token-goat 2.6.28 → 2.6.29

package/dist/token-goat-hook.mjs

@@ -49,7 +49,7 @@ var init_define_import_meta_env = __esm({
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.28";
+    return "2.6.29";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -2141,8 +2141,9 @@ function buildGuidanceBody(fallbackToolClause) {
     "- pulling one value or subtree out of a JSON/YAML file (manifest, lockfile, spec, config) \u2192 `json-query file 'a.b.c'` / `yaml-query file 'a.b.c'`",
     "- opening an image to check its dimensions, format, or size \u2192 `image-meta file`",
     "- opening a screenshot, diagram, or scan to read the text in it \u2192 `image-text file`",
+    "- opening a PDF or Office document \u2192 inspect its format first, then read a narrow slice: PDF `pdf-meta`/`pdf-outline` then `pdf-extract`; Word `docx-outline` then `docx-text`; PowerPoint `pptx-outline` then `pptx-slide`/`pptx-notes`; Excel `xlsx-sheets` then `xlsx-head`/`xlsx-range`/`xlsx-query`",
     "",
-    'Commands: `symbol NAME`, `read "file::symbol"`, `brief "file::symbol"`, `section "file::Heading"`, `semantic "description"`, `outline file`/`skeleton file`, `map --compact`, `refs file::symbol --callers`, `changed --symbol`, `config-get file KEY`, `json-query file \'a.b.c\'`/`yaml-query`, `json-outline file`/`yaml-outline`, `bash-output`/`web-output`/`mcp-output`, `gdrive-sections <file-id>`, `image-meta file`/`image-text file`.',
+    'Commands: `symbol NAME`, `read "file::symbol"`, `brief "file::symbol"`, `section "file::Heading"`, `semantic "description"`, `outline file`/`skeleton file`, `map --compact`, `refs file::symbol --callers`, `changed --symbol`, `config-get file KEY`, `json-query file \'a.b.c\'`/`yaml-query`, `json-outline file`/`yaml-outline`, `bash-output`/`web-output`/`mcp-output`, `gdrive-sections <file-id>`, `image-meta file`/`image-text file`, `pdf-meta`/`pdf-outline`/`pdf-extract`, `docx-outline`/`docx-text`, `pptx-outline`/`pptx-slide`/`pptx-notes`/`pptx-text`, `xlsx-sheets`/`xlsx-head`/`xlsx-range`/`xlsx-query`.',
     "",
     "Sub-agent briefs must carry this gate verbatim: a sub-agent inherits none of this context and its reads spend the same token budget.",
     "",
@@ -3643,6 +3644,12 @@ function envInt(key, defaultVal, min, max) {
   if (max !== void 0) clamped = Math.min(max, clamped);
   return clamped;
 }
+function envStrList(key, defaultVal, delimiter3) {
+  const raw = process.env[key];
+  if (raw === void 0) return defaultVal;
+  const entries = raw.split(delimiter3).map((s) => s.trim()).filter((s) => s !== "");
+  return entries.length > 0 ? entries : defaultVal;
+}
 var FALSY_ENV_VALUES, TRUTHY_ENV_VALUES;
 var init_env = __esm({
   "src/env.ts"() {
@@ -3891,6 +3898,7 @@ var init_project = __esm({
 
 // src/config.ts
 import * as fs9 from "node:fs";
+import * as path10 from "node:path";
 function getDefaultConfig(section2) {
   return structuredClone(CONFIG_DEFAULTS[section2] ?? {});
 }
@@ -4459,6 +4467,8 @@ function _buildConfig(raw, projectRaw = {}) {
   const mcp = getDefaultConfig("mcp");
   mcp.confine_reads_to_project_root = validatedBool(mcp_raw["confine_reads_to_project_root"], mcp.confine_reads_to_project_root);
   mcp.confine_reads_to_project_root = envBool("TOKEN_GOAT_MCP_CONFINE_READS", mcp.confine_reads_to_project_root);
+  mcp.allowed_roots = validatedStrList(mcp_raw["allowed_roots"], mcp.allowed_roots);
+  mcp.allowed_roots = envStrList("TOKEN_GOAT_MCP_ALLOWED_ROOTS", mcp.allowed_roots, path10.delimiter);
   const hs_raw = section(raw, "hint_stats");
   const hs = getDefaultConfig("hint_stats");
   hs.suppress_threshold_pct = validatedInt(hs_raw["suppress_threshold_pct"], hs.suppress_threshold_pct, ...boundsOf("hint_stats.suppress_threshold_pct"));
@@ -4847,7 +4857,8 @@ var init_config = __esm({
         enabled: true
       },
       mcp: {
-        confine_reads_to_project_root: true
+        confine_reads_to_project_root: true,
+        allowed_roots: []
       },
       hint_stats: {
         suppress_threshold_pct: 15,
@@ -5036,6 +5047,7 @@ var init_config = __esm({
       "context.model_window_tokens": ["TOKEN_GOAT_MODEL_WINDOW_TOKENS"],
       "injection.enabled": ["TOKEN_GOAT_INJECTION_ENABLED"],
       "mcp.confine_reads_to_project_root": ["TOKEN_GOAT_MCP_CONFINE_READS"],
+      "mcp.allowed_roots": ["TOKEN_GOAT_MCP_ALLOWED_ROOTS"],
       "indexing.embeddings_enabled": ["TOKEN_GOAT_EMBEDDINGS_ENABLED"]
     };
   }
@@ -5120,7 +5132,7 @@ var init_secret_redact = __esm({
 // src/db.ts
 import * as fs10 from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 import Database from "better-sqlite3";
 function alterTableIdempotent(conn, sql) {
   try {
@@ -5173,8 +5185,8 @@ function initConnection(conn) {
   }
 }
 function resolveDbPath(dbPath) {
-  if (path10.isAbsolute(dbPath)) return dbPath;
-  if (dbPath.includes("/") || dbPath.includes("\\")) return path10.resolve(dbPath);
+  if (path11.isAbsolute(dbPath)) return dbPath;
+  if (dbPath.includes("/") || dbPath.includes("\\")) return path11.resolve(dbPath);
   return safeJoin(dataDir(), dbPath);
 }
 function connectionKey(dbPath) {
@@ -5185,7 +5197,7 @@ function getDb(dbPath) {
   const { resolved, key } = connectionKey(dbPath);
   const existing = _connections.get(key);
   if (existing !== void 0) return existing;
-  const dir = path10.dirname(resolved);
+  const dir = path11.dirname(resolved);
   try {
     fs10.mkdirSync(dir, { recursive: true });
   } catch (e) {
@@ -6222,7 +6234,7 @@ var init_stats_renderer = __esm({
 });
 
 // src/stats.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 function kindToSource(kind) {
   const src = KIND_TO_SOURCE[kind];
   if (src !== void 0) return src;
@@ -6258,7 +6270,7 @@ function incBucket(bucket, bytesSaved, tokensSaved) {
 }
 function getGlobalDb(homeDir) {
   const basePath = homeDir ? dataDirForHome(homeDir) : dataDir();
-  const dbPath = path11.join(basePath, "global.db");
+  const dbPath = path12.join(basePath, "global.db");
   const db = getDb(dbPath);
   if (!_globalSchemaApplied.has(dbPath)) {
     db.exec(GLOBAL_SCHEMA_SQL);
@@ -6707,26 +6719,26 @@ CREATE INDEX IF NOT EXISTS idx_stats_kind ON stats(kind);
 
 // src/disk_cache.ts
 import * as fs11 from "node:fs";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import * as os8 from "node:os";
 function tokenGoatHome() {
   const override = process.env["TOKEN_GOAT_HOME"];
   if (override !== void 0 && override !== "") return override;
-  return path12.join(os8.homedir(), ".token-goat");
+  return path13.join(os8.homedir(), ".token-goat");
 }
 function sanitizeId(id) {
   return sanitizeIdForFilename(id, 64);
 }
 function blobDir(subdir) {
-  return path12.join(tokenGoatHome(), subdir);
+  return path13.join(tokenGoatHome(), subdir);
 }
 function blobPath(subdir, id) {
   const safe = sanitizeId(id);
   if (!safe) return null;
   const dir = blobDir(subdir);
-  const candidate = path12.join(dir, `${safe}.json`);
+  const candidate = path13.join(dir, `${safe}.json`);
   try {
-    const rel = path12.relative(dir, candidate);
+    const rel = path13.relative(dir, candidate);
     if (rel.startsWith("..")) return null;
   } catch {
     return null;
@@ -6773,7 +6785,7 @@ function storeBlob(subdir, id, value, opts = {}) {
   }
   if (Number.isFinite(maxBytesPerItem) && Buffer.byteLength(json2, "utf-8") > maxBytesPerItem) return false;
   try {
-    const dir = path12.dirname(p);
+    const dir = path13.dirname(p);
     if (!fs11.existsSync(dir)) fs11.mkdirSync(dir, { recursive: true });
     atomicWriteText(p, json2);
   } catch {
@@ -6808,7 +6820,7 @@ function listBlobs(subdir) {
       const id = file2.slice(0, -5);
       let mtime = 0;
       try {
-        mtime = fs11.statSync(path12.join(dir, file2)).mtimeMs;
+        mtime = fs11.statSync(path13.join(dir, file2)).mtimeMs;
       } catch {
       }
       const value = loadBlob(subdir, id);
@@ -6829,7 +6841,7 @@ function pruneBlobs(subdir, maxCount = DEFAULT_MAX_COUNT, maxAgeMs = DEFAULT_MAX
     let protectedEntry;
     for (const file2 of fs11.readdirSync(dir)) {
       if (!file2.endsWith(".json")) continue;
-      const full = path12.join(dir, file2);
+      const full = path13.join(dir, file2);
       let stat2;
       try {
         stat2 = fs11.statSync(full);
@@ -7260,15 +7272,15 @@ var init_session = __esm({
 
 // src/session_store.ts
 import * as fs13 from "node:fs";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 function sessionPath(sessionId) {
   if (!sessionId) return null;
   const safe = sanitizeIdForFilename(sessionId, 64);
   if (!safe) return null;
-  const dir = path13.join(tokenGoatHome(), SESSIONS_SUBDIR);
-  const candidate = path13.join(dir, `${safe}.json`);
+  const dir = path14.join(tokenGoatHome(), SESSIONS_SUBDIR);
+  const candidate = path14.join(dir, `${safe}.json`);
   try {
-    const rel = path13.relative(dir, candidate);
+    const rel = path14.relative(dir, candidate);
     if (rel.startsWith("..")) return null;
   } catch {
     return null;
@@ -7503,13 +7515,13 @@ function listSiblingSessionStates(sessionId) {
   const safeSessionId = sanitizeIdForFilename(sessionId);
   if (!safeSessionId) return [];
   const prefix = `${safeSessionId}${AGENT_SALT_MARKER}`;
-  const dir = path13.join(tokenGoatHome(), SESSIONS_SUBDIR);
+  const dir = path14.join(tokenGoatHome(), SESSIONS_SUBDIR);
   const out2 = [];
   try {
     if (!fs13.existsSync(dir)) return out2;
     for (const file2 of fs13.readdirSync(dir)) {
       if (!file2.endsWith(".json") || !file2.startsWith(prefix)) continue;
-      const state = readDiskState(path13.join(dir, file2));
+      const state = readDiskState(path14.join(dir, file2));
       if (state !== null) out2.push(state);
     }
   } catch {
@@ -7528,7 +7540,7 @@ function saveSessionState(sessionId) {
   const p = sessionPath(sessionId);
   if (!p) return;
   try {
-    const dir = path13.dirname(p);
+    const dir = path14.dirname(p);
     if (!fs13.existsSync(dir)) fs13.mkdirSync(dir, { recursive: true });
     const mem = exportSessionState();
     const writeMerged = () => {
@@ -8108,7 +8120,7 @@ var init_overflow_guard = __esm({
 
 // src/compact.ts
 import * as fs14 from "node:fs";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 function tierForFraction(fill) {
   if (fill >= CONTEXT_TIER_CRITICAL) return "critical";
   if (fill >= CONTEXT_TIER_HOT) return "hot";
@@ -8175,7 +8187,7 @@ function inferSessionGoal(cache, maxTokens = 80) {
     const dirCounts = new Counter();
     for (const fpath of editedPaths) {
       try {
-        let parent = path14.dirname(fpath);
+        let parent = path15.dirname(fpath);
         if (parent === ".") {
           parent = "root";
         } else if (parent.startsWith("./")) {
@@ -8251,7 +8263,7 @@ function isNoisePath(inputPath) {
 }
 function findLatestSessionId() {
   try {
-    const sessionsDir = path14.join(tokenGoatHome(), "sessions");
+    const sessionsDir = path15.join(tokenGoatHome(), "sessions");
     if (!fs14.existsSync(sessionsDir)) {
       return null;
     }
@@ -8265,9 +8277,9 @@ function findLatestSessionId() {
       return null;
     }
     let latestFile = firstFile;
-    let latestMtime = fs14.statSync(path14.join(sessionsDir, firstFile)).mtimeMs;
+    let latestMtime = fs14.statSync(path15.join(sessionsDir, firstFile)).mtimeMs;
     for (const file2 of jsonFiles) {
-      const mtime = fs14.statSync(path14.join(sessionsDir, file2)).mtimeMs;
+      const mtime = fs14.statSync(path15.join(sessionsDir, file2)).mtimeMs;
       if (mtime > latestMtime) {
         latestFile = file2;
         latestMtime = mtime;
@@ -8289,15 +8301,15 @@ function eventCount(cache) {
 function writeSessionManifest(projectHash2, sessionId, manifestJson) {
   const safeSessionId = sanitizeIdForFilename(sessionId, 64);
   if (!safeSessionId) return;
-  const sessionsDir = path14.join(dataDir(), "projects", projectHash2, "sessions");
+  const sessionsDir = path15.join(dataDir(), "projects", projectHash2, "sessions");
   if (!fs14.existsSync(sessionsDir)) {
     fs14.mkdirSync(sessionsDir, { recursive: true });
   }
-  const dest = path14.join(sessionsDir, `${safeSessionId}.json`);
+  const dest = path15.join(sessionsDir, `${safeSessionId}.json`);
   atomicWriteText(dest, JSON.stringify(manifestJson));
 }
 function readAllSessionManifests(projectHash2, maxAgeSecs = 3600) {
-  const sessionsDir = path14.join(dataDir(), "projects", projectHash2, "sessions");
+  const sessionsDir = path15.join(dataDir(), "projects", projectHash2, "sessions");
   if (!fs14.existsSync(sessionsDir)) {
     return [];
   }
@@ -8310,7 +8322,7 @@ function readAllSessionManifests(projectHash2, maxAgeSecs = 3600) {
         continue;
       }
       try {
-        const fullPath = path14.join(sessionsDir, file2);
+        const fullPath = path15.join(sessionsDir, file2);
         const stat2 = fs14.statSync(fullPath);
         if (now - stat2.mtimeMs / 1e3 > maxAgeSecs) {
           try {
@@ -8628,14 +8640,14 @@ var init_compact = __esm({
 
 // src/snapshots.ts
 import * as fs15 from "node:fs";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 function sessionDir(sessionId) {
   if (!sessionId) return null;
   const safe = sanitizeIdForFilename(sessionId, 64, "anon");
-  const base = path15.join(tokenGoatHome(), "session_snapshots");
-  const candidate = path15.join(base, safe);
+  const base = path16.join(tokenGoatHome(), "session_snapshots");
+  const candidate = path16.join(base, safe);
   try {
-    const rel = path15.relative(base, candidate);
+    const rel = path16.relative(base, candidate);
     if (rel.startsWith("..")) return null;
   } catch {
     return null;
@@ -8648,7 +8660,7 @@ function pathKey(filePath) {
 function snapshot_path(sessionId, filePath) {
   const d = sessionDir(sessionId);
   if (!d) return null;
-  return path15.join(d, `${pathKey(filePath)}.bin`);
+  return path16.join(d, `${pathKey(filePath)}.bin`);
 }
 function kindSidecarPath(snapshotPath) {
   return snapshotPath + ".kind";
@@ -8656,7 +8668,7 @@ function kindSidecarPath(snapshotPath) {
 function writeSnapshotKind(sidecarPath, kind) {
   try {
     const safeKind = VALID_KINDS.has(kind) ? kind : KIND_READ;
-    const dir = path15.dirname(sidecarPath);
+    const dir = path16.dirname(sidecarPath);
     if (!fs15.existsSync(dir)) {
       fs15.mkdirSync(dir, { recursive: true });
     }
@@ -8671,7 +8683,7 @@ function evictOldest(d, maxCount) {
     const entries = [];
     const files = fs15.readdirSync(d);
     for (const file2 of files) {
-      const fullPath = path15.join(d, file2);
+      const fullPath = path16.join(d, file2);
       if (!file2.endsWith(".bin")) continue;
       try {
         const stat2 = fs15.statSync(fullPath);
@@ -8732,7 +8744,7 @@ function store(sessionId, filePath, content, opts = {}) {
       } catch {
       }
     }
-    const dir = path15.dirname(p);
+    const dir = path16.dirname(p);
     if (!fs15.existsSync(dir)) {
       fs15.mkdirSync(dir, { recursive: true });
     }
@@ -8814,11 +8826,11 @@ function buildPackageManifestHint(options) {
     return null;
   }
 }
-function _sanitizeHintPath(path69) {
-  if (typeof path69 !== "string") {
+function _sanitizeHintPath(path70) {
+  if (typeof path70 !== "string") {
     return "???";
   }
-  return path69.replace(/[\x00]/g, "").slice(0, 200);
+  return path70.replace(/[\x00]/g, "").slice(0, 200);
 }
 var HINT_PRIORITY_MEDIUM;
 var init_hints = __esm({
@@ -9475,7 +9487,7 @@ var init_init_state = __esm({
         needMoreDataSize: Math.max(
           // Skip if the remaining buffer smaller than comment
           options.comment !== null ? options.comment.length : 0,
-          ...options.delimiter ? options.delimiter.map((delimiter2) => delimiter2.length) : [],
+          ...options.delimiter ? options.delimiter.map((delimiter3) => delimiter3.length) : [],
           // Auto discovery of delimiter is limited to 1 character
           options.delimiter_auto ? 1 : 0,
           // Skip if the remaining buffer can be escape sequence
@@ -9743,11 +9755,11 @@ var init_normalize_options = __esm({
         }
         options.delimiter = [options.delimiter];
       }
-      options.delimiter = options.delimiter.map(function(delimiter2) {
-        if (typeof delimiter2 === "string") {
-          delimiter2 = Buffer.from(delimiter2, options.encoding);
+      options.delimiter = options.delimiter.map(function(delimiter3) {
+        if (typeof delimiter3 === "string") {
+          delimiter3 = Buffer.from(delimiter3, options.encoding);
         }
-        if (!Buffer.isBuffer(delimiter2) || delimiter2.length === 0) {
+        if (!Buffer.isBuffer(delimiter3) || delimiter3.length === 0) {
           throw new CsvError(
             "CSV_INVALID_OPTION_DELIMITER",
             [
@@ -9758,7 +9770,7 @@ var init_normalize_options = __esm({
             options
           );
         }
-        return delimiter2;
+        return delimiter3;
       });
       if (options.escape === void 0 || options.escape === true) {
         options.escape = Buffer.from('"', options.encoding);
@@ -10843,14 +10855,14 @@ var init_api = __esm({
           return 0;
         },
         __isDelimiter: function(buf, pos, chr) {
-          const { delimiter: delimiter2, ignore_last_delimiters } = this.options;
+          const { delimiter: delimiter3, ignore_last_delimiters } = this.options;
           if (ignore_last_delimiters === true && this.state.record.length === this.options.columns.length - 1) {
             return 0;
           } else if (ignore_last_delimiters !== false && typeof ignore_last_delimiters === "number" && this.state.record.length === ignore_last_delimiters - 1) {
             return 0;
           }
-          loop1: for (let i = 0; i < delimiter2.length; i++) {
-            const del = delimiter2[i];
+          loop1: for (let i = 0; i < delimiter3.length; i++) {
+            const del = delimiter3[i];
             if (del[0] === chr) {
               for (let j = 1; j < del.length; j++) {
                 if (del[j] !== buf[pos + j]) continue loop1;
@@ -11797,7 +11809,8 @@ function handlePdf(filePath, contentLength) {
     shouldBlock: true,
     message: [
       `PDF file (${formatBytes(contentLength)}) \u2014 Read cannot return PDF content; this is not retryable with different Read parameters.`,
-      `Extract text instead: token-goat pdf-extract "${filePath}"`
+      `Inspect first: token-goat pdf-meta "${filePath}" and token-goat pdf-outline "${filePath}"`,
+      `Then extract relevant pages: token-goat pdf-extract "${filePath}" --pages <range>`
     ].join("\n")
   };
 }
@@ -12636,9 +12649,9 @@ var init_lazy_module = __esm({
 // src/image_ocr.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createRequire as createRequire4 } from "node:module";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 function ocrCacheDir() {
-  return path16.join(tokenGoatHome(), "ocr-cache");
+  return path17.join(tokenGoatHome(), "ocr-cache");
 }
 function resolveTesseractEntry() {
   if (_tesseractEntryPath !== void 0) return _tesseractEntryPath;
@@ -12746,7 +12759,7 @@ var init_image_ocr = __esm({
 // src/image_shrink.ts
 import { createHash as createHash2 } from "node:crypto";
 import * as fs17 from "node:fs";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 function formatShrinkSummary(result, subject) {
   const saved = result.originalBytes - result.shrunkBytes;
   const pct = Math.round(saved / result.originalBytes * 100);
@@ -12755,7 +12768,7 @@ function formatShrinkSummary(result, subject) {
   return { summary, dataUrl };
 }
 function isImagePath(p) {
-  return IMAGE_EXTENSIONS.has(path17.extname(p).toLowerCase());
+  return IMAGE_EXTENSIONS.has(path18.extname(p).toLowerCase());
 }
 async function probeImageMeta(input) {
   const sharp = await loadSharp();
@@ -12813,7 +12826,7 @@ function statInfo(absPath) {
   }
 }
 function imageShrinkCacheDir() {
-  return path17.join(tokenGoatHome(), "image_shrink_cache");
+  return path18.join(tokenGoatHome(), "image_shrink_cache");
 }
 function shrinkCacheKey(originalPath, size, mtimeMs) {
   return createHash2("sha256").update(`${originalPath}:${size}:${mtimeMs}`).digest("hex").slice(0, 16);
@@ -12826,7 +12839,7 @@ function findCachedShrink(originalPath, size, mtimeMs) {
     { ext: ".jpg", format: "jpeg" }
   ];
   for (const { ext: ext2, format } of candidates) {
-    const candidate = path17.join(dir, `token-goat-shrink-${key}${ext2}`);
+    const candidate = path18.join(dir, `token-goat-shrink-${key}${ext2}`);
     if (fs17.existsSync(candidate)) return { filePath: candidate, format };
   }
   return null;
@@ -12837,7 +12850,7 @@ function writeCachedShrink(originalPath, result, mtimeMs) {
     fs17.mkdirSync(dir, { recursive: true });
     const key = shrinkCacheKey(originalPath, result.originalBytes, mtimeMs);
     const ext2 = result.format === "jpeg" ? ".jpg" : ".webp";
-    atomicWriteBytes(path17.join(dir, `token-goat-shrink-${key}${ext2}`), result.data);
+    atomicWriteBytes(path18.join(dir, `token-goat-shrink-${key}${ext2}`), result.data);
   } catch {
   }
 }
@@ -12851,7 +12864,7 @@ function pruneShrinkCache() {
     const cutoff = now - DEFAULT_MAX_AGE_MS;
     for (const file2 of fs17.readdirSync(dir)) {
       if (!file2.startsWith("token-goat-shrink-")) continue;
-      const full = path17.join(dir, file2);
+      const full = path18.join(dir, file2);
       try {
         const st = fs17.statSync(full);
         if (st.mtimeMs < cutoff) fs17.unlinkSync(full);
@@ -12862,7 +12875,7 @@ function pruneShrinkCache() {
   }
 }
 async function finalizeShrinkResult(result, filePath) {
-  const basename22 = path17.basename(filePath);
+  const basename22 = path18.basename(filePath);
   if (loadConfig().image_shrink.ocr_enabled) {
     const ocr = await ocrImage(result.data);
     if (ocr !== null && isTextHeavy(ocr, loadConfig().image_shrink.ocr_min_confidence)) {
@@ -12988,7 +13001,7 @@ var init_image_shrink = __esm({
 
 // src/doc_compact.ts
 import * as fs18 from "fs";
-import * as path18 from "path";
+import * as path19 from "path";
 function sourceHash(filePath) {
   try {
     return fingerprintContent(fs18.readFileSync(filePath));
@@ -12998,14 +13011,14 @@ function sourceHash(filePath) {
 }
 function _compactSlug(absPathStr) {
   const h = fingerprintContent(foldPath(absPathStr)).slice(0, 12);
-  const ext2 = path18.extname(absPathStr);
-  const stem = path18.basename(absPathStr, ext2);
+  const ext2 = path19.extname(absPathStr);
+  const stem = path19.basename(absPathStr, ext2);
   const safeStem = sanitizeIdForFilename(stem, 32);
   return `${h}_${safeStem}`;
 }
 function compactPathFor(sourcePath) {
   const abs = resolveIndexPath(sourcePath);
-  return path18.join(dataDir(), compactSubdir, `${_compactSlug(abs)}.md`);
+  return path19.join(dataDir(), compactSubdir, `${_compactSlug(abs)}.md`);
 }
 function readCompactHeader(compactPath) {
   try {
@@ -13054,13 +13067,13 @@ function readCompactBody(compactPath) {
   }
 }
 function writeCompact(compactPath, sourcePath, compactBody, sourceRel) {
-  const srcPath = path18.resolve(sourcePath);
+  const srcPath = path19.resolve(sourcePath);
   const sha = sourceHash(srcPath);
-  const displayRel = sourceRel || path18.basename(srcPath);
+  const displayRel = sourceRel || path19.basename(srcPath);
   const header = `${headerPrefix}${sha} source:${displayRel} -->
 `;
   const fullText = header + compactBody.trimStart();
-  const dir = path18.dirname(compactPath);
+  const dir = path19.dirname(compactPath);
   if (!fs18.existsSync(dir)) {
     fs18.mkdirSync(dir, { recursive: true });
   }
@@ -13211,7 +13224,7 @@ var init_doc_compact = __esm({
 
 // src/notebook_compact.ts
 import * as fs19 from "node:fs";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function stripNotebook(nbDict) {
   const cells = [];
   for (const cell of nbDict.cells ?? []) {
@@ -13228,14 +13241,14 @@ function stripNotebook(nbDict) {
   return { ...nbDict, cells };
 }
 function pruneSidecars(cacheRoot, maxCount = SIDECAR_DEFAULT_MAX_COUNT, maxAgeMs = SIDECAR_DEFAULT_MAX_AGE_MS) {
-  const nbStripDir = path19.join(cacheRoot, "nb_strip");
+  const nbStripDir = path20.join(cacheRoot, "nb_strip");
   let removed = 0;
   try {
     if (!fs19.existsSync(nbStripDir)) return 0;
     const cutoff = Date.now() - maxAgeMs;
     const kept = [];
     for (const entry of fs19.readdirSync(nbStripDir)) {
-      const dir = path19.join(nbStripDir, entry);
+      const dir = path20.join(nbStripDir, entry);
       let mtime;
       try {
         mtime = fs19.statSync(dir).mtimeMs;
@@ -13271,8 +13284,8 @@ function pruneSidecars(cacheRoot, maxCount = SIDECAR_DEFAULT_MAX_COUNT, maxAgeMs
 }
 function getOrCreateSidecar(rawBytes, cacheRoot, opts = {}) {
   const sha = fingerprintContent(rawBytes);
-  const sidecarDir = path19.join(cacheRoot, "nb_strip", sha);
-  const sidecarPath = path19.join(sidecarDir, "stripped.ipynb");
+  const sidecarDir = path20.join(cacheRoot, "nb_strip", sha);
+  const sidecarPath = path20.join(sidecarDir, "stripped.ipynb");
   if (fs19.existsSync(sidecarPath)) {
     return [sidecarPath, false];
   }
@@ -13313,20 +13326,20 @@ var init_notebook_compact = __esm({
 });
 
 // src/parser_types.ts
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function detectLanguage(filePath) {
-  const base = path20.basename(filePath).toLowerCase();
+  const base = path21.basename(filePath).toLowerCase();
   if (DOTENV_VARIANT_RE.test(base)) return "env_file";
   const byName = FILENAME_LANGUAGE.get(base);
   if (byName !== void 0) return byName;
   if (base.endsWith("-meta.xml")) {
     return "salesforce_metadata";
   }
-  const ext2 = path20.extname(base).toLowerCase();
+  const ext2 = path21.extname(base).toLowerCase();
   return EXTENSION_LANGUAGE.get(ext2) ?? "unknown";
 }
 function unsupportedLanguageName(filePath) {
-  const ext2 = path20.extname(filePath).toLowerCase();
+  const ext2 = path21.extname(filePath).toLowerCase();
   return UNSUPPORTED_LANGUAGE_EXTENSIONS.get(ext2);
 }
 var EXTENSION_LANGUAGE, FILENAME_LANGUAGE, DOTENV_VARIANT_RE, UNSUPPORTED_LANGUAGE_EXTENSIONS;
@@ -13478,7 +13491,7 @@ var init_parser_types = __esm({
 
 // src/hooks_read.ts
 import * as fs20 from "node:fs";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function isTsConfigFile(basename22) {
   const lower = basename22.toLowerCase();
   return /^tsconfig(\..+)?\.json$/i.test(lower) || lower === "jsconfig.json";
@@ -13493,8 +13506,8 @@ function isNodeModulesPath(p) {
   return check2.includes("/node_modules/") || check2.includes("\\node_modules\\");
 }
 function relPathWithinRoot(root, target) {
-  const rel = path21.relative(root, target).replace(/\\/g, "/");
-  if (rel.startsWith("..") || path21.isAbsolute(rel)) return null;
+  const rel = path22.relative(root, target).replace(/\\/g, "/");
+  if (rel.startsWith("..") || path22.isAbsolute(rel)) return null;
   return rel;
 }
 function _isDocFile(filePath) {
@@ -13586,7 +13599,7 @@ function isSourceExtension(basename22) {
   return language === "apex" || language === "salesforce_metadata" || language === "salesforce_markup";
 }
 function isDispatchedFileType(basename22) {
-  return DISPATCHED_FILE_TYPE_EXTS.has(path21.extname(basename22).slice(1).toLowerCase());
+  return DISPATCHED_FILE_TYPE_EXTS.has(path22.extname(basename22).slice(1).toLowerCase());
 }
 function surgicalHint(filePath, basename22, lineCount) {
   if (lineCount < loadConfig().hints.min_file_lines_for_hint) return "";
@@ -13730,7 +13743,7 @@ function preReadHandlerInner(event) {
       "node_modules is typically noise; use npm ls, npm outdated, or npm audit instead for dependency info. To force access, use: token-goat read node_modules/package/file.js::symbol-name or token-goat section node_modules/package/file.js::heading"
     );
   }
-  const basename22 = path21.basename(normalized);
+  const basename22 = path22.basename(normalized);
   if (isLockFile(basename22)) {
     return denyOutput(
       'Lock files are rarely useful to read in full. Use `token-goat section "' + normalized + '::<section>"` to extract a specific dependency, or read the relevant manifest instead.'
@@ -14051,7 +14064,7 @@ function preReadHandlerInner(event) {
       "Note: " + normalized + " is large (" + kb + "KB). " + hint + contextPressureAdvisorySuffix()
     );
   }
-  const fileTypeExt = path21.extname(normalized).slice(1).toLowerCase();
+  const fileTypeExt = path22.extname(normalized).slice(1).toLowerCase();
   const fileStatSize = size ?? statSize(normalized) ?? 0;
   const isKnownFileType = DISPATCHED_FILE_TYPE_EXTS.has(fileTypeExt);
   if (event.toolName !== "Grep" && !isImagePath(normalized) && (isKnownFileType || fileStatSize >= FILE_TYPE_THRESHOLDS.generic)) {
@@ -14108,7 +14121,7 @@ function postReadHandlerInner(event) {
   if (respText.includes("[Truncated:") || respText.includes("Truncated: PARTIAL view")) {
     markFileTruncated(normalized);
   }
-  const postBasename = path21.basename(normalized);
+  const postBasename = path22.basename(normalized);
   const diffSourcesEnabled = loadConfig().hints.serve_diff_on_reread;
   if (/\.(md|mdx|markdown|rst|txt)$/i.test(postBasename) || isSessionArtifactFile(normalized) || diffSourcesEnabled && DIFFABLE_SOURCE_RE.test(postBasename)) {
     try {
@@ -14962,8 +14975,8 @@ async function readOoxmlZip(filePath) {
   const data = fs22.readFileSync(filePath);
   return fflate.unzipSync(new Uint8Array(data));
 }
-function decodeZipEntry(entries, path69) {
-  const bytes = entries[path69];
+function decodeZipEntry(entries, path70) {
+  const bytes = entries[path70];
   if (bytes === void 0) return null;
   return new TextDecoder("utf-8").decode(bytes);
 }
@@ -15173,9 +15186,9 @@ async function notesPathFor(entries, slidePath) {
   }
   return null;
 }
-async function parseSlide(entries, path69) {
-  const xml = decodeZipEntry(entries, path69);
-  if (xml === null) throw new Error(`missing part: ${path69}`);
+async function parseSlide(entries, path70) {
+  const xml = decodeZipEntry(entries, path70);
+  if (xml === null) throw new Error(`missing part: ${path70}`);
   return parseOoxmlPart(xml);
 }
 async function notesTextFor(entries, notesPath) {
@@ -15191,8 +15204,8 @@ async function pptxOutline(filePath) {
   const { entries, slidePaths } = await listSlideParts(filePath);
   const out2 = [];
   for (let i = 0; i < slidePaths.length; i++) {
-    const path69 = slidePaths[i];
-    const parsed = await parseSlide(entries, path69);
+    const path70 = slidePaths[i];
+    const parsed = await parseSlide(entries, path70);
     const shapes = slideShapes(parsed);
     const titleShape = shapes.find((s) => {
       const t = shapePlaceholderType(s);
@@ -15201,7 +15214,7 @@ async function pptxOutline(filePath) {
     const title = titleShape !== void 0 ? shapeText(titleShape) : "";
     const allText = collectTextRuns(parsed, "a:t").join(" ");
     const bodyChars = Math.max(0, allText.length - title.length);
-    const hasNotes = (await notesTextFor(entries, await notesPathFor(entries, path69))).length > 0;
+    const hasNotes = (await notesTextFor(entries, await notesPathFor(entries, path70))).length > 0;
     out2.push({ slide: i + 1, title, bodyChars, hasNotes });
   }
   return out2;
@@ -15211,13 +15224,13 @@ async function pptxSlideText(filePath, slideNumber, includeNotes) {
   if (slideNumber < 1 || slideNumber > slidePaths.length) {
     throw new Error(`slide ${slideNumber} out of range (this deck has ${slidePaths.length} slides)`);
   }
-  const path69 = slidePaths[slideNumber - 1];
-  const parsed = await parseSlide(entries, path69);
+  const path70 = slidePaths[slideNumber - 1];
+  const parsed = await parseSlide(entries, path70);
   const shapes = slideShapes(parsed);
   const blocks = [...shapes.map(shapeText).filter((t) => t.length > 0), ...tableRowBlocks(parsed)];
   const lines2 = [`# Slide ${slideNumber}`, ...blocks];
   if (includeNotes) {
-    const notes = await notesTextFor(entries, await notesPathFor(entries, path69));
+    const notes = await notesTextFor(entries, await notesPathFor(entries, path70));
     if (notes.length > 0) lines2.push("", "## Speaker notes", notes);
   }
   return lines2.join("\n\n");
@@ -15261,18 +15274,18 @@ var init_pptx_extract = __esm({
 
 // src/csv_query.ts
 function parseRecords(content, opts) {
-  const delimiter2 = opts.delimiter ?? ",";
+  const delimiter3 = opts.delimiter ?? ",";
   if (opts.noHeader === true) {
-    const rows = parse3(content, { columns: false, skip_empty_lines: true, trim: true, delimiter: delimiter2, bom: true });
+    const rows = parse3(content, { columns: false, skip_empty_lines: true, trim: true, delimiter: delimiter3, bom: true });
     return rows.map((row) => Object.fromEntries(row.map((cell, i) => [`col${i + 1}`, cell])));
   }
-  return parse3(content, { columns: true, skip_empty_lines: true, trim: true, delimiter: delimiter2, bom: true });
+  return parse3(content, { columns: true, skip_empty_lines: true, trim: true, delimiter: delimiter3, bom: true });
 }
 function csvHeader(content, opts) {
   if (opts.noHeader === true) return [];
-  const delimiter2 = opts.delimiter ?? ",";
+  const delimiter3 = opts.delimiter ?? ",";
   try {
-    const rows = parse3(content, { columns: false, skip_empty_lines: true, trim: true, delimiter: delimiter2, bom: true, to: 1 });
+    const rows = parse3(content, { columns: false, skip_empty_lines: true, trim: true, delimiter: delimiter3, bom: true, to: 1 });
     return rows[0] ?? [];
   } catch {
     return [];
@@ -15634,13 +15647,13 @@ var init_xlsx_extract = __esm({
 
 // src/doc_embed_extract.ts
 import * as fs23 from "node:fs";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 function isEmbeddableDocument(filePath) {
-  return EMBEDDABLE_DOCUMENT_EXTENSIONS.has(path23.extname(filePath).toLowerCase());
+  return EMBEDDABLE_DOCUMENT_EXTENSIONS.has(path24.extname(filePath).toLowerCase());
 }
 async function extractEmbeddableDocumentText(filePath) {
   try {
-    switch (path23.extname(filePath).toLowerCase()) {
+    switch (path24.extname(filePath).toLowerCase()) {
       case ".pdf": {
         const data = await fs23.promises.readFile(filePath);
         const { text } = await extractPdfText(new Uint8Array(data));
@@ -16286,7 +16299,7 @@ var init_html = __esm({
 });
 
 // src/languages/liquid.ts
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 function extractLiquid(content, filePath, relPath) {
   const symbols = [];
   const imports = [];
@@ -16320,7 +16333,7 @@ function extractLiquid(content, filePath, relPath) {
   const resolvedRel = relPath ?? filePath;
   const relPosix = resolvedRel.replace(/\\/g, "/");
   if (relPosix.startsWith("sections/") || relPosix.includes("/sections/")) {
-    const stem = path24.basename(resolvedRel, path24.extname(resolvedRel));
+    const stem = path25.basename(resolvedRel, path25.extname(resolvedRel));
     symbols.push({ filePath, name: stem, kind: "liquid_section_file", lineStart: 1, lineEnd: 1, body: "", docstring: "", parent: "" });
   }
   const totalLines = content.split("\n").length;
@@ -18549,7 +18562,7 @@ var init_apex = __esm({
 });
 
 // src/languages/salesforce_metadata.ts
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 function xmlText(content, tag) {
   const re = new RegExp(
     `<(?:[A-Za-z_][\\w.-]*:)?${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</(?:[A-Za-z_][\\w.-]*:)?${tag}>`,
@@ -18585,7 +18598,7 @@ function normalizedPath(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function basenameWithout(filePath, suffix) {
-  const base = path25.basename(filePath);
+  const base = path26.basename(filePath);
   return base.toLowerCase().endsWith(suffix.toLowerCase()) ? base.slice(0, base.length - suffix.length) : base;
 }
 function objectNameFromPath(filePath) {
@@ -18624,12 +18637,12 @@ function snakeCase(value) {
   return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
 }
 function companionName(filePath) {
-  const base = path25.basename(filePath);
+  const base = path26.basename(filePath);
   const match2 = /^(.+)\.(?:cls|trigger|page|component|cmp|app|evt|intf|design|auradoc|tokens|js)-meta\.xml$/i.exec(base);
   return match2?.[1] === void 0 ? null : `${match2[1]}.metadata`;
 }
 function metadataArtifactName(filePath) {
-  const base = path25.basename(filePath);
+  const base = path26.basename(filePath);
   const match2 = /^(.+)\.[^.]+-meta\.xml$/i.exec(base);
   return match2?.[1] ?? basenameWithout(filePath, "-meta.xml");
 }
@@ -18720,7 +18733,7 @@ function extractSalesforceMetadata(rawContent, filePath) {
   const seen = /* @__PURE__ */ new Set();
   const refs = [];
   const seenRefs = /* @__PURE__ */ new Set();
-  const base = path25.basename(filePath).toLowerCase();
+  const base = path26.basename(filePath).toLowerCase();
   const whole = wholeFileSpan(content);
   const root = rootElement(content);
   if (root === null) return { symbols, refs };
@@ -18894,14 +18907,14 @@ var init_salesforce_metadata = __esm({
 });
 
 // src/languages/salesforce_frontend.ts
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 function lines(content) {
   return content.split("\n");
 }
 function bundleName(filePath) {
   const normalized = filePath.replaceAll("\\", "/");
-  const parent = path26.posix.basename(path26.posix.dirname(normalized));
-  const base = path26.posix.basename(normalized).replace(/\.[^.]+$/, "");
+  const parent = path27.posix.basename(path27.posix.dirname(normalized));
+  const base = path27.posix.basename(normalized).replace(/\.[^.]+$/, "");
   return parent === "lwc" || parent === "aura" ? base : parent;
 }
 function lwcTagAlias(name2) {
@@ -18993,7 +19006,7 @@ function extractLwcTemplate(content, filePath) {
 }
 function markupArtifactName(filePath, extension) {
   if (extension === ".page" || extension === ".component" || extension === ".email") {
-    return path26.posix.basename(filePath.replaceAll("\\", "/")).replace(new RegExp(`${extension.replace(".", "\\.")}$`, "i"), "");
+    return path27.posix.basename(filePath.replaceAll("\\", "/")).replace(new RegExp(`${extension.replace(".", "\\.")}$`, "i"), "");
   }
   return bundleName(filePath);
 }
@@ -19013,7 +19026,7 @@ function attributeRefs(refs, content, filePath, attribute, split = false) {
 }
 function extractSalesforceMarkup(content, filePath) {
   const normalized = filePath.replaceAll("\\", "/");
-  const extension = path26.posix.extname(normalized).toLowerCase();
+  const extension = path27.posix.extname(normalized).toLowerCase();
   const sourceLines = lines(content);
   const kind = MARKUP_KIND[extension] ?? "salesforce_markup";
   const symbols = [
@@ -19066,7 +19079,7 @@ var init_salesforce_frontend = __esm({
 });
 
 // src/languages/sfc_idx.ts
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 function dedupe2(values, key) {
   const seen = /* @__PURE__ */ new Set();
   return values.filter((value) => {
@@ -19084,7 +19097,7 @@ function finalize(symbols, refs) {
 }
 function componentName(filePath) {
   const normalized = filePath.replaceAll("\\", "/");
-  return path27.posix.basename(normalized).replace(/\.[^.]+$/, "");
+  return path28.posix.basename(normalized).replace(/\.[^.]+$/, "");
 }
 function matchLine2(content, offset) {
   return content.slice(0, offset).split("\n").length;
@@ -19324,7 +19337,7 @@ var init_ipynb_idx = __esm({
 // src/parser.ts
 import * as fs24 from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 function loadParserCtor() {
   if (_parserCtor !== void 0) return _parserCtor;
   try {
@@ -19406,8 +19419,8 @@ function countNewlines(s) {
   return n;
 }
 function loadGrammar(lang, filePath, content) {
-  const useTsx = lang === "typescript" && filePath !== void 0 && path28.extname(filePath).toLowerCase() === ".tsx";
-  const useCppHeader = lang === "c" && filePath !== void 0 && path28.extname(filePath).toLowerCase() === ".h" && content !== void 0 && CPP_HEADER_SNIFF_RE.test(content);
+  const useTsx = lang === "typescript" && filePath !== void 0 && path29.extname(filePath).toLowerCase() === ".tsx";
+  const useCppHeader = lang === "c" && filePath !== void 0 && path29.extname(filePath).toLowerCase() === ".h" && content !== void 0 && CPP_HEADER_SNIFF_RE.test(content);
   const cacheKey = useTsx ? "typescript:tsx" : useCppHeader ? "c:cpp-header" : lang;
   const cached2 = _grammarCache.get(cacheKey);
   if (cached2 !== void 0) return cached2;
@@ -20456,7 +20469,7 @@ function isUnderSkipDir(filePath, skipDirs) {
 }
 function isParseSkipEligible(filePath, cfg) {
   if (isUnderSkipDir(filePath, cfg.skip_dirs)) return true;
-  if (cfg.skip_files.includes(path28.basename(filePath))) return true;
+  if (cfg.skip_files.includes(path29.basename(filePath))) return true;
   try {
     const stat2 = fs24.statSync(filePath);
     if (stat2.size > cfg.large_file_skip_kb * 1024) return true;
@@ -21194,7 +21207,7 @@ var init_parser = __esm({
 
 // src/index_prune.ts
 import * as fs25 from "node:fs";
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 function removeFileFromIndex(db, filePath) {
   const tx = db.transaction(() => {
     deleteFileRows(db, filePath);
@@ -21270,7 +21283,7 @@ function pruneSystemTempFiles(dbPath = globalDbPath()) {
   return removeFilesBestEffort(db, findSystemTempFiles(dbPath));
 }
 function recordKnownRoot(filePath, dbPath = globalDbPath()) {
-  const project = findProject(path29.dirname(filePath));
+  const project = findProject(path30.dirname(filePath));
   if (project === null || isTooShallowToPrune(project.root)) return;
   const db = getDb(dbPath);
   db.prepare(
@@ -21279,7 +21292,7 @@ function recordKnownRoot(filePath, dbPath = globalDbPath()) {
   ).run(project.root, Date.now());
 }
 function knownRootRecordMarkerPath(dir, filePath) {
-  return path29.join(dir, `known-root-record-${shortFingerprint(path29.dirname(filePath))}.marker`);
+  return path30.join(dir, `known-root-record-${shortFingerprint(path30.dirname(filePath))}.marker`);
 }
 function recordKnownRootThrottled(filePath, dir = dataDir(), dbPath = globalDbPath()) {
   const markerPath = knownRootRecordMarkerPath(dir, filePath);
@@ -21315,13 +21328,13 @@ var init_index_prune = __esm({
 // src/worker.ts
 import { spawn as spawn3 } from "node:child_process";
 import * as fs26 from "node:fs";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function dirtyQueuePathFor(dir) {
-  return path30.join(dir, "queue", "dirty.txt");
+  return path31.join(dir, "queue", "dirty.txt");
 }
 function drainHeartbeatPathFor(dir) {
-  return path30.join(dir, "queue", "drain-heartbeat");
+  return path31.join(dir, "queue", "drain-heartbeat");
 }
 function hasFreshWorkerHeartbeat(dir, pid) {
   try {
@@ -21354,7 +21367,7 @@ function parseDirtyQueueLines(raw) {
   return out2;
 }
 function workerPidPath(dir = dataDir()) {
-  return path30.join(dir, "worker.pid");
+  return path31.join(dir, "worker.pid");
 }
 function getDirtyPathsFor(dir) {
   let raw;
@@ -21366,7 +21379,7 @@ function getDirtyPathsFor(dir) {
   return parseDirtyQueueLines(raw);
 }
 function workerErrorLogPath(dir) {
-  return path30.join(dir, "worker-errors.log");
+  return path31.join(dir, "worker-errors.log");
 }
 function appendWorkerErrorLog(dir, line) {
   try {
@@ -21397,7 +21410,7 @@ function isWorkerRunning(dir = dataDir()) {
   return pidAlive(pid) && hasFreshWorkerHeartbeat(dir, pid);
 }
 function workerHealthCheckMarkerPath(dir) {
-  return path30.join(dir, "worker-healthcheck.marker");
+  return path31.join(dir, "worker-healthcheck.marker");
 }
 function ensureWorkerAlive(dir = dataDir()) {
   if (process.env["TOKEN_GOAT_NO_WORKER_SPAWN"] === "1") return;
@@ -21553,13 +21566,13 @@ var init_worker = __esm({
 
 // src/hooks_index.ts
 import * as fs27 from "node:fs";
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 function dirtyQueuePath() {
-  return path31.join(dataDir(), "queue", "dirty.txt");
+  return path32.join(dataDir(), "queue", "dirty.txt");
 }
 function appendDirtyPath(normalizedPath2) {
   const queuePath = dirtyQueuePath();
-  const dir = path31.dirname(queuePath);
+  const dir = path32.dirname(queuePath);
   try {
     fs27.mkdirSync(dir, { recursive: true });
   } catch (e) {
@@ -21593,9 +21606,9 @@ function getDirtyPaths() {
 function preCompactIndexHandler(_event) {
   const paths = getDirtyPaths();
   if (paths.length > 0) {
-    const sidecar = path31.join(dataDir(), "queue", "pending.txt");
+    const sidecar = path32.join(dataDir(), "queue", "pending.txt");
     try {
-      fs27.mkdirSync(path31.dirname(sidecar), { recursive: true });
+      fs27.mkdirSync(path32.dirname(sidecar), { recursive: true });
       atomicWriteBytes(sidecar, Buffer.from(`${paths.join("\n")}
 `, "utf8"));
     } catch {
@@ -22556,7 +22569,7 @@ var require_command = __commonJS({
     init_define_import_meta_env();
     var EventEmitter = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
-    var path69 = __require("node:path");
+    var path70 = __require("node:path");
     var fs61 = __require("node:fs");
     var process4 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -23489,9 +23502,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path69.resolve(baseDir, baseName);
+          const localBin = path70.resolve(baseDir, baseName);
           if (fs61.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path69.extname(baseName))) return void 0;
+          if (sourceExt.includes(path70.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
             (ext2) => fs61.existsSync(`${localBin}${ext2}`)
           );
@@ -23509,17 +23522,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch (err2) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path69.resolve(
-            path69.dirname(resolvedScriptPath),
+          executableDir = path70.resolve(
+            path70.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path69.basename(
+            const legacyName = path70.basename(
               this._scriptPath,
-              path69.extname(this._scriptPath)
+              path70.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -23530,7 +23543,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path69.extname(executableFile));
+        launchWithNode = sourceExt.includes(path70.extname(executableFile));
         let proc;
         if (process4.platform !== "win32") {
           if (launchWithNode) {
@@ -24370,7 +24383,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path69.basename(filename, path69.extname(filename));
+        this._name = path70.basename(filename, path70.extname(filename));
         return this;
       }
       /**
@@ -24384,9 +24397,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path70) {
-        if (path70 === void 0) return this._executableDir;
-        this._executableDir = path70;
+      executableDir(path71) {
+        if (path71 === void 0) return this._executableDir;
+        this._executableDir = path71;
         return this;
       }
       /**
@@ -27320,10 +27333,10 @@ var init_json_query = __esm({
 });
 
 // src/openapi_query.ts
-import * as path33 from "node:path";
+import * as path34 from "node:path";
 function parseOpenApiSpec(text, filePath) {
   text = stripBom(text);
-  const ext2 = path33.extname(filePath).toLowerCase();
+  const ext2 = path34.extname(filePath).toLowerCase();
   if (ext2 === ".yaml" || ext2 === ".yml") return load2(text);
   if (ext2 === ".json") return JSON.parse(text);
   try {
@@ -28402,7 +28415,7 @@ var init_conflict_query = __esm({
 // src/screenshot.ts
 import dns from "node:dns/promises";
 import fs29 from "node:fs";
-import path34 from "node:path";
+import path35 from "node:path";
 function findPlaywrightChromium(msPlaywrightDir) {
   let entries;
   try {
@@ -28414,7 +28427,7 @@ function findPlaywrightChromium(msPlaywrightDir) {
   const candidates = [];
   for (const m of versioned) {
     for (const sub of PLAYWRIGHT_CHROME_SUBDIRS) {
-      candidates.push(path34.join(msPlaywrightDir, m[0], sub, "chrome.exe"));
+      candidates.push(path35.join(msPlaywrightDir, m[0], sub, "chrome.exe"));
     }
   }
   return candidates;
@@ -28425,23 +28438,23 @@ function platformCandidatePaths() {
     const programFiles = process.env["PROGRAMFILES"];
     const programFilesX86 = process.env["PROGRAMFILES(X86)"];
     const localAppData = process.env["LOCALAPPDATA"];
-    if (programFiles) candidates2.push(path34.join(programFiles, "Google", "Chrome", "Application", "chrome.exe"));
-    if (programFilesX86) candidates2.push(path34.join(programFilesX86, "Google", "Chrome", "Application", "chrome.exe"));
+    if (programFiles) candidates2.push(path35.join(programFiles, "Google", "Chrome", "Application", "chrome.exe"));
+    if (programFilesX86) candidates2.push(path35.join(programFilesX86, "Google", "Chrome", "Application", "chrome.exe"));
     if (localAppData) {
-      candidates2.push(path34.join(localAppData, "Google", "Chrome", "Application", "chrome.exe"));
-      candidates2.push(...findPlaywrightChromium(path34.join(localAppData, "ms-playwright")));
+      candidates2.push(path35.join(localAppData, "Google", "Chrome", "Application", "chrome.exe"));
+      candidates2.push(...findPlaywrightChromium(path35.join(localAppData, "ms-playwright")));
     }
     return candidates2;
   }
   if (process.platform === "darwin") {
     const home2 = process.env["HOME"];
     const candidates2 = ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"];
-    if (home2) candidates2.push(...findPlaywrightChromium(path34.join(home2, "Library", "Caches", "ms-playwright")));
+    if (home2) candidates2.push(...findPlaywrightChromium(path35.join(home2, "Library", "Caches", "ms-playwright")));
     return candidates2;
   }
   const home = process.env["HOME"];
   const candidates = ["/usr/bin/google-chrome-stable", "/usr/bin/google-chrome", "/usr/bin/chromium-browser", "/usr/bin/chromium"];
-  if (home) candidates.push(...findPlaywrightChromium(path34.join(home, ".cache", "ms-playwright")));
+  if (home) candidates.push(...findPlaywrightChromium(path35.join(home, ".cache", "ms-playwright")));
   return candidates;
 }
 function resolveBrowserExecutablePath(explicit) {
@@ -28856,7 +28869,7 @@ var init_notes = __esm({
 
 // src/ts_refs.ts
 import { createRequire as createRequire7 } from "node:module";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 function loadTs() {
   if (_tsOverride !== void 0) return _tsOverride;
   if (!_tsLoadAttempted) {
@@ -28876,7 +28889,7 @@ function loadError() {
   return _tsError;
 }
 function isTsPath(filePath) {
-  return TS_EXTENSIONS.has(path35.extname(filePath).toLowerCase());
+  return TS_EXTENSIONS.has(path36.extname(filePath).toLowerCase());
 }
 function resolveTypedRefs(input) {
   const ts = loadTs();
@@ -28906,7 +28919,7 @@ function resolveTypedRefs(input) {
   if (defSymbol === null) return null;
   const out2 = [];
   for (const ref2 of input.candidates) {
-    if (!TS_JS_EXTENSIONS.has(path35.extname(ref2.filePath).toLowerCase())) {
+    if (!TS_JS_EXTENSIONS.has(path36.extname(ref2.filePath).toLowerCase())) {
       out2.push(ref2);
       continue;
     }
@@ -28932,12 +28945,12 @@ function buildScopedProgram(ts, rootNames, searchFrom) {
     resolveJsonModule: true,
     esModuleInterop: true
   };
-  const configPath2 = ts.findConfigFile(path35.dirname(searchFrom), ts.sys.fileExists, "tsconfig.json");
+  const configPath2 = ts.findConfigFile(path36.dirname(searchFrom), ts.sys.fileExists, "tsconfig.json");
   if (configPath2 !== void 0) {
     try {
       const raw = ts.readConfigFile(configPath2, ts.sys.readFile);
       if (raw.error === void 0) {
-        const parsed = ts.parseJsonConfigFileContent(raw.config, ts.sys, path35.dirname(configPath2));
+        const parsed = ts.parseJsonConfigFileContent(raw.config, ts.sys, path36.dirname(configPath2));
         Object.assign(options, parsed.options);
       }
     } catch {
@@ -29041,7 +29054,7 @@ var init_ts_refs = __esm({
 
 // src/read_commands.ts
 import * as fs31 from "node:fs";
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 function fileExists(p) {
   try {
     fs31.statSync(p);
@@ -29108,7 +29121,7 @@ function verifyPin(p, pinned) {
   verifyPinnedIdentity(p, pinned);
 }
 function indexFileSyncPinned(resolvedPath, dbPath) {
-  const pinned = activePins?.get(pinKey(path36.resolve(resolvedPath)));
+  const pinned = activePins?.get(pinKey(path37.resolve(resolvedPath)));
   if (pinned === void 0) {
     indexFileSync(resolvedPath, dbPath);
     return;
@@ -29130,7 +29143,7 @@ function indexFileSyncPinned(resolvedPath, dbPath) {
   indexFileSync(resolvedPath, dbPath, bytes);
 }
 function readFileText(p) {
-  const pinned = activePins?.get(pinKey(path36.resolve(p)));
+  const pinned = activePins?.get(pinKey(path37.resolve(p)));
   try {
     if (pinned === ABSENT_PIN) {
       verifyStillAbsent(p);
@@ -29144,7 +29157,7 @@ function readFileText(p) {
   }
 }
 function readFileBytes(p) {
-  const pinned = activePins?.get(pinKey(path36.resolve(p)));
+  const pinned = activePins?.get(pinKey(path37.resolve(p)));
   try {
     if (pinned === ABSENT_PIN) {
       verifyStillAbsent(p);
@@ -29862,7 +29875,7 @@ ${sub.text}`);
   return { text, code: 1 };
 }
 function resolveAgainstProjectRoot(file2, projectRoot) {
-  return projectRoot !== void 0 && !path36.isAbsolute(file2) ? path36.resolve(projectRoot, file2) : file2;
+  return projectRoot !== void 0 && !path37.isAbsolute(file2) ? path37.resolve(projectRoot, file2) : file2;
 }
 function runSection(opts) {
   const crossFilePairs = parseCrossFileMultiSpec(opts.spec);
@@ -29943,7 +29956,7 @@ function runSectionCrossFile(pairs, opts) {
     textBlocks.push(`${key}:
 ${sub.text}`);
   }
-  const resolvePath = (f) => opts.projectRoot !== void 0 && !path36.isAbsolute(f) ? path36.resolve(opts.projectRoot, f) : f;
+  const resolvePath = (f) => opts.projectRoot !== void 0 && !path37.isAbsolute(f) ? path37.resolve(opts.projectRoot, f) : f;
   const text = opts.json === true ? JSON.stringify(jsonOut, null, 2) : textBlocks.join("\n\n");
   if (anyFound) {
     const fullSourceBytes = sumFileSizes(Array.from(distinctFiles, resolvePath));
@@ -30916,7 +30929,7 @@ function runConflicts(opts) {
   if (opts.path === void 0) {
     files = walkProject(process.cwd()).files;
   } else {
-    const abs = path36.resolve(opts.path);
+    const abs = path37.resolve(opts.path);
     let stat2;
     try {
       stat2 = fs31.statSync(abs);
@@ -31310,6 +31323,10 @@ function buildChangedRefHint(cwd, ref2) {
 }
 function runChanged(opts = {}) {
   const ref2 = opts.ref ?? "HEAD~5";
+  if (ref2.startsWith("-")) {
+    emitErr(`Refusing a git ref that starts with '-': ${ref2}`);
+    return 1;
+  }
   const cwd = opts.projectRoot ?? process.cwd();
   const projectRoot = resolveProjectRoot({ project: cwd });
   let changedFiles;
@@ -31674,7 +31691,7 @@ function runGrep(opts) {
     try {
       for (const entry of fs31.readdirSync(dir)) {
         if (entry.startsWith(".")) continue;
-        const full = path36.join(dir, entry);
+        const full = path37.join(dir, entry);
         let lst;
         try {
           lst = fs31.lstatSync(full);
@@ -31716,14 +31733,14 @@ function runGrep(opts) {
     }
     const stat2 = fs31.statSync(searchPath);
     if (stat2.isDirectory()) {
-      const pinned = activePins?.get(pinKey(path36.resolve(searchPath)));
+      const pinned = activePins?.get(pinKey(path37.resolve(searchPath)));
       if (pinned !== void 0) verifyPin(searchPath, pinned);
       let boundaryReal;
       try {
         boundaryReal = fs31.realpathSync(searchPath);
       } catch (err2) {
         if (pinned === void 0) {
-          boundaryReal = path36.resolve(searchPath);
+          boundaryReal = path37.resolve(searchPath);
         } else {
           throw new ConfinementIdentityError(
             `refused: "${searchPath}" could not be resolved after validation (${String(err2)}). The path may have been replaced or redirected after the confinement check, so the search was not performed.`
@@ -31854,7 +31871,7 @@ function runConfigGet(opts) {
     emit2(value);
     return 0;
   }
-  const ext2 = path36.extname(opts.file).toLowerCase();
+  const ext2 = path37.extname(opts.file).toLowerCase();
   if (ext2 === ".json") {
     try {
       let obj = JSON.parse(text);
@@ -31972,7 +31989,7 @@ function runExports(opts) {
       names.push(s.name);
     }
   }
-  const ext2 = path36.extname(opts.file).toLowerCase();
+  const ext2 = path37.extname(opts.file).toLowerCase();
   const text = readFileText(diskPath);
   if (text === null && symbols.length === 0) {
     emitErr(`Could not read: ${opts.file}`);
@@ -32310,9 +32327,9 @@ function extractImports(text, ext2) {
   return found;
 }
 function importsExtensionFor(filePath) {
-  const base = path36.basename(filePath).toLowerCase();
+  const base = path37.basename(filePath).toLowerCase();
   if (base === "makefile" || base === "gnumakefile" || base === "bsdmakefile") return ".mk";
-  return path36.extname(filePath);
+  return path37.extname(filePath);
 }
 function runImports(opts) {
   const multiFiles = parseMultiFileSpec(opts.file);
@@ -32403,7 +32420,7 @@ async function runSemantic(query, opts) {
   }
   const n = opts.limit !== void 0 && Number.isFinite(opts.limit) ? opts.limit : 20;
   if (opts.projectRoot !== void 0) {
-    if (!path36.isAbsolute(opts.projectRoot) || !fs31.existsSync(opts.projectRoot) || !fs31.statSync(opts.projectRoot).isDirectory()) {
+    if (!path37.isAbsolute(opts.projectRoot) || !fs31.existsSync(opts.projectRoot) || !fs31.statSync(opts.projectRoot).isDirectory()) {
       const message = `token-goat: projectRoot must be an absolute, existing directory, got '${opts.projectRoot}'`;
       if (opts.json === true) {
         return { text: JSON.stringify({ error: message }, null, 2), code: 1 };
@@ -32655,14 +32672,14 @@ var init_read_commands = __esm({
 });
 
 // src/repomap.ts
-import * as path37 from "path";
+import * as path38 from "path";
 function getTrackedFiles(cwd = process.cwd()) {
   try {
     const result = runGit(["ls-files"], { cwd });
     if (result.exitCode !== 0 || !result.stdout) {
       return [];
     }
-    return result.stdout.split("\n").filter((line) => line.trim().length > 0).map((rel) => path37.join(cwd, rel));
+    return result.stdout.split("\n").filter((line) => line.trim().length > 0).map((rel) => path38.join(cwd, rel));
   } catch {
     return [];
   }
@@ -32678,7 +32695,7 @@ var init_repomap = __esm({
 // src/graph_commands.ts
 import * as fs32 from "node:fs";
 import * as os9 from "node:os";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 import { execFileSync, spawnSync as spawnSync4 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function emit3(text) {
@@ -32971,7 +32988,19 @@ function runImpact(opts) {
     }
   }
   hops.delete(rootName);
-  const sorted = [...hops.entries()].sort(compareHopEntries).slice(0, top);
+  const allSorted = [...hops.entries()].sort(compareHopEntries);
+  const matchesGrep = opts.grep !== void 0 ? compileGrepMatcher(opts.grep) : void 0;
+  const grepped = matchesGrep !== void 0 ? allSorted.filter(([symbol3]) => matchesGrep(symbol3)) : allSorted;
+  const sorted = grepped.slice(0, top);
+  if (matchesGrep !== void 0 && sorted.length === 0 && allSorted.length > 0) {
+    if (opts.json === true) {
+      emitErr2(grepFilteredToEmptyNotice(allSorted.length, opts.grep, "impacted symbol", "impacted symbols"));
+      emit3(JSON.stringify([], null, 2));
+      return 0;
+    }
+    emit3(grepFilteredToEmptyNotice(allSorted.length, opts.grep, "impacted symbol", "impacted symbols"));
+    return 0;
+  }
   if (sorted.length === 0) {
     if (opts.excludeTests === true && suppressedCount > 0) {
       if (opts.json === true) {
@@ -33107,17 +33136,17 @@ function runDeps(opts) {
   }
   const ext2 = importsExtensionFor(opts.file);
   const raw = extractImports(text, ext2);
-  const dir = path38.dirname(opts.file);
+  const dir = path39.dirname(opts.file);
   const internal = [];
   const external = [];
   for (const imp of raw) {
     if (imp.startsWith("./") || imp.startsWith("../")) {
-      const base = path38.resolve(dir, imp);
+      const base = path39.resolve(dir, imp);
       let resolved = imp;
       if (fs32.existsSync(base) && fs32.statSync(base).isFile()) {
         resolved = base;
       } else {
-        const baseExt = path38.extname(base);
+        const baseExt = path39.extname(base);
         const bareBase = SOURCE_EXTENSIONS.includes(baseExt) ? base.slice(0, -baseExt.length) : base;
         for (const srcExt of SOURCE_EXTENSIONS) {
           const candidate = bareBase + srcExt;
@@ -33128,7 +33157,7 @@ function runDeps(opts) {
         }
         if (resolved === imp && fs32.existsSync(base) && fs32.statSync(base).isDirectory()) {
           for (const srcExt of SOURCE_EXTENSIONS) {
-            const candidate = path38.join(base, "index" + srcExt);
+            const candidate = path39.join(base, "index" + srcExt);
             if (fs32.existsSync(candidate)) {
               resolved = candidate;
               break;
@@ -33144,7 +33173,7 @@ function runDeps(opts) {
     }
   }
   const rootDir = resolveProjectRoot({ project: process.cwd() });
-  const displayInternal = internal.map((i) => path38.isAbsolute(i) ? toDisplayPath(rootDir, normalizePath(i)) : i);
+  const displayInternal = internal.map((i) => path39.isAbsolute(i) ? toDisplayPath(rootDir, normalizePath(i)) : i);
   const preFilterCount = displayInternal.length + external.length;
   const matchesGrep = opts.grep !== void 0 ? compileGrepMatcher(opts.grep) : void 0;
   const filteredInternal = matchesGrep !== void 0 ? displayInternal.filter((i) => matchesGrep(i)) : displayInternal;
@@ -33537,15 +33566,15 @@ function runArch(opts) {
   const importedBy = /* @__PURE__ */ new Map();
   const resolveRelImport = (fromFile, spec) => {
     if (!spec.startsWith(".")) return null;
-    const dir = path38.dirname(fromFile);
+    const dir = path39.dirname(fromFile);
     const strippedSpec = spec.replace(/\.(m?js|cjs)$/, "");
-    const base = path38.resolve(dir, strippedSpec);
+    const base = path39.resolve(dir, strippedSpec);
     for (const ext2 of ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".mjs", ".cjs", ".cts", ".py"]) {
       const candidate = base + ext2;
       const match2 = filesByFoldedPath.get(foldPath(candidate));
       if (match2 !== void 0) return match2;
     }
-    const idx = path38.join(base, "index");
+    const idx = path39.join(base, "index");
     for (const ext2 of [".ts", ".js", ".tsx", ".jsx", ".mts", ".cts"]) {
       const candidate = idx + ext2;
       const match2 = filesByFoldedPath.get(foldPath(candidate));
@@ -33670,7 +33699,7 @@ ANSWER:`;
   try {
     let askArgs;
     if (isCodex) {
-      codexOutPath = path38.join(os9.tmpdir(), `tg-ask-${process.pid}-${randomUUID2()}.txt`);
+      codexOutPath = path39.join(os9.tmpdir(), `tg-ask-${process.pid}-${randomUUID2()}.txt`);
       askArgs = ["exec", "--ephemeral", "--output-last-message", codexOutPath];
     } else {
       askArgs = ["--print", "--bare", "--no-session-persistence"];
@@ -33866,12 +33895,12 @@ var init_graph_commands = __esm({
 
 // src/project_memory.ts
 import * as fs33 from "node:fs";
-import * as path39 from "node:path";
+import * as path40 from "node:path";
 function ordinal(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
 }
 function memoryPath(projectHash2) {
-  return path39.join(dataDir(), "projects", `${projectHash2}_memory.toml`);
+  return path40.join(dataDir(), "projects", `${projectHash2}_memory.toml`);
 }
 function validateKey(key) {
   if (!KEY_RE.test(key)) {
@@ -33930,7 +33959,7 @@ function save(filePath, entries) {
     lines2.push(`${k} = "${escaped}"`);
   }
   const content = lines2.length > 0 ? lines2.join("\n") + "\n" : "";
-  const dir = path39.dirname(filePath);
+  const dir = path40.dirname(filePath);
   ensureDirSync(dir);
   atomicWriteText(filePath, content);
 }
@@ -33940,7 +33969,7 @@ function loadEntries(projectHash2) {
 function setEntry(projectHash2, key, value) {
   validateKey(key);
   const p = memoryPath(projectHash2);
-  const dir = path39.dirname(p);
+  const dir = path40.dirname(p);
   ensureDirSync(dir);
   const doSet = () => {
     const entries = loadRaw(p);
@@ -33995,7 +34024,7 @@ var init_project_memory = __esm({
 
 // src/text_commands.ts
 import * as fs34 from "fs";
-import * as path40 from "path";
+import * as path41 from "path";
 function readInput(src) {
   if (src !== void 0) return fs34.readFileSync(src, "utf8");
   return fs34.readFileSync(0, "utf8");
@@ -34046,7 +34075,7 @@ function collectTodoFiles(patterns) {
   if (patterns.length > 0) {
     const results = [];
     for (const p of patterns) {
-      const abs = path40.resolve(p);
+      const abs = path41.resolve(p);
       try {
         const stat2 = fs34.statSync(abs);
         if (stat2.isDirectory()) {
@@ -34304,7 +34333,7 @@ function isProjectFrame(framePath, cwd) {
   if (framePath.includes("/rustc/")) return false;
   if (framePath.includes(".cargo/registry") || framePath.includes(".cargo\\registry")) return false;
   if (/^<.+>$/.test(framePath)) return false;
-  if (!path40.isAbsolute(framePath) && !framePath.startsWith("..")) return true;
+  if (!path41.isAbsolute(framePath) && !framePath.startsWith("..")) return true;
   return false;
 }
 function resolveFrameSymbol(frame, projectRoot) {
@@ -34490,17 +34519,17 @@ function findLockfile(startPath) {
   if (stat2 !== void 0 && stat2.isFile()) {
     return { file: startPath, others: [] };
   }
-  const dir = stat2 !== void 0 && stat2.isDirectory() ? startPath : path40.dirname(startPath);
+  const dir = stat2 !== void 0 && stat2.isDirectory() ? startPath : path41.dirname(startPath);
   const found = [];
   for (const name2 of LOCK_PRIORITY) {
-    const candidate = path40.join(dir, name2);
+    const candidate = path41.join(dir, name2);
     if (fs34.existsSync(candidate)) found.push(candidate);
   }
   try {
     const entries = fs34.readdirSync(dir);
     for (const e of entries) {
       if (/^requirements.*\.txt$/.test(e)) {
-        const p = path40.join(dir, e);
+        const p = path41.join(dir, e);
         if (!found.includes(p)) found.push(p);
       }
     }
@@ -34697,7 +34726,7 @@ function parsePnpmLock(content) {
   return deps;
 }
 function parseLockFile(filePath) {
-  const base = path40.basename(filePath);
+  const base = path41.basename(filePath);
   const content = fs34.readFileSync(filePath, "utf8");
   if (base === "package-lock.json") return { format: "npm", deps: parsePackageLockJson(content) };
   if (base === "yarn.lock") return { format: "yarn", deps: parseYarnLock(content) };
@@ -34813,7 +34842,7 @@ Depended on by direct/top-level deps (${dependedOnBy.length}):
 `);
 }
 function cmdLockdeps(filePath, opts) {
-  const target = filePath !== void 0 ? path40.resolve(filePath) : process.cwd();
+  const target = filePath !== void 0 ? path41.resolve(filePath) : process.cwd();
   const found = findLockfile(target);
   if (found === null) {
     throw new Error("No lockfile found. Expected one of: " + LOCK_PRIORITY.join(", ") + ", requirements*.txt");
@@ -34901,7 +34930,7 @@ function cmdNote(action, key, value, opts) {
   throw new Error(`Unknown note action: ${action}. Use: set, get, unset, list, clear`);
 }
 function loadAllSessionReadCounts() {
-  const sessionsDir = path40.join(tokenGoatHome(), "sessions");
+  const sessionsDir = path41.join(tokenGoatHome(), "sessions");
   const totals = /* @__PURE__ */ new Map();
   let entries;
   try {
@@ -34911,7 +34940,7 @@ function loadAllSessionReadCounts() {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const filePath = path40.join(sessionsDir, entry.name);
+    const filePath = path41.join(sessionsDir, entry.name);
     let raw;
     try {
       raw = JSON.parse(fs34.readFileSync(filePath, "utf8"));
@@ -34999,8 +35028,8 @@ function detectWalkMode(cwd) {
   if (project?.marker === ".git") return "git";
   let cur = cwd;
   while (true) {
-    if (fs34.existsSync(path40.join(cur, ".git"))) return "git";
-    const parent = path40.dirname(cur);
+    if (fs34.existsSync(path41.join(cur, ".git"))) return "git";
+    const parent = path41.dirname(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -35198,7 +35227,7 @@ var init_confirm_apply = __esm({
 
 // src/memory_prune.ts
 import * as fs36 from "node:fs";
-import * as path41 from "node:path";
+import * as path42 from "node:path";
 function parseIndex(text) {
   const passthrough2 = [];
   const entries = [];
@@ -35241,7 +35270,7 @@ function pruneIndex(memoryDir, opts) {
     changed: false,
     tokensSaved: 0
   };
-  const memoryMd = path41.join(memoryDir, "MEMORY.md");
+  const memoryMd = path42.join(memoryDir, "MEMORY.md");
   let text;
   try {
     text = fs36.readFileSync(memoryMd, "utf-8");
@@ -35255,7 +35284,7 @@ function pruneIndex(memoryDir, opts) {
   const dups = [];
   for (const entry of entries) {
     const isUrl = URL_SCHEME_RE.test(entry.target);
-    const targetExists = isUrl ? true : path41.isAbsolute(entry.target) ? fs36.existsSync(entry.target) : fs36.existsSync(path41.join(memoryDir, entry.target));
+    const targetExists = isUrl ? true : path42.isAbsolute(entry.target) ? fs36.existsSync(entry.target) : fs36.existsSync(path42.join(memoryDir, entry.target));
     const foldedTarget = foldPath(entry.target);
     if (!targetExists) {
       dead.push(entry);
@@ -35399,7 +35428,7 @@ async function tryEmbeddingClusters(siblings, snippets, threshold) {
 }
 async function findContentDuplicates(memoryDir, _opts) {
   const threshold = _opts?.threshold ?? 0.92;
-  const siblings = fs36.readdirSync(memoryDir).filter((name2) => name2.toLowerCase().endsWith(".md") && name2.toLowerCase() !== "memory.md").map((name2) => path41.join(memoryDir, name2)).sort();
+  const siblings = fs36.readdirSync(memoryDir).filter((name2) => name2.toLowerCase().endsWith(".md") && name2.toLowerCase() !== "memory.md").map((name2) => path42.join(memoryDir, name2)).sort();
   if (siblings.length < 2) {
     return [];
   }
@@ -35483,7 +35512,7 @@ function auditClaudeMd(files) {
     const overlaps = [];
     for (const [stripped, filesSet] of lineToFiles) {
       if (filesSet.has(report.path) && filesSet.size > 1) {
-        const others = Array.from(filesSet).filter((p) => p !== report.path).map((p) => path41.basename(p));
+        const others = Array.from(filesSet).filter((p) => p !== report.path).map((p) => path42.basename(p));
         if (others.length > 0) {
           if (stripped.length > 60) {
             overlaps.push(
@@ -35516,7 +35545,7 @@ var init_memory_prune = __esm({
 // src/cli_context_stats.ts
 import * as fs37 from "node:fs";
 import * as os10 from "node:os";
-import * as path42 from "node:path";
+import * as path43 from "node:path";
 function tok(filePath) {
   try {
     const size = fs37.statSync(filePath).size;
@@ -35528,18 +35557,18 @@ function tok(filePath) {
 function findClaudeMdFiles(projectRoot, homeDir = os10.homedir()) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
-  let current = path42.resolve(projectRoot);
+  let current = path43.resolve(projectRoot);
   while (true) {
-    const candidate = path42.join(current, "CLAUDE.md");
+    const candidate = path43.join(current, "CLAUDE.md");
     if (!seen.has(candidate) && fs37.existsSync(candidate)) {
       found.push(candidate);
       seen.add(candidate);
     }
-    const parent = path42.dirname(current);
+    const parent = path43.dirname(current);
     if (parent === current) break;
     current = parent;
   }
-  const globalMd = path42.join(homeDir, ".claude", "CLAUDE.md");
+  const globalMd = path43.join(homeDir, ".claude", "CLAUDE.md");
   if (!seen.has(globalMd) && fs37.existsSync(globalMd)) {
     found.push(globalMd);
   }
@@ -35547,9 +35576,9 @@ function findClaudeMdFiles(projectRoot, homeDir = os10.homedir()) {
 }
 function findMemoryMd(projectRoot, homeDir = os10.homedir(), alternateRoots = []) {
   try {
-    const projectsDir = path42.join(homeDir, ".claude", "projects");
+    const projectsDir = path43.join(homeDir, ".claude", "projects");
     if (!fs37.existsSync(projectsDir)) return null;
-    const rootStr = path42.resolve(projectRoot);
+    const rootStr = path43.resolve(projectRoot);
     const candidateRoots2 = [rootStr];
     try {
       const realRoot = fs37.realpathSync.native(rootStr);
@@ -35557,12 +35586,12 @@ function findMemoryMd(projectRoot, homeDir = os10.homedir(), alternateRoots = []
     } catch {
     }
     for (const alternate of alternateRoots) {
-      const resolved = path42.resolve(alternate);
+      const resolved = path43.resolve(alternate);
       if (!candidateRoots2.includes(resolved)) candidateRoots2.push(resolved);
     }
     for (const root of candidateRoots2) {
       const expectedSlug = root.replace(/[^A-Za-z0-9]/g, "-");
-      const candidate = path42.join(projectsDir, expectedSlug, "memory", "MEMORY.md");
+      const candidate = path43.join(projectsDir, expectedSlug, "memory", "MEMORY.md");
       if (fs37.existsSync(candidate)) return candidate;
     }
     return null;
@@ -35577,10 +35606,10 @@ function buildStats(projectRoot, homeDir = os10.homedir(), alternateRoots = [])
   for (const p of claudeMds) {
     const t = tok(p);
     claudeMdTotal += t;
-    const parentDir = path42.basename(path42.dirname(p));
+    const parentDir = path43.basename(path43.dirname(p));
     const label = parentDir === ".claude" ? "~/.claude/CLAUDE.md" : (() => {
       try {
-        return path42.relative(projectRoot, p);
+        return path43.relative(projectRoot, p);
       } catch {
         return p;
       }
@@ -35644,7 +35673,7 @@ async function runContextStats(opts = {}) {
       process.stdout.write("[--fix] No MEMORY.md found; nothing to prune.\n");
     } else {
       const memPath = result.memory_md_path;
-      const pruneResult = pruneIndex(path42.dirname(memPath), { dryRun: true });
+      const pruneResult = pruneIndex(path43.dirname(memPath), { dryRun: true });
       if (!pruneResult.changed || pruneResult.after === void 0) {
         process.stdout.write("[--fix] MEMORY.md already clean; nothing to prune.\n");
       } else {
@@ -35686,7 +35715,7 @@ var init_cli_context_stats = __esm({
 
 // src/baseline.ts
 import * as fs38 from "node:fs";
-import * as path43 from "node:path";
+import * as path44 from "node:path";
 function walkProject(rootDir, opts = {}) {
   const files = [];
   const languages = {};
@@ -35705,7 +35734,7 @@ function walkProject(rootDir, opts = {}) {
       continue;
     }
     for (const entry of entries) {
-      const full = path43.join(dir, entry.name);
+      const full = path44.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name) || extraSkipDirs.includes(entry.name)) continue;
         if (entry.name.startsWith(".") && entry.name !== ".") {
@@ -35769,7 +35798,7 @@ function fetchTopSymbols(limit, dbPath, rootDir) {
   }
 }
 function buildProjectMap(rootDir = process.cwd(), opts = {}) {
-  const root = path43.resolve(rootDir);
+  const root = path44.resolve(rootDir);
   const config2 = loadConfig();
   const { files, languages } = walkProject(root, { excludeTests: config2.repomap.exclude_tests });
   const compact = opts.compact === true || files.length > config2.repomap.compact_file_threshold;
@@ -35783,7 +35812,7 @@ function buildProjectMap(rootDir = process.cwd(), opts = {}) {
       mtime = 0;
     }
     return { f, mtime };
-  }).sort((a, b) => b.mtime - a.mtime).slice(0, compact ? 5 : 15).map((x) => path43.relative(root, x.f));
+  }).sort((a, b) => b.mtime - a.mtime).slice(0, compact ? 5 : 15).map((x) => path44.relative(root, x.f));
   return {
     rootDir: root,
     fileCount: files.length,
@@ -35795,7 +35824,7 @@ function buildProjectMap(rootDir = process.cwd(), opts = {}) {
 }
 function formatProjectMap(map3, compact = false) {
   const lines2 = [];
-  const rel = path43.basename(map3.rootDir);
+  const rel = path44.basename(map3.rootDir);
   lines2.push(`# Project map: ${rel}`);
   lines2.push(`Files: ${map3.fileCount}`);
   const langPairs = Object.entries(map3.languages).sort((a, b) => b[1] - a[1]);
@@ -35823,7 +35852,7 @@ function formatProjectMap(map3, compact = false) {
 }
 function mapLookupBytesSaved(map3, emittedText) {
   const referencedFiles = /* @__PURE__ */ new Set([
-    ...map3.recentFiles.map((f) => normalizePath(path43.resolve(map3.rootDir, f))),
+    ...map3.recentFiles.map((f) => normalizePath(path44.resolve(map3.rootDir, f))),
     ...map3.topSymbols.map((s) => normalizePath(s.filePath))
   ]);
   let fullSourceBytes = 0;
@@ -35840,7 +35869,7 @@ function findMemSuggestionCandidates(projectRoot) {
   const claudeMdFiles = findClaudeMdFiles(projectRoot);
   const candidateFiles = new Set(claudeMdFiles);
   for (const claudeMd of claudeMdFiles) {
-    const agentsMd = path43.join(path43.dirname(claudeMd), "AGENTS.md");
+    const agentsMd = path44.join(path44.dirname(claudeMd), "AGENTS.md");
     if (fs38.existsSync(agentsMd)) candidateFiles.add(agentsMd);
   }
   const suggestions = [];
@@ -35876,7 +35905,7 @@ function formatMemSuggestions(projectRoot) {
   if (suggestions.length === 0) return "";
   const lines2 = ["", "## mem suggestions"];
   for (const s of suggestions) {
-    const basename22 = path43.basename(s.path);
+    const basename22 = path44.basename(s.path);
     lines2.push(
       "Consider: mem import --from-md " + s.path + "  # migrates " + s.count + " preference-shaped lines from " + basename22 + " as pending facts for review"
     );
@@ -35930,7 +35959,7 @@ var init_baseline = __esm({
 
 // src/content_store.ts
 import { deflateRawSync } from "node:zlib";
-import * as path66 from "node:path";
+import * as path67 from "node:path";
 function estimateTextTokens(bytes) {
   return Math.round(bytes / TEXT_BYTES_PER_TOKEN);
 }
@@ -35946,7 +35975,7 @@ function contentId(text) {
   return `tg_${shortFingerprint(text)}`;
 }
 function normalizeProjectRoot(projectRoot) {
-  const candidate = path66.resolve(projectRoot ?? process.cwd());
+  const candidate = path67.resolve(projectRoot ?? process.cwd());
   return findProject(candidate)?.root ?? candidate;
 }
 function handoffId(name2, projectRoot) {
@@ -36310,10 +36339,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path69) {
-  if (!path69)
+function getElementAtPath(obj, path70) {
+  if (!path70)
     return obj;
-  return path69.reduce((acc, key) => acc?.[key], obj);
+  return path70.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36641,11 +36670,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path69, issues) {
+function prefixIssues(path70, issues) {
   return issues.map((iss) => {
     var _a6;
     (_a6 = iss).path ?? (_a6.path = []);
-    iss.path.unshift(path69);
+    iss.path.unshift(path70);
     return iss;
   });
 }
@@ -36863,16 +36892,16 @@ function flattenError(error52, mapper = (issue2) => issue2.message) {
 }
 function formatError2(error52, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error53, path69 = []) => {
+  const processError = (error53, path70 = []) => {
     for (const issue2 of error53.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path69, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path70, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else {
-        const fullpath = [...path69, ...issue2.path];
+        const fullpath = [...path70, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36899,17 +36928,17 @@ function formatError2(error52, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error52, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error53, path69 = []) => {
+  const processError = (error53, path70 = []) => {
     var _a6, _b;
     for (const issue2 of error53.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path69, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path70, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else {
-        const fullpath = [...path69, ...issue2.path];
+        const fullpath = [...path70, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36941,8 +36970,8 @@ function treeifyError(error52, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path69 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path69) {
+  const path70 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path70) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -37212,8 +37241,8 @@ var init_regexes = __esm({
     _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
     ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    mac = (delimiter2) => {
-      const escapedDelim = escapeRegex(delimiter2 ?? ":");
+    mac = (delimiter3) => {
+      const escapedDelim = escapeRegex(delimiter3 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -50445,13 +50474,13 @@ function resolveRef(ref2, ctx) {
   if (!ref2.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path69 = ref2.slice(1).split("/").filter(Boolean);
-  if (path69.length === 0) {
+  const path70 = ref2.slice(1).split("/").filter(Boolean);
+  if (path70.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path69[0] === defsKey) {
-    const key = path69[1];
+  if (path70[0] === defsKey) {
+    const key = path70[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref2}`);
     }
@@ -51228,7 +51257,7 @@ __export(mcp_server_exports, {
   createMcpServer: () => createMcpServer
 });
 import * as fs59 from "fs";
-import * as path67 from "path";
+import * as path68 from "path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 function mcpFriendlyText(text) {
   let out2 = text.replace(TOKEN_GOAT_RETRY_RE, (_match, cmd, arg) => {
@@ -51297,7 +51326,7 @@ function resolveToolRoot(projectRoot) {
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
-  const abs = path67.resolve(resolvedRoot, normalizePath(target));
+  const abs = path68.resolve(resolvedRoot, normalizePath(target));
   let identity;
   try {
     identity = fileIdentity(fs59.statSync(abs, { bigint: true }));
@@ -51316,6 +51345,16 @@ function specFilePart(spec) {
 }
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
+  const allowedRoots = loadConfig().mcp.allowed_roots;
+  if (allowedRoots.length > 0 && !allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) {
+    return {
+      ok: false,
+      refusal: toCallToolResult({
+        text: `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`,
+        code: 1
+      })
+    };
+  }
   const checked = [];
   const pins = /* @__PURE__ */ new Map();
   for (const raw of targets) {
@@ -52066,7 +52105,7 @@ init_define_import_meta_env();
 init_define_import_meta_env();
 init_bash_compress();
 import * as fs21 from "node:fs";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 var DEFAULT_MAX_LINES = 1e3;
 var DEFAULT_MAX_BYTES = 64 * 1024;
 var MAX_INSPECT_BYTES = 2 * 1024 * 1024;
@@ -52487,13 +52526,13 @@ function loadPackageScripts(candidate, stat2) {
 function findNearestPackageScripts(startDir) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = path22.join(dir, "package.json");
+    const candidate = path23.join(dir, "package.json");
     try {
       const stat2 = fs21.statSync(candidate);
       if (stat2.isFile()) return loadPackageScripts(candidate, stat2);
     } catch {
     }
-    const parent = path22.dirname(dir);
+    const parent = path23.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -65664,7 +65703,7 @@ function grepIntInput(toolInput, key) {
 function grepSignature(toolInput) {
   const pattern = toolInput["pattern"];
   if (typeof pattern !== "string" || pattern === "") return null;
-  const path69 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
+  const path70 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
   const outputMode = typeof toolInput["output_mode"] === "string" ? toolInput["output_mode"] : "files_with_matches";
   const glob = typeof toolInput["glob"] === "string" ? toolInput["glob"] : "";
   const type = typeof toolInput["type"] === "string" ? toolInput["type"] : "";
@@ -65679,7 +65718,7 @@ function grepSignature(toolInput) {
   const offset = grepIntInput(toolInput, "offset");
   return JSON.stringify([
     pattern,
-    path69,
+    path70,
     outputMode,
     glob,
     type,
@@ -65779,8 +65818,8 @@ init_session();
 function globSignature(toolInput) {
   const pattern = toolInput["pattern"];
   if (typeof pattern !== "string" || pattern === "") return null;
-  const path69 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
-  return JSON.stringify([pattern, path69]);
+  const path70 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
+  return JSON.stringify([pattern, path70]);
 }
 var { post: postGlobHandler, pre: preGlobDedupHandler } = makeDedupHintHandlers({
   toolName: "Glob",
@@ -65809,7 +65848,7 @@ init_stats();
 init_config();
 init_doc_compact();
 init_worker();
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 import { statSync as statSync15 } from "node:fs";
 function postEditHandlerInner(event) {
   const filePath = getFilePath(event);
@@ -65837,7 +65876,7 @@ function postEditHandlerInner(event) {
   if (loadConfig().hints.stable_doc_compacts) {
     markCompactStale(compactPathFor(normalized));
   }
-  const editedBasename = path32.basename(normalized);
+  const editedBasename = path33.basename(normalized);
   if (/\.(md|mdx|markdown|rst)$/i.test(editedBasename)) {
     let editedSize = Infinity;
     try {
@@ -66159,11 +66198,11 @@ function gitStateFingerprintSync(cwd) {
   }
 }
 var DIR_FINGERPRINT_LISTING_CAP_ENTRIES = 1e4;
-function dirStateFingerprintSync(path69) {
+function dirStateFingerprintSync(path70) {
   try {
-    const stat2 = statSync17(path69);
+    const stat2 = statSync17(path70);
     if (!stat2.isDirectory()) return null;
-    const entries = readdirSync12(path69);
+    const entries = readdirSync12(path70);
     if (entries.length <= DIR_FINGERPRINT_LISTING_CAP_ENTRIES) {
       return shortFingerprint(entries.slice().sort().join("\0"));
     }
@@ -66173,12 +66212,12 @@ function dirStateFingerprintSync(path69) {
   }
 }
 var FILE_FINGERPRINT_CONTENT_CAP_BYTES = 2 * 1024 * 1024;
-function fileStateFingerprintSync(path69) {
+function fileStateFingerprintSync(path70) {
   try {
-    const stat2 = statSync17(path69);
+    const stat2 = statSync17(path70);
     if (!stat2.isFile()) return null;
     if (stat2.size <= FILE_FINGERPRINT_CONTENT_CAP_BYTES) {
-      return shortFingerprint(readFileSync22(path69));
+      return shortFingerprint(readFileSync22(path70));
     }
     return shortFingerprint(`${stat2.mtimeMs}\0${stat2.size}`);
   } catch {
@@ -66656,7 +66695,7 @@ init_baseline();
 init_stats();
 init_repomap();
 import * as fs60 from "fs";
-import * as path68 from "path";
+import * as path69 from "path";
 import { homedir as homedir19 } from "os";
 
 // src/walk_index.ts
@@ -66665,27 +66704,27 @@ init_baseline();
 init_util2();
 import * as fs39 from "node:fs";
 import * as os11 from "node:os";
-import * as path44 from "node:path";
+import * as path45 from "node:path";
 function isWalkExcluded(file2) {
-  const base = path44.basename(file2).toLowerCase();
+  const base = path45.basename(file2).toLowerCase();
   if (base === ".env" || base.startsWith(".env.")) return true;
   if (base.endsWith(".d.ts")) return true;
   return false;
 }
 function assertWalkableRoot(root) {
-  let resolved = path44.resolve(root);
+  let resolved = path45.resolve(root);
   try {
     resolved = fs39.realpathSync.native(resolved);
   } catch {
   }
   const norm = foldPath(normalizePath(resolved));
-  const fsRoot = foldPath(normalizePath(path44.parse(resolved).root));
+  const fsRoot = foldPath(normalizePath(path45.parse(resolved).root));
   if (norm === fsRoot) {
     throw new Error(`refusing to walk-index a filesystem root: ${resolved}`);
   }
   const home = os11.homedir();
   if (home) {
-    const normHome = foldPath(normalizePath(path44.resolve(home)));
+    const normHome = foldPath(normalizePath(path45.resolve(home)));
     if (norm === normHome) {
       throw new Error(`refusing to walk-index the home directory: ${resolved}`);
     }
@@ -66697,7 +66736,7 @@ function assertWalkableRoot(root) {
 }
 var MAX_FILES_SCANNED_FORCED = 5e5;
 function collectWalkIndexFiles(root, opts = {}) {
-  const resolved = path44.resolve(root);
+  const resolved = path45.resolve(root);
   assertWalkableRoot(resolved);
   const force = opts.force === true;
   const ceiling = force ? MAX_FILES_SCANNED_FORCED : MAX_FILES_SCANNED;
@@ -66731,7 +66770,7 @@ init_codex_install();
 init_define_import_meta_env();
 import * as fs40 from "node:fs";
 import * as os12 from "node:os";
-import * as path45 from "node:path";
+import * as path46 from "node:path";
 init_install();
 init_util2();
 init_matcher_group();
@@ -66747,7 +66786,7 @@ var GEMINI_POST_TOOLS = /* @__PURE__ */ new Set(["Bash", "Read", "Write", "Edit"
 var GeminiSettingsParseError = class extends Error {
 };
 function geminiSettingsPath() {
-  return path45.join(os12.homedir(), ".gemini", "settings.json");
+  return path46.join(os12.homedir(), ".gemini", "settings.json");
 }
 function readGeminiSettings(p, opts = {}) {
   let raw;
@@ -66868,7 +66907,7 @@ init_install();
 init_util2();
 import * as fs41 from "node:fs";
 import * as os13 from "node:os";
-import * as path46 from "node:path";
+import * as path47 from "node:path";
 var QWEN_HOOK_EVENTS = ["PreToolUse", "PostToolUse", "PreCompact", "UserPromptSubmit", "SubagentStop"];
 var QWEN_EVENT_ARG = {
   PreToolUse: "pre_tool_use",
@@ -66880,7 +66919,7 @@ var QWEN_EVENT_ARG = {
 var QwenSettingsParseError = class extends Error {
 };
 function qwenSettingsPath() {
-  return path46.join(os13.homedir(), ".qwen", "settings.json");
+  return path47.join(os13.homedir(), ".qwen", "settings.json");
 }
 function readQwenSettings(p, opts = {}) {
   let raw;
@@ -66983,7 +67022,7 @@ function uninstallQwen() {
 init_define_import_meta_env();
 init_util2();
 import * as os14 from "node:os";
-import * as path47 from "node:path";
+import * as path48 from "node:path";
 
 // src/bridges/pi.ts
 init_define_import_meta_env();
@@ -67297,16 +67336,16 @@ export default function (pi: ExtensionAPI) {
 
 // src/bridges/pi_install.ts
 function piGlobalExtensionPath() {
-  return path47.join(os14.homedir(), ".pi", "agent", "extensions", "token-goat.ts");
+  return path48.join(os14.homedir(), ".pi", "agent", "extensions", "token-goat.ts");
 }
 function piLocalExtensionPath() {
-  return path47.join(process.cwd(), ".pi", "extensions", "token-goat.ts");
+  return path48.join(process.cwd(), ".pi", "extensions", "token-goat.ts");
 }
 function piExtensionPath(opts = {}) {
   return opts.local === true ? piLocalExtensionPath() : piGlobalExtensionPath();
 }
 function piEntrySidecarPath(opts = {}) {
-  return path47.join(path47.dirname(piExtensionPath(opts)), "token-goat-entry.json");
+  return path48.join(path48.dirname(piExtensionPath(opts)), "token-goat-entry.json");
 }
 function installPi(opts = {}) {
   const extensionPath = piExtensionPath(opts);
@@ -67329,7 +67368,7 @@ function uninstallPi(opts = {}) {
 init_define_import_meta_env();
 init_util2();
 import * as os15 from "node:os";
-import * as path48 from "node:path";
+import * as path49 from "node:path";
 
 // src/bridges/opencode.ts
 init_define_import_meta_env();
@@ -67609,17 +67648,17 @@ function opencodeGlobalConfigDir() {
   if (process.platform === "win32") {
     const appData = process.env["APPDATA"];
     if (appData !== void 0 && appData.trim() !== "") return appData;
-    return path48.join(os15.homedir(), "AppData", "Roaming");
+    return path49.join(os15.homedir(), "AppData", "Roaming");
   }
   const xdgConfigHome = process.env["XDG_CONFIG_HOME"];
   if (xdgConfigHome !== void 0 && xdgConfigHome.trim() !== "") return xdgConfigHome;
-  return path48.join(os15.homedir(), ".config");
+  return path49.join(os15.homedir(), ".config");
 }
 function opencodePluginPath() {
-  return path48.join(opencodeGlobalConfigDir(), "opencode", "plugins", "token-goat.ts");
+  return path49.join(opencodeGlobalConfigDir(), "opencode", "plugins", "token-goat.ts");
 }
 function opencodeEntrySidecarPath() {
-  return path48.join(path48.dirname(opencodePluginPath()), "token-goat-entry.json");
+  return path49.join(path49.dirname(opencodePluginPath()), "token-goat-entry.json");
 }
 function installOpencode() {
   const pluginPath = opencodePluginPath();
@@ -67635,7 +67674,7 @@ init_define_import_meta_env();
 init_util2();
 import * as fs42 from "node:fs";
 import * as os16 from "node:os";
-import * as path49 from "node:path";
+import * as path50 from "node:path";
 
 // src/bridges/openclaw.ts
 init_define_import_meta_env();
@@ -67771,16 +67810,16 @@ var OpenclawConfigParseError = class extends Error {
 };
 var OPENCLAW_PLUGIN_ID = "token-goat";
 function openclawHomeDir() {
-  return path49.join(os16.homedir(), ".openclaw");
+  return path50.join(os16.homedir(), ".openclaw");
 }
 function openclawConfigPath() {
-  return path49.join(openclawHomeDir(), "openclaw.json");
+  return path50.join(openclawHomeDir(), "openclaw.json");
 }
 function openclawPluginPath() {
-  return path49.join(openclawHomeDir(), "plugins", "token-goat.ts");
+  return path50.join(openclawHomeDir(), "plugins", "token-goat.ts");
 }
 function openclawEntrySidecarPath() {
-  return path49.join(path49.dirname(openclawPluginPath()), "token-goat-entry.json");
+  return path50.join(path50.dirname(openclawPluginPath()), "token-goat-entry.json");
 }
 function readOpenclawConfig(p, opts = {}) {
   let raw;
@@ -67833,7 +67872,7 @@ function installOpenclaw() {
   const settings = readOpenclawConfig(configPath2, { strict: true });
   const entryPath = process.argv[1];
   if (entryPath) {
-    ensureDirSync(path49.dirname(pluginPath));
+    ensureDirSync(path50.dirname(pluginPath));
     atomicWriteText(openclawEntrySidecarPath(), JSON.stringify({ entryPath }));
   }
   const plugins = settings.plugins ?? {};
@@ -67852,7 +67891,7 @@ function installOpenclaw() {
     return { configPath: configPath2, pluginPath, alreadyInstalled: true };
   }
   if (pluginChanged) {
-    ensureDirSync(path49.dirname(pluginPath));
+    ensureDirSync(path50.dirname(pluginPath));
     atomicWriteText(pluginPath, OPENCLAW_PLUGIN_SCRIPT);
   }
   if (configChanged) {
@@ -67985,7 +68024,7 @@ import * as os17 from "node:os";
 // src/shell.ts
 init_define_import_meta_env();
 import * as fs43 from "node:fs";
-import * as path50 from "node:path";
+import * as path51 from "node:path";
 var WSL_LAUNCHER_SEGMENTS = /* @__PURE__ */ new Set(["system32", "syswow64", "windowsapps"]);
 function isExecutable(p) {
   try {
@@ -67998,15 +68037,15 @@ function isWslLauncherDir(dir) {
   return dir.toLowerCase().split(/[\\/]+/).some((seg) => WSL_LAUNCHER_SEGMENTS.has(seg));
 }
 function locateBashOnPath(pathValue, isExe = isExecutable) {
-  for (const dir of (pathValue ?? "").split(path50.delimiter)) {
+  for (const dir of (pathValue ?? "").split(path51.delimiter)) {
     if (!dir || isWslLauncherDir(dir)) continue;
-    const cand = path50.join(dir, "bash.exe");
+    const cand = path51.join(dir, "bash.exe");
     if (isExe(cand)) return cand;
   }
   return null;
 }
 function knownGitBashPaths() {
-  const localPrograms = process.env["LOCALAPPDATA"] ? path50.join(process.env["LOCALAPPDATA"], "Programs") : void 0;
+  const localPrograms = process.env["LOCALAPPDATA"] ? path51.join(process.env["LOCALAPPDATA"], "Programs") : void 0;
   const bases = [
     process.env["ProgramFiles"],
     process.env["ProgramFiles(x86)"],
@@ -68016,8 +68055,8 @@ function knownGitBashPaths() {
   const out2 = [];
   for (const base of bases) {
     if (!base) continue;
-    out2.push(path50.join(base, "Git", "bin", "bash.exe"));
-    out2.push(path50.join(base, "Git", "usr", "bin", "bash.exe"));
+    out2.push(path51.join(base, "Git", "bin", "bash.exe"));
+    out2.push(path51.join(base, "Git", "usr", "bin", "bash.exe"));
   }
   return out2;
 }
@@ -68420,7 +68459,7 @@ init_define_import_meta_env();
 init_util2();
 import * as fs44 from "node:fs";
 import * as os18 from "node:os";
-import * as path51 from "node:path";
+import * as path52 from "node:path";
 var TENANT_HOST_RE = /^([a-z0-9-]+?)(-my)?\.sharepoint\.com$/i;
 function parseShareUrl(url2) {
   let u;
@@ -68470,7 +68509,7 @@ function candidateRoots(env, home) {
   try {
     for (const entry of fs44.readdirSync(home, { withFileTypes: true })) {
       if (entry.isDirectory() && /onedrive/i.test(entry.name)) {
-        const full = path51.join(home, entry.name);
+        const full = path52.join(home, entry.name);
         if (!roots.includes(full)) roots.push(full);
       }
     }
@@ -68479,13 +68518,13 @@ function candidateRoots(env, home) {
   return roots;
 }
 function tryLibraryPaths(root, libSegments, triedPaths) {
-  const rawJoined = path51.join(root, ...libSegments);
+  const rawJoined = path52.join(root, ...libSegments);
   triedPaths.push(rawJoined);
   if (fs44.existsSync(rawJoined)) return rawJoined;
   if (libSegments.length > 0) {
     const aliasedFirst = normalizeLibrarySegment(libSegments[0]);
     if (aliasedFirst !== libSegments[0]) {
-      const aliasedJoined = path51.join(root, aliasedFirst, ...libSegments.slice(1));
+      const aliasedJoined = path52.join(root, aliasedFirst, ...libSegments.slice(1));
       triedPaths.push(aliasedJoined);
       if (fs44.existsSync(aliasedJoined)) return aliasedJoined;
     }
@@ -68497,9 +68536,9 @@ function resolveLocalPath(parsed, env = process.env, home = os18.homedir()) {
   const libSegments = parsed.libraryPath.split(/[/\\]+/).filter((s) => s.length > 0 && s !== "." && s !== "..");
   const triedPaths = [];
   function withinRoot(root, candidate) {
-    const resolvedRoot = path51.resolve(root) + path51.sep;
-    const resolvedCandidate = path51.resolve(candidate);
-    return (resolvedCandidate + path51.sep).startsWith(resolvedRoot);
+    const resolvedRoot = path52.resolve(root) + path52.sep;
+    const resolvedCandidate = path52.resolve(candidate);
+    return (resolvedCandidate + path52.sep).startsWith(resolvedRoot);
   }
   function safeTryLibraryPaths(root, segments, tried) {
     const found = tryLibraryPaths(root, segments, tried);
@@ -68513,7 +68552,7 @@ function resolveLocalPath(parsed, env = process.env, home = os18.homedir()) {
       try {
         for (const entry of fs44.readdirSync(root, { withFileTypes: true })) {
           if (!entry.isDirectory() || !entry.name.toLowerCase().includes(parsed.siteName.toLowerCase())) continue;
-          const siteRoot = path51.join(root, entry.name);
+          const siteRoot = path52.join(root, entry.name);
           const siteFound = safeTryLibraryPaths(siteRoot, libSegments, triedPaths);
           if (siteFound !== null) return { resolvedPath: siteFound, triedPaths };
         }
@@ -68703,7 +68742,7 @@ init_session();
 init_util2();
 init_ansi();
 import * as fs46 from "node:fs";
-import * as path52 from "node:path";
+import * as path53 from "node:path";
 function writeRaw(text) {
   const payload = colorStdout() ? text : stripAnsi(text);
   process.stdout.write(ensureNewline(payload));
@@ -68715,7 +68754,7 @@ function formatTopFiles(ranked) {
   if (ranked.length === 0) return "";
   const lines2 = ["Top files this session:"];
   for (const { path: filePath, count } of ranked) {
-    const basename22 = path52.basename(filePath);
+    const basename22 = path53.basename(filePath);
     lines2.push(`  ${count.toString().padStart(3)}x  ${basename22}  (${filePath})`);
   }
   return lines2.join("\n");
@@ -68732,12 +68771,12 @@ function renderTopSessionFiles(topN = 5) {
 }
 function renderTopSessionFilesFromDisk(topN = 5, overrideSessionsDir) {
   try {
-    const sessionsDir = overrideSessionsDir ?? path52.join(dataDir(), "sessions");
+    const sessionsDir = overrideSessionsDir ?? path53.join(dataDir(), "sessions");
     if (!fs46.existsSync(sessionsDir)) return "";
-    const files = fs46.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, mtime: fs46.statSync(path52.join(sessionsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(0, 3);
+    const files = fs46.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, mtime: fs46.statSync(path53.join(sessionsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(0, 3);
     for (const { name: name2 } of files) {
       try {
-        const raw = fs46.readFileSync(path52.join(sessionsDir, name2), "utf-8");
+        const raw = fs46.readFileSync(path53.join(sessionsDir, name2), "utf-8");
         const data = JSON.parse(raw);
         const filesList = data["files"];
         if (!Array.isArray(filesList)) continue;
@@ -68804,14 +68843,14 @@ init_install();
 init_ts_refs();
 init_parser();
 import * as fs47 from "fs";
-import * as path53 from "path";
+import * as path54 from "path";
 import { execSync, spawnSync as spawnSync7 } from "child_process";
 function checkWorkerRunning(dataDir2) {
   return dataDir2 !== void 0 ? isWorkerRunning(dataDir2) : isWorkerRunning();
 }
 var DB_SIZE_WARN_BYTES = 1024 * 1024 * 1024;
 function checkDbExists(dataDir2) {
-  const dbPath = path53.join(dataDir2, "global.db");
+  const dbPath = path54.join(dataDir2, "global.db");
   if (!fs47.existsSync(dbPath)) {
     return {
       name: "Database",
@@ -69123,8 +69162,8 @@ function runDoctor(dataDir2, configPath2, rootDir) {
   results.push(checkStrayClaudeMdBlocks());
   results.push(checkWorkerRunning(actualDataDir) ? { name: "Worker", status: "ok", message: "running" } : { name: "Worker", status: "warn", message: "not running" });
   results.push(checkDbExists(actualDataDir));
-  results.push(checkSymbolBodySize(path53.join(actualDataDir, "global.db")));
-  results.push(checkSymbolCount(path53.join(actualDataDir, "global.db"), rootDir));
+  results.push(checkSymbolBodySize(path54.join(actualDataDir, "global.db")));
+  results.push(checkSymbolCount(path54.join(actualDataDir, "global.db"), rootDir));
   results.push(checkDirtyQueueHealth(actualDataDir));
   const actualConfigPath = configPath2 || configPath();
   results.push(checkConfigValid(actualConfigPath));
@@ -69162,7 +69201,7 @@ async function runDoctorAndExit(opts) {
     console.log();
     try {
       const dir = skillOutputsDir();
-      const pregenPath = path53.join(dir, "pregen.json");
+      const pregenPath = path54.join(dir, "pregen.json");
       if (fs47.existsSync(pregenPath)) {
         const content = JSON.parse(fs47.readFileSync(pregenPath, "utf-8"));
         const pregenNames = new Set(content.names || []);
@@ -69172,7 +69211,7 @@ async function runDoctorAndExit(opts) {
           for (const entry of entries) {
             if (!entry.isFile() || !entry.name.endsWith(".meta")) continue;
             try {
-              const meta3 = JSON.parse(fs47.readFileSync(path53.join(dir, entry.name), "utf-8"));
+              const meta3 = JSON.parse(fs47.readFileSync(path54.join(dir, entry.name), "utf-8"));
               if (meta3.skillName && !pregenNames.has(meta3.skillName)) {
                 skillsSeen.add(meta3.skillName);
               }
@@ -69635,7 +69674,7 @@ async function getSectionContent(fileId, heading, opts = {}) {
 // src/pack.ts
 init_define_import_meta_env();
 import * as fs48 from "node:fs";
-import * as path55 from "node:path";
+import * as path56 from "node:path";
 
 // node_modules/minimatch/dist/esm/index.js
 var esm_exports = {};
@@ -70718,11 +70757,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path54 = {
+var path55 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep2 = defaultPlatform === "win32" ? path54.win32.sep : path54.posix.sep;
+var sep2 = defaultPlatform === "win32" ? path55.win32.sep : path55.posix.sep;
 minimatch.sep = sep2;
 var GLOBSTAR = Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -71508,7 +71547,7 @@ var LANG_MAP = {
   ".exs": "elixir"
 };
 function getLang(filePath) {
-  const ext2 = path55.extname(filePath).toLowerCase();
+  const ext2 = path56.extname(filePath).toLowerCase();
   return LANG_MAP[ext2] ?? "";
 }
 function matches(rel, patterns) {
@@ -71518,8 +71557,8 @@ function matches(rel, patterns) {
   return patterns.some((pat) => mm.minimatch(norm, pat) || mm.minimatch(base, pat));
 }
 function isPathWithinRoot(rootReal, resolvedPath) {
-  const rel = path55.relative(rootReal, resolvedPath);
-  return rel !== "" && rel !== ".." && !rel.startsWith(".." + path55.sep) && !path55.isAbsolute(rel);
+  const rel = path56.relative(rootReal, resolvedPath);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + path56.sep) && !path56.isAbsolute(rel);
 }
 function openWithinRoot(rootReal, p) {
   let fd;
@@ -71559,11 +71598,11 @@ function openWithinRoot(rootReal, p) {
 }
 function* resolveOpenCandidates(projectRoot, patterns, rootReal, ignorePatterns, seen, skipped) {
   for (const pattern of patterns) {
-    const p = path55.isAbsolute(pattern) ? pattern : path55.join(projectRoot, pattern);
+    const p = path56.isAbsolute(pattern) ? pattern : path56.join(projectRoot, pattern);
     if (seen.has(p)) continue;
     let rel;
     try {
-      rel = path55.relative(projectRoot, p).replace(/\\/g, "/");
+      rel = path56.relative(projectRoot, p).replace(/\\/g, "/");
     } catch {
       skipped.push(`${p} (outside project root)`);
       continue;
@@ -71637,7 +71676,7 @@ function stripBlockComments(content, pattern, lineStates) {
   );
 }
 function stripComments4(content, filePath) {
-  const ext2 = path55.extname(filePath).toLowerCase();
+  const ext2 = path56.extname(filePath).toLowerCase();
   const lineStates = computeLineStartQuoteStates(content);
   if (ext2 === ".py") {
     return stripLineComments(content, PY_LINE_COMMENT_RE, lineStates);
@@ -71675,7 +71714,7 @@ var SAFE_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp
 function scanSecrets(files) {
   const hits = [];
   for (const pf of files) {
-    if (SAFE_EXTS.has(path55.extname(pf.path).toLowerCase())) {
+    if (SAFE_EXTS.has(path56.extname(pf.path).toLowerCase())) {
       continue;
     }
     for (const [lineno, line] of pf.content.split("\n").entries()) {
@@ -71698,7 +71737,7 @@ function scanSecrets(files) {
 function collectFiles(projectRoot, patterns, opts = {}) {
   const result = { files: [], skipped: [], total_lines: 0, total_tokens: 0 };
   const seen = /* @__PURE__ */ new Set();
-  const rootResolved = path55.resolve(projectRoot);
+  const rootResolved = path56.resolve(projectRoot);
   let rootReal;
   try {
     rootReal = fs48.realpathSync(rootResolved);
@@ -71873,7 +71912,7 @@ function formatPack(result, style, opts = {}) {
 function estimateBudget(projectRoot, patterns, opts = {}) {
   const result = { entries: [], skipped: [], total_lines: 0, total_tokens: 0 };
   const seen = /* @__PURE__ */ new Set();
-  const rootResolved = path55.resolve(projectRoot);
+  const rootResolved = path56.resolve(projectRoot);
   let rootReal;
   try {
     rootReal = fs48.realpathSync(rootResolved);
@@ -72327,7 +72366,7 @@ init_define_import_meta_env();
 init_constants();
 init_util2();
 import * as fs49 from "node:fs";
-import * as path56 from "node:path";
+import * as path57 from "node:path";
 var KEY_RE2 = /^[A-Za-z0-9_-]{1,80}$/;
 var DEFAULT_FAILURES_STATE_KEY = "default";
 function validateKey2(key) {
@@ -72339,7 +72378,7 @@ function validateKey2(key) {
 }
 function failuresStatePath(projectHash2, key) {
   validateKey2(key);
-  return path56.join(dataDir(), "projects", `${projectHash2}_failures_${key}.json`);
+  return path57.join(dataDir(), "projects", `${projectHash2}_failures_${key}.json`);
 }
 function loadFailureSnapshot(projectHash2, key) {
   const p = failuresStatePath(projectHash2, key);
@@ -72360,7 +72399,7 @@ function loadFailureSnapshot(projectHash2, key) {
 }
 function saveFailureSnapshot(projectHash2, key, snapshot) {
   const p = failuresStatePath(projectHash2, key);
-  const dir = path56.dirname(p);
+  const dir = path57.dirname(p);
   ensureDirSync(dir);
   const content = JSON.stringify(snapshot);
   const doSave = () => {
@@ -72383,7 +72422,7 @@ init_stats();
 init_util2();
 import { createRequire as createRequire8 } from "node:module";
 import * as fs50 from "node:fs";
-import * as path57 from "node:path";
+import * as path58 from "node:path";
 var _require6 = createRequire8(import.meta.url);
 var _ts2 = null;
 var _tsLoadAttempted2 = false;
@@ -72434,7 +72473,7 @@ function listInstalledPackageNames(nodeModulesDir) {
     if (entry.name.startsWith("@")) {
       let scoped;
       try {
-        scoped = fs50.readdirSync(path57.join(nodeModulesDir, entry.name), { withFileTypes: true });
+        scoped = fs50.readdirSync(path58.join(nodeModulesDir, entry.name), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -72451,7 +72490,7 @@ var README_NAME_RE = /^readme(\.(md|markdown|txt))?$/i;
 function findReadmeFile(pkgDir) {
   const direct = findReadmeIn(pkgDir);
   if (direct !== null) return direct;
-  return findReadmeIn(path57.join(pkgDir, "docs"));
+  return findReadmeIn(path58.join(pkgDir, "docs"));
 }
 function findReadmeIn(dir) {
   let entries;
@@ -72468,7 +72507,7 @@ function findReadmeIn(dir) {
     return 1;
   };
   matches2.sort((a, b) => rank(a.name) - rank(b.name));
-  return path57.join(dir, matches2[0].name);
+  return path58.join(dir, matches2[0].name);
 }
 function typesPackageDirName(pkgName) {
   if (pkgName.startsWith("@")) {
@@ -72495,30 +72534,30 @@ function resolveTypesLocation(pkgDir, pkgJson, nodeModulesDir, pkgName) {
   if (declared !== void 0) {
     const candidates = [declared, declared.endsWith(".d.ts") ? declared : `${declared}.d.ts`, declared.replace(/\.[cm]?[jt]s$/, ".d.ts")];
     for (const c of candidates) {
-      const p = path57.join(pkgDir, c);
+      const p = path58.join(pkgDir, c);
       if (fileExists2(p)) return { path: p, source: "bundled" };
     }
   }
   const main = typeof pkgJson["main"] === "string" ? pkgJson["main"] : "index.js";
-  const mainDts = path57.join(pkgDir, main.replace(/\.[cm]?js$/, ".d.ts"));
+  const mainDts = path58.join(pkgDir, main.replace(/\.[cm]?js$/, ".d.ts"));
   if (fileExists2(mainDts)) return { path: mainDts, source: "bundled" };
-  const indexDts = path57.join(pkgDir, "index.d.ts");
+  const indexDts = path58.join(pkgDir, "index.d.ts");
   if (fileExists2(indexDts)) return { path: indexDts, source: "bundled" };
   const typesDirName = typesPackageDirName(pkgName);
-  const typesPkgDir = path57.join(nodeModulesDir, "@types", typesDirName);
-  const typesPkgJsonRaw = readFileTextOrNull(path57.join(typesPkgDir, "package.json"));
+  const typesPkgDir = path58.join(nodeModulesDir, "@types", typesDirName);
+  const typesPkgJsonRaw = readFileTextOrNull(path58.join(typesPkgDir, "package.json"));
   if (typesPkgJsonRaw !== null) {
     try {
       const typesPkgJson = JSON.parse(typesPkgJsonRaw);
       const entry = (typeof typesPkgJson["types"] === "string" ? typesPkgJson["types"] : void 0) ?? (typeof typesPkgJson["main"] === "string" ? typesPkgJson["main"] : void 0) ?? "index.d.ts";
       const entryCandidates = [entry, entry.endsWith(".d.ts") ? entry : `${entry}.d.ts`, entry.replace(/\.[cm]?[jt]s$/, ".d.ts")];
       for (const c of entryCandidates) {
-        const entryPath = path57.join(typesPkgDir, c);
+        const entryPath = path58.join(typesPkgDir, c);
         if (fileExists2(entryPath)) return { path: entryPath, source: "@types" };
       }
     } catch {
     }
-    const fallback = path57.join(typesPkgDir, "index.d.ts");
+    const fallback = path58.join(typesPkgDir, "index.d.ts");
     if (fileExists2(fallback)) return { path: fallback, source: "@types" };
   }
   return null;
@@ -72585,9 +72624,9 @@ function recordDepDocsStat(fullSourceBytes, emittedText, packageName) {
 }
 function runDepDocs(opts) {
   const root = resolveProjectRoot({ project: opts.projectRoot ?? process.cwd() });
-  const nodeModulesDir = path57.join(root, "node_modules");
-  const pkgDir = path57.join(nodeModulesDir, opts.packageName);
-  const pkgJsonPath = path57.join(pkgDir, "package.json");
+  const nodeModulesDir = path58.join(root, "node_modules");
+  const pkgDir = path58.join(nodeModulesDir, opts.packageName);
+  const pkgJsonPath = path58.join(pkgDir, "package.json");
   if (!dirExists(pkgDir) || !fileExists2(pkgJsonPath)) {
     const known = listInstalledPackageNames(nodeModulesDir);
     const suggestions = suggestPackageNames(opts.packageName, known);
@@ -73115,7 +73154,7 @@ init_db();
 init_constants();
 init_worker();
 import * as fs51 from "node:fs";
-import * as path58 from "node:path";
+import * as path59 from "node:path";
 var DERIVED_TABLES = ["chunk_vectors", "chunks", "refs", "symbols", "files"];
 function indexSizeBytes(dbPath) {
   let total = 0;
@@ -73183,7 +73222,7 @@ function mb(bytes) {
 }
 function cmdReclaimIndex(opts) {
   const dbPath = opts.dbPath ?? globalDbPath();
-  if (opts.force !== true && isWorkerRunning(path58.dirname(dbPath))) {
+  if (opts.force !== true && isWorkerRunning(path59.dirname(dbPath))) {
     throw new Error(
       "reclaim-index: the worker daemon is running and writing to this index. Stop it first with 'token-goat worker stop', then re-run. Pass --force to proceed anyway (results may be inaccurate if the worker is really live)."
     );
@@ -73218,7 +73257,7 @@ function cmdReclaimIndex(opts) {
   }
   if (result.checkpointBusy) {
     process.stdout.write(
-      `  note: a concurrent reader blocked WAL truncation, so some space may still be held in ${path58.basename(dbPath)}-wal
+      `  note: a concurrent reader blocked WAL truncation, so some space may still be held in ${path59.basename(dbPath)}-wal
 `
     );
   }
@@ -73235,7 +73274,7 @@ init_index_prune();
 init_disk_cache();
 import * as fs52 from "node:fs";
 import * as os19 from "node:os";
-import * as path59 from "node:path";
+import * as path60 from "node:path";
 init_util2();
 init_paths();
 init_ansi();
@@ -73249,7 +73288,7 @@ function emitErr4(text) {
   process.stderr.write(ensureNewline(text));
 }
 function saveConfigSafe(cfg) {
-  ensureDirSync(path59.dirname(configPath()));
+  ensureDirSync(path60.dirname(configPath()));
   saveConfig(cfg);
 }
 function levenshtein(a, b, cap = 3) {
@@ -73496,8 +73535,8 @@ function cmdConfig(opts) {
       saveConfigSafe(cfg);
       return coercedValue;
     };
-    ensureDirSync(path59.dirname(configPath()));
-    const lockPath = path59.join(path59.dirname(configPath()), ".config.lock");
+    ensureDirSync(path60.dirname(configPath()));
+    const lockPath = path60.join(path60.dirname(configPath()), ".config.lock");
     const lockResult = withFileLock(lockPath, applySet, { waitMs: LOCK_WAIT_MS_HARDENED });
     const coerced = lockResult === void 0 ? applySet() : lockResult;
     invalidateConfigCache();
@@ -73633,7 +73672,7 @@ function cmdProject(opts) {
       emitErr4("project exclude requires a path argument");
       throw new Error("missing path");
     }
-    const target = path59.resolve(opts.pathArg);
+    const target = path60.resolve(opts.pathArg);
     const cfg = loadPersistedConfig();
     const targetFolded = foldPath(normalizePath(target));
     if (cfg.worker.blocked_roots.some((r) => foldPath(normalizePath(r)) === targetFolded)) {
@@ -73702,7 +73741,7 @@ function recordCompactDocStat(fullSourceBytes, emittedText, detail) {
   recordStat("compact_doc", bytesSaved, Math.round(bytesSaved / 4), void 0, detail);
 }
 function cmdCompactDoc(opts) {
-  const resolved = path59.resolve(opts.filePath);
+  const resolved = path60.resolve(opts.filePath);
   if (opts.heading !== void 0) {
     const result = compactDoc(resolved, opts.heading);
     if (result === null) {
@@ -73809,7 +73848,7 @@ async function cmdFetchImage(opts) {
     throw new Error(`fetch failed: ${opts.url}`, { cause: e });
   }
   const buf = fetched.body;
-  const outPath = opts.out ?? path59.join(os19.tmpdir(), `tg-fetch-${Date.now()}${extensionForContentType(fetched.contentType)}`);
+  const outPath = opts.out ?? path60.join(os19.tmpdir(), `tg-fetch-${Date.now()}${extensionForContentType(fetched.contentType)}`);
   const originalBytes = buf.length;
   let shrunkBytes;
   let outData;
@@ -73898,7 +73937,7 @@ init_cli_context_stats();
 init_project();
 import * as fs53 from "node:fs";
 import * as os20 from "node:os";
-import * as path60 from "node:path";
+import * as path61 from "node:path";
 import * as readline2 from "node:readline";
 var FRONTMATTER_KEYS = /* @__PURE__ */ new Set(["description", "tools", "allowed-tools", "allowed_tools"]);
 function parseBudget(name2, value) {
@@ -73957,17 +73996,17 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
     logicalRoot = await fs53.promises.realpath(root);
   } catch (error52) {
     if (error52.code === "ENOENT") return entries;
-    diagnostics.push({ path: path60.resolve(root), reason: "unreadable root" });
+    diagnostics.push({ path: path61.resolve(root), reason: "unreadable root" });
     return entries;
   }
   if (rootIsLink && !followLinks) {
-    diagnostics.push({ path: path60.resolve(root), reason: "external root link skipped (use --follow-links)" });
+    diagnostics.push({ path: path61.resolve(root), reason: "external root link skipped (use --follow-links)" });
     return entries;
   }
   const canonicalKey = (candidate) => process.platform === "win32" ? candidate.toLocaleLowerCase() : candidate;
   const isContained = (candidate, allowedRoot) => {
-    const relative11 = path60.relative(canonicalKey(allowedRoot), canonicalKey(candidate));
-    return relative11 === "" || relative11 !== ".." && !relative11.startsWith(`..${path60.sep}`) && !path60.isAbsolute(relative11);
+    const relative11 = path61.relative(canonicalKey(allowedRoot), canonicalKey(candidate));
+    return relative11 === "" || relative11 !== ".." && !relative11.startsWith(`..${path61.sep}`) && !path61.isAbsolute(relative11);
   };
   async function visit(candidate, allowedRoot, topLevel = false) {
     let real;
@@ -73976,13 +74015,13 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       candidateIsLink = (await fs53.promises.lstat(candidate)).isSymbolicLink();
       real = await fs53.promises.realpath(candidate);
     } catch {
-      diagnostics.push({ path: path60.resolve(candidate), reason: "broken or unreadable link" });
+      diagnostics.push({ path: path61.resolve(candidate), reason: "broken or unreadable link" });
       return;
     }
     const withinAllowedRoot = allowedRoot === void 0 ? isContained(real, logicalRoot) : isContained(real, allowedRoot);
     const canFollowExternal = followLinks && topLevel;
     if (!withinAllowedRoot && !canFollowExternal) {
-      diagnostics.push({ path: path60.resolve(candidate), reason: candidateIsLink ? "external link skipped (use --follow-links)" : "canonical target outside scan root" });
+      diagnostics.push({ path: path61.resolve(candidate), reason: candidateIsLink ? "external link skipped (use --follow-links)" : "canonical target outside scan root" });
       return;
     }
     const trustedRoot = !withinAllowedRoot && canFollowExternal ? real : allowedRoot ?? real;
@@ -73990,7 +74029,7 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
     try {
       stat2 = await fs53.promises.stat(real);
     } catch {
-      diagnostics.push({ path: path60.resolve(candidate), reason: "unreadable" });
+      diagnostics.push({ path: path61.resolve(candidate), reason: "unreadable" });
       return;
     }
     const canonical = process.platform === "win32" ? real.toLocaleLowerCase() : real;
@@ -74001,14 +74040,14 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       try {
         children = await fs53.promises.readdir(real, { withFileTypes: true });
       } catch {
-        diagnostics.push({ path: path60.resolve(candidate), reason: "unreadable directory" });
+        diagnostics.push({ path: path61.resolve(candidate), reason: "unreadable directory" });
         return;
       }
       children.sort((a, b) => a.name.localeCompare(b.name));
-      for (const child of children) await visit(path60.join(real, child.name), trustedRoot);
+      for (const child of children) await visit(path61.join(real, child.name), trustedRoot);
       return;
     }
-    if (!stat2.isFile() || path60.extname(real).toLowerCase() !== ".md") return;
+    if (!stat2.isFile() || path61.extname(real).toLowerCase() !== ".md") return;
     if (seenFiles.has(canonical)) return;
     seenFiles.add(canonical);
     try {
@@ -74018,35 +74057,35 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       const toolsBytes = Buffer.byteLength(metadata.tools, "utf8");
       entries.push({
         kind,
-        path: path60.resolve(real),
+        path: path61.resolve(real),
         description_bytes: descriptionBytes,
         tools_bytes: toolsBytes,
         metadata_bytes: descriptionBytes + toolsBytes,
         estimated_tokens: Math.floor((descriptionBytes + toolsBytes) / 4)
       });
     } catch {
-      diagnostics.push({ path: path60.resolve(candidate), reason: "unreadable file" });
+      diagnostics.push({ path: path61.resolve(candidate), reason: "unreadable file" });
     }
   }
   try {
     const children = await fs53.promises.readdir(logicalRoot, { withFileTypes: true });
     children.sort((a, b) => a.name.localeCompare(b.name));
-    for (const child of children) await visit(path60.join(logicalRoot, child.name), void 0, true);
+    for (const child of children) await visit(path61.join(logicalRoot, child.name), void 0, true);
   } catch {
-    diagnostics.push({ path: path60.resolve(root), reason: "unreadable root" });
+    diagnostics.push({ path: path61.resolve(root), reason: "unreadable root" });
   }
   return entries;
 }
 async function buildBootstrapAudit(opts = {}) {
   const project = resolveProjectRoot(opts.project === void 0 ? {} : { project: opts.project });
-  const home = path60.resolve(opts.home ?? os20.homedir());
+  const home = path61.resolve(opts.home ?? os20.homedir());
   const context = buildStats(project, home, opts.project === void 0 ? [] : [opts.project]);
   const diagnostics = [];
   const top = opts.top === void 0 ? 10 : parseBudget("--top", opts.top) ?? 10;
   const visitedDirs = /* @__PURE__ */ new Set();
   const seenFiles = /* @__PURE__ */ new Set();
-  const agents = await scanMetadataRoot(path60.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
-  const skills = await scanMetadataRoot(path60.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
+  const agents = await scanMetadataRoot(path61.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
+  const skills = await scanMetadataRoot(path61.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
   const largest = [...agents, ...skills].sort((a, b) => b.metadata_bytes - a.metadata_bytes || a.path.localeCompare(b.path)).slice(0, top);
   const metadataBytes = [...agents, ...skills].reduce((sum, entry) => sum + entry.metadata_bytes, 0);
   const totalTokens = context.total_tokens + Math.floor(metadataBytes / 4);
@@ -74112,7 +74151,7 @@ init_memory_prune();
 init_project();
 init_confirm_apply();
 import * as fs54 from "node:fs";
-import * as path61 from "node:path";
+import * as path62 from "node:path";
 function removeExactDupLines(text, report) {
   if (report.exactDupLines.length === 0) return text;
   const toRemove = new Set(report.exactDupLines.map(([, dupIdx]) => dupIdx));
@@ -74170,7 +74209,7 @@ function printReport(reports, clusters) {
   } else {
     for (const cluster of clusters) {
       w(
-        `  [${cluster.method}, similarity ${cluster.similarity}, ~${cluster.tokens} tok] ${cluster.members.map((m) => path61.basename(m)).join(", ")}
+        `  [${cluster.method}, similarity ${cluster.similarity}, ~${cluster.tokens} tok] ${cluster.members.map((m) => path62.basename(m)).join(", ")}
 `
       );
     }
@@ -74185,7 +74224,7 @@ async function runMemoryCommand(opts = {}) {
   const claudeMds = findClaudeMdFiles(projectRoot);
   const reports = auditClaudeMd(claudeMds);
   const memoryMdPath = findMemoryMd(projectRoot);
-  const clusters = memoryMdPath !== null ? await findContentDuplicates(path61.dirname(memoryMdPath)) : [];
+  const clusters = memoryMdPath !== null ? await findContentDuplicates(path62.dirname(memoryMdPath)) : [];
   printReport(reports, clusters);
   if (opts.fix !== true) return;
   const changes = [];
@@ -74233,18 +74272,18 @@ async function runMemoryCommand(opts = {}) {
 init_define_import_meta_env();
 init_project();
 import * as fs56 from "node:fs";
-import * as path63 from "node:path";
+import * as path64 from "node:path";
 
 // src/waste.ts
 init_define_import_meta_env();
 init_overflow_guard();
 import * as fs55 from "node:fs";
 import * as os21 from "node:os";
-import * as path62 from "node:path";
+import * as path63 from "node:path";
 function projectTranscriptsDir(projectRoot) {
-  const rootStr = path62.resolve(projectRoot);
+  const rootStr = path63.resolve(projectRoot);
   const slug = rootStr.replace(/[^A-Za-z0-9]/g, "-");
-  return path62.join(os21.homedir(), ".claude", "projects", slug);
+  return path63.join(os21.homedir(), ".claude", "projects", slug);
 }
 function findLatestTranscript(projectRoot) {
   const dir = projectTranscriptsDir(projectRoot);
@@ -74256,7 +74295,7 @@ function findLatestTranscript(projectRoot) {
   }
   let best = null;
   for (const name2 of entries) {
-    const full = path62.join(dir, name2);
+    const full = path63.join(dir, name2);
     let stat2;
     try {
       stat2 = fs55.statSync(full);
@@ -74538,7 +74577,7 @@ function printReport2(report) {
 }
 async function runWasteCommand(opts = {}) {
   const projectRoot = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
-  const transcriptPath = opts.transcript !== void 0 ? path63.resolve(opts.transcript) : findLatestTranscript(projectRoot);
+  const transcriptPath = opts.transcript !== void 0 ? path64.resolve(opts.transcript) : findLatestTranscript(projectRoot);
   if (transcriptPath === null) {
     if (opts.json === true) {
       process.stdout.write(`${JSON.stringify({ error: "no session transcript found", project: projectRoot })}
@@ -74571,7 +74610,7 @@ async function runWasteCommand(opts = {}) {
 init_define_import_meta_env();
 init_compact();
 import * as fs57 from "node:fs";
-import * as path64 from "node:path";
+import * as path65 from "node:path";
 import * as readline3 from "node:readline";
 init_project();
 function resolveSessionTranscript(arg, opts = {}) {
@@ -74580,7 +74619,7 @@ function resolveSessionTranscript(arg, opts = {}) {
     const projectRoot2 = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
     const dir = projectTranscriptsDir(projectRoot2);
     const byId = arg.endsWith(".jsonl") ? arg : `${arg}.jsonl`;
-    const candidate = path64.join(dir, byId);
+    const candidate = path65.join(dir, byId);
     if (fs57.existsSync(candidate) && fs57.statSync(candidate).isFile()) return candidate;
     return null;
   }
@@ -74741,9 +74780,9 @@ init_define_import_meta_env();
 init_project();
 init_disk_cache();
 import * as fs58 from "node:fs";
-import * as path65 from "node:path";
+import * as path66 from "node:path";
 function readMcpConfig(projectRoot) {
-  const configPath2 = path65.join(projectRoot, ".mcp.json");
+  const configPath2 = path66.join(projectRoot, ".mcp.json");
   try {
     if (!fs58.existsSync(configPath2)) {
       return null;
@@ -75392,14 +75431,14 @@ async function cmdInstall(opts) {
     );
   }
   try {
-    const skillDir2 = path68.join(homedir19(), ".claude", "skills");
+    const skillDir2 = path69.join(homedir19(), ".claude", "skills");
     if (fs60.existsSync(skillDir2)) {
       const entries = fs60.readdirSync(skillDir2, { withFileTypes: true });
       const skillNames = [];
       const sessionId = getSessionId();
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const skillFile = path68.join(skillDir2, entry.name, "SKILL.md");
+        const skillFile = path69.join(skillDir2, entry.name, "SKILL.md");
         if (fs60.existsSync(skillFile)) {
           const body = fs60.readFileSync(skillFile, "utf-8");
           const compact = extractCompactFromMarker(body);
@@ -75412,7 +75451,7 @@ async function cmdInstall(opts) {
       if (skillNames.length > 0) {
         const dir = skillOutputsDir();
         await fs60.promises.mkdir(dir, { recursive: true });
-        const pregenPath = path68.join(dir, "pregen.json");
+        const pregenPath = path69.join(dir, "pregen.json");
         const pregenData = { ts: Date.now(), names: skillNames };
         await fs60.promises.writeFile(pregenPath, JSON.stringify(pregenData, null, 2));
         out(`Pre-generated ${skillNames.length} skill compacts.`);
@@ -76150,8 +76189,8 @@ async function cmdSkillCompact(name2, opts) {
       }
       throw new CliError(`failed to read skill file '${opts.path}': ${extractErrorMessage(e)}`);
     }
-    cacheName = name2 ?? path68.basename(path68.dirname(path68.resolve(opts.path)));
-    sourcePath = path68.resolve(opts.path);
+    cacheName = name2 ?? path69.basename(path69.dirname(path69.resolve(opts.path)));
+    sourcePath = path69.resolve(opts.path);
   } else {
     if (name2 === void 0 || !name2.trim()) {
       throw new CliError("skill-compact requires a <name> or --path <file>");
@@ -76292,8 +76331,8 @@ async function cmdSkillDiff(name2) {
   }
   const newer = versions[0];
   const older = versions[1];
-  const newerBody = await fs60.promises.readFile(path68.resolve(dir, `${newer.outputId}.txt`), "utf-8").catch(() => null);
-  const olderBody = await fs60.promises.readFile(path68.resolve(dir, `${older.outputId}.txt`), "utf-8").catch(() => null);
+  const newerBody = await fs60.promises.readFile(path69.resolve(dir, `${newer.outputId}.txt`), "utf-8").catch(() => null);
+  const olderBody = await fs60.promises.readFile(path69.resolve(dir, `${older.outputId}.txt`), "utf-8").catch(() => null);
   if (newerBody === null || olderBody === null) {
     out(`a cached version of '${name2}' was evicted while diffing -- try again`);
     return;
@@ -76340,7 +76379,7 @@ function atomicWriteBuffer(dest, data) {
     if (e.code !== "ENOENT") throw e;
   }
   const rnd = Math.random().toString(36).slice(2, 8);
-  const tmp = path68.join(path68.dirname(path68.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
+  const tmp = path69.join(path69.dirname(path69.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
   try {
     fs60.writeFileSync(tmp, data, { mode: 384 });
     try {
@@ -76378,9 +76417,9 @@ function mapFsError(e, src, dest, srcLabel = "source") {
   const fe = e;
   if (fe.code === "ENOENT") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && path68.resolve(errPath) === path68.resolve(src);
+    const isSource = src !== void 0 && path69.resolve(errPath) === path69.resolve(src);
     if (isSource) throw new CliError(`${srcLabel} file not found: ${src}`);
-    const destDir = dest ? path68.dirname(path68.resolve(dest)) : path68.dirname(path68.resolve(errPath || "."));
+    const destDir = dest ? path69.dirname(path69.resolve(dest)) : path69.dirname(path69.resolve(errPath || "."));
     throw new CliError(`destination directory does not exist: ${destDir}`);
   }
   if (fe.code === "ENOTDIR") {
@@ -76391,7 +76430,7 @@ function mapFsError(e, src, dest, srcLabel = "source") {
   }
   if (fe.code === "EISDIR") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && (errPath === "" || path68.resolve(errPath) === path68.resolve(src));
+    const isSource = src !== void 0 && (errPath === "" || path69.resolve(errPath) === path69.resolve(src));
     if (isSource) throw new CliError(`source is a directory, not a file: ${src}`);
     throw new CliError(`destination is a directory, not a file: ${dest ?? (errPath || "(unknown)")}`);
   }
@@ -76460,7 +76499,7 @@ function validateWritablePath(dest, label) {
     throw new CliError(`${label} path contains a null byte`);
   }
   if (isWindows()) {
-    const base = path68.basename(dest);
+    const base = path69.basename(dest);
     const stem = base.replace(/\.[^.]*$/, "").toUpperCase();
     if (WIN_RESERVED.has(stem)) {
       throw new CliError(`${label} '${base}' is a reserved Windows device name`);
@@ -76964,17 +77003,17 @@ function expandGlobs(root, patterns, globFnOverride) {
     if (globFn !== void 0 && (p.includes("*") || p.includes("?") || p.includes("{"))) {
       try {
         const hits = globFn(p, { cwd: root });
-        for (const h of hits) out2.push(path68.isAbsolute(h) ? h : path68.join(root, h));
+        for (const h of hits) out2.push(path69.isAbsolute(h) ? h : path69.join(root, h));
         continue;
       } catch {
       }
     }
-    out2.push(path68.isAbsolute(p) ? p : path68.join(root, p));
+    out2.push(path69.isAbsolute(p) ? p : path69.join(root, p));
   }
   return out2;
 }
 function readIgnoreFile(root) {
-  const ignorePath = path68.join(root, ".tokengoatignore");
+  const ignorePath = path69.join(root, ".tokengoatignore");
   let raw;
   try {
     raw = fs60.readFileSync(ignorePath, "utf8");
@@ -77043,7 +77082,7 @@ function cmdTokens(patterns, opts) {
   if (opts.tree === true) {
     const dirs = /* @__PURE__ */ new Map();
     for (const e of entries) {
-      const dir = path68.dirname(e.rel_path);
+      const dir = path69.dirname(e.rel_path);
       if (!dirs.has(dir)) dirs.set(dir, []);
       dirs.get(dir).push(e);
     }
@@ -77053,7 +77092,7 @@ function cmdTokens(patterns, opts) {
       const pct = result.total_tokens > 0 ? Math.round(dirTokens / result.total_tokens * 100) : 0;
       lines3.push(`${dir}/ (${dirTokens} tokens, ${pct}%)`);
       for (const e of dirEntries) {
-        lines3.push(`  ${path68.basename(e.rel_path).padEnd(30)}  ${String(e.tokens).padStart(8)} tokens`);
+        lines3.push(`  ${path69.basename(e.rel_path).padEnd(30)}  ${String(e.tokens).padStart(8)} tokens`);
       }
     }
     out(lines3.join("\n"));
@@ -77336,13 +77375,14 @@ function buildProgram() {
       })
     )
   );
-  program2.command("impact <symbol>").description("transitive set of callers impacted by a change (with hop depth; accepts file::symbol to disambiguate which same-named definition is meant)").option("--top <n>", "limit output to top N results").option("-j, --json", "output as JSON").option("--exclude-tests", "hide callers whose call site lives in a test file (opt-in; default output is unchanged)").action(
+  program2.command("impact <symbol>").description("transitive set of callers impacted by a change (with hop depth; accepts file::symbol to disambiguate which same-named definition is meant)").option("--top <n>", "limit output to top N results").option("-j, --json", "output as JSON").option("--exclude-tests", "hide callers whose call site lives in a test file (opt-in; default output is unchanged)").option("--grep <pattern>", "only show impacted symbols whose name matches this regex (literal substring if it is not valid regex)").action(
     (symbol3, opts) => runExit(
       () => runImpact({
         symbol: symbol3,
         ...opts.top !== void 0 ? { top: requireNonNegativeInt("--top", opts.top) } : {},
         ...opts.json === true ? { json: true } : {},
-        ...opts.excludeTests === true ? { excludeTests: true } : {}
+        ...opts.excludeTests === true ? { excludeTests: true } : {},
+        ...opts.grep !== void 0 ? { grep: opts.grep } : {}
       })
     )
   );
@@ -82179,8 +82219,8 @@ function trimCharacterEnd(str, char) {
 function unicodeEscape(str) {
   return str.replace(/[\s\S]/g, (c) => "\\u" + c.charCodeAt().toString(16).padStart(4, "0"));
 }
-function get(obj, path69) {
-  for (const key of path69) {
+function get(obj, path70) {
+  for (const key of path70) {
     if (!obj) {
       return void 0;
     }
@@ -83381,8 +83421,8 @@ function withBrackets(str, brackets) {
   const rbr = typeof brackets[1] === "string" ? brackets[1] : "]";
   return lbr + str + rbr;
 }
-function pathRewrite(path69, rewriter, baseUrl, metadata, elem) {
-  const modifiedPath = typeof rewriter === "function" ? rewriter(path69, metadata, elem) : path69;
+function pathRewrite(path70, rewriter, baseUrl, metadata, elem) {
+  const modifiedPath = typeof rewriter === "function" ? rewriter(path70, metadata, elem) : path70;
   return modifiedPath[0] === "/" && baseUrl ? trimCharacterEnd(baseUrl, "/") + modifiedPath : modifiedPath;
 }
 function formatImage(elem, walk, builder, formatOptions) {
@@ -83706,9 +83746,9 @@ function handleDeprecatedOptions(options) {
     options.selectors.push(...tagDefinitions);
     options.selectors = mergeDuplicatesPreferLast(options.selectors, (s) => s.selector);
   }
-  function set2(obj, path69, value) {
-    const valueKey = path69.pop();
-    for (const key of path69) {
+  function set2(obj, path70, value) {
+    const valueKey = path70.pop();
+    for (const key of path70) {
       let nested = obj[key];
       if (!nested) {
         nested = {};
@@ -84757,8 +84797,8 @@ function detectUnbalancedShellSyntax(cmd) {
           }
           j = delimEnd;
         }
-        const delimiter2 = cmd.slice(delimStart, j).replace(/["']/g, "");
-        if (delimiter2) {
+        const delimiter3 = cmd.slice(delimStart, j).replace(/["']/g, "");
+        if (delimiter3) {
           let scanPos = j;
           let terminatorEnd = -1;
           while (scanPos <= cmd.length) {
@@ -84768,7 +84808,7 @@ function detectUnbalancedShellSyntax(cmd) {
             if (line.endsWith("\r")) {
               line = line.slice(0, -1);
             }
-            const isMatch = hasIndentModifier ? line.trim() === delimiter2 : line === delimiter2;
+            const isMatch = hasIndentModifier ? line.trim() === delimiter3 : line === delimiter3;
             if (isMatch) {
               terminatorEnd = nl3 === -1 ? cmd.length : nl3 + 1;
               break;
@@ -84777,7 +84817,7 @@ function detectUnbalancedShellSyntax(cmd) {
             scanPos = nl3 + 1;
           }
           if (terminatorEnd === -1) {
-            return `an unterminated heredoc (${delimiter2} never appears on its own line)`;
+            return `an unterminated heredoc (${delimiter3} never appears on its own line)`;
           }
           i = terminatorEnd;
           continue;