chore: bump package to 0.1.9

.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "GitHits plugins for Claude Code - code examples from global open source",
-    "version": "0.1.8"
+    "version": "0.1.9"
   },
   "plugins": [
     {

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"

.plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"

README.md

@@ -82,11 +82,13 @@ For plugin-based hosts, install from npm/GitHub using your agent's plugin workfl
 - **GitHub Copilot**: supports Open Plugin components
 - **Gemini CLI**: supports `gemini-extension.json` and `GEMINI.md`
 
-That's it. Your assistant now has a `search` tool it will use automatically when it needs code examples.
+That's it. Your assistant now has GitHits search tools, and on accounts with package/source access enabled it also gets dependency inspection tools.
 
 ## How It Works
 
-GitHits runs as an [MCP server](https://modelcontextprotocol.io/) that your AI assistant connects to over stdio. The assistant gets three tools:
+GitHits runs as an [MCP server](https://modelcontextprotocol.io/) that your AI assistant connects to over stdio.
+
+Core tools available in every authenticated session:
 
 | Tool | Purpose |
 |---|---|
@@ -96,6 +98,21 @@ GitHits runs as an [MCP server](https://modelcontextprotocol.io/) that your AI a
 
 The assistant decides when to call these tools on its own — typically when it's stuck, needs a working example for an unfamiliar API, or encounters an error it can't resolve from its training data alone.
 
+When package/source access is enabled for the current token, GitHits also exposes these capability-gated tools:
+
+| Tool | Purpose |
+|---|---|
+| `package_summary` | Quick package overview: version, license, downloads, quickstart, advisories |
+| `package_vulnerabilities` | CVE / OSV advisories for a package or specific version |
+| `package_dependencies` | Direct dependencies, dependency groups, and optional transitive graph |
+| `package_changelog` | Release notes / changelog entries for a package or GitHub repo |
+| `search_symbols` | Exact-token search inside indexed dependency source |
+| `list_files` | Discover what files a dependency or repo contains |
+| `read_file` | Read a dependency file by path |
+| `grep_file` | Search for a case-insensitive substring within one file |
+
+These advanced tools remain feature-gated. The MCP server advertises them only when the authenticated token is entitled to package/source access.
+
 ### License Filtering
 
 Search results respect license filtering by default, excluding copyleft-licensed code. Three modes are available:
@@ -141,18 +158,29 @@ githits mcp start      Always start MCP server (for use in MCP config files)
 githits auth status    Show current authentication status
 ```
 
+When package/source access is enabled for the current token, two extra command groups are also available:
+
+```
+githits pkg ...        Package metadata: overview, advisories, deps, changelog
+githits code ...       Dependency source inspection: search, files, read, grep
+```
+
 ## Environment Variables
 
 | Variable | Purpose | Default |
 |---|---|---|
 | `GITHITS_API_TOKEN` | API token for authentication | — |
 | `GITHITS_MCP_URL` | Override MCP server URL | `https://mcp.githits.com` |
 | `GITHITS_API_URL` | Override REST API URL | `https://api.githits.com` |
+| `GITHITS_CODE_NAV_URL` | Override package/source service URL | environment-specific |
+| `GITHITS_CODE_NAVIGATION` | Expose hidden `pkg` / `code` command groups locally | — |
 
 ## Manual Setup
 
 If your tool is not in the supported `githits init` list, configure GitHits manually.
 
+The same MCP server command exposes both the core search tools and, when your token is entitled, the package/source inspection tools. No separate install is required.
+
 Use this MCP server command in your tool's MCP config (the host/agent runs this command):
 
 ```sh

docs/implementation/auth.md

@@ -19,7 +19,7 @@ The two methods exist because OAuth provides full access but requires a browser,
 
 > **The container resolves auth at startup.** The `createContainer()` function checks for `GITHITS_API_TOKEN` first — if set, it takes precedence even when OAuth tokens are stored. If not set, it loads stored OAuth tokens and attempts auto-refresh if expired. See `src/container.ts` for the resolution logic.
 
-For the code navigation PoC, the CLI also inspects the current bearer token for Supabase `feature_flags` claims. This is a local capability hint only: the backend still enforces access. The CLI decodes JWT payloads without signature verification, treating opaque or malformed tokens as `unknown` capability.
+Some hidden package/source tooling is conditionally exposed based on the active auth context.
 
 ## OAuth PKCE Flow
 
@@ -44,7 +44,7 @@ Tokens are JWTs with a configurable expiration (typically 1 hour). The CLI handl
 - **Proactive refresh** — When 90% of the token lifetime has elapsed (e.g., at ~54 minutes for a 1-hour token), the `TokenManager` refreshes before expiry. This avoids a stale-token window.
 - **Reactive refresh** — If the token is already expired, refresh is attempted immediately.
 - **401 retry** — The `RefreshingGitHitsService` decorator wraps `GitHitsServiceImpl` and retries once on `AuthenticationError`, calling `forceRefresh()` to handle clock skew or server-side revocation.
-- **Shared retry helper** — GitHits REST calls and code navigation GraphQL calls both use the same token-refresh/retry flow, so auth drift is handled consistently across both service families.
+- **Shared retry helper** — GitHits REST calls and package/source service calls both use the same token-refresh/retry flow, so auth drift is handled consistently across both service families.
 - **Concurrent coalescing** — Multiple concurrent refresh requests share a single in-flight Promise.
 - **At login** (`src/commands/login.ts`) — Checks if existing token is still valid before starting the OAuth flow. Respects `--force` flag to re-authenticate regardless.
 - **At auth status** (`src/commands/auth-status.ts`) — Attempts refresh before reporting "Token expired".
@@ -162,8 +162,8 @@ The `hasValidToken` flag is checked by `requireAuth()` in `src/commands/mcp.ts`
 | `src/services/token-manager.ts` | `TokenProvider` interface, `TokenManager` (proactive refresh, coalescing) |
 | `src/services/refreshing-githits-service.ts` | `GitHitsService` decorator with token refresh and 401 retry |
 | `src/services/execute-with-token-refresh.ts` | Shared helper for token-authenticated retry-on-refresh flows |
-| `src/services/code-navigation-capability.ts` | Local JWT capability decoding for `code_navigation` |
-| `src/services/code-navigation-service.ts` | GraphQL code navigation client using the shared refresh helper |
+| `src/services/code-navigation-capability.ts` | Local package/source access gating helpers |
+| `src/services/code-navigation-service.ts` | Package/source service client using the shared refresh helper |
 | `src/services/auth-service.ts` | OAuth operations (DCR, PKCE, token exchange, callback server) |
 | `src/services/auth-storage.ts` | `AuthStorage` interface and file-based implementation |
 | `src/services/keyring-service.ts` | `KeyringService` interface wrapping `@napi-rs/keyring` |