmp/config-audit-manifest.json $RAW_FLAG >/dev/null 2>/dev/null; echo $?

Exit code handling:

• 0 → continue
• 3 → tell user: "Couldn't read configuration. Check that the path exists and is a directory." Stop.

Step 3: If --json was requested, cat the file and stop

cat /tmp/config-audit-manifest.json

Do NOT render the table in JSON mode.

Step 4: Read JSON and render

Use the Read tool on /tmp/config-audit-manifest.json. Extract meta.repoPath, total, summary, and sources[]. Lead with the always-loaded subtotal (the headline), then render the top 20 sources (or fewer if the manifest is shorter):

**Token-source manifest for `<repoPath>`** — ~{total} tokens total

- 🔴 **~{summary.always.tokens} tokens enter context every turn** before you type ({summary.always.count} always-loaded sources)
- 🟡 ~{summary.onDemand.tokens} tokens on-demand ({summary.onDemand.count} sources — loaded only when invoked / matched)
- ⚪ ~{summary.external.tokens} tokens external ({summary.external.count} sources — hooks, run outside context)

| Rank | Kind | Name | Source | Tokens | Load |
|------|------|------|--------|--------|------|
| 1 | {kind} | `<name>` | {source} | ~{estimated_tokens} | {loadPattern} |
| ... | ... | ... | ... | ... | ... |

_Load column: **always** / **on-demand** / **external**. Append `°` when `derivationConfidence` is `inferred` (no primary-doc row pins it exactly)._
_Estimates assume ~4 chars/token (Claude ballpark). Real token count varies ±15%._

If sources.length > 20, follow the table with: "Showing top 20 of {N} sources. Run with --json to see the full list."

When narrating, prioritize the always-loaded subtotal: a large always source is worse than an equally large on-demand one, because it is paid on every request. Call out any single always-loaded source that dwarfs the rest.

Step 5: Suggest next steps

**Next steps:**
- `/config-audit tokens` — prompt-cache token-hotspot patterns (cache-breaking, redundant perms, deep imports, MCP budget)
- `/config-audit whats-active` — same data grouped by category, with disable suggestions
- `/config-audit feature-gap` — what *could* improve here, grouped by impact

Tone (key on the always-loaded subtotal — the every-turn cost — not the grand total):

• High always-loaded (>40k): empathetic — "That's a heavy per-turn cost; it taxes every request before you've typed a word. Look at the largest always-loaded sources first."
• Moderate (10–40k): neutral — "Reasonable. Skim the top always-loaded sources to see if anything is unexpectedly large."
• Low (<10k): encouraging — "Tight setup. The model has plenty of room for the actual work each turn."