ToolsEnabled Data 0.8.3

ToolsEnabled Data 0.8.3

A reliability hotfix for 0.8.2. It corrects two defects in how TE Data read connected files and handled its own state folder. Nothing else changes: TE Data still runs only on your computer, reads only what you connect, and never modifies a source file.

What was wrong

1. A connected file whose path contains *, ?, [ or ] could show another file's rows. The query engine treated such a path as a pattern, so data[1].csv was read as data1.csv whenever that file existed beside it. The profile, and any derived copy made from it, carried the connected file's name and fingerprint over rows from the other file. The reading code is the same in 0.8.0, 0.8.1 and 0.8.2; the defect was reproduced on 0.8.2.
2. Saved state followed symbolic links. A symbolic link at .tedata, or at a folder below it, redirected what TE Data writes there (interpretations, caches, derived copies, exports, preparation and collection records) to wherever the link pointed, outside the workspace. The profile-cache cleanup also removed every .json file in .tedata/cache/profiles that was not a current cache record, which through such a link could include a file that was not TE Data's.

What changed

• A path with *, ?, [ or ] is read literally. The worker opens it through a pattern-free alias in a private temporary folder and checks that the alias resolves to the very same file; where no alias can be made, the file is refused with a message naming the characters, and nothing is read. The rows and the fingerprint always describe the same file.
• Saved state is read and written only through real folders. A symbolic link at .tedata, or at a folder or record below it (data-state, cache, preparations, collections, derived-data and its exports), is refused with a message naming the link. Replace the link with a folder; to keep derived copies and exports on another disk, set derivedDirectory in .tedata/workspace.json to a real folder.
• Profile-cache cleanup removes only the cache records TE Data wrote, never another file in that folder.
• A collection member's saved output record is checked for the expected shape before TE Data cleans up or restores from it.

Who should update

Everyone on 0.8.0, 0.8.1 or 0.8.2.

• If you connected a file or folder whose name has *, ?, [ or ]: inspect it once more after updating, so that its saved interpretation is checked against its own columns, and derive again any copy made from it before 0.8.3 (its lineage names the source file).
• If .tedata or a folder under it is a symbolic link: replace it with a real folder, or set derivedDirectory for derived copies and exports. Derived copies already behind a link stay listed; new copies and exports are refused until the link is replaced, and a linked cache folder is refused at the first profile of a dataset.

How to update

From a terminal:

claude plugin marketplace update toolsenabled-data
claude plugin update toolsenabled-data@toolsenabled-data

or use the /plugin menu inside Claude Code. Then restart Claude Code. If you installed TE Data from a local folder or a development marketplace, update that copy instead. The README's "Notes for 0.8.3" section repeats the two notes above.

How it was tested

• Regression tests for both defects, written to fail on 0.8.2 and pass on 0.8.3. The worker tests read a bracketed file beside a same-named decoy and check that the rows and the SHA-256 fingerprint are the file's own, for *, ?, [ ], .tsv, .csv.gz, a bracketed folder and a bracketed ZIP archive. The state-tree tests plant a symbolic link at every state folder and record (.tedata, data-state, cache, preparations, collections, derived-data, exports, a single record) and check that nothing is written or read through it, that the message names the link, and that cache cleanup leaves other files alone.
• The full suites on the release source (commit 4f61abc): JavaScript 159 tests, 151 pass, 0 fail, 8 skipped (browser tests); Python 71 tests, OK.
• End to end over MCP stdio on the finished plugin: data[1].csv beside data1.csv, z[1].csv.gz, q?.csv, star*.csv, archive[1].zip and a proj [2024] folder each return their own rows with unchanged fixture hashes; a linked .tedata, derived-data, cache and exports are refused by name and their link targets stay empty; cache cleanup removes only an old cache record and keeps the other files.
• node release.mjs verify on the published tree: every file matches a fresh build of source commit 4f61abc (RELEASE-MANIFEST.json lists each file's SHA-256), and claude plugin validate --strict passes.

Windows and macOS were not tested for this release; the symbolic-link behaviour there follows the same code path but was exercised only on Linux.