token-goat 2.0.3 → 2.2.0

package/dist/token-goat.mjs

@@ -981,8 +981,8 @@ var require_command = __commonJS({
     init_define_import_meta_env();
     var EventEmitter = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
-    var path15 = __require("node:path");
-    var fs15 = __require("node:fs");
+    var path17 = __require("node:path");
+    var fs16 = __require("node:fs");
     var process2 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1914,11 +1914,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path15.resolve(baseDir, baseName);
-          if (fs15.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path15.extname(baseName))) return void 0;
+          const localBin = path17.resolve(baseDir, baseName);
+          if (fs16.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path17.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs15.existsSync(`${localBin}${ext}`)
+            (ext) => fs16.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1930,21 +1930,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs15.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs16.realpathSync(this._scriptPath);
           } catch (err2) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path15.resolve(
-            path15.dirname(resolvedScriptPath),
+          executableDir = path17.resolve(
+            path17.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path15.basename(
+            const legacyName = path17.basename(
               this._scriptPath,
-              path15.extname(this._scriptPath)
+              path17.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1955,7 +1955,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path15.extname(executableFile));
+        launchWithNode = sourceExt.includes(path17.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2795,7 +2795,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path15.basename(filename, path15.extname(filename));
+        this._name = path17.basename(filename, path17.extname(filename));
         return this;
       }
       /**
@@ -2809,9 +2809,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path16) {
-        if (path16 === void 0) return this._executableDir;
-        this._executableDir = path16;
+      executableDir(path18) {
+        if (path18 === void 0) return this._executableDir;
+        this._executableDir = path18;
         return this;
       }
       /**
@@ -3158,27 +3158,27 @@ var require_filesystem = __commonJS({
   "node_modules/detect-libc/lib/filesystem.js"(exports, module) {
     "use strict";
     init_define_import_meta_env();
-    var fs15 = __require("fs");
+    var fs16 = __require("fs");
     var LDD_PATH = "/usr/bin/ldd";
     var SELF_PATH = "/proc/self/exe";
     var MAX_LENGTH = 2048;
-    var readFileSync11 = (path15) => {
-      const fd = fs15.openSync(path15, "r");
+    var readFileSync12 = (path17) => {
+      const fd = fs16.openSync(path17, "r");
       const buffer = Buffer.alloc(MAX_LENGTH);
-      const bytesRead = fs15.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-      fs15.close(fd, () => {
+      const bytesRead = fs16.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+      fs16.close(fd, () => {
       });
       return buffer.subarray(0, bytesRead);
     };
-    var readFile3 = (path15) => new Promise((resolve6, reject) => {
-      fs15.open(path15, "r", (err2, fd) => {
+    var readFile3 = (path17) => new Promise((resolve6, reject) => {
+      fs16.open(path17, "r", (err2, fd) => {
         if (err2) {
           reject(err2);
         } else {
           const buffer = Buffer.alloc(MAX_LENGTH);
-          fs15.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
+          fs16.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
             resolve6(buffer.subarray(0, bytesRead));
-            fs15.close(fd, () => {
+            fs16.close(fd, () => {
             });
           });
         }
@@ -3187,7 +3187,7 @@ var require_filesystem = __commonJS({
     module.exports = {
       LDD_PATH,
       SELF_PATH,
-      readFileSync: readFileSync11,
+      readFileSync: readFileSync12,
       readFile: readFile3
     };
   }
@@ -3238,7 +3238,7 @@ var require_detect_libc = __commonJS({
     init_define_import_meta_env();
     var childProcess = __require("child_process");
     var { isLinux, getReport } = require_process();
-    var { LDD_PATH, SELF_PATH, readFile: readFile3, readFileSync: readFileSync11 } = require_filesystem();
+    var { LDD_PATH, SELF_PATH, readFile: readFile3, readFileSync: readFileSync12 } = require_filesystem();
     var { interpreterPath } = require_elf();
     var cachedFamilyInterpreter;
     var cachedFamilyFilesystem;
@@ -3292,11 +3292,11 @@ var require_detect_libc = __commonJS({
       }
       return null;
     };
-    var familyFromInterpreterPath = (path15) => {
-      if (path15) {
-        if (path15.includes("/ld-musl-")) {
+    var familyFromInterpreterPath = (path17) => {
+      if (path17) {
+        if (path17.includes("/ld-musl-")) {
           return MUSL;
-        } else if (path15.includes("/ld-linux-")) {
+        } else if (path17.includes("/ld-linux-")) {
           return GLIBC;
         }
       }
@@ -3330,7 +3330,7 @@ var require_detect_libc = __commonJS({
       }
       cachedFamilyFilesystem = null;
       try {
-        const lddContent = readFileSync11(LDD_PATH);
+        const lddContent = readFileSync12(LDD_PATH);
         cachedFamilyFilesystem = getFamilyFromLddContent(lddContent);
       } catch (e) {
       }
@@ -3343,8 +3343,8 @@ var require_detect_libc = __commonJS({
       cachedFamilyInterpreter = null;
       try {
         const selfContent = await readFile3(SELF_PATH);
-        const path15 = interpreterPath(selfContent);
-        cachedFamilyInterpreter = familyFromInterpreterPath(path15);
+        const path17 = interpreterPath(selfContent);
+        cachedFamilyInterpreter = familyFromInterpreterPath(path17);
       } catch (e) {
       }
       return cachedFamilyInterpreter;
@@ -3355,9 +3355,9 @@ var require_detect_libc = __commonJS({
       }
       cachedFamilyInterpreter = null;
       try {
-        const selfContent = readFileSync11(SELF_PATH);
-        const path15 = interpreterPath(selfContent);
-        cachedFamilyInterpreter = familyFromInterpreterPath(path15);
+        const selfContent = readFileSync12(SELF_PATH);
+        const path17 = interpreterPath(selfContent);
+        cachedFamilyInterpreter = familyFromInterpreterPath(path17);
       } catch (e) {
       }
       return cachedFamilyInterpreter;
@@ -3419,7 +3419,7 @@ var require_detect_libc = __commonJS({
       }
       cachedVersionFilesystem = null;
       try {
-        const lddContent = readFileSync11(LDD_PATH);
+        const lddContent = readFileSync12(LDD_PATH);
         const versionMatch = lddContent.match(RE_GLIBC_VERSION);
         if (versionMatch) {
           cachedVersionFilesystem = versionMatch[1];
@@ -4947,8 +4947,8 @@ var require_libvips = __commonJS({
   "node_modules/sharp/lib/libvips.js"(exports, module) {
     "use strict";
     init_define_import_meta_env();
-    var { spawnSync: spawnSync2 } = __require("node:child_process");
-    var { createHash: createHash2 } = __require("node:crypto");
+    var { spawnSync: spawnSync3 } = __require("node:child_process");
+    var { createHash: createHash3 } = __require("node:crypto");
     var semverCoerce = require_coerce();
     var semverGreaterThanOrEqualTo = require_gte();
     var semverSatisfies = require_satisfies();
@@ -5032,12 +5032,12 @@ var require_libvips = __commonJS({
     };
     var isRosetta = () => {
       if (process.platform === "darwin" && process.arch === "x64") {
-        const translated = spawnSync2("sysctl sysctl.proc_translated", spawnSyncOptions).stdout;
+        const translated = spawnSync3("sysctl sysctl.proc_translated", spawnSyncOptions).stdout;
         return (translated || "").trim() === "sysctl.proc_translated: 1";
       }
       return false;
     };
-    var sha512 = (s) => createHash2("sha512").update(s).digest("hex");
+    var sha512 = (s) => createHash3("sha512").update(s).digest("hex");
     var yarnLocator = () => {
       try {
         const identHash = sha512(`imgsharp-libvips-${buildPlatformArch()}`);
@@ -5047,13 +5047,13 @@ var require_libvips = __commonJS({
       }
       return "";
     };
-    var spawnRebuild = () => spawnSync2(`node-gyp rebuild --directory=src ${isEmscripten() ? "--nodedir=emscripten" : ""}`, {
+    var spawnRebuild = () => spawnSync3(`node-gyp rebuild --directory=src ${isEmscripten() ? "--nodedir=emscripten" : ""}`, {
       ...spawnSyncOptions,
       stdio: "inherit"
     }).status;
     var globalLibvipsVersion = () => {
       if (process.platform !== "win32") {
-        const globalLibvipsVersion2 = spawnSync2("pkg-config --modversion vips-cpp", {
+        const globalLibvipsVersion2 = spawnSync3("pkg-config --modversion vips-cpp", {
           ...spawnSyncOptions,
           env: {
             ...process.env,
@@ -5067,7 +5067,7 @@ var require_libvips = __commonJS({
     };
     var pkgConfigPath = () => {
       if (process.platform !== "win32") {
-        const brewPkgConfigPath = spawnSync2(
+        const brewPkgConfigPath = spawnSync3(
           'which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',
           spawnSyncOptions
         ).stdout || "";
@@ -5138,9 +5138,9 @@ var require_sharp = __commonJS({
     ];
     var sharp;
     var errors = [];
-    for (const path15 of paths) {
+    for (const path17 of paths) {
       try {
-        sharp = __require(path15);
+        sharp = __require(path17);
         break;
       } catch (err2) {
         errors.push(err2);
@@ -5149,7 +5149,7 @@ var require_sharp = __commonJS({
     if (sharp) {
       module.exports = sharp;
     } else {
-      const [isLinux, isMacOs, isWindows] = ["linux", "darwin", "win32"].map((os3) => runtimePlatform.startsWith(os3));
+      const [isLinux, isMacOs, isWindows2] = ["linux", "darwin", "win32"].map((os4) => runtimePlatform.startsWith(os4));
       const help = [`Could not load the "sharp" module using the ${runtimePlatform} runtime`];
       errors.forEach((err2) => {
         if (err2.code !== "MODULE_NOT_FOUND") {
@@ -5166,15 +5166,15 @@ var require_sharp = __commonJS({
           `    Requires ${expected}`
         );
       } else if (prebuiltPlatforms.includes(runtimePlatform)) {
-        const [os3, cpu] = runtimePlatform.split("-");
-        const libc = os3.endsWith("musl") ? " --libc=musl" : "";
+        const [os4, cpu] = runtimePlatform.split("-");
+        const libc = os4.endsWith("musl") ? " --libc=musl" : "";
         help.push(
           "- Ensure optional dependencies can be installed:",
           "    npm install --include=optional sharp",
           "- Ensure your package manager supports multi-platform installation:",
           "    See https://sharp.pixelplumbing.com/install#cross-platform",
           "- Add platform-specific dependencies:",
-          `    npm install --os=${os3.replace("musl", "")}${libc} --cpu=${cpu} sharp`
+          `    npm install --os=${os4.replace("musl", "")}${libc} --cpu=${cpu} sharp`
         );
       } else {
         help.push(
@@ -5212,7 +5212,7 @@ var require_sharp = __commonJS({
       if (errors.some((err2) => err2.code === "ERR_DLOPEN_DISABLED")) {
         help.push("- Run Node.js without using the --no-addons flag");
       }
-      if (isWindows && /The specified procedure could not be found/.test(messages)) {
+      if (isWindows2 && /The specified procedure could not be found/.test(messages)) {
         help.push(
           "- Using the canvas package on Windows?",
           "    See https://sharp.pixelplumbing.com/install#canvas-and-windows",
@@ -6552,15 +6552,15 @@ var require_route = __commonJS({
       };
     }
     function wrapConversion(toModel, graph) {
-      const path15 = [graph[toModel].parent, toModel];
+      const path17 = [graph[toModel].parent, toModel];
       let fn = conversions[graph[toModel].parent][toModel];
       let cur = graph[toModel].parent;
       while (graph[cur].parent) {
-        path15.unshift(graph[cur].parent);
+        path17.unshift(graph[cur].parent);
         fn = link(conversions[graph[cur].parent][cur], fn);
         cur = graph[cur].parent;
       }
-      fn.conversion = path15;
+      fn.conversion = path17;
       return fn;
     }
     module.exports = function(fromModel) {
@@ -8464,7 +8464,7 @@ var require_output = __commonJS({
   "node_modules/sharp/lib/output.js"(exports, module) {
     "use strict";
     init_define_import_meta_env();
-    var path15 = __require("node:path");
+    var path17 = __require("node:path");
     var is = require_is();
     var sharp = require_sharp();
     var formats = /* @__PURE__ */ new Map([
@@ -8495,9 +8495,9 @@ var require_output = __commonJS({
       let err2;
       if (!is.string(fileOut)) {
         err2 = new Error("Missing output file path");
-      } else if (is.string(this.options.input.file) && path15.resolve(this.options.input.file) === path15.resolve(fileOut)) {
+      } else if (is.string(this.options.input.file) && path17.resolve(this.options.input.file) === path17.resolve(fileOut)) {
         err2 = new Error("Cannot use same file for input and output");
-      } else if (jp2Regex.test(path15.extname(fileOut)) && !this.constructor.format.jp2k.output.file) {
+      } else if (jp2Regex.test(path17.extname(fileOut)) && !this.constructor.format.jp2k.output.file) {
         err2 = errJp2Save();
       }
       if (err2) {
@@ -9475,13 +9475,13 @@ var {
 } = import_index.default;
 
 // src/cli.ts
-import * as fs14 from "fs";
-import * as path14 from "path";
+import * as fs15 from "fs";
+import * as path16 from "path";
 
 // src/baseline.ts
 init_define_import_meta_env();
 import * as fs2 from "node:fs";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 
 // src/constants.ts
 init_define_import_meta_env();
@@ -9493,7 +9493,7 @@ init_define_import_meta_env();
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.0.3";
+    return "2.2.0";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -9543,9 +9543,42 @@ function configPath() {
 init_define_import_meta_env();
 import * as fs from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import * as path2 from "node:path";
+import * as path3 from "node:path";
 import Database from "better-sqlite3";
 
+// src/paths.ts
+init_define_import_meta_env();
+import * as path2 from "node:path";
+var WSL_PATH_RE = /^\/mnt\/([a-zA-Z])\/(.*)$/s;
+function normalizePath(p) {
+  let s = p;
+  if (s.includes("\\")) {
+    s = s.replace(/\\/g, "/");
+  }
+  const m = WSL_PATH_RE.exec(s);
+  if (m) {
+    const driveLetter = m[1].toLowerCase();
+    const rest = m[2];
+    const restStripped = rest.replace(/^\/+/, "");
+    s = `${driveLetter}:/${restStripped}`;
+  }
+  if (s.length >= 2 && s[1] === ":") {
+    const c = s[0];
+    if (/^[A-Z]$/.test(c)) {
+      s = c.toLowerCase() + s.slice(1);
+    }
+  }
+  return s;
+}
+function safeJoin(base, ...parts) {
+  for (const part of parts) {
+    if (part.includes(":")) {
+      throw new Error(`safeJoin: path component contains colon: ${JSON.stringify(part)}`);
+    }
+  }
+  return path2.join(base, ...parts);
+}
+
 // src/reset.ts
 init_define_import_meta_env();
 var _resets = [];
@@ -9589,6 +9622,16 @@ CREATE TABLE IF NOT EXISTS refs (
 );
 CREATE INDEX IF NOT EXISTS idx_refs_name ON refs(name);
 CREATE INDEX IF NOT EXISTS idx_refs_file ON refs(file_path);
+
+CREATE TABLE IF NOT EXISTS chunks (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  file_path TEXT,
+  start_line INTEGER,
+  end_line INTEGER,
+  text TEXT,
+  kind TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_chunks_file ON chunks(file_path);
 `;
 var FTS_SQL = `
 CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(
@@ -9636,15 +9679,15 @@ function initConnection(conn) {
   }
 }
 function resolveDbPath(dbPath) {
-  if (path2.isAbsolute(dbPath)) return dbPath;
-  if (dbPath.includes("/") || dbPath.includes("\\")) return path2.resolve(dbPath);
-  return path2.join(dataDir(), dbPath);
+  if (path3.isAbsolute(dbPath)) return dbPath;
+  if (dbPath.includes("/") || dbPath.includes("\\")) return path3.resolve(dbPath);
+  return safeJoin(dataDir(), dbPath);
 }
 function getDb(dbPath) {
   const resolved = resolveDbPath(dbPath);
   const existing = _connections.get(resolved);
   if (existing !== void 0) return existing;
-  const dir = path2.dirname(resolved);
+  const dir = path3.dirname(resolved);
   try {
     fs.mkdirSync(dir, { recursive: true });
   } catch (e) {
@@ -9668,7 +9711,7 @@ registerReset(closeAllDbs);
 
 // src/parser_types.ts
 init_define_import_meta_env();
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 var EXTENSION_LANGUAGE = /* @__PURE__ */ new Map([
   [".py", "python"],
   [".pyi", "python"],
@@ -9738,10 +9781,10 @@ var FILENAME_LANGUAGE = /* @__PURE__ */ new Map([
   [".envrc", "env_file"]
 ]);
 function detectLanguage(filePath) {
-  const base = path3.basename(filePath).toLowerCase();
+  const base = path4.basename(filePath).toLowerCase();
   const byName = FILENAME_LANGUAGE.get(base);
   if (byName !== void 0) return byName;
-  const ext = path3.extname(base).toLowerCase();
+  const ext = path4.extname(base).toLowerCase();
   return EXTENSION_LANGUAGE.get(ext) ?? "unknown";
 }
 
@@ -9782,7 +9825,7 @@ function walkProject(rootDir) {
       continue;
     }
     for (const entry of entries) {
-      const full = path4.join(dir, entry.name);
+      const full = path5.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         if (entry.name.startsWith(".") && entry.name !== ".") {
@@ -9825,7 +9868,7 @@ function fetchTopSymbols(limit, dbPath) {
   }
 }
 function buildProjectMap(rootDir = process.cwd(), opts = {}) {
-  const root = path4.resolve(rootDir);
+  const root = path5.resolve(rootDir);
   const { files, languages } = walkProject(root);
   const symbolLimit = opts.compact ? 10 : 30;
   const topSymbols = fetchTopSymbols(symbolLimit, globalDbPath());
@@ -9837,7 +9880,7 @@ function buildProjectMap(rootDir = process.cwd(), opts = {}) {
       mtime = 0;
     }
     return { f, mtime };
-  }).sort((a, b) => b.mtime - a.mtime).slice(0, opts.compact ? 5 : 15).map((x) => path4.relative(root, x.f));
+  }).sort((a, b) => b.mtime - a.mtime).slice(0, opts.compact ? 5 : 15).map((x) => path5.relative(root, x.f));
   return {
     rootDir: root,
     fileCount: files.length,
@@ -9848,7 +9891,7 @@ function buildProjectMap(rootDir = process.cwd(), opts = {}) {
 }
 function formatProjectMap(map, compact = false) {
   const lines = [];
-  const rel = path4.basename(map.rootDir);
+  const rel = path5.basename(map.rootDir);
   lines.push(`# Project map: ${rel}`);
   lines.push(`Files: ${map.fileCount}`);
   const langPairs = Object.entries(map.languages).sort((a, b) => b[1] - a[1]);
@@ -9861,7 +9904,7 @@ function formatProjectMap(map, compact = false) {
       if (compact) {
         lines.push(`- ${s.name} (${s.kind})`);
       } else {
-        const loc = `${path4.basename(s.filePath)}:${s.lineStart}-${s.lineEnd}`;
+        const loc = `${path5.basename(s.filePath)}:${s.lineStart}-${s.lineEnd}`;
         lines.push(`- ${s.name} (${s.kind}) \u2014 ${loc}`);
       }
     }
@@ -9878,42 +9921,19 @@ function formatProjectMap(map, compact = false) {
 
 // src/repomap.ts
 init_define_import_meta_env();
-import * as path5 from "path";
+import * as path6 from "path";
 
 // src/util.ts
 init_define_import_meta_env();
 import { spawnSync } from "node:child_process";
 import { closeSync, openSync, renameSync, unlinkSync, writeSync } from "node:fs";
-
-// src/paths.ts
-init_define_import_meta_env();
-var WSL_PATH_RE = /^\/mnt\/([a-zA-Z])\/(.*)$/s;
-function normalizePath(p) {
-  let s = p;
-  if (s.includes("\\")) {
-    s = s.replace(/\\/g, "/");
-  }
-  const m = WSL_PATH_RE.exec(s);
-  if (m) {
-    const driveLetter = m[1].toLowerCase();
-    const rest = m[2];
-    const restStripped = rest.replace(/^\/+/, "");
-    s = `${driveLetter}:/${restStripped}`;
-  }
-  if (s.length >= 2 && s[1] === ":") {
-    const c = s[0];
-    if (/^[A-Z]$/.test(c)) {
-      s = c.toLowerCase() + s.slice(1);
-    }
-  }
-  return s;
-}
-
-// src/util.ts
 function sleepSync(ms) {
   if (ms <= 0) return;
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+function isWindows() {
+  return process.platform === "win32";
+}
 function runGit(args, opts = {}) {
   const fullArgs = ["-c", "core.fsmonitor=", ...args];
   const result = spawnSync("git", fullArgs, {
@@ -9979,6 +9999,21 @@ function atomicWriteText(filePath, content) {
 function atomicWriteBytes(filePath, content) {
   atomicWriteCore(filePath, content);
 }
+function ensureNewline(text) {
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function extractErrorMessage(err2, fallback = "") {
+  return err2 instanceof Error ? err2.message : fallback || String(err2);
+}
+function isCodeFenceDelimiter(line) {
+  const s = line.trim();
+  return s.startsWith("```") || s.startsWith("~~~");
+}
+function normalizePathForwardSlash(p, toLowerCase) {
+  let result = normalizePath(p).replace(/\\/g, "/");
+  if (toLowerCase) result = result.toLowerCase();
+  return result;
+}
 
 // src/index_reader.ts
 init_define_import_meta_env();
@@ -10124,7 +10159,7 @@ function isNoisePath(inputPath) {
   if (!inputPath) {
     return false;
   }
-  const p = normalizePath(inputPath).toLowerCase().replace(/\\/g, "/");
+  const p = normalizePathForwardSlash(inputPath, true);
   for (const segment of NOISE_SEGMENTS) {
     if (p.includes(segment)) {
       return true;
@@ -10162,7 +10197,7 @@ function getTrackedFiles(cwd = process.cwd()) {
     if (result.exitCode !== 0 || !result.stdout) {
       return [];
     }
-    return result.stdout.split("\n").filter((line) => line.trim().length > 0).map((rel) => path5.join(cwd, rel));
+    return result.stdout.split("\n").filter((line) => line.trim().length > 0).map((rel) => path6.join(cwd, rel));
   } catch {
     return [];
   }
@@ -10218,7 +10253,7 @@ function formatMap(entries, opts = {}) {
     lines.push("");
     lines.push("## Files");
     for (const e of shown) {
-      const rel = path5.relative(cwd, e.filePath);
+      const rel = path6.relative(cwd, e.filePath);
       if (compact) {
         lines.push(`- ${rel} (${e.language})`);
       } else {
@@ -10236,11 +10271,13 @@ function formatMap(entries, opts = {}) {
 
 // src/session.ts
 init_define_import_meta_env();
+import { randomBytes, randomUUID } from "node:crypto";
 import * as fs3 from "node:fs";
 var _files = /* @__PURE__ */ new Map();
 var _hintsShown = /* @__PURE__ */ new Set();
 var _webFetches = /* @__PURE__ */ new Map();
 var _bashOutputs = /* @__PURE__ */ new Map();
+var _curlDownloads = /* @__PURE__ */ new Map();
 var _sessionId = null;
 function fileSize(absPath) {
   try {
@@ -10265,10 +10302,9 @@ function recordFileRead(filePath) {
     return;
   }
   _files.set(key, {
-    path: key,
+    ...prev,
     readCount: prev.readCount + 1,
     lastReadAt: now,
-    wasEdited: prev.wasEdited,
     sizeBytes: size
   });
 }
@@ -10309,11 +10345,51 @@ function recordBashOutput(commandHash2, outputId, _sizeBytes) {
 function getBashOutputId(commandHash2) {
   return _bashOutputs.get(commandHash2) ?? null;
 }
+function recordCurlDownload(url, savedPath) {
+  _curlDownloads.set(url, savedPath);
+}
+function getCurlDownloadPath(url) {
+  return _curlDownloads.get(url) ?? null;
+}
+function markFileTruncated(filePath) {
+  const key = normalizePath(filePath);
+  const prev = _files.get(key);
+  if (prev === void 0) {
+    _files.set(key, {
+      path: key,
+      readCount: 1,
+      lastReadAt: Date.now(),
+      wasEdited: false,
+      sizeBytes: fileSize(key),
+      wasTruncated: true
+    });
+    return;
+  }
+  _files.set(key, { ...prev, wasTruncated: true });
+}
+function wasFileTruncatedThisSession(filePath) {
+  const entry = _files.get(normalizePath(filePath));
+  return entry?.wasTruncated === true;
+}
+function generateSessionId() {
+  try {
+    return randomUUID();
+  } catch {
+    return randomBytes(16).toString("hex");
+  }
+}
+function getSessionId() {
+  if (_sessionId !== null) return _sessionId;
+  const fromEnv = process.env["CLAUDE_SESSION_ID"];
+  _sessionId = fromEnv !== void 0 && fromEnv !== "" ? fromEnv : generateSessionId();
+  return _sessionId;
+}
 registerReset(() => {
   _files = /* @__PURE__ */ new Map();
   _hintsShown = /* @__PURE__ */ new Set();
   _webFetches = /* @__PURE__ */ new Map();
   _bashOutputs = /* @__PURE__ */ new Map();
+  _curlDownloads = /* @__PURE__ */ new Map();
   _sessionId = null;
 });
 
@@ -10373,8 +10449,8 @@ var HOOK_EVENTS = [
 
 // src/hooks_read.ts
 init_define_import_meta_env();
-import * as fs4 from "node:fs";
-import * as path7 from "node:path";
+import * as fs5 from "node:fs";
+import * as path9 from "node:path";
 
 // src/hooks_common.ts
 init_define_import_meta_env();
@@ -10398,6 +10474,166 @@ function contextOutput(context) {
   return { hookType: "context", context };
 }
 
+// src/snapshots.ts
+init_define_import_meta_env();
+import * as fs4 from "node:fs";
+import * as path7 from "node:path";
+import * as crypto from "node:crypto";
+import * as os2 from "node:os";
+var MAX_SNAPSHOTS_PER_SESSION = 150;
+var MAX_SNAPSHOT_BYTES = 256 * 1024;
+var SNAPSHOT_TRUNCATE_BYTES = 50 * 1024;
+var KIND_READ = "read";
+var KIND_PREDICTIVE = "predictive";
+var VALID_KINDS = /* @__PURE__ */ new Set([KIND_READ, KIND_PREDICTIVE]);
+var _TRUNCATED_MARKER = Buffer.from("\n<snapshot truncated at ");
+var SESSION_DIR_RE = /[^a-zA-Z0-9_-]/g;
+function sessionDir(sessionId) {
+  if (!sessionId) return null;
+  const safe = sessionId.replace(SESSION_DIR_RE, "_").slice(0, 64) || "anon";
+  const base = path7.join(os2.homedir(), ".token-goat", "session_snapshots");
+  const candidate = path7.join(base, safe);
+  try {
+    const rel = path7.relative(base, candidate);
+    if (rel.startsWith("..")) return null;
+  } catch {
+    return null;
+  }
+  return candidate;
+}
+function pathKey(filePath) {
+  return crypto.createHash("sha256").update(filePath, "utf8").digest("hex").slice(0, 32);
+}
+function snapshot_path(sessionId, filePath) {
+  const d = sessionDir(sessionId);
+  if (!d) return null;
+  return path7.join(d, `${pathKey(filePath)}.bin`);
+}
+function kindSidecarPath(snapshotPath) {
+  return snapshotPath + ".kind";
+}
+function writeSnapshotKind(sidecarPath, kind) {
+  try {
+    const safeKind = VALID_KINDS.has(kind) ? kind : KIND_READ;
+    const dir = path7.dirname(sidecarPath);
+    if (!fs4.existsSync(dir)) {
+      fs4.mkdirSync(dir, { recursive: true });
+    }
+    fs4.writeFileSync(sidecarPath, safeKind, "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function evictOldest(d, maxCount) {
+  try {
+    const entries = [];
+    const files = fs4.readdirSync(d);
+    for (const file of files) {
+      const fullPath = path7.join(d, file);
+      if (!file.endsWith(".bin")) continue;
+      try {
+        const stat3 = fs4.statSync(fullPath);
+        entries.push([fullPath, stat3.mtimeMs]);
+      } catch {
+        continue;
+      }
+    }
+    if (entries.length <= maxCount) return 0;
+    entries.sort((a, b) => a[1] - b[1]);
+    let removed = 0;
+    const over = entries.length - maxCount;
+    for (const [p] of entries.slice(0, over)) {
+      try {
+        fs4.unlinkSync(p);
+        removed++;
+        try {
+          fs4.unlinkSync(kindSidecarPath(p));
+        } catch {
+        }
+      } catch {
+        continue;
+      }
+    }
+    return removed;
+  } catch {
+    return 0;
+  }
+}
+function store(sessionId, filePath, content, opts = {}) {
+  const kind = opts.kind ?? KIND_READ;
+  const origLen = content.length;
+  if (origLen > MAX_SNAPSHOT_BYTES) {
+    return null;
+  }
+  let stored = content;
+  if (origLen > SNAPSHOT_TRUNCATE_BYTES) {
+    const marker = Buffer.from(`
+<snapshot truncated at ${origLen} bytes>
+`);
+    stored = Buffer.concat([content.slice(0, SNAPSHOT_TRUNCATE_BYTES), marker]);
+  }
+  const p = snapshot_path(sessionId, filePath);
+  if (!p) return null;
+  const sha = crypto.createHash("sha256").update(stored).digest("hex");
+  try {
+    if (fs4.existsSync(p)) {
+      try {
+        const existing = fs4.readFileSync(p);
+        if (Buffer.from(existing).equals(stored)) {
+          return {
+            path: p,
+            content_sha: sha,
+            size_bytes: stored.length
+          };
+        }
+      } catch {
+      }
+    }
+    const dir = path7.dirname(p);
+    if (!fs4.existsSync(dir)) {
+      fs4.mkdirSync(dir, { recursive: true });
+    }
+    evictOldest(dir, MAX_SNAPSHOTS_PER_SESSION - 1);
+    const tempPath = p + ".tmp";
+    fs4.writeFileSync(tempPath, stored);
+    fs4.renameSync(tempPath, p);
+    const sidecar = kindSidecarPath(p);
+    writeSnapshotKind(sidecar, kind);
+    return {
+      path: p,
+      content_sha: sha,
+      size_bytes: stored.length
+    };
+  } catch {
+    return null;
+  }
+}
+function load(sessionId, filePath, opts = {}) {
+  const p = snapshot_path(sessionId, filePath);
+  if (!p || !fs4.existsSync(p)) return null;
+  try {
+    const stat3 = fs4.statSync(p);
+    if (stat3.size > MAX_SNAPSHOT_BYTES) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
+  try {
+    const data = fs4.readFileSync(p);
+    if (opts.expected_sha) {
+      const actualSha = crypto.createHash("sha256").update(data).digest("hex");
+      if (actualSha.toLowerCase() !== opts.expected_sha.toLowerCase()) {
+        return null;
+      }
+    }
+    return data;
+  } catch {
+    return null;
+  }
+}
+
 // src/hints.ts
 init_define_import_meta_env();
 var HINT_PRIORITY_MEDIUM = 3;
@@ -10430,11 +10666,11 @@ function buildPackageManifestHint(options) {
     return null;
   }
 }
-function _sanitizeHintPath(path15) {
-  if (typeof path15 !== "string") {
+function _sanitizeHintPath(path17) {
+  if (typeof path17 !== "string") {
     return "???";
   }
-  return path15.replace(/[\x00]/g, "").slice(0, 200);
+  return path17.replace(/[\x00]/g, "").slice(0, 200);
 }
 
 // src/hints/lang_patterns.ts
@@ -10567,6 +10803,10 @@ var BUILD_COMMAND_PATTERNS = [
   // Turbo
   /^\s*turbo\s+(build|dev)\b/i
 ];
+var LOCK_FILE_COUNT = LOCK_FILE_NAMES.size;
+var MANIFEST_FILE_COUNT = MANIFEST_FILE_NAMES.size + MANIFEST_EXTENSIONS.size + MANIFEST_BASENAME_PATTERNS.length;
+var BUILD_DIR_COUNT = BUILD_DIR_NAMES.size;
+var GENERATED_EXT_COUNT = ALWAYS_GENERATED_EXTS.size + CONDITIONALLY_GENERATED_EXTS.size;
 function isLockFile(basename7) {
   return LOCK_FILE_NAMES.has(basename7.toLowerCase());
 }
@@ -10870,7 +11110,7 @@ function dispatchFileTypeHandler(filePath, content, contentLengthHint) {
 
 // src/stats.ts
 init_define_import_meta_env();
-import * as path6 from "node:path";
+import * as path8 from "node:path";
 
 // src/render/stats_renderer.ts
 init_define_import_meta_env();
@@ -11650,7 +11890,7 @@ CREATE INDEX IF NOT EXISTS idx_stats_kind ON stats(kind);
 var _globalSchemaApplied = /* @__PURE__ */ new Set();
 registerReset(() => _globalSchemaApplied.clear());
 function getGlobalDb() {
-  const dbPath = path6.join(dataDir(), "global.db");
+  const dbPath = path8.join(dataDir(), "global.db");
   const db = getDb(dbPath);
   if (!_globalSchemaApplied.has(dbPath)) {
     db.exec(GLOBAL_SCHEMA_SQL);
@@ -11684,7 +11924,9 @@ function summarize(windowDays = 30, testDb) {
     const bytesSaved = row.bytes_saved ?? 0;
     const tokensSaved = row.tokens_saved ?? 0;
     const kind = row.kind;
-    const ts = row.ts;
+    const tsRaw = row.ts;
+    if (tsRaw === void 0) continue;
+    const ts = tsRaw;
     totalEvents += 1;
     totalBytes += bytesSaved;
     totalTokens += tokensSaved;
@@ -11845,22 +12087,61 @@ function isTsConfigFile(basename7) {
   return /^tsconfig(\..+)?\.json$/i.test(lower) || lower === "jsconfig.json";
 }
 var LARGE_FILE_BYTES = 100 * 1024;
-function isNodeModulesPath(path15) {
-  const isWindows = process.platform === "win32";
-  const check = isWindows ? path15.toLowerCase() : path15;
+var REREAD_DENY_BYTES = 50 * 1024;
+var LARGE_FILE_DENY_BYTES = 500 * 1024;
+function isNodeModulesPath(p) {
+  const check = isWindows() ? p.toLowerCase() : p;
   return check.includes("/node_modules/") || check.includes("\\node_modules\\");
 }
 function _isDocFile(filePath) {
   const lower = filePath.toLowerCase();
   return lower.endsWith(".md") || lower.endsWith(".mdx") || lower.endsWith(".markdown") || lower.endsWith(".rst");
 }
+function isSessionArtifactFile(filePath) {
+  if (/[/\\]tasks[/\\][a-z0-9]+\.output$/i.test(filePath)) return true;
+  if (/[/\\]tool-results[/\\][a-z0-9]+\.txt$/i.test(filePath)) return true;
+  return false;
+}
 function statSize(absPath) {
   try {
-    return fs4.statSync(absPath).size;
+    return fs5.statSync(absPath).size;
   } catch {
     return null;
   }
 }
+function buildLineDiff(oldContent, newContent, label) {
+  const oldLines = oldContent.split("\n");
+  const newLines = newContent.split("\n");
+  let prefix = 0;
+  while (prefix < oldLines.length && prefix < newLines.length && oldLines[prefix] === newLines[prefix]) {
+    prefix++;
+  }
+  let oldSuffix = oldLines.length;
+  let newSuffix = newLines.length;
+  while (oldSuffix > prefix && newSuffix > prefix && oldLines[oldSuffix - 1] === newLines[newSuffix - 1]) {
+    oldSuffix--;
+    newSuffix--;
+  }
+  if (prefix === oldLines.length && prefix === newLines.length) return "";
+  const changedOld = oldLines.slice(prefix, oldSuffix);
+  const changedNew = newLines.slice(prefix, newSuffix);
+  const MAX_LINES = 50;
+  const out2 = [
+    `--- ${label} (prev)`,
+    `+++ ${label} (current)`,
+    `@@ -${prefix + 1},${changedOld.length} +${prefix + 1},${changedNew.length} @@`
+  ];
+  const removedLines = changedOld.map((l) => `-${l}`);
+  const addedLines = changedNew.map((l) => `+${l}`);
+  const allChanges = [...removedLines, ...addedLines];
+  if (allChanges.length <= MAX_LINES) {
+    out2.push(...allChanges);
+  } else {
+    out2.push(...allChanges.slice(0, MAX_LINES));
+    out2.push(`... (${allChanges.length - MAX_LINES} more changed lines)`);
+  }
+  return out2.join("\n");
+}
 function preReadHandler(event) {
   const filePath = getFilePath(event);
   if (filePath === void 0) return passOutput();
@@ -11870,7 +12151,7 @@ function preReadHandler(event) {
       "node_modules is typically noise; use npm ls, npm outdated, or npm audit instead for dependency info. To force access, use: token-goat read node_modules/package/file.js::symbol-name or token-goat section node_modules/package/file.js::heading"
     );
   }
-  const basename7 = path7.basename(normalized);
+  const basename7 = path9.basename(normalized);
   if (isLockFile(basename7)) {
     return denyOutput(
       'Lock files are rarely useful to read in full. Use `token-goat section "' + normalized + '::<section>"` to extract a specific dependency, or read the relevant manifest instead.'
@@ -11909,7 +12190,7 @@ function preReadHandler(event) {
     try {
       const sz = statSize(normalized);
       if (sz !== null && sz >= MARKDOWN_SIZE_THRESHOLD) {
-        fileContent = fs4.readFileSync(normalized, "utf8");
+        fileContent = fs5.readFileSync(normalized, "utf8");
       }
     } catch {
     }
@@ -11925,14 +12206,152 @@ function preReadHandler(event) {
       }
     }
   }
+  const isMemoryMd = normalized.toLowerCase().includes("memory/memory.md") || /[/\\]memory[/\\][^/\\]+\.md$/i.test(normalized);
+  if (isMemoryMd && wasFileReadThisSession(normalized)) {
+    recordFileRead(normalized);
+    recordStat("session_hint", 0, 0);
+    const isMainMemory = basename7.toLowerCase() === "memory.md";
+    return denyOutput(
+      isMainMemory ? "MEMORY.md was read this session. Its content is in the compact manifest as 'session memory'." : normalized + ' was already read this session. Memory files rarely change mid-session. Use `token-goat section "' + normalized + '::SectionHeading"` to extract one section.'
+    );
+  }
+  if (/^\.improve-state-.*\.json$/.test(basename7) && wasFileReadThisSession(normalized)) {
+    recordFileRead(normalized);
+    recordStat("session_hint", 0, 0);
+    return denyOutput(
+      "Orchestrator state already read this session. Use `token-goat bash-output <id>` or recall it from the compact manifest."
+    );
+  }
+  if (/^\.env(\.\w+)?$/.test(basename7) && wasFileReadThisSession(normalized)) {
+    recordFileRead(normalized);
+    recordStat("session_hint", 0, 0);
+    return denyOutput(
+      normalized + " was already read this session. Environment files rarely change mid-session. Use `token-goat config-get " + normalized + " KEY_NAME` to extract a specific variable."
+    );
+  }
+  if (isSessionArtifactFile(normalized)) {
+    if (wasFileReadThisSession(normalized)) {
+      if (wasFileTruncatedThisSession(normalized)) {
+        recordFileRead(normalized);
+        recordStat("session_hint", 0, 0);
+        return denyOutput(
+          "File was truncated on last read. Use `token-goat bash-output --tail N` or `--grep PATTERN` to read a slice."
+        );
+      }
+      const artifactSessionId = getSessionId();
+      const oldArtifactSnap = load(artifactSessionId, normalized);
+      if (oldArtifactSnap !== null) {
+        try {
+          const sz = statSize(normalized);
+          if (sz !== null && sz <= 256 * 1024) {
+            const currentContent = fs5.readFileSync(normalized, "utf8");
+            const TRUNC_MARKER = "\n<snapshot truncated at ";
+            const oldRaw = oldArtifactSnap.toString("utf8");
+            const truncIdx = oldRaw.indexOf(TRUNC_MARKER);
+            const oldContent = truncIdx >= 0 ? oldRaw.slice(0, truncIdx) : oldRaw;
+            if (oldContent === currentContent) {
+              recordFileRead(normalized);
+              recordStat("session_hint", 0, 0);
+              return denyOutput(
+                basename7 + " is unchanged since last read. Use `token-goat bash-output --tail N` or `--grep PATTERN` to read a slice."
+              );
+            }
+            const diff = buildLineDiff(oldContent, currentContent, basename7);
+            if (diff !== "") {
+              recordFileRead(normalized);
+              const savedBytes = Math.max(0, currentContent.length - diff.length);
+              recordStat("session_hint", savedBytes, Math.round(savedBytes / 4));
+              return denyOutput(
+                "Content changed since last read of " + basename7 + ". Here is what changed:\n\n```diff\n" + diff + "\n```\n\nUse `token-goat bash-output --tail N` or `--grep PATTERN` to read a slice."
+              );
+            }
+          }
+        } catch {
+        }
+      }
+      recordFileRead(normalized);
+      recordStat("session_hint", 0, 0);
+      return denyOutput(
+        normalized + " was already read this session. Use `token-goat bash-output --tail N` or `--grep PATTERN` to read a slice."
+      );
+    }
+    if (/[/\\]tasks[/\\][a-z0-9]+\.output$/i.test(normalized)) {
+      recordFileRead(normalized);
+      return contextOutput(
+        "Session transcript: use `token-goat bash-output --tail N` or `--grep PATTERN` to read a slice instead of the full file."
+      );
+    }
+  }
+  if (/\.(md|mdx|rst|txt)$/i.test(basename7) && wasFileReadThisSession(normalized)) {
+    if (wasFileTruncatedThisSession(normalized)) {
+      recordFileRead(normalized);
+      recordStat("session_hint", 0, 0);
+      return denyOutput(
+        'File was truncated on last read (>33K tokens). Use `token-goat skeleton "' + normalized + '"` for structure or `token-goat read "' + normalized + '::SymbolName"` for one function.'
+      );
+    }
+    const sessionId = getSessionId();
+    const oldSnap = load(sessionId, normalized);
+    if (oldSnap !== null) {
+      try {
+        const sz = statSize(normalized);
+        if (sz !== null && sz <= 256 * 1024) {
+          const currentContent = fs5.readFileSync(normalized, "utf8");
+          const TRUNC_MARKER = "\n<snapshot truncated at ";
+          const oldRaw = oldSnap.toString("utf8");
+          const truncIdx = oldRaw.indexOf(TRUNC_MARKER);
+          const oldContent = truncIdx >= 0 ? oldRaw.slice(0, truncIdx) : oldRaw;
+          if (oldContent === currentContent) {
+            recordFileRead(normalized);
+            recordStat("session_hint", 0, 0);
+            return denyOutput(
+              basename7 + ' is unchanged since last read. Use `token-goat section "' + normalized + '::HeadingName"` to extract a part.'
+            );
+          }
+          const diff = buildLineDiff(oldContent, currentContent, basename7);
+          if (diff !== "") {
+            recordFileRead(normalized);
+            const savedBytes = Math.max(0, currentContent.length - diff.length);
+            recordStat("session_hint", savedBytes, Math.round(savedBytes / 4));
+            return denyOutput(
+              "Content changed since last read of " + basename7 + ". Here is what changed:\n\n```diff\n" + diff + '\n```\n\nUse `token-goat section "' + normalized + '::HeadingName"` to read a specific section.'
+            );
+          }
+        }
+      } catch {
+      }
+    }
+  }
   if (wasFileReadThisSession(normalized)) {
     const entry = getSessionFiles().get(normalized);
     const reads = entry?.readCount ?? 1;
     const plural = reads === 1 ? "read" : "reads";
     recordFileRead(normalized);
-    const hint = _isDocFile(normalized) ? 'Use `token-goat section "' + normalized + '::SectionName"` to read one section.' : "Use token-goat read/section/symbol to re-read surgically.";
     const rereadBytes = statSize(normalized) ?? 0;
     recordStat("session_hint", rereadBytes, Math.round(rereadBytes / 4));
+    if (wasFileTruncatedThisSession(normalized)) {
+      return denyOutput(
+        'File was truncated on last read (>33K tokens). Use `token-goat skeleton "' + normalized + '"` for structure or `token-goat read "' + normalized + '::SymbolName"` for one function.'
+      );
+    }
+    if (/\.(md|mdx)$/i.test(basename7)) {
+      return denyOutput(
+        'Markdown file already read this session. Use `token-goat section "' + normalized + '::HeadingName"` to read one section.'
+      );
+    }
+    const isSourceExt = /\.(ts|tsx|js|jsx|py|go|rs|java|rb|php|swift|kt|cpp|c|h)$/i.test(basename7);
+    if (isSourceExt && reads >= 2) {
+      recordStat("read_count_deny", rereadBytes, Math.round(rereadBytes / 4));
+      return denyOutput(
+        "Read this file " + reads + ' times already \u2014 use `token-goat read "' + normalized + '::Symbol"`, `token-goat skeleton ' + normalized + "`, or `token-goat outline " + normalized + "` to pull just the part you need."
+      );
+    }
+    const hint = _isDocFile(normalized) ? 'Use `token-goat section "' + normalized + '::SectionName"` to read one section.' : "Use token-goat read/section/symbol to re-read surgically.";
+    if (rereadBytes >= REREAD_DENY_BYTES || reads >= 2) {
+      return denyOutput(
+        normalized + " was already read this session (" + reads + " " + plural + "). " + hint
+      );
+    }
     return contextOutput(
       "Note: " + normalized + " was already read this session (" + reads + " " + plural + "). " + hint
     );
@@ -11943,11 +12362,16 @@ function preReadHandler(event) {
     recordFileRead(normalized);
     const hint = _isDocFile(normalized) ? 'Use `token-goat section "' + normalized + '::SectionName"` to read one section.' : "Consider token-goat skeleton or token-goat section.";
     recordStat("session_hint", size, Math.round(size / 4));
+    if (size >= LARGE_FILE_DENY_BYTES) {
+      return denyOutput(
+        normalized + " is very large (" + kb + "KB). " + hint + " Use Read with offset/limit to sample specific sections."
+      );
+    }
     return contextOutput(
-      "Note: " + normalized + " is large (" + kb + "kb). " + hint
+      "Note: " + normalized + " is large (" + kb + "KB). " + hint
     );
   }
-  const fileTypeExt = path7.extname(normalized).slice(1).toLowerCase();
+  const fileTypeExt = path9.extname(normalized).slice(1).toLowerCase();
   const binaryExts = /* @__PURE__ */ new Set(["pdf", "docx", "xlsx", "pptx", "odt", "ods", "ott", "odp"]);
   const textTypeExts = /* @__PURE__ */ new Set(["html", "htm", "xhtml", "txt", "log", "out", "err", "trace", "csv", "tsv"]);
   const fileStatSize = size ?? statSize(normalized) ?? 0;
@@ -11956,7 +12380,7 @@ function preReadHandler(event) {
     let ftContent = "";
     if (!binaryExts.has(fileTypeExt)) {
       try {
-        ftContent = fs4.readFileSync(normalized, "utf8");
+        ftContent = fs5.readFileSync(normalized, "utf8");
       } catch {
       }
     }
@@ -11971,29 +12395,67 @@ function preReadHandler(event) {
 }
 registerHook("pre_tool_use", preReadHandler, { toolName: "Read" });
 registerHook("pre_tool_use", preReadHandler, { toolName: "Grep" });
+function extractReadOutput(raw) {
+  const resp = raw["tool_response"];
+  if (typeof resp === "string") return resp;
+  if (resp !== null && typeof resp === "object") {
+    const r = resp;
+    for (const key of ["output", "content", "text", "body"]) {
+      if (typeof r[key] === "string") return r[key];
+    }
+  }
+  return "";
+}
+function postReadHandler(event) {
+  const filePath = getFilePath(event);
+  if (filePath === void 0) return passOutput();
+  const normalized = normalizePath(filePath);
+  const respText = extractReadOutput(event.raw);
+  if (respText.includes("[Truncated:") || respText.includes("Truncated: PARTIAL view")) {
+    markFileTruncated(normalized);
+  }
+  const postBasename = path9.basename(normalized);
+  if (/\.(md|mdx|rst|txt)$/i.test(postBasename) || isSessionArtifactFile(normalized)) {
+    try {
+      const sz = statSize(normalized);
+      if (sz !== null && sz <= 256 * 1024) {
+        const content = fs5.readFileSync(normalized);
+        store(getSessionId(), normalized, content);
+      }
+    } catch {
+    }
+  }
+  return passOutput();
+}
+registerHook("post_tool_use", postReadHandler, { toolName: "Read" });
 
 // src/hooks_edit.ts
 init_define_import_meta_env();
-import * as path9 from "node:path";
+import * as path11 from "node:path";
 
 // src/hooks_index.ts
 init_define_import_meta_env();
-import * as fs5 from "node:fs";
-import * as path8 from "node:path";
+import * as fs6 from "node:fs";
+import * as path10 from "node:path";
 function dirtyQueuePath() {
-  return path8.join(dataDir(), "queue", "dirty.txt");
+  return path10.join(dataDir(), "queue", "dirty.txt");
 }
 function appendDirtyPath(normalizedPath) {
   const queuePath = dirtyQueuePath();
-  fs5.mkdirSync(path8.dirname(queuePath), { recursive: true });
-  fs5.appendFileSync(queuePath, `${normalizedPath}
+  const dir = path10.dirname(queuePath);
+  try {
+    fs6.mkdirSync(dir, { recursive: true });
+  } catch (e) {
+    if (e.code !== "EEXIST" || !fs6.existsSync(dir)) throw e;
+  }
+  fs6.appendFileSync(queuePath, `${normalizedPath}
 `);
 }
 function getDirtyPaths() {
   const queuePath = dirtyQueuePath();
   let raw;
   try {
-    raw = fs5.readFileSync(queuePath, "utf8");
+    raw = fs6.readFileSync(queuePath, "utf8");
   } catch {
     return [];
   }
@@ -12009,21 +12471,21 @@ function getDirtyPaths() {
 }
 function clearDirtyQueue() {
   try {
-    fs5.rmSync(dirtyQueuePath(), { force: true });
+    fs6.rmSync(dirtyQueuePath(), { force: true });
   } catch {
   }
 }
 function preCompactIndexHandler(_event) {
   const paths = getDirtyPaths();
   if (paths.length > 0) {
-    const sidecar = path8.join(dataDir(), "queue", "pending.txt");
+    const sidecar = path10.join(dataDir(), "queue", "pending.txt");
     try {
-      fs5.mkdirSync(path8.dirname(sidecar), { recursive: true });
+      fs6.mkdirSync(path10.dirname(sidecar), { recursive: true });
       atomicWriteBytes(sidecar, Buffer.from(`${paths.join("\n")}
 `, "utf8"));
+      clearDirtyQueue();
     } catch {
     }
-    clearDirtyQueue();
   }
   return passOutput();
 }
@@ -12036,10 +12498,11 @@ function postEditHandler(event) {
   const normalized = normalizePath(filePath);
   recordFileEdit(normalized);
   appendDirtyPath(normalized);
-  const editedBasename = path9.basename(normalized);
+  const editedBasename = path11.basename(normalized);
   if (/\.(md|mdx|markdown|rst)$/i.test(editedBasename)) {
+    const escapedPath = normalized.replace(/`/g, "\\`");
     return contextOutput(
-      editedBasename + ' was edited. Use `token-goat section "' + normalized + '::HeadingName"` to re-read a specific section rather than the full file.'
+      editedBasename + ' was edited. Use `token-goat section "' + escapedPath + '::HeadingName"` to re-read a specific section rather than the full file.'
     );
   }
   return passOutput();
@@ -12317,17 +12780,20 @@ init_define_import_meta_env();
 
 // src/fingerprint.ts
 init_define_import_meta_env();
-import { createHash } from "node:crypto";
-import * as fs6 from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import * as fs7 from "node:fs";
 function fingerprintContent(content) {
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   hash.update(typeof content === "string" ? Buffer.from(content, "utf-8") : content);
   return hash.digest("hex");
 }
+function shortFingerprint(content) {
+  return fingerprintContent(content).slice(0, 16);
+}
 function fingerprintFile(filePath) {
   let data;
   try {
-    data = fs6.readFileSync(filePath);
+    data = fs7.readFileSync(filePath);
   } catch {
     return null;
   }
@@ -12336,15 +12802,24 @@ function fingerprintFile(filePath) {
 
 // src/bash_output_cache.ts
 init_define_import_meta_env();
-import * as fs7 from "fs/promises";
+import * as fs8 from "fs/promises";
 import { resolve as resolve3 } from "path";
 var _byId = /* @__PURE__ */ new Map();
 var _globsByKey = /* @__PURE__ */ new Map();
 var _grepsByKey = /* @__PURE__ */ new Map();
-var GIT_MUTABLE_RE = /^\s*git\s+(diff|status)\b/i;
-var LS_CMD_RE = /^\s*(?:ls|eza|exa|dir|Get-ChildItem|gci)\b/i;
-var DEP_LIST_RE = /^\s*(?:npm\s+(?:-\S+\s+)*(?:ls|list)\b|pip\s+(?:-\S+\s+)*(?:list|freeze)\b|uv\s+pip\s+(?:-\S+\s+)*(?:list|freeze)\b|pnpm\s+(?:-\S+\s+)*(?:list|ls)\b|yarn\s+(?:-\S+\s+)*(?:list)\b|cargo\s+(?:-\S+\s+)*tree\b|bundle\s+(?:-\S+\s+)*(?:list|show)\b|composer\s+(?:-\S+\s+)*show\b)/i;
-var NPM_INSTALL_RE = /^\s*npm\s+(?:-\S+\s+)*(?:install|ci)\b/i;
+var COMMAND_PATTERNS = {
+  gitMutable: /^\s*git\s+(diff|status)\b/i,
+  gitImmutable: /^\s*git\s+show\s+[0-9a-f]{40}\b/i,
+  gitDiffUnscoped: /^\s*git\s+diff\b/i,
+  gitDiffScoped: /\s--\s+\S/,
+  dirListing: /^\s*(?:ls|eza|exa|dir|Get-ChildItem|gci)\b/i,
+  depList: /^\s*(?:npm\s+(?:-\S+\s+)*(?:ls|list)\b|pip\s+(?:-\S+\s+)*(?:list|freeze)\b|uv\s+pip\s+(?:-\S+\s+)*(?:list|freeze)\b|pnpm\s+(?:-\S+\s+)*(?:list|ls)\b|yarn\s+(?:-\S+\s+)*(?:list)\b|cargo\s+(?:-\S+\s+)*tree\b|bundle\s+(?:-\S+\s+)*(?:list|show)\b|composer\s+(?:-\S+\s+)*show\b)/i,
+  npmInstall: /^\s*npm\s+(?:-\S+\s+)*(?:install|ci)\b/i,
+  npmAudit: /^\s*npm\s+(?:-\S+\s+)*audit\b(?!.*(?:--fix|fix)\b)/i,
+  npmOutdated: /^\s*npm\s+(?:-\S+\s+)*outdated\b/i,
+  envProbe: /^\s*(?:node\s+(?:-v|--version)|npm\s+(?:-v|--version)|python3?\s+(?:(?:-V)\b|--?version)|git\s+--version|uv\s+--version|go\s+version|rustc\s+--version|cargo\s+--version|java\s+--version|ruby\s+--version|gem\s+--version|php\s+--version|which\b|where\b)/i,
+  npx: /^\s*npx\s+(?:--?yes\s+)?(?!.*\b(?:install|add|remove|uninstall|i|rm|update|upgrade|set|get|publish|link|ci|audit|shrinkwrap|dedupe|prune|rebuild)\b)/i
+};
 var DEP_LOCKFILES = {
   npm: ["package-lock.json", "yarn.lock"],
   pip: ["requirements.txt"],
@@ -12355,18 +12830,14 @@ var DEP_LOCKFILES = {
   bundle: ["Gemfile.lock"],
   composer: ["composer.lock"]
 };
-function isGitMutableCommand(cmd) {
-  return GIT_MUTABLE_RE.test(cmd);
-}
-function isDirListingCommand(cmd) {
-  return LS_CMD_RE.test(cmd);
-}
-function isDepListCommand(cmd) {
-  return DEP_LIST_RE.test(cmd);
-}
-function isNpmInstallCommand(cmd) {
-  return NPM_INSTALL_RE.test(cmd);
-}
+function isCommandOfType(cmd, type) {
+  const pattern = COMMAND_PATTERNS[type];
+  return pattern?.test(cmd) ?? false;
+}
+var isGitMutableCommand = (cmd) => isCommandOfType(cmd, "gitMutable");
+var isDirListingCommand = (cmd) => isCommandOfType(cmd, "dirListing");
+var isDepListCommand = (cmd) => isCommandOfType(cmd, "depList");
+var isNpmInstallCommand = (cmd) => isCommandOfType(cmd, "npmInstall");
 async function gitStateFingerprint(cwd) {
   try {
     const headResult = runGit(["rev-parse", "HEAD"], { cwd });
@@ -12374,21 +12845,21 @@ async function gitStateFingerprint(cwd) {
     const headSha = headResult.stdout.trim();
     let indexMtime = "";
     try {
-      const stat3 = await fs7.stat(resolve3(cwd, ".git", "index"));
+      const stat3 = await fs8.stat(resolve3(cwd, ".git", "index"));
       indexMtime = stat3.mtimeMs.toString();
     } catch {
     }
     const key = `${headSha}\0${indexMtime}`;
-    return fingerprintContent(key).slice(0, 16);
+    return shortFingerprint(key);
   } catch {
     return null;
   }
 }
-async function dirStateFingerprint(path15) {
+async function dirStateFingerprint(path17) {
   try {
-    const stat3 = await fs7.stat(path15);
+    const stat3 = await fs8.stat(path17);
     if (!stat3.isDirectory()) return null;
-    return fingerprintContent(stat3.mtimeMs.toString()).slice(0, 16);
+    return shortFingerprint(stat3.mtimeMs.toString());
   } catch {
     return null;
   }
@@ -12402,8 +12873,8 @@ async function depLockfileFingerprint(cmd, cwd) {
   if (!candidates) return null;
   for (const lockfile of candidates) {
     try {
-      const content = await fs7.readFile(resolve3(cwd, lockfile));
-      return fingerprintContent(content).slice(0, 16);
+      const content = await fs8.readFile(resolve3(cwd, lockfile));
+      return shortFingerprint(content);
     } catch {
       continue;
     }
@@ -12451,7 +12922,7 @@ async function commandHash(command, cwd = null) {
     const fp = await depLockfileFingerprint(command, cwd);
     if (fp) key = `${key}\0npm-install:${fp}`;
   }
-  return fingerprintContent(key).slice(0, 16);
+  return shortFingerprint(key);
 }
 function extractLsTarget(cmd, cwd) {
   const tokens = cmd.trim().split(/\s+/);
@@ -12489,10 +12960,276 @@ function extractCommand(event) {
   const cmd = event.toolInput["command"];
   return typeof cmd === "string" && cmd.trim() !== "" ? cmd.trim() : void 0;
 }
+function isTempPath(fp) {
+  const norm = fp.replace(/\\/g, "/");
+  return /^\/tmp\//i.test(norm) || /\/var\/folders\//i.test(norm) || /AppData\/Local\/Temp\//i.test(norm) || norm.startsWith("/c/Users/") && norm.includes("/AppData/Local/Temp/");
+}
+function isOrchestratorStateFile(filePath) {
+  const basename7 = (filePath.includes("/") ? filePath.split("/").at(-1) : filePath.split("\\").at(-1)) ?? filePath;
+  return /^\.improve-state-/.test(basename7);
+}
 function extractCatSourceFile(cmd) {
-  const m = /^cat\s+(\S+\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj))\s*$/.exec(cmd);
+  const m = /^cat\s+(\S+\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less))\s*$/.exec(cmd);
   return m?.[1] ?? null;
 }
+function extractCatFile(cmd) {
+  const m = /^cat(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+))*\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+  if (!m) return null;
+  const filePath = m[1] ?? m[2] ?? m[3];
+  if (filePath === void 0) return null;
+  if (isTempPath(filePath)) return null;
+  const basename7 = (filePath.includes("/") ? filePath.split("/").at(-1) : filePath.split("\\").at(-1)) ?? filePath;
+  const isEnvFile = /^\.env(\.\w+)?$/i.test(basename7);
+  const hasKnownExt = /\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties|sql|env)$/i.test(filePath);
+  if (!hasKnownExt && !isEnvFile) return null;
+  const isSql = /\.sql$/i.test(filePath);
+  const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
+  const isEnv = isEnvFile || /\.env$/i.test(filePath);
+  const isConfig = /\.(?:json|yaml|yml|toml|conf|cfg|ini|properties)$/i.test(filePath);
+  return { filePath, isDoc, isEnv, isConfig, isSql };
+}
+function extractRgSymbolSearch(cmd) {
+  if (!/^(?:rg|grep)\s+/.test(cmd)) return null;
+  if (!/-n\b/.test(cmd)) return null;
+  const patternMatch = /["']([^"']+)["']/.exec(cmd);
+  const pattern = patternMatch?.[1];
+  if (!pattern) return null;
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(\|[A-Za-z_][A-Za-z0-9_]*)*$/.test(pattern)) return null;
+  const fileMatch = /(?:^|\s)(?:"([^"]+\.(?:ts|tsx|js|jsx|py|go|rs|java|rb|php|swift|kt|cpp|cc|cxx|c|h))"|'([^']+\.(?:ts|tsx|js|jsx|py|go|rs|java|rb|php|swift|kt|cpp|cc|cxx|c|h))'|([^\s"'|<>]+\.(?:ts|tsx|js|jsx|py|go|rs|java|rb|php|swift|kt|cpp|cc|cxx|c|h)))(?:\s|$|\|)/i.exec(cmd);
+  if (!fileMatch) return null;
+  const filePath = fileMatch[1] ?? fileMatch[2] ?? fileMatch[3];
+  if (!filePath) return null;
+  if (isTempPath(filePath)) return null;
+  if (/-[a-zA-Z]*r[a-zA-Z]*\b/.test(cmd) || /--recursive\b/.test(cmd)) return null;
+  return { filePath, identifier: pattern };
+}
+function extractCatJsonPipe(cmd) {
+  const m = /^cat\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*\|\s*jq\b/.exec(cmd);
+  if (!m) return null;
+  const filePath = m[1] ?? m[2] ?? m[3];
+  if (!filePath) return null;
+  if (isTempPath(filePath)) return null;
+  if (!/\.(?:json|yaml|yml|toml)$/i.test(filePath)) return null;
+  return { filePath };
+}
+function extractWslCatFile(cmd) {
+  const wslMatch = /^wsl(?:\s+-d\s+\S+)?\s+bash\s+-c\s+"cat(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+))*\s+\/mnt\/([a-z])\/([^"]*)"/.exec(cmd);
+  if (!wslMatch) return null;
+  const drive = wslMatch[1]?.toUpperCase();
+  const pathRest = wslMatch[2];
+  if (!drive || !pathRest) return null;
+  const filePath = drive + ":/" + pathRest;
+  if (isTempPath(filePath)) return null;
+  const basename7 = (filePath.includes("/") ? filePath.split("/").at(-1) : filePath.split("\\").at(-1)) ?? filePath;
+  const isEnvFile = /^\.env(\.\w+)?$/i.test(basename7);
+  const hasKnownExt = /\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties|sql|env)$/i.test(filePath);
+  if (!hasKnownExt && !isEnvFile) return null;
+  const isSql = /\.sql$/i.test(filePath);
+  const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
+  const isEnv = isEnvFile || /\.env$/i.test(filePath);
+  const isConfig = /\.(?:json|yaml|yml|toml|conf|cfg|ini|properties)$/i.test(filePath);
+  return { filePath, isDoc, isEnv, isConfig, isSql };
+}
+function extractPythonFileRead(cmd) {
+  if (!/python3?/.test(cmd)) return null;
+  if (/open\s*\([^)]*,\s*['"][wa]/i.test(cmd) || /\.write\s*\(/.test(cmd)) return null;
+  const OPEN_EXT = /\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties)/i;
+  const heredocMatch = /^python3?\s+-\s+<<\s*'?(\w+)'?\s*\n([\s\S]*?)\n\1\s*$/.exec(cmd);
+  if (heredocMatch) {
+    const body = heredocMatch[2] ?? "";
+    if (/open\s*\([^)]*,\s*['"][wa]/i.test(body) || /\.write\s*\(/.test(body) || /\.writelines\s*\(/.test(body)) return null;
+    const heredocOpen = /open\s*\(\s*r?['"]([^'"]+\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties))['"]/i.exec(body);
+    if (heredocOpen?.[1]) {
+      const filePath = heredocOpen[1];
+      if (isOrchestratorStateFile(filePath)) return null;
+      const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
+      return { filePath, isDoc };
+    }
+    if (/open\s*\(/.test(body)) {
+      const literal = /['"]([^'"]+\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties))['"]/i.exec(body);
+      if (literal?.[1]) {
+        const filePath = literal[1];
+        if (isOrchestratorStateFile(filePath)) return null;
+        if (OPEN_EXT.test(filePath)) {
+          const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
+          return { filePath, isDoc };
+        }
+      }
+    }
+    return null;
+  }
+  const direct = /open\(['"]([^'"]+\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties))['"]/i.exec(cmd);
+  if (direct) {
+    const filePath = direct[1] ?? "";
+    if (!filePath) return null;
+    if (isOrchestratorStateFile(filePath)) return null;
+    const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
+    return { filePath, isDoc };
+  }
+  if (/open\s*\(/.test(cmd)) {
+    const literal = /['"]([^'"]+\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties))['"]/i.exec(cmd);
+    if (literal) {
+      const filePath = literal[1] ?? "";
+      if (filePath) {
+        if (isOrchestratorStateFile(filePath)) return null;
+        if (OPEN_EXT.test(filePath)) {
+          const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
+          return { filePath, isDoc };
+        }
+      }
+    }
+  }
+  return null;
+}
+function extractHeadFile(cmd) {
+  const m = /^head(?:\s+-n\s+(\d+)|\s+-(\d+))?\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+  if (!m) return null;
+  const n = parseInt(m[1] ?? m[2] ?? "0", 10);
+  if (n < 10) return null;
+  const filePath = m[3] ?? m[4] ?? m[5];
+  if (filePath === void 0) return null;
+  if (isTempPath(filePath)) return null;
+  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh)$/i.test(filePath)) return null;
+  const isDoc = /\.(?:md|mdx|rst|txt|sql)$/i.test(filePath);
+  const isConfig = /\.(?:json|yaml|yml|toml|conf|cfg|ini|properties)$/i.test(filePath);
+  return { filePath, isDoc, isConfig };
+}
+function extractNodeFileRead(cmd) {
+  if (!/^node\s+-e/.test(cmd)) return null;
+  const readSync = /readFileSync\(['"]([^'"]+\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties|sql))['"]/i.exec(cmd);
+  if (readSync?.[1]) {
+    const filePath = readSync[1];
+    if (isOrchestratorStateFile(filePath)) return null;
+    if (isTempPath(filePath)) return null;
+    const isDoc = /\.(?:md|mdx|rst|txt|sql)$/i.test(filePath);
+    const isConfig = /\.(?:json|yaml|yml|toml|conf|cfg|ini|properties)$/i.test(filePath);
+    return { filePath, isDoc, isConfig };
+  }
+  const requireM = /require\(['"]([^'"]+\.json)['"]\)/i.exec(cmd);
+  if (requireM?.[1]) {
+    const filePath = requireM[1];
+    if (filePath.includes("node_modules")) return null;
+    if (isOrchestratorStateFile(filePath)) return null;
+    if (isTempPath(filePath)) return null;
+    return { filePath, isDoc: false, isConfig: true };
+  }
+  return null;
+}
+function extractTailFile(cmd) {
+  if (/-f\b/.test(cmd)) return null;
+  if (/-c\b/.test(cmd)) return null;
+  if (/-n\s*\+/.test(cmd)) return null;
+  const m = /^tail(?:\s+-n\s+(\d+)|\s+-(\d+))?\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+  if (!m) return null;
+  const n = parseInt(m[1] ?? m[2] ?? "0", 10);
+  if (n <= 10) return null;
+  const filePath = m[3] ?? m[4] ?? m[5];
+  if (!filePath) return null;
+  if (isTempPath(filePath)) return null;
+  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh)$/i.test(filePath)) return null;
+  const isDoc = /\.(?:md|mdx|rst|txt|sql)$/i.test(filePath);
+  return { filePath, isDoc };
+}
+function extractTasksOutput(cmd) {
+  const taskOutputRe = /[/\\]tasks[/\\]([a-z0-9]+)\.output$/;
+  const catM = /^cat(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+))*\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+  if (catM) {
+    const fp = catM[1] ?? catM[2] ?? catM[3];
+    if (fp) {
+      const m = taskOutputRe.exec(fp);
+      if (m) return { id: m[1] };
+    }
+  }
+  if (!/-f\b/.test(cmd) && !/-n\s*\+/.test(cmd)) {
+    const tailM = /^tail(?:\s+-n\s+(\d+)|\s+-(\d+))?\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+    if (tailM) {
+      const fp = tailM[3] ?? tailM[4] ?? tailM[5];
+      if (fp) {
+        const m = taskOutputRe.exec(fp);
+        if (m) {
+          const nStr = tailM[1] ?? tailM[2];
+          const n = nStr !== void 0 ? parseInt(nStr, 10) : void 0;
+          return n !== void 0 ? { id: m[1], n } : { id: m[1] };
+        }
+      }
+    }
+    const byteTailM = /^tail\s+-c\s+\d+\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+    if (byteTailM) {
+      const fp = byteTailM[1] ?? byteTailM[2] ?? byteTailM[3];
+      if (fp) {
+        const m = taskOutputRe.exec(fp);
+        if (m) return { id: m[1] };
+      }
+    }
+  }
+  return null;
+}
+function extractSedLineRange(cmd) {
+  return /^sed\s+-n\s+['"]?\d+,\d+p['"]?/.test(cmd);
+}
+function extractDirectoryListing(cmd) {
+  return /^eza\s+.*--long\s+\S+/.test(cmd) || /^eza\s+.*--tree/.test(cmd) || /^tree(\s|$)/.test(cmd) || /^ls\s+.*-[a-zA-Z]*R/.test(cmd) || /^ls\s+(?:-[la]+\s+)?(\S+)\s*[|]\s*head/.test(cmd);
+}
+function extractFindCommand(cmd) {
+  if (!/^find\b/.test(cmd)) return null;
+  const isXargsGrepL = /[|]\s*xargs\s+(?:grep|rg)\s+.*-l\b/.test(cmd) || /[|]\s*xargs\s+grep\s+-l\b/.test(cmd);
+  const nameMatch = /-name\s+['"]([^'"]+)['"]/i.exec(cmd);
+  const extGlob = nameMatch ? nameMatch[1] ?? null : null;
+  return { extGlob, isXargsGrepL };
+}
+function extractMarkdownHeadingGrep(cmd) {
+  if (!/^(?:rg|grep)\s+/.test(cmd)) return null;
+  if (!/-n\b/.test(cmd)) return null;
+  const hasHeadingPattern = /["']?\^#{1,6}["']?/.test(cmd) || /["']?\^#\+["']?/.test(cmd) || /["']?\^#\\+["']?/.test(cmd);
+  if (!hasHeadingPattern) return null;
+  const fileMatch = /(?:^|\s)(?:"([^"]+\.(?:md|markdown))"|'([^']+\.(?:md|markdown))'|([^\s"'|<>]+\.(?:md|markdown)))\s*(?:\||$)/.exec(cmd);
+  if (!fileMatch) return null;
+  const filePath = fileMatch[1] ?? fileMatch[2] ?? fileMatch[3];
+  if (!filePath) return null;
+  return { filePath };
+}
+function extractRgStructuralSearch(cmd) {
+  if (!/^(?:rg|grep)\s+/.test(cmd)) return null;
+  const hasStructural = /["']?\^?(?:def\s|class\s|function\s|func\s|fn\s|pub fn\s|import\s|from\s)/.test(cmd) || /["']\^(?:def|class|function|func|import|from)["']/.test(cmd) || /\\bdef\\b|\\bclass\\b/.test(cmd) || /["']?\^[ \t]+def\b/.test(cmd);
+  if (!hasStructural) return null;
+  const fileMatch = /(?:^|\s)(?:"([^"]+\.(?:py|ts|tsx|js|jsx|go|rs|rb|cs|java|cpp|cc|cxx|c|h|sh|bash))"|('([^']+\.(?:py|ts|tsx|js|jsx|go|rs|rb|cs|java|cpp|cc|cxx|c|h|sh|bash))')|([^\s"']+\.(?:py|ts|tsx|js|jsx|go|rs|rb|cs|java|cpp|cc|cxx|c|h|sh|bash)))\s*$/.exec(cmd);
+  if (!fileMatch) return null;
+  const filePath = fileMatch[1] ?? fileMatch[3] ?? fileMatch[4];
+  if (!filePath) return null;
+  if (isTempPath(filePath)) return null;
+  return { filePath };
+}
+function extractGrepPipeChain(cmd) {
+  return /^(?:rg|grep)\b.*\|\s*(?:rg|grep)\b/.test(cmd);
+}
+function extractCurlUrl(cmd) {
+  const m = /(https?:\/\/[^\s'"]+)/.exec(cmd);
+  return m?.[1] ?? null;
+}
+function isCurlGetCommand(cmd) {
+  if (!/^curl\b/.test(cmd)) return false;
+  if (/-X\s+(?:POST|PUT|PATCH|DELETE|HEAD|OPTIONS)/i.test(cmd)) return false;
+  if (/--request\s+(?:POST|PUT|PATCH|DELETE|HEAD|OPTIONS)/i.test(cmd)) return false;
+  if (/\s(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form)\b/.test(cmd)) return false;
+  if (/\s(?:-u|--user)\b/.test(cmd)) return false;
+  if (/-H\s+['"]?Authorization/i.test(cmd)) return false;
+  return true;
+}
+function extractCurlDownload(cmd) {
+  if (!/^curl\b/.test(cmd)) return null;
+  const outputMatch = /(?:^|\s)(?:-o|--output)\s+(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(cmd);
+  if (!outputMatch) return null;
+  const outputPath = outputMatch[1] ?? outputMatch[2] ?? outputMatch[3];
+  if (!outputPath) return null;
+  if (/-X\s+(?:POST|PUT|PATCH|DELETE|HEAD|OPTIONS)/i.test(cmd)) return null;
+  if (/--request\s+(?:POST|PUT|PATCH|DELETE|HEAD|OPTIONS)/i.test(cmd)) return null;
+  if (/(?:^|\s)(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form)\b/.test(cmd)) return null;
+  if (/(?:^|\s)(?:-u|--user)\b/.test(cmd)) return null;
+  if (/-H\s+['"]?Authorization/i.test(cmd)) return null;
+  const urlMatch = /(https?:\/\/[^\s'"]+)/.exec(cmd);
+  if (!urlMatch?.[1]) return null;
+  return { url: urlMatch[1], outputPath };
+}
 function isTscCommand(cmd) {
   return /^\s*tsc(\s|$)/i.test(cmd);
 }
@@ -12512,9 +13249,133 @@ function buildRecallHint(cmd, outputId) {
 function preBashHandler(event) {
   const cmd = extractCommand(event);
   if (cmd === void 0) return passOutput();
+  const taskOutput = extractTasksOutput(cmd);
+  if (taskOutput !== null) {
+    const { id } = taskOutput;
+    recordStat("session_hint", 0, 0);
+    return denyOutput(
+      "Use `token-goat bash-output " + id + "` to recall this task output (already cached). Append `--tail <n>` or `--grep PATTERN` to slice it."
+    );
+  }
+  const findResult = extractFindCommand(cmd);
+  if (findResult !== null) {
+    const { extGlob, isXargsGrepL } = findResult;
+    recordStat("session_hint", 0, 0);
+    if (isXargsGrepL) {
+      return denyOutput(
+        "`find | xargs grep -l` is a slow symbol search. Use `token-goat refs <symbol>` or `rg -l <symbol>` for faster symbol-file discovery."
+      );
+    }
+    const fdHint = extGlob ? "Use `fd '" + extGlob + "'` for faster file discovery (respects .gitignore)." : "Use `fd` for faster file discovery (respects .gitignore).";
+    return contextOutput(
+      "`find` is slow and ignores .gitignore. " + fdHint + " For symbol definitions, use `token-goat symbol <Name>`."
+    );
+  }
+  if (extractDirectoryListing(cmd)) {
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      "Use `token-goat map --compact` (~300 tokens) for a repo overview, or `token-goat map <dir>` for a subdirectory."
+    );
+  }
+  if (extractSedLineRange(cmd)) {
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      'Use `token-goat section "<file>::HeadingName"` to read one section instead of a line range.'
+    );
+  }
+  const catJsonPipe = extractCatJsonPipe(cmd);
+  if (catJsonPipe !== null) {
+    const { filePath } = catJsonPipe;
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      '`cat | jq` loads the whole file. Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to slice one value.'
+    );
+  }
+  const catResult = extractCatFile(cmd);
+  if (catResult !== null) {
+    const { filePath, isDoc, isEnv, isConfig, isSql } = catResult;
+    recordStat("session_hint", 0, 0);
+    if (isSql) {
+      return contextOutput(
+        '`cat` loads the entire file into context. Use `token-goat section "' + filePath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.'
+      );
+    }
+    const hint = isEnv ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` to read a specific variable.' : isConfig ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to read a specific value.' : isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` to read one function or class.';
+    return denyOutput("`cat` loads the entire file into context. " + hint);
+  }
+  const wslCatResult = extractWslCatFile(cmd);
+  if (wslCatResult !== null) {
+    const { filePath, isDoc, isEnv, isConfig, isSql } = wslCatResult;
+    recordStat("session_hint", 0, 0);
+    if (isSql) {
+      return contextOutput(
+        '`cat` loads the entire file into context. Use `token-goat section "' + filePath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.'
+      );
+    }
+    const hint = isEnv ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` to read a specific variable.' : isConfig ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to read a specific value.' : isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` to read one function or class.';
+    return denyOutput("`cat` loads the entire file into context. " + hint);
+  }
+  const pyRead = extractPythonFileRead(cmd);
+  if (pyRead !== null) {
+    const { filePath, isDoc } = pyRead;
+    const hint = isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` to extract a specific symbol.';
+    recordStat("session_hint", 0, 0);
+    return denyOutput("Python `open()` file reads bypass read hooks. " + hint);
+  }
+  const tailResult = extractTailFile(cmd);
+  if (tailResult !== null) {
+    const { filePath, isDoc } = tailResult;
+    const hint = isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` or `token-goat skeleton "' + filePath + '"` to see the file structure.';
+    recordStat("session_hint", 0, 0);
+    return contextOutput("`tail` bypasses read hooks. " + hint);
+  }
+  const headResult = extractHeadFile(cmd);
+  if (headResult !== null) {
+    const { filePath, isDoc, isConfig } = headResult;
+    const hint = isConfig ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to read a specific value.' : isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` or `token-goat skeleton "' + filePath + '"` to see the file structure.';
+    recordStat("session_hint", 0, 0);
+    return contextOutput("`head` bypasses read hooks. " + hint);
+  }
+  const nodeRead = extractNodeFileRead(cmd);
+  if (nodeRead !== null) {
+    const { filePath, isDoc, isConfig } = nodeRead;
+    const hint = isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : isConfig ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to read a specific value.' : 'Use `token-goat read "' + filePath + '::SymbolName"` to extract a specific symbol.';
+    recordStat("session_hint", 0, 0);
+    return denyOutput("Node.js `fs.readFileSync()` bypasses read hooks. " + hint);
+  }
+  if (extractGrepPipeChain(cmd)) {
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      "Collapse `grep | grep` into `rg -e PAT1 -e PAT2` (single pass). For symbol discovery: `token-goat refs <symbol>` or `token-goat semantic`."
+    );
+  }
+  const mdHeadingGrep = extractMarkdownHeadingGrep(cmd);
+  if (mdHeadingGrep !== null) {
+    const { filePath } = mdHeadingGrep;
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      'Use `token-goat outline "' + filePath + '"` to get all headings with line ranges \u2014 then `token-goat section "' + filePath + '::Heading"` to read one section.'
+    );
+  }
+  const rgSymbol = extractRgSymbolSearch(cmd);
+  if (rgSymbol !== null) {
+    const { identifier } = rgSymbol;
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      "Use `token-goat symbol " + identifier + "` to jump directly to the definition without scanning the file."
+    );
+  }
+  const rgStructural = extractRgStructuralSearch(cmd);
+  if (rgStructural !== null) {
+    const { filePath } = rgStructural;
+    recordStat("session_hint", 0, 0);
+    return contextOutput(
+      'Searching for code definitions with `rg`/`grep` is slower than surgical reads. Use `token-goat skeleton "' + filePath + '"` to see all symbols with line numbers, or `token-goat outline "' + filePath + '"` for symbols with docstrings and line ranges.'
+    );
+  }
   const monitoringHint = getMonitoringRecallHint(cmd);
   if (monitoringHint !== null) {
-    const monCmdHash = fingerprintContent(cmd).slice(0, 16);
+    const monCmdHash = shortFingerprint(cmd);
     const monOutputId = getBashOutputId(monCmdHash);
     if (monOutputId !== null) {
       const monEntry = getBashOutput(monOutputId);
@@ -12533,8 +13394,32 @@ function preBashHandler(event) {
       );
     }
   }
+  const curlDl = extractCurlDownload(cmd);
+  if (curlDl !== null) {
+    const prevPath = getCurlDownloadPath(curlDl.url);
+    if (prevPath !== null) {
+      recordStat("session_hint", 0, 0);
+      return denyOutput(
+        "Already downloaded to " + prevPath + " earlier this session. Use `rg '<pattern>' " + prevPath + '` to search it, or `token-goat read "' + prevPath + '::SectionName"` to read a part of it.'
+      );
+    }
+  }
+  if (isCurlGetCommand(cmd)) {
+    const curlCacheKey = extractCurlUrl(cmd) ?? cmd;
+    const curlHash = shortFingerprint(curlCacheKey);
+    const curlOutputId = getBashOutputId(curlHash);
+    if (curlOutputId !== null) {
+      const curlEntry = getBashOutput(curlOutputId);
+      const curlBytes = curlEntry?.sizeBytes ?? 0;
+      recordStat("bash_compress:recall", curlBytes, Math.round(curlBytes / 4));
+      const curlPreview = cmd.length > 60 ? cmd.slice(0, 57) + "..." : cmd;
+      return contextOutput(
+        "curl response cached (`" + curlPreview + "`). Use `token-goat bash-output " + curlOutputId + "` to recall it. Append `--grep PATTERN` to filter or `--section HeadingName` for a markdown section."
+      );
+    }
+  }
   if (!isBuildCommand(cmd)) return passOutput();
-  const cmdHash = fingerprintContent(cmd).slice(0, 16);
+  const cmdHash = shortFingerprint(cmd);
   const outputId = getBashOutputId(cmdHash);
   if (outputId === null) return passOutput();
   const entry = getBashOutput(outputId);
@@ -12559,12 +13444,17 @@ async function postBashHandler(event) {
   try {
     const cmd = extractCommand(event);
     if (cmd === void 0) return passOutput();
+    const curlDl = extractCurlDownload(cmd);
+    if (curlDl !== null) {
+      recordCurlDownload(curlDl.url, curlDl.outputPath);
+    }
     const isMonitoring = getMonitoringRecallHint(cmd) !== null;
-    if (!isMonitoring && !isBuildCommand(cmd)) return passOutput();
+    if (!isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) return passOutput();
     const output = extractBashOutput(event.raw);
     if (Buffer.byteLength(output, "utf-8") < MIN_CACHE_BYTES) return passOutput();
     const cwd = typeof event.raw["cwd"] === "string" ? event.raw["cwd"] : null;
-    const simpleHash = fingerprintContent(cmd).slice(0, 16);
+    const cacheKey = isCurlGetCommand(cmd) ? extractCurlUrl(cmd) ?? cmd : cmd;
+    const simpleHash = shortFingerprint(cacheKey);
     const id = await storeBashOutput(cmd, output, 0, cwd);
     recordBashOutput(simpleHash, id, Buffer.byteLength(output, "utf-8"));
   } catch {
@@ -12575,8 +13465,8 @@ registerHook("post_tool_use", postBashHandler, { toolName: "Bash" });
 
 // src/image_shrink.ts
 init_define_import_meta_env();
-import * as fs8 from "node:fs";
-import * as path10 from "node:path";
+import * as fs9 from "node:fs";
+import * as path12 from "node:path";
 var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".png",
   ".jpg",
@@ -12603,7 +13493,7 @@ async function loadSharp() {
   return _sharpCache;
 }
 function isImagePath(p) {
-  return IMAGE_EXTENSIONS.has(path10.extname(p).toLowerCase());
+  return IMAGE_EXTENSIONS.has(path12.extname(p).toLowerCase());
 }
 async function shrinkImage(input, opts) {
   const maxDimension = opts?.maxDimension ?? DEFAULT_MAX_DIMENSION;
@@ -12635,7 +13525,7 @@ async function shrinkImage(input, opts) {
 }
 function statSize2(absPath) {
   try {
-    const st = fs8.statSync(absPath);
+    const st = fs9.statSync(absPath);
     return st.isFile() ? st.size : null;
   } catch {
     return null;
@@ -12649,7 +13539,7 @@ async function preReadImageHandler(event) {
   if (size === null || size < DEFAULT_SIZE_THRESHOLD_BYTES) return passOutput();
   let input;
   try {
-    input = fs8.readFileSync(filePath);
+    input = fs9.readFileSync(filePath);
   } catch {
     return passOutput();
   }
@@ -12658,7 +13548,7 @@ async function preReadImageHandler(event) {
   const saved = result.originalBytes - result.shrunkBytes;
   const pct = Math.round(saved / result.originalBytes * 100);
   const dataUrl = `data:image/${result.format};base64,${result.data.toString("base64")}`;
-  const summary = `token-goat shrank ${path10.basename(filePath)}: ${Math.round(result.originalBytes / 1024)}kb -> ${Math.round(result.shrunkBytes / 1024)}kb (${pct}% smaller, ${result.width}x${result.height} ${result.format}).`;
+  const summary = `token-goat shrank ${path12.basename(filePath)}: ${Math.round(result.originalBytes / 1024)}kb -> ${Math.round(result.shrunkBytes / 1024)}kb (${pct}% smaller, ${result.width}x${result.height} ${result.format}).`;
   return contextOutput(`${summary}
 ${dataUrl}`);
 }
@@ -12737,7 +13627,7 @@ async function relay(eventName) {
 
 // src/section_reader.ts
 init_define_import_meta_env();
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 function parseHeadingSpec(spec) {
   const m = /^(.*?)#(\d+)$/.exec(spec);
   if (m !== null && m[1] !== void 0 && m[2] !== void 0) {
@@ -12745,6 +13635,18 @@ function parseHeadingSpec(spec) {
   }
   return { base: spec.trim(), ordinal: null };
 }
+function normalizeHeading(s) {
+  let n = s.replace(/[—–]/g, "-");
+  n = n.replace(/\s*\([^)]+\)\s*$/, "");
+  n = n.replace(/^\d+\.\s+/, "");
+  return n.replace(/\s+/g, " ").trim();
+}
+function normalizeHeadingStrip(s) {
+  let n = s.replace(/\s*[—–].*$/, "");
+  n = n.replace(/\s*\([^)]+\)\s*$/, "");
+  n = n.replace(/^\d+\.\s+/, "");
+  return n.replace(/\s+/g, " ").trim();
+}
 var MARKDOWN_HEADER_RE = /^(#{1,6})\s+(.+?)\s*#*\s*$/;
 var TABLE_HEADER_RE = /^\s*\[+\s*([^\]]+?)\s*\]+\s*$/;
 var PYTHON_HEADER_RE = /^(\s*)(?:async\s+)?(?:def|class)\s+([A-Za-z_]\w*)/;
@@ -12819,7 +13721,7 @@ function sectionEndIndex(headers, headerPos, totalLines) {
 function readSection(filePath, headingSpec) {
   let text;
   try {
-    text = readFileSync5(filePath, "utf-8");
+    text = readFileSync6(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -12829,10 +13731,15 @@ function readSection(filePath, headingSpec) {
   const headers = findHeaders(text, language);
   const lines = text.split("\n");
   const target = base.toLowerCase();
+  const normalizedTarget = normalizeHeading(base).toLowerCase();
+  const strippedTarget = normalizeHeadingStrip(base).toLowerCase();
   const matches = [];
   for (let i = 0; i < headers.length; i++) {
     const h = headers[i];
-    if (h !== void 0 && h.heading.toLowerCase() === target) matches.push(i);
+    if (h === void 0) continue;
+    if (h.heading.toLowerCase() === target || normalizeHeading(h.heading).toLowerCase() === normalizedTarget || normalizeHeadingStrip(h.heading).toLowerCase() === strippedTarget) {
+      matches.push(i);
+    }
   }
   if (matches.length === 0) return null;
   const pick = ordinal === null ? 0 : ordinal - 1;
@@ -12856,9 +13763,9 @@ function readSection(filePath, headingSpec) {
 
 // src/install.ts
 init_define_import_meta_env();
-import * as fs9 from "node:fs";
-import * as os2 from "node:os";
-import * as path11 from "node:path";
+import * as fs10 from "node:fs";
+import * as os3 from "node:os";
+import * as path13 from "node:path";
 var HOOK_EVENT_MAP = [
   ["PreToolUse", "pre_tool_use"],
   ["PostToolUse", "post_tool_use"],
@@ -12869,13 +13776,13 @@ function hookCommand(eventArg) {
   return `token-goat hook ${eventArg}`;
 }
 function settingsPath(scope) {
-  const base = scope === "user" ? path11.join(os2.homedir(), ".claude") : path11.join(process.cwd(), ".claude");
-  return path11.join(base, "settings.json");
+  const base = scope === "user" ? path13.join(os3.homedir(), ".claude") : path13.join(process.cwd(), ".claude");
+  return path13.join(base, "settings.json");
 }
 function readSettings(p) {
   let raw;
   try {
-    raw = fs9.readFileSync(p, "utf8");
+    raw = fs10.readFileSync(p, "utf8");
   } catch {
     return {};
   }
@@ -12915,7 +13822,7 @@ function installHooks(scope = "user") {
     return { scope, settingsPath: p, alreadyInstalled: true };
   }
   settings.hooks = hooks;
-  fs9.mkdirSync(path11.dirname(p), { recursive: true });
+  fs10.mkdirSync(path13.dirname(p), { recursive: true });
   atomicWriteText(p, `${JSON.stringify(settings, null, 2)}
 `);
   return { scope, settingsPath: p, alreadyInstalled: false };
@@ -12954,7 +13861,7 @@ function uninstallHooks(scope = "user") {
   } else {
     settings.hooks = hooks;
   }
-  fs9.mkdirSync(path11.dirname(p), { recursive: true });
+  fs10.mkdirSync(path13.dirname(p), { recursive: true });
   atomicWriteText(p, `${JSON.stringify(settings, null, 2)}
 `);
   return true;
@@ -12963,21 +13870,21 @@ function uninstallHooks(scope = "user") {
 // src/worker.ts
 init_define_import_meta_env();
 import { spawn } from "node:child_process";
-import * as fs10 from "node:fs";
-import * as path12 from "node:path";
+import * as fs11 from "node:fs";
+import * as path14 from "node:path";
 import { Worker, isMainThread, parentPort, workerData } from "node:worker_threads";
 import { fileURLToPath } from "node:url";
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
 function dirtyQueuePathFor(dir) {
-  return path12.join(dir, "queue", "dirty.txt");
+  return path14.join(dir, "queue", "dirty.txt");
 }
 function workerPidPath(dir = dataDir()) {
-  return path12.join(dir, "worker.pid");
+  return path14.join(dir, "worker.pid");
 }
 function getDirtyPathsFor(dir) {
   let raw;
   try {
-    raw = fs10.readFileSync(dirtyQueuePathFor(dir), "utf8");
+    raw = fs11.readFileSync(dirtyQueuePathFor(dir), "utf8");
   } catch {
     return [];
   }
@@ -12993,7 +13900,7 @@ function getDirtyPathsFor(dir) {
 }
 function clearDirtyQueueFor(dir) {
   try {
-    fs10.rmSync(dirtyQueuePathFor(dir), { force: true });
+    fs11.rmSync(dirtyQueuePathFor(dir), { force: true });
   } catch {
   }
 }
@@ -13003,7 +13910,7 @@ function processDirtyBatch(paths, index = (absPath) => {
 }) {
   let indexed = 0;
   for (const p of paths) {
-    if (!fs10.existsSync(p)) continue;
+    if (!p || !fs11.existsSync(p)) continue;
     const sha = fingerprintFile(p);
     if (sha === null) continue;
     index(p, sha);
@@ -13028,7 +13935,7 @@ function pidAlive(pid) {
 }
 function readPidFile(dir) {
   try {
-    const raw = fs10.readFileSync(workerPidPath(dir), "utf8").trim();
+    const raw = fs11.readFileSync(workerPidPath(dir), "utf8").trim();
     if (!/^\d+$/.test(raw)) return null;
     return parseInt(raw, 10);
   } catch {
@@ -13051,7 +13958,7 @@ function stopWorker(dir = dataDir()) {
     }
   }
   try {
-    fs10.rmSync(workerPidPath(dir), { force: true });
+    fs11.rmSync(workerPidPath(dir), { force: true });
   } catch {
   }
   return alive;
@@ -13059,7 +13966,11 @@ function stopWorker(dir = dataDir()) {
 function startDetachedWorker(opts) {
   const pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   const dir = opts?.dataDir ?? dataDir();
-  fs10.mkdirSync(dir, { recursive: true });
+  try {
+    fs11.mkdirSync(dir, { recursive: true });
+  } catch (e) {
+    if (e.code !== "EEXIST" || !fs11.existsSync(dir)) throw e;
+  }
   const child = spawn(
     process.execPath,
     [fileURLToPath(import.meta.url), "--worker-daemon"],
@@ -13078,7 +13989,7 @@ function startDetachedWorker(opts) {
   if (pid === void 0) {
     throw new Error("startDetachedWorker: spawn produced no pid");
   }
-  fs10.writeFileSync(workerPidPath(dir), `${pid}
+  fs11.writeFileSync(workerPidPath(dir), `${pid}
 `);
   child.unref();
   return pid;
@@ -13121,7 +14032,7 @@ workerEntry();
 
 // src/skill_cache.ts
 init_define_import_meta_env();
-import * as fs11 from "fs/promises";
+import * as fs12 from "fs/promises";
 import { resolve as resolve4 } from "path";
 var COMPACT_END_MARKER = "<!-- COMPACT_END -->";
 var _skillOutputsDirOverride = null;
@@ -13134,7 +14045,7 @@ function skillOutputsDir() {
 }
 async function ensureSkillsDir() {
   try {
-    await fs11.mkdir(skillOutputsDir(), { recursive: true });
+    await fs12.mkdir(skillOutputsDir(), { recursive: true });
   } catch {
   }
 }
@@ -13161,7 +14072,7 @@ function extractCompactFromMarker(body) {
   const lines = body.split("\n");
   for (let i = 0; i < lines.length; i++) {
     const stripped = lines[i].trim();
-    if (stripped.startsWith("```") || stripped.startsWith("~~~")) {
+    if (isCodeFenceDelimiter(stripped)) {
       inCodeBlock = !inCodeBlock;
       continue;
     }
@@ -13176,14 +14087,14 @@ function extractCompactFromMarker(body) {
 async function listOutputs() {
   try {
     const dir = skillOutputsDir();
-    const entries = await fs11.readdir(dir, { withFileTypes: true });
+    const entries = await fs12.readdir(dir, { withFileTypes: true });
     const metas = [];
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".meta")) {
         continue;
       }
       try {
-        const content = await fs11.readFile(resolve4(dir, entry.name), "utf-8");
+        const content = await fs12.readFile(resolve4(dir, entry.name), "utf-8");
         const meta = JSON.parse(content);
         metas.push(meta);
       } catch {
@@ -13228,13 +14139,13 @@ async function listSkills(sessionId) {
       const compactFileId = `${safeSession}-${meta.skillName.replace(":", "_")}-compact`;
       let compactLen = 0;
       try {
-        const stat3 = await fs11.stat(resolve4(dir, compactFileId));
+        const stat3 = await fs12.stat(resolve4(dir, compactFileId));
         compactLen = stat3.size;
       } catch {
         compactLen = 0;
       }
       const hasMarker = extractCompactFromMarker(
-        await fs11.readFile(resolve4(dir, `${meta.outputId}.txt`), "utf-8").catch(() => "")
+        await fs12.readFile(resolve4(dir, `${meta.outputId}.txt`), "utf-8").catch(() => "")
       ) !== null;
       results.push({
         name: meta.skillName,
@@ -13266,7 +14177,7 @@ async function getSkillFilePath(skillName) {
 
 // src/config.ts
 init_define_import_meta_env();
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 
 // node_modules/smol-toml/dist/index.js
 init_define_import_meta_env();
@@ -13998,8 +14909,8 @@ function envInt(key, defaultVal) {
 }
 
 // src/config.ts
-function defaultCompactAssistConfig() {
-  return {
+var CONFIG_DEFAULTS = {
+  compact_assist: {
     enabled: true,
     triggers: ["manual", "auto"],
     min_events: 3,
@@ -14014,10 +14925,8 @@ function defaultCompactAssistConfig() {
     lazy_skill_injection: true,
     max_manifest_chars: 1600,
     harness: "auto"
-  };
-}
-function defaultBashCompressConfig() {
-  return {
+  },
+  bash_compress: {
     enabled: true,
     disabled_filters: [],
     max_lines: 1e3,
@@ -14027,32 +14936,22 @@ function defaultBashCompressConfig() {
     cache_max_file_count: 4096,
     cache_max_bytes: 16 * 1024 * 1024,
     cache_max_bytes_per_output: 50 * 1024 * 1024
-  };
-}
-function defaultBashDiffConfig() {
-  return {
+  },
+  bash_diff: {
     max_hunks_per_file: 10,
     hunk_density_cap: true
-  };
-}
-function defaultSeverityLogConfig() {
-  return {
+  },
+  bash_severity_log: {
     context_lines: 3,
     score_threshold: 0.5
-  };
-}
-function defaultCodeCompressConfig() {
-  return {
+  },
+  post_read_code_compress: {
     min_lines: 200
-  };
-}
-function defaultSessionBriefConfig() {
-  return {
+  },
+  session_brief: {
     enabled: true
-  };
-}
-function defaultSkillPreservationConfig() {
-  return {
+  },
+  skill_preservation: {
     enabled: true,
     max_cache_bytes: 5 * 1024 * 1024,
     orphan_sweep_enabled: true,
@@ -14064,25 +14963,19 @@ function defaultSkillPreservationConfig() {
     pre_skill_enabled: true,
     first_load_compact: false,
     post_compact_full_loads: false
-  };
-}
-function defaultCuratorConfig() {
-  return {
+  },
+  curator: {
     enabled: true,
     min_samples: 10,
     threshold_pct: 20
-  };
-}
-function defaultHintBudgetConfig() {
-  return {
+  },
+  hint_budget: {
     enabled: true,
     max_per_session: 100,
     max_structured_per_session: 30,
     max_index_only_per_session: 30
-  };
-}
-function defaultImageShrinkConfig() {
-  return {
+  },
+  image_shrink: {
     prefer_avif: true,
     avif_quality: 60,
     jpeg_quality: 75,
@@ -14090,27 +14983,19 @@ function defaultImageShrinkConfig() {
     orphan_sweep_enabled: true,
     orphan_age_secs: 604800,
     screenshot_redirect: true
-  };
-}
-function defaultRepomapConfig() {
-  return {
+  },
+  repomap: {
     compact_file_threshold: 50,
     exclude_tests: true
-  };
-}
-function defaultOverflowGuardConfig() {
-  return {
+  },
+  overflow_guard: {
     enabled: true,
     max_tokens: 25e3
-  };
-}
-function defaultStatsConfig() {
-  return {
+  },
+  stats: {
     record_zero_savings: false
-  };
-}
-function defaultHintsConfig() {
-  return {
+  },
+  hints: {
     suppress_after_ignored: 5,
     quiet_hours: "",
     json_sidecar: false,
@@ -14134,51 +15019,40 @@ function defaultHintsConfig() {
     truncated_read_min_lines: 200,
     protect_recent_reads: 4,
     prompt_triggers: []
-  };
-}
-function defaultHooksConfig() {
-  return {
+  },
+  hooks: {
     watchdog_ms: 700
-  };
-}
-function defaultWebFetchConfig() {
-  return {
+  },
+  webfetch: {
     allow: [],
     deny: [],
     max_file_count: 4096,
     max_bytes: 32 * 1024 * 1024,
     compress_bodies: true,
     compress_min_bytes: 16 * 1024
-  };
-}
-function defaultWorkerConfig() {
-  return {
+  },
+  worker: {
     watchdog_enabled: true,
     max_pool_workers: 4,
     blocked_roots: []
-  };
-}
-function defaultIndexingConfig() {
-  return {
+  },
+  indexing: {
     large_file_symbol_only_kb: 500,
     large_file_skip_kb: 2048,
     skip_dirs: []
-  };
-}
-function defaultCompressionConfig() {
-  return {
+  },
+  compression: {
     profile: "auto"
-  };
-}
-function defaultContextConfig() {
-  return {
+  },
+  context: {
     model_window_tokens: 2e5
-  };
-}
-function defaultInjectionConfig() {
-  return {
+  },
+  injection: {
     enabled: true
-  };
+  }
+};
+function getDefaultConfig(section2) {
+  return structuredClone(CONFIG_DEFAULTS[section2] ?? {});
 }
 function validatedBool(raw, def) {
   if (typeof raw === "boolean") return raw;
@@ -14251,7 +15125,7 @@ function loadConfig() {
   const p = configPath();
   let currentMtime = 0;
   try {
-    currentMtime = fs12.statSync(p).mtimeMs;
+    currentMtime = fs13.statSync(p).mtimeMs;
   } catch {
   }
   const envFp = configEnvFingerprint();
@@ -14261,7 +15135,7 @@ function loadConfig() {
   let raw = {};
   if (currentMtime !== 0) {
     try {
-      const text = fs12.readFileSync(p, "utf8");
+      const text = fs13.readFileSync(p, "utf8");
       raw = parse(text);
     } catch {
     }
@@ -14272,7 +15146,7 @@ function loadConfig() {
 }
 function _buildConfig(raw) {
   const ca_raw = section(raw, "compact_assist");
-  const ca = defaultCompactAssistConfig();
+  const ca = getDefaultConfig("compact_assist");
   ca.enabled = validatedBool(ca_raw["enabled"], ca.enabled);
   ca.triggers = validatedStrList(ca_raw["triggers"], ca.triggers);
   ca.min_events = validatedInt(ca_raw["min_events"], ca.min_events, 0, 1e3);
@@ -14290,7 +15164,7 @@ function _buildConfig(raw) {
   ca.enabled = envBool("TOKEN_GOAT_COMPACT_ASSIST", envBool("TOKENWISE_COMPACT_ASSIST", ca.enabled));
   ca.lazy_skill_injection = envBool("TOKEN_GOAT_LAZY_SKILL_INJECTION", ca.lazy_skill_injection);
   const bc_raw = section(raw, "bash_compress");
-  const bc = defaultBashCompressConfig();
+  const bc = getDefaultConfig("bash_compress");
   bc.enabled = validatedBool(bc_raw["enabled"], bc.enabled);
   bc.disabled_filters = validatedStrList(bc_raw["disabled_filters"], bc.disabled_filters);
   bc.max_lines = validatedInt(bc_raw["max_lines"], bc.max_lines, 50, 1e5);
@@ -14306,22 +15180,22 @@ function _buildConfig(raw) {
   bc.cache_max_bytes = envInt("TOKEN_GOAT_BASH_CACHE_MAX_BYTES", bc.cache_max_bytes);
   bc.cache_max_bytes_per_output = envInt("TOKEN_GOAT_BASH_CACHE_MAX_BYTES_PER_OUTPUT", bc.cache_max_bytes_per_output);
   const bd_raw = section(raw, "bash_diff");
-  const bd = defaultBashDiffConfig();
+  const bd = getDefaultConfig("bash_diff");
   bd.max_hunks_per_file = validatedInt(bd_raw["max_hunks_per_file"], bd.max_hunks_per_file, 1, 1e4);
   bd.hunk_density_cap = validatedBool(bd_raw["hunk_density_cap"], bd.hunk_density_cap);
   const sl_raw = section(raw, "bash_severity_log");
-  const sl = defaultSeverityLogConfig();
+  const sl = getDefaultConfig("bash_severity_log");
   sl.context_lines = validatedInt(sl_raw["context_lines"], sl.context_lines, 0, 100);
   sl.score_threshold = validatedFloat(sl_raw["score_threshold"], sl.score_threshold, 0, 1);
   const cc_raw = section(raw, "post_read_code_compress");
-  const cc = defaultCodeCompressConfig();
+  const cc = getDefaultConfig("post_read_code_compress");
   cc.min_lines = validatedInt(cc_raw["min_lines"], cc.min_lines, 0, 1e6);
   const sb_raw = section(raw, "session_brief");
-  const sb = defaultSessionBriefConfig();
+  const sb = getDefaultConfig("session_brief");
   sb.enabled = validatedBool(sb_raw["enabled"], sb.enabled);
   sb.enabled = envBool("TOKEN_GOAT_SESSION_BRIEF", sb.enabled);
   const sp_raw = section(raw, "skill_preservation");
-  const sp = defaultSkillPreservationConfig();
+  const sp = getDefaultConfig("skill_preservation");
   sp.enabled = validatedBool(sp_raw["enabled"], sp.enabled);
   sp.max_cache_bytes = validatedInt(sp_raw["max_cache_bytes"], sp.max_cache_bytes, 64 * 1024, 512 * 1024 * 1024);
   sp.orphan_sweep_enabled = validatedBool(sp_raw["orphan_sweep_enabled"], sp.orphan_sweep_enabled);
@@ -14338,7 +15212,7 @@ function _buildConfig(raw) {
   sp.pre_skill_enabled = envBool("TOKEN_GOAT_PRE_SKILL", sp.pre_skill_enabled);
   sp.orphan_sweep_enabled = envBool("TOKEN_GOAT_ORPHAN_SWEEP", sp.orphan_sweep_enabled);
   const is_raw = section(raw, "image_shrink");
-  const is_cfg = defaultImageShrinkConfig();
+  const is_cfg = getDefaultConfig("image_shrink");
   is_cfg.prefer_avif = validatedBool(is_raw["prefer_avif"], is_cfg.prefer_avif);
   is_cfg.avif_quality = validatedInt(is_raw["avif_quality"], is_cfg.avif_quality, 1, 100);
   is_cfg.jpeg_quality = validatedInt(is_raw["jpeg_quality"], is_cfg.jpeg_quality, 1, 100);
@@ -14349,33 +15223,33 @@ function _buildConfig(raw) {
   is_cfg.prefer_avif = envBool("TOKEN_GOAT_PREFER_AVIF", is_cfg.prefer_avif);
   is_cfg.max_image_pixels = envInt("TOKEN_GOAT_MAX_IMAGE_PIXELS", is_cfg.max_image_pixels);
   const cur_raw = section(raw, "curator");
-  const cur = defaultCuratorConfig();
+  const cur = getDefaultConfig("curator");
   cur.enabled = validatedBool(cur_raw["enabled"], cur.enabled);
   cur.min_samples = validatedInt(cur_raw["min_samples"], cur.min_samples, 0, 1e4);
   cur.threshold_pct = validatedInt(cur_raw["threshold_pct"], cur.threshold_pct, 0, 100);
   cur.enabled = envBool("TOKEN_GOAT_CURATOR", cur.enabled);
   const hb_raw = section(raw, "hint_budget");
-  const hb = defaultHintBudgetConfig();
+  const hb = getDefaultConfig("hint_budget");
   hb.enabled = validatedBool(hb_raw["enabled"], hb.enabled);
   hb.max_per_session = validatedInt(hb_raw["max_per_session"], hb.max_per_session, 0, 1e6);
   hb.max_structured_per_session = validatedInt(hb_raw["max_structured_per_session"], hb.max_structured_per_session, 0, 1e6);
   hb.max_index_only_per_session = validatedInt(hb_raw["max_index_only_per_session"], hb.max_index_only_per_session, 0, 1e6);
   hb.enabled = envBool("TOKEN_GOAT_HINT_BUDGET", hb.enabled);
   const rm_raw = section(raw, "repomap");
-  const rm = defaultRepomapConfig();
+  const rm = getDefaultConfig("repomap");
   rm.compact_file_threshold = validatedInt(rm_raw["compact_file_threshold"], rm.compact_file_threshold, 0, 1e5);
   rm.exclude_tests = validatedBool(rm_raw["exclude_tests"], rm.exclude_tests);
   rm.compact_file_threshold = envInt("TOKEN_GOAT_REPOMAP_COMPACT_THRESHOLD", rm.compact_file_threshold);
   rm.exclude_tests = envBool("TOKEN_GOAT_REPOMAP_EXCLUDE_TESTS", rm.exclude_tests);
   const og_raw = section(raw, "overflow_guard");
-  const og = defaultOverflowGuardConfig();
+  const og = getDefaultConfig("overflow_guard");
   og.enabled = validatedBool(og_raw["enabled"], og.enabled);
   og.max_tokens = validatedInt(og_raw["max_tokens"], og.max_tokens, 1e3, 1e6);
   const st_raw = section(raw, "stats");
-  const st = defaultStatsConfig();
+  const st = getDefaultConfig("stats");
   st.record_zero_savings = validatedBool(st_raw["record_zero_savings"], st.record_zero_savings);
   const hi_raw = section(raw, "hints");
-  const hi = defaultHintsConfig();
+  const hi = getDefaultConfig("hints");
   hi.suppress_after_ignored = validatedInt(hi_raw["suppress_after_ignored"], hi.suppress_after_ignored, 0, 1e3);
   hi.quiet_hours = validatedStr(hi_raw["quiet_hours"], hi.quiet_hours);
   hi.json_sidecar = validatedBool(hi_raw["json_sidecar"], hi.json_sidecar);
@@ -14408,11 +15282,11 @@ function _buildConfig(raw) {
     })).filter((t) => t.keywords.length > 0 && t.hint.length > 0);
   }
   const hk_raw = section(raw, "hooks");
-  const hk = defaultHooksConfig();
+  const hk = getDefaultConfig("hooks");
   hk.watchdog_ms = validatedInt(hk_raw["watchdog_ms"], hk.watchdog_ms, 100, 3e4);
   hk.watchdog_ms = envInt("TOKEN_GOAT_HOOK_WATCHDOG_MS", hk.watchdog_ms);
   const wf_raw = section(raw, "webfetch");
-  const wf = defaultWebFetchConfig();
+  const wf = getDefaultConfig("webfetch");
   wf.allow = validatedStrList(wf_raw["allow"], wf.allow);
   wf.deny = validatedStrList(wf_raw["deny"], wf.deny);
   wf.max_file_count = validatedInt(wf_raw["max_file_count"], wf.max_file_count, 0, 1e7);
@@ -14421,27 +15295,27 @@ function _buildConfig(raw) {
   wf.compress_min_bytes = validatedInt(wf_raw["compress_min_bytes"], wf.compress_min_bytes, 1024, 10 * 1024 * 1024);
   wf.compress_bodies = envBool("TOKEN_GOAT_WEB_COMPRESS", wf.compress_bodies);
   const wk_raw = section(raw, "worker");
-  const wk = defaultWorkerConfig();
+  const wk = getDefaultConfig("worker");
   wk.watchdog_enabled = validatedBool(wk_raw["watchdog_enabled"], wk.watchdog_enabled);
   wk.max_pool_workers = validatedInt(wk_raw["max_pool_workers"], wk.max_pool_workers, 1, 8);
   wk.blocked_roots = validatedStrList(wk_raw["blocked_roots"], wk.blocked_roots);
   wk.watchdog_enabled = envBool("TOKEN_GOAT_WORKER_WATCHDOG", wk.watchdog_enabled);
   wk.max_pool_workers = envInt("TOKEN_GOAT_WORKER_MAX_POOL", wk.max_pool_workers);
   const ix_raw = section(raw, "indexing");
-  const ix = defaultIndexingConfig();
+  const ix = getDefaultConfig("indexing");
   ix.large_file_symbol_only_kb = validatedInt(ix_raw["large_file_symbol_only_kb"], ix.large_file_symbol_only_kb, 1, 1048576);
   ix.large_file_skip_kb = validatedInt(ix_raw["large_file_skip_kb"], ix.large_file_skip_kb, 1, 1048576);
   ix.skip_dirs = validatedStrList(ix_raw["skip_dirs"], ix.skip_dirs);
   const cpr_raw = section(raw, "compression");
-  const cpr = defaultCompressionConfig();
+  const cpr = getDefaultConfig("compression");
   cpr.profile = validatedStr(cpr_raw["profile"], cpr.profile);
   cpr.profile = envStr("TOKEN_GOAT_COMPRESS_PROFILE", cpr.profile);
   const ctx_raw = section(raw, "context");
-  const ctx = defaultContextConfig();
+  const ctx = getDefaultConfig("context");
   ctx.model_window_tokens = validatedInt(ctx_raw["model_window_tokens"], ctx.model_window_tokens, 1e4, 1e7);
   ctx.model_window_tokens = envInt("TOKEN_GOAT_MODEL_WINDOW_TOKENS", ctx.model_window_tokens);
   const inj_raw = section(raw, "injection");
-  const inj = defaultInjectionConfig();
+  const inj = getDefaultConfig("injection");
   inj.enabled = validatedBool(inj_raw["enabled"], inj.enabled);
   inj.enabled = envBool("TOKEN_GOAT_INJECTION_ENABLED", inj.enabled);
   return {
@@ -14471,9 +15345,9 @@ function _buildConfig(raw) {
 
 // src/cli_doctor.ts
 init_define_import_meta_env();
-import * as fs13 from "fs";
-import * as path13 from "path";
-import { execSync } from "child_process";
+import * as fs14 from "fs";
+import * as path15 from "path";
+import { execSync, spawnSync as spawnSync2 } from "child_process";
 function checkWorkerRunning() {
   try {
     const output = execSync("tasklist", { encoding: "utf-8" });
@@ -14483,8 +15357,8 @@ function checkWorkerRunning() {
   }
 }
 function checkDbExists(dataDir2) {
-  const dbPath = path13.join(dataDir2, "index.db");
-  if (!fs13.existsSync(dbPath)) {
+  const dbPath = path15.join(dataDir2, "index.db");
+  if (!fs14.existsSync(dbPath)) {
     return {
       name: "Database",
       status: "warn",
@@ -14494,7 +15368,7 @@ function checkDbExists(dataDir2) {
   return {
     name: "Database",
     status: "ok",
-    message: `index.db exists (${Math.round(fs13.statSync(dbPath).size / 1024)} KB)`
+    message: `index.db exists (${Math.round(fs14.statSync(dbPath).size / 1024)} KB)`
   };
 }
 function checkInstall() {
@@ -14514,7 +15388,7 @@ function checkInstall() {
   }
 }
 function checkConfigValid(configPath2) {
-  if (!fs13.existsSync(configPath2)) {
+  if (!fs14.existsSync(configPath2)) {
     return {
       name: "Config",
       status: "warn",
@@ -14522,7 +15396,7 @@ function checkConfigValid(configPath2) {
     };
   }
   try {
-    const content = fs13.readFileSync(configPath2, "utf-8");
+    const content = fs14.readFileSync(configPath2, "utf-8");
     JSON.parse(content);
     return {
       name: "Config",
@@ -14533,18 +15407,22 @@ function checkConfigValid(configPath2) {
     return {
       name: "Config",
       status: "fail",
-      message: `config invalid: ${err2 instanceof Error ? err2.message : "unknown error"}`
+      message: `config invalid: ${extractErrorMessage(err2, "unknown error")}`
     };
   }
 }
 function checkDiskSpace(dataDir2) {
   try {
-    const statSync8 = execSync(`df -h ${dataDir2}`, { encoding: "utf-8" });
-    const lines = statSync8.trim().split("\n");
+    const result = spawnSync2("df", ["-h", dataDir2], { encoding: "utf-8" });
+    const stdout = typeof result.stdout === "string" ? result.stdout : "";
+    if (result.error !== void 0 || result.status !== 0 || !stdout) {
+      return { name: "Disk Space", status: "warn", message: "could not determine" };
+    }
+    const lines = stdout.trim().split("\n");
     if (lines.length < 2) {
       return { name: "Disk Space", status: "warn", message: "could not determine" };
     }
-    const parts = lines[1].split(/\s+/);
+    const parts = lines[1].trim().split(/\s+/);
     const available = parts[3] || "unknown";
     return { name: "Disk Space", status: "ok", message: `${available} available` };
   } catch {
@@ -14556,9 +15434,9 @@ function runDoctor(dataDir2, configPath2) {
   results.push(checkInstall());
   results.push(checkWorkerRunning() ? { name: "Worker", status: "ok", message: "running" } : { name: "Worker", status: "warn", message: "not running" });
   const homeDir = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  const actualDataDir = dataDir2 || path13.join(homeDir, ".token-goat");
+  const actualDataDir = dataDir2 || path15.join(homeDir, ".token-goat");
   results.push(checkDbExists(actualDataDir));
-  const actualConfigPath = configPath2 || path13.join(actualDataDir, "config.json");
+  const actualConfigPath = configPath2 || path15.join(actualDataDir, "config.json");
   results.push(checkConfigValid(actualConfigPath));
   results.push(checkDiskSpace(actualDataDir));
   return results;
@@ -14597,7 +15475,7 @@ init_define_import_meta_env();
 var _byId2 = /* @__PURE__ */ new Map();
 var _urlIndex = /* @__PURE__ */ new Map();
 function cacheIdForUrl(url) {
-  return fingerprintContent(url).slice(0, 16);
+  return shortFingerprint(url);
 }
 function storeWebOutput(url, content) {
   const cacheId = cacheIdForUrl(url);
@@ -14717,12 +15595,10 @@ async function getSectionContent(fileId, heading) {
 var CliError = class extends Error {
 };
 function out(text) {
-  process.stdout.write(text.endsWith("\n") ? text : `${text}
-`);
+  process.stdout.write(ensureNewline(text));
 }
 function err(text) {
-  process.stderr.write(text.endsWith("\n") ? text : `${text}
-`);
+  process.stderr.write(ensureNewline(text));
 }
 function previewLines(body, n) {
   return body.split(/\r?\n/).slice(0, n).join("\n");
@@ -14882,7 +15758,7 @@ function _applyFiltersAndPrint(content, opts) {
     const n = Number.parseInt(opts.tail, 10);
     return Number.isFinite(n) && n > 0 ? n : 80;
   })() : 80;
-  const applyElision = (lines2, headN2, tailN2) => lines2.length > headN2 + tailN2 ? [...lines2.slice(0, headN2), "...(elided)...", ...lines2.slice(lines2.length - tailN2)] : lines2;
+  const applyElision = (lines2, headN2, tailN2) => lines2.length > headN2 + tailN2 + 1 ? [...lines2.slice(0, headN2), "...(elided)...", ...lines2.slice(lines2.length - tailN2)] : lines2;
   let result = lines;
   if (opts.head === void 0 && opts.tail === void 0 && opts.grep === void 0) {
     result = applyElision(lines, headN, tailN);
@@ -14897,10 +15773,21 @@ function _applyFiltersAndPrint(content, opts) {
 }
 function cmdBashOutput(id, opts) {
   if (opts.file !== void 0) {
+    if (opts.file.includes("\0")) {
+      throw new CliError("--file path contains a null byte");
+    }
+    if (!isWindows() && /^\/dev\/(stdin|fd\/0)$|^\/proc\/self\/fd\/0$/.test(opts.file) && process.stdin.isTTY) {
+      throw new CliError("--file /dev/stdin requires piped input; redirect a file instead");
+    }
     let content;
     try {
-      content = fs14.readFileSync(opts.file, "utf-8");
-    } catch {
+      const st = fs15.statSync(opts.file);
+      if (st.isFIFO() || st.isSocket()) {
+        throw new CliError(`--file '${opts.file}' is a special file (FIFO or socket) \u2014 only regular files are supported`);
+      }
+      content = fs15.readFileSync(opts.file, "utf-8");
+    } catch (e) {
+      if (e instanceof CliError) throw e;
       throw new CliError(`cannot read file: ${opts.file}`);
     }
     _applyFiltersAndPrint(content, opts);
@@ -14920,12 +15807,12 @@ async function cmdSkillBody(name, opts) {
   if (filePath === null) {
     throw new CliError(`skill '${name}' not found`);
   }
-  const body = fs14.readFileSync(filePath, "utf-8");
+  const body = fs15.readFileSync(filePath, "utf-8");
   if (opts.compact === true) {
     const lines = body.split("\n");
     const end = lines.findIndex((l) => l.includes("COMPACT_END"));
     if (end !== -1) {
-      out(lines.slice(0, end).join("\n"));
+      out(lines.slice(end + 1).join("\n"));
     } else {
       out(body);
     }
@@ -14938,7 +15825,7 @@ async function cmdSkillCompact(name) {
   if (filePath === null) {
     throw new CliError(`skill '${name}' not found`);
   }
-  const body = fs14.readFileSync(filePath, "utf-8");
+  const body = fs15.readFileSync(filePath, "utf-8");
   const sessionFiles = getSessionFiles();
   const sessionId = Array.from(sessionFiles.keys())[0] ?? "default";
   await storeCompact(sessionId, name, body);
@@ -15025,7 +15912,7 @@ function cmdConfigGet(file, key) {
 }
 function atomicWriteBuffer(dest, data) {
   try {
-    if (fs14.statSync(dest).isDirectory()) {
+    if (fs15.statSync(dest).isDirectory()) {
       const e = Object.assign(new Error(`EISDIR: illegal operation on a directory, open '${dest}'`), { code: "EISDIR", path: dest });
       throw e;
     }
@@ -15033,16 +15920,16 @@ function atomicWriteBuffer(dest, data) {
     if (e.code !== "ENOENT") throw e;
   }
   const rnd = Math.random().toString(36).slice(2, 8);
-  const tmp = path14.join(path14.dirname(path14.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
+  const tmp = path16.join(path16.dirname(path16.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
   try {
-    fs14.writeFileSync(tmp, data, { mode: 384 });
+    fs15.writeFileSync(tmp, data, { mode: 384 });
     try {
-      fs14.renameSync(tmp, dest);
+      fs15.renameSync(tmp, dest);
     } catch (e) {
       if (e.code === "EXDEV") {
-        fs14.copyFileSync(tmp, dest);
+        fs15.copyFileSync(tmp, dest);
         try {
-          fs14.unlinkSync(tmp);
+          fs15.unlinkSync(tmp);
         } catch (ue) {
           process.stderr.write(`token-goat write-file: warning: could not remove temp file ${tmp}: ${ue.message}
 `);
@@ -15053,7 +15940,7 @@ function atomicWriteBuffer(dest, data) {
     }
   } catch (e) {
     try {
-      fs14.unlinkSync(tmp);
+      fs15.unlinkSync(tmp);
     } catch {
     }
     throw e;
@@ -15063,9 +15950,9 @@ function mapFsError(e, src, dest) {
   const fe = e;
   if (fe.code === "ENOENT") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && path14.resolve(errPath) === path14.resolve(src);
+    const isSource = src !== void 0 && path16.resolve(errPath) === path16.resolve(src);
     if (isSource) throw new CliError(`source file not found: ${src}`);
-    const destDir = dest ? path14.dirname(path14.resolve(dest)) : path14.dirname(path14.resolve(errPath || "."));
+    const destDir = dest ? path16.dirname(path16.resolve(dest)) : path16.dirname(path16.resolve(errPath || "."));
     throw new CliError(`destination directory does not exist: ${destDir}`);
   }
   if (fe.code === "ENOTDIR") {
@@ -15073,7 +15960,7 @@ function mapFsError(e, src, dest) {
   }
   if (fe.code === "EISDIR") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && (errPath === "" || path14.resolve(errPath) === path14.resolve(src));
+    const isSource = src !== void 0 && (errPath === "" || path16.resolve(errPath) === path16.resolve(src));
     if (isSource) throw new CliError(`source is a directory, not a file: ${src}`);
     throw new CliError(`destination is a directory, not a file: ${dest ?? (errPath || "(unknown)")}`);
   }
@@ -15138,8 +16025,8 @@ function cmdWriteFile(dest, opts) {
   if (dest.includes("\0")) {
     throw new CliError("destination path contains a null byte");
   }
-  if (process.platform === "win32") {
-    const base = path14.basename(dest);
+  if (isWindows()) {
+    const base = path16.basename(dest);
     const stem = base.replace(/\.[^.]*$/, "").toUpperCase();
     if (WIN_RESERVED.has(stem)) {
       throw new CliError(`destination '${base}' is a reserved Windows device name`);
@@ -15158,20 +16045,23 @@ function cmdWriteFile(dest, opts) {
     if (opts.from.includes("\0")) {
       throw new CliError("--from path contains a null byte");
     }
-    if (process.platform !== "win32" && /^\/dev\/(stdin|fd\/0)$|^\/proc\/self\/fd\/0$/.test(opts.from) && process.stdin.isTTY) {
+    if (!isWindows() && /^\/dev\/(stdin|fd\/0)$|^\/proc\/self\/fd\/0$/.test(opts.from) && process.stdin.isTTY) {
       throw new CliError("--from /dev/stdin requires piped input; use piped stdin mode or --b64 for interactive use");
     }
     try {
-      const st = fs14.statSync(opts.from);
+      const st = fs15.statSync(opts.from);
       if (st.isFIFO() || st.isSocket()) {
         throw new CliError(`--from '${opts.from}' is a special file (FIFO or socket) \u2014 only regular files are supported`);
       }
       const maxFromMB = parseInt(process.env["TOKEN_GOAT_MAX_STDIN_MB"] ?? "512", 10);
-      const maxFromBytes = (Number.isFinite(maxFromMB) && maxFromMB > 0 ? maxFromMB : 512) * 1024 * 1024;
+      if (!Number.isFinite(maxFromMB) || maxFromMB <= 0) {
+        throw new CliError(`TOKEN_GOAT_MAX_STDIN_MB must be a positive integer; got '${process.env["TOKEN_GOAT_MAX_STDIN_MB"] ?? ""}'`);
+      }
+      const maxFromBytes = maxFromMB * 1024 * 1024;
       if (st.size > maxFromBytes) {
         throw new CliError(`--from source exceeds size limit (${Math.round(st.size / 1024 / 1024)} MB); set TOKEN_GOAT_MAX_STDIN_MB to override`);
       }
-      atomicWriteBuffer(dest, fs14.readFileSync(opts.from));
+      atomicWriteBuffer(dest, fs15.readFileSync(opts.from));
     } catch (e) {
       if (e instanceof CliError) throw e;
       mapFsError(e, opts.from, dest);
@@ -15184,7 +16074,10 @@ function cmdWriteFile(dest, opts) {
       throw new CliError("--b64 payload contains only whitespace \u2014 likely a shell expansion error; pass an empty string explicitly for a zero-byte file");
     }
     const maxB64MB = parseInt(process.env["TOKEN_GOAT_MAX_STDIN_MB"] ?? "512", 10);
-    const maxB64Bytes = (Number.isFinite(maxB64MB) && maxB64MB > 0 ? maxB64MB : 512) * 1024 * 1024;
+    if (!Number.isFinite(maxB64MB) || maxB64MB <= 0) {
+      throw new CliError(`TOKEN_GOAT_MAX_STDIN_MB must be a positive integer; got '${process.env["TOKEN_GOAT_MAX_STDIN_MB"] ?? ""}'`);
+    }
+    const maxB64Bytes = maxB64MB * 1024 * 1024;
     const decodedSize = Math.floor(normalized.replace(/=+$/, "").length * 3 / 4);
     if (decodedSize > maxB64Bytes) {
       throw new CliError(`--b64 payload would decode to ${Math.round(decodedSize / 1024 / 1024)} MB which exceeds size limit; set TOKEN_GOAT_MAX_STDIN_MB to override`);
@@ -15285,7 +16178,7 @@ function buildProgram() {
       await fn(...args);
       process.exitCode = 0;
     } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = extractErrorMessage(e);
       err(`token-goat: ${msg}`);
       process.exitCode = 1;
     }
@@ -15337,7 +16230,7 @@ async function run(argv = process.argv) {
       process.exitCode = 1;
       return;
     }
-    const msg = e instanceof Error ? e.message : String(e);
+    const msg = extractErrorMessage(e);
     err(`token-goat: ${msg}`);
     process.exitCode = 1;
   }