token-goat 2.6.30 → 2.6.31

package/dist/{token-goat-hook-chunk-XNZLMFQ2.mjs → token-goat-hook-chunk-YHRJMMEF.mjs}

@@ -1,17 +1,96 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
+import {
+  ALL_SYMBOLS_IN_FILE_LIMIT,
+  CONTENT_MAX_INPUT_CHARS,
+  WHOLE_FILE_NOTE_SYMBOL,
+  compressText,
+  computeFileFingerprint,
+  createHandoff,
+  didYouMean,
+  enclosingSymbol,
+  extraFileArgsNote,
+  extractSection,
+  extractTranscriptText,
+  filterSimilarHeadings,
+  findSpecSeparator,
+  getTrackedFiles,
+  healStaleIndex,
+  isAvailable,
+  listSections,
+  load,
+  loadError,
+  rankSimilarNames,
+  readSection,
+  resolveBody,
+  resolveHandoff,
+  resolveSymbolMatch,
+  retrieveText,
+  runArch,
+  runAsk,
+  runBlame,
+  runBrief,
+  runCallChain,
+  runCallers,
+  runChanged,
+  runConfigGet,
+  runConflicts,
+  runContextFor,
+  runCoverageGaps,
+  runCoverageReportGaps,
+  runCsvProfile,
+  runCsvQuery,
+  runDead,
+  runDeps,
+  runDiff,
+  runExports,
+  runFind,
+  runGrep,
+  runImageMeta,
+  runImageText,
+  runImpact,
+  runImports,
+  runJsonOutline,
+  runJsonQuery,
+  runListSections,
+  runLog,
+  runNoteGet,
+  runNoteList,
+  runOpenApiOp,
+  runOpenApiOutline,
+  runOutline,
+  runPdfExtractText,
+  runPdfMeta,
+  runPdfOutline,
+  runPrSlice,
+  runRead,
+  runRefs,
+  runScope,
+  runScreenshot,
+  runSection,
+  runSemantic,
+  runSimilar,
+  runSkeleton,
+  runSqliteQuery,
+  runSqliteSchema,
+  runSymbol,
+  runTestFor,
+  runTypes,
+  runYamlOutline,
+  runYamlQuery,
+  runZipList,
+  runZipRead,
+  symbolNamesInFile,
+  upsertNote
+} from "./token-goat-hook-chunk-66W63A4Y.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
   HOOK_EVENTS,
-  ToolFilter,
   WEB_OUTPUT_SUBDIR,
   buildCommandManifest,
-  capTokens,
-  combineStreams,
+  checkSymbolBodySize,
   commandHash,
-  compressOutput,
-  filterByName,
   filterCommandManifest,
   formatCommandManifest,
   getBashOutput,
@@ -22,43 +101,23 @@ import {
   listRecentRecall,
   normalizeCommandForCacheKey,
   readStdinJson,
-  relay,
-  resolveMinNetSavingsBytes,
-  runDoctor,
-  runDoctorAndExit,
   searchRecall,
-  selectFilter,
-  shlexSplit,
-  storeWebOutput,
-  wrappedShell
-} from "./token-goat-hook-chunk-VKAQNN2R.mjs";
-import {
-  CONTENT_MAX_INPUT_CHARS,
-  compressText,
-  createHandoff,
-  resolveHandoff,
-  retrieveText
-} from "./token-goat-hook-chunk-5B3OWRNC.mjs";
+  storeWebOutput
+} from "./token-goat-hook-chunk-JT5RMRIY.mjs";
 import {
   AGENT_SALT_MARKER,
-  C,
-  CONFIG_KEY_ENV_OVERRIDES,
   CONTEXT_AUTOCOMPACT_TOKENS,
   DEFAULT_MAX_AGE_MS,
   DEFAULT_MAX_COUNT,
-  ENV_KEYS,
-  LOCK_WAIT_MS_HARDENED,
   MAX_FILES_SCANNED,
-  RESET,
   SESSIONS_SUBDIR,
   SKILLS_OUTPUT_SUBDIR,
-  VERSION,
-  WHOLE_FILE_NOTE_SYMBOL,
+  SKIP_DIRS,
+  UNTRUSTED_TOOL_TAG,
+  UNTRUSTED_WEB_TAG,
+  WORKER_HEARTBEAT_STALE_MS,
   WorkerAlreadyRunningError,
-  _useRichStats,
   anchoredMarkerPattern,
-  atomicWriteBytes,
-  atomicWriteText,
   auditClaudeMd,
   buildExtractiveCompact,
   buildLineDiff,
@@ -66,77 +125,49 @@ import {
   buildProjectMap,
   buildStats,
   capJsonRows,
-  cmdHot,
-  cmdIgnores,
-  cmdLockdeps,
-  cmdLogfold,
-  cmdNote,
-  cmdRecent,
-  cmdTodo,
-  cmdTrace,
-  colorStdout,
   compactDoc,
   compactPathFor,
-  computeFileFingerprint,
-  configPath,
   confirmAndApply,
   contentHash,
-  countNoun,
-  dataDir,
-  defaultConfig,
+  copilotCliConfigPath,
+  copilotCliScriptPath,
   detectLanguage,
-  didYouMean,
+  detectWalkMode,
+  dirtyQueuePathFor,
   docxOutline,
   docxText,
+  drainHeartbeatPathFor,
   embeddingsDepsAvailable,
+  emptyIndexMessage,
   enqueueDirtyPathSafe,
-  ensureDirSync,
-  ensureNewline,
   estimateTokens,
-  extraFileArgsNote,
   extractChecklistSection,
   extractCompactFromMarker,
-  extractErrorMessage,
   extractNamedSection,
-  extractSection,
-  extractTranscriptText,
-  fg,
-  filterSimilarHeadings,
+  fenceUntrustedContent,
   findClaudeMdFiles,
   findContentDuplicates,
   findLatestSessionId,
   findMemSuggestionCandidates,
   findMemoryMd,
-  findProject,
-  findSpecSeparator,
   findStrayClaudeMdBlocks,
   findSystemTempFiles,
-  fingerprintContent,
-  fingerprintFile,
-  foldPath,
   formatAge,
   formatCsvTable,
-  formatLocalTimestamp,
   formatMemSuggestions,
   formatProjectMap,
   formatXlsxRange,
   getContextPressure,
-  getDb,
   getDirtyPathsFor,
   getFileEntry,
   getHintStatsSummary,
   getHintStatsTotals,
-  getLastConfigParseError,
-  getLastProjectConfigParseError,
-  getProjectConfigInfo,
+  getProjectIndexCounts,
   getSessionFiles,
   getSessionId,
   getSkillFilePath,
-  getTrackedFiles,
-  globalDbPath,
   groupHasTokenGoat,
   headSheet,
-  healStaleIndex,
   incrementSkillHit,
   indexFileEmbeddings,
   indexFileSync,
@@ -145,35 +176,28 @@ import {
   installCopilotCli,
   installGrok,
   installHooks,
-  installSingleFilePlugin,
   installSkill,
   installVscode,
-  invalidateConfigCache,
+  isCodexInstalled,
   isCompactFresh,
+  isCopilotCliInstalled,
   isEmbedFresh,
   isEmbeddableDocument,
+  isGrokInstalled,
   isHintCategory,
   isInstalled,
   isParseSkipEligible,
-  isUnderBlockedRoot,
-  isWindows,
   isWorkerRunning,
   listBlobs,
   listOutputs,
-  listSections,
   listSheets,
   listSkills,
   loadBlob,
-  loadConfig,
-  loadPersistedConfig,
   loadSessionCache,
   mapLookupBytesSaved,
   markCategoryEffective,
   markCategoryIneffective,
-  normalizePath,
   otherScopeHasManagedServer,
-  pad,
-  parse,
   parseWhereSpecs,
   pptxNotesText,
   pptxOutline,
@@ -184,161 +208,153 @@ import {
   pruneSkillOutputs,
   pruneSystemTempFiles,
   querySheet,
+  querySymbols,
   rangeSheet,
-  rankSimilarNames,
   readCompactBody,
-  readSection,
-  recordStat,
-  redactUrlQuery,
   removeFileFromIndex,
-  renderShortStats,
-  renderStats,
-  requireNonNegativeStrictInt,
-  requirePositiveStrictInt,
   resetHintStats,
-  resolveConfigKeyLayer,
-  resolveIndexPath,
-  resolveProjectRoot,
-  resolveSymbolMatch,
-  runArch,
-  runAsk,
-  runBlame,
-  runBrief,
-  runCallChain,
-  runCallers,
-  runChanged,
-  runConfigGet,
-  runConflicts,
-  runContextFor,
   runContextStats,
-  runCoverageGaps,
-  runCoverageReportGaps,
-  runCsvProfile,
-  runCsvQuery,
-  runDead,
-  runDeps,
   runDetachedWorkerDaemon,
-  runDiff,
-  runExports,
-  runFind,
-  runGit,
-  runGrep,
-  runImageMeta,
-  runImageText,
-  runImpact,
-  runImports,
-  runJsonOutline,
-  runJsonQuery,
-  runListSections,
-  runLog,
-  runNoteGet,
-  runNoteList,
-  runOpenApiOp,
-  runOpenApiOutline,
-  runOutline,
-  runPdfExtractText,
-  runPdfMeta,
-  runPdfOutline,
-  runPrSlice,
-  runRead,
-  runRefs,
-  runScope,
-  runScreenshot,
-  runSection,
-  runSemantic,
-  runSimilar,
-  runSkeleton,
-  runSqliteQuery,
-  runSqliteSchema,
-  runSymbol,
-  runTestFor,
-  runTypes,
-  runYamlOutline,
-  runYamlQuery,
-  runZipList,
-  runZipRead,
-  safeSlice,
-  saveConfig,
+  scanForInjectionPatterns,
   shrinkImage,
   skillOutputsDir,
-  sleepSync,
   startDetachedWorker,
   stopWorker,
   storeCompact,
   storeOutput,
-  stripAnsi,
-  stripOwnHooksFromMap,
-  stripStaleGroupHooks,
-  suggestPackageNames,
-  summarize,
-  symbolNamesInFile,
+  tokenGoatHome,
   trimToBudget,
   uninstallClaudeMd,
   uninstallCodex,
   uninstallCopilotCli,
   uninstallGrok,
   uninstallHooks,
-  uninstallSingleFilePlugin,
   uninstallSkill,
   uninstallVscode,
-  upsertNote,
-  validateEnumField,
-  validateNumericField,
+  urlPolicyDenialReason,
   vscodeDecoderConfigured,
   walkProject,
-  withExtension,
-  withFileLock,
-  withRetryOnLock,
-  writeCompact,
-  writeJsonSettings
-} from "./token-goat-hook-chunk-4SM2PAR6.mjs";
-import "./token-goat-hook-chunk-KNVHTGEX.mjs";
+  writeCompact
+} from "./token-goat-hook-chunk-SJM4BUZQ.mjs";
 import {
-  __commonJS,
-  __export,
-  __require,
-  __toESM,
-  init_define_import_meta_env
-} from "./token-goat-hook-chunk-7WC2H3EW.mjs";
-
-// node_modules/commander/lib/error.js
-var require_error = __commonJS({
-  "node_modules/commander/lib/error.js"(exports) {
-    init_define_import_meta_env();
-    var CommanderError2 = class extends Error {
-      /**
-       * Constructs the CommanderError class
-       * @param {number} exitCode suggested exit code which could be used with process.exit
-       * @param {string} code an id string representing the error
-       * @param {string} message human-readable description of the error
-       */
-      constructor(exitCode, code, message) {
-        super(message);
-        Error.captureStackTrace(this, this.constructor);
-        this.name = this.constructor.name;
-        this.code = code;
-        this.exitCode = exitCode;
-        this.nestedError = void 0;
-      }
-    };
-    var InvalidArgumentError2 = class extends CommanderError2 {
-      /**
-       * Constructs the InvalidArgumentError class
-       * @param {string} [message] explanation of why argument is invalid
-       */
-      constructor(message) {
-        super(1, "commander.invalidArgument", message);
-        Error.captureStackTrace(this, this.constructor);
-        this.name = this.constructor.name;
-      }
-    };
-    exports.CommanderError = CommanderError2;
-    exports.InvalidArgumentError = InvalidArgumentError2;
-  }
-});
-
-// node_modules/commander/lib/argument.js
-var require_argument = __commonJS({
+  C,
+  CONFIG_KEY_ENV_OVERRIDES,
+  ENV_KEYS,
+  FILTERS,
+  LOCK_WAIT_MS_HARDENED,
+  RESET,
+  VERSION,
+  _useRichStats,
+  atomicWriteBytes,
+  atomicWriteText,
+  canonicalize,
+  colorStdout,
+  configPath,
+  countNoun,
+  dataDir,
+  defaultConfig,
+  ensureDirSync,
+  ensureNewline,
+  escapeRegExp,
+  extractErrorMessage,
+  fg,
+  findProject,
+  fingerprintContent,
+  fingerprintFile,
+  foldPath,
+  formatLocalTimestamp,
+  getDb,
+  getDisplayRoot,
+  getLastConfigParseError,
+  getLastProjectConfigParseError,
+  getProjectConfigInfo,
+  globalDbPath,
+  installSingleFilePlugin,
+  invalidateConfigCache,
+  isUnderBlockedRoot,
+  isWindows,
+  lastProjectConfigLockedKeys,
+  loadConfig,
+  loadPersistedConfig,
+  normalizeDarwinSystemAlias,
+  normalizePath,
+  pad,
+  parse,
+  recordStat,
+  redactUrlQuery,
+  renderShortStats,
+  renderStats,
+  requireNonNegativeStrictInt,
+  requirePositiveStrictInt,
+  resolveConfigKeyLayer,
+  resolveIndexPath,
+  resolveProjectRoot,
+  runGit,
+  safeSlice,
+  saveConfig,
+  sleepSync,
+  stripAnsi,
+  stripOwnHooksFromMap,
+  stripStaleGroupHooks,
+  suggestPackageNames,
+  summarize,
+  toDisplayPath,
+  toKB,
+  uninstallSingleFilePlugin,
+  validateEnumField,
+  validateNumericField,
+  withExtension,
+  withFileLock,
+  withRetryOnLock,
+  writeJsonSettings
+} from "./token-goat-hook-chunk-NIVRFAJ4.mjs";
+import "./token-goat-hook-chunk-KNVHTGEX.mjs";
+import {
+  __commonJS,
+  __export,
+  __require,
+  __toESM,
+  init_define_import_meta_env
+} from "./token-goat-hook-chunk-7WC2H3EW.mjs";
+
+// node_modules/commander/lib/error.js
+var require_error = __commonJS({
+  "node_modules/commander/lib/error.js"(exports) {
+    init_define_import_meta_env();
+    var CommanderError2 = class extends Error {
+      /**
+       * Constructs the CommanderError class
+       * @param {number} exitCode suggested exit code which could be used with process.exit
+       * @param {string} code an id string representing the error
+       * @param {string} message human-readable description of the error
+       */
+      constructor(exitCode, code, message) {
+        super(message);
+        Error.captureStackTrace(this, this.constructor);
+        this.name = this.constructor.name;
+        this.code = code;
+        this.exitCode = exitCode;
+        this.nestedError = void 0;
+      }
+    };
+    var InvalidArgumentError2 = class extends CommanderError2 {
+      /**
+       * Constructs the InvalidArgumentError class
+       * @param {string} [message] explanation of why argument is invalid
+       */
+      constructor(message) {
+        super(1, "commander.invalidArgument", message);
+        Error.captureStackTrace(this, this.constructor);
+        this.name = this.constructor.name;
+      }
+    };
+    exports.CommanderError = CommanderError2;
+    exports.InvalidArgumentError = InvalidArgumentError2;
+  }
+});
+
+// node_modules/commander/lib/argument.js
+var require_argument = __commonJS({
   "node_modules/commander/lib/argument.js"(exports) {
     init_define_import_meta_env();
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
@@ -1240,8 +1256,8 @@ var require_command = __commonJS({
     init_define_import_meta_env();
     var EventEmitter = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
-    var path22 = __require("node:path");
-    var fs20 = __require("node:fs");
+    var path26 = __require("node:path");
+    var fs26 = __require("node:fs");
     var process2 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2173,11 +2189,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path22.resolve(baseDir, baseName);
-          if (fs20.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path22.extname(baseName))) return void 0;
+          const localBin = path26.resolve(baseDir, baseName);
+          if (fs26.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path26.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext2) => fs20.existsSync(`${localBin}${ext2}`)
+            (ext2) => fs26.existsSync(`${localBin}${ext2}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2189,21 +2205,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs20.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs26.realpathSync(this._scriptPath);
           } catch (err2) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path22.resolve(
-            path22.dirname(resolvedScriptPath),
+          executableDir = path26.resolve(
+            path26.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path22.basename(
+            const legacyName = path26.basename(
               this._scriptPath,
-              path22.extname(this._scriptPath)
+              path26.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2214,7 +2230,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path22.extname(executableFile));
+        launchWithNode = sourceExt.includes(path26.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -3054,7 +3070,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path22.basename(filename, path22.extname(filename));
+        this._name = path26.basename(filename, path26.extname(filename));
         return this;
       }
       /**
@@ -3068,9 +3084,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path23) {
-        if (path23 === void 0) return this._executableDir;
-        this._executableDir = path23;
+      executableDir(path27) {
+        if (path27 === void 0) return this._executableDir;
+        this._executableDir = path27;
         return this;
       }
       /**
@@ -3367,9 +3383,9 @@ function attemptedCommandName(argv) {
 }
 
 // src/cli.ts
-import * as fs19 from "fs";
-import * as path21 from "path";
-import { homedir as homedir10 } from "os";
+import * as fs25 from "fs";
+import * as path25 from "path";
+import { homedir as homedir11 } from "os";
 
 // src/walk_index.ts
 init_define_import_meta_env();
@@ -3551,6 +3567,18 @@ function uninstallGemini() {
   writeJsonSettings(p, settings);
   return true;
 }
+function isGeminiInstalled() {
+  const settings = readGeminiSettings(geminiSettingsPath());
+  const hooks = settings.hooks;
+  if (hooks === void 0) return false;
+  for (const event of GEMINI_HOOK_EVENTS) {
+    const command = geminiHookCommand(GEMINI_EVENT_ARG[event]);
+    for (const matcher of desiredMatchersFor(event)) {
+      if (!groupHasTokenGoat(hooks[event], matcher, (c) => isCurrentGeminiTokenGoatCommand(c, command))) return false;
+    }
+  }
+  return true;
+}
 
 // src/bridges/qwen_install.ts
 init_define_import_meta_env();
@@ -3666,9 +3694,20 @@ function uninstallQwen() {
   writeJsonSettings(p, settings);
   return true;
 }
+function isQwenInstalled() {
+  const settings = readQwenSettings(qwenSettingsPath());
+  const hooks = settings.hooks;
+  if (hooks === void 0) return false;
+  for (const event of QWEN_HOOK_EVENTS) {
+    const command = qwenHookCommand(QWEN_EVENT_ARG[event]);
+    if (!groupHasTokenGoat2(hooks[event], (c) => isCurrentQwenTokenGoatCommand(c, command))) return false;
+  }
+  return true;
+}
 
 // src/bridges/pi_install.ts
 init_define_import_meta_env();
+import * as fs4 from "node:fs";
 import * as os4 from "node:os";
 import * as path4 from "node:path";
 
@@ -4011,9 +4050,13 @@ function uninstallPi(opts = {}) {
   const localRemoved = uninstallPiScope({ local: true });
   return globalRemoved || localRemoved;
 }
+function isPiInstalled(opts = {}) {
+  return fs4.existsSync(piExtensionPath(opts));
+}
 
 // src/bridges/opencode_install.ts
 init_define_import_meta_env();
+import * as fs5 from "node:fs";
 import * as os5 from "node:os";
 import * as path5 from "node:path";
 
@@ -4315,10 +4358,13 @@ function installOpencode() {
 function uninstallOpencode() {
   return uninstallSingleFilePlugin(opencodePluginPath(), opencodeEntrySidecarPath());
 }
+function isOpencodeInstalled() {
+  return fs5.existsSync(opencodePluginPath());
+}
 
 // src/bridges/openclaw_install.ts
 init_define_import_meta_env();
-import * as fs4 from "node:fs";
+import * as fs6 from "node:fs";
 import * as os6 from "node:os";
 import * as path6 from "node:path";
 
@@ -4470,7 +4516,7 @@ function openclawEntrySidecarPath() {
 function readOpenclawConfig(p, opts = {}) {
   let raw;
   try {
-    raw = fs4.readFileSync(p, "utf8");
+    raw = fs6.readFileSync(p, "utf8");
   } catch {
     return {};
   }
@@ -4510,7 +4556,7 @@ function installOpenclaw() {
   const pluginPath = openclawPluginPath();
   let existingPlugin;
   try {
-    existingPlugin = fs4.readFileSync(pluginPath, "utf8");
+    existingPlugin = fs6.readFileSync(pluginPath, "utf8");
   } catch {
     existingPlugin = void 0;
   }
@@ -4551,12 +4597,12 @@ function uninstallOpenclaw() {
   const pluginPath = openclawPluginPath();
   let removed = false;
   try {
-    fs4.unlinkSync(pluginPath);
+    fs6.unlinkSync(pluginPath);
     removed = true;
   } catch {
   }
   try {
-    fs4.unlinkSync(openclawEntrySidecarPath());
+    fs6.unlinkSync(openclawEntrySidecarPath());
   } catch {
   }
   const settings = readOpenclawConfig(configPath2);
@@ -4593,134 +4639,15 @@ function uninstallOpenclaw() {
   }
   return removed;
 }
-
-// src/bash_runner.ts
-init_define_import_meta_env();
-import { spawnSync } from "node:child_process";
-import * as os7 from "node:os";
-var IdentityFilter = class extends ToolFilter {
-  name = "passthrough";
-};
-var DEFAULT_TIMEOUT_SECONDS = 600;
-var MAX_CAPTURE_BYTES = 32 * 1024 * 1024;
-var MIN_RECORD_STAT_BYTES = 32;
-function resolveFilter(command, filterName, cwd) {
-  if (filterName) {
-    const named = filterByName(filterName);
-    if (named !== null) return named;
-  }
-  let argv;
-  try {
-    argv = shlexSplit(command);
-  } catch {
-    return null;
-  }
-  return selectFilter(argv, cwd);
-}
-function baseSpawnOptions(timeout, cwd, env) {
-  return { shell: wrappedShell(), timeout: timeout * 1e3, cwd, env };
-}
-function signalExitCode(signal) {
-  const num = os7.constants.signals[signal];
-  return 128 + (num ?? 0);
-}
-function resolveProfile(explicit) {
-  if (explicit) return explicit;
-  try {
-    const p = loadConfig().compression.profile;
-    return p && p !== "auto" ? p : "balanced";
-  } catch {
-    return "balanced";
-  }
-}
-function resolveCompressLimits() {
-  try {
-    const bc = loadConfig().bash_compress;
-    return { maxLines: bc.max_lines, maxBytes: bc.max_bytes };
-  } catch {
-    return { maxLines: 1e3, maxBytes: 64 * 1024 };
-  }
-}
-function run(command, opts = {}) {
-  const timeout = opts.timeout ?? DEFAULT_TIMEOUT_SECONDS;
-  const filter2 = resolveFilter(command, opts.filterName, opts.cwd);
-  if (filter2 === null) {
-    if ((opts.maxTokens ?? 0) > 0) {
-      return wrapAndCompress(command, new IdentityFilter(), timeout, resolveProfile(opts.compressionProfile), opts);
-    }
-    return passthrough(command, timeout, opts.cwd, opts.env);
-  }
-  return wrapAndCompress(command, filter2, timeout, resolveProfile(opts.compressionProfile), opts);
-}
-function runRaw(command, timeout = DEFAULT_TIMEOUT_SECONDS) {
-  return passthrough(command, timeout, void 0, void 0);
-}
-function passthrough(command, timeout, cwd, env) {
-  const result = spawnSync(command, { ...baseSpawnOptions(timeout, cwd, env), stdio: "inherit" });
-  if (isTimeout(result.error)) return 124;
-  if (result.status !== null) return result.status;
-  if (result.signal) return signalExitCode(result.signal);
-  return 0;
-}
-function isTimeout(error) {
-  return !!error && error.code === "ETIMEDOUT";
-}
-function decode(buf) {
-  if (buf == null) return "";
-  return typeof buf === "string" ? buf : buf.toString("utf8");
-}
-function wrapAndCompress(command, filter2, timeout, profile, opts) {
-  const writeStdout = opts.writeStdout ?? ((s) => process.stdout.write(s));
-  const result = spawnSync(command, {
-    ...baseSpawnOptions(timeout, opts.cwd, opts.env),
-    stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: MAX_CAPTURE_BYTES
-  });
-  const timedOut = isTimeout(result.error);
-  const overflowed = !!result.error && result.error.code === "ENOBUFS";
-  let stdoutText = decode(result.stdout);
-  let stderrText = decode(result.stderr);
-  if (overflowed) {
-    stdoutText += `
-[token-goat: capture capped at ${MAX_CAPTURE_BYTES / (1024 * 1024)} MiB]`;
-  }
-  let exitCode;
-  if (timedOut) {
-    exitCode = 124;
-    stderrText = (stderrText ? stderrText + "\n" : "") + `[token-goat: command exceeded ${timeout}s timeout and was killed]`;
-  } else if (result.status !== null) {
-    exitCode = result.status;
-  } else if (result.signal) {
-    exitCode = signalExitCode(result.signal);
-  } else {
-    exitCode = 0;
-  }
-  let argv;
-  try {
-    argv = shlexSplit(command);
-  } catch {
-    argv = [command];
-  }
-  const limits = resolveCompressLimits();
-  const compressed = compressOutput(filter2, stdoutText, stderrText, exitCode, argv, {
-    compressionProfile: profile,
-    maxLines: limits.maxLines,
-    maxBytes: limits.maxBytes
-  });
-  const minNetSavingsBytes = resolveMinNetSavingsBytes();
-  const applied = compressed.worthApplying(minNetSavingsBytes);
-  let text = applied ? compressed.text : combineStreams(stdoutText, stderrText);
-  const maxTokens = opts.maxTokens ?? 0;
-  if (maxTokens > 0) text = capTokens(text, maxTokens);
-  const marker = applied ? compressed.withMarker(minNetSavingsBytes).slice(compressed.text.length) : "";
-  const body = text + marker;
-  writeStdout(body.endsWith("\n") ? body : body + "\n");
-  if (applied) recordSavings(compressed);
-  return exitCode;
-}
-function recordSavings(result) {
-  if (result.bytesSaved < MIN_RECORD_STAT_BYTES) return;
-  recordStat(`bash_compress:${result.filterName}`, result.bytesSaved, result.tokensSaved);
+function isOpenclawInstalled() {
+  if (!fs6.existsSync(openclawPluginPath())) return false;
+  const settings = readOpenclawConfig(openclawConfigPath());
+  const plugins = settings.plugins;
+  if (plugins === void 0) return false;
+  const targetFolded = foldPath(openclawPluginPath());
+  const hasPath = (plugins.load?.paths ?? []).some((p) => foldPath(p) === targetFolded);
+  const hasEntry = plugins.entries?.[OPENCLAW_PLUGIN_ID] !== void 0;
+  return hasPath && hasEntry;
 }
 
 // src/bridges_status.ts
@@ -4894,8 +4821,8 @@ function formatBridgesStatus(matrix = BRIDGE_CAPABILITY_MATRIX) {
 
 // src/sharepoint_resolve.ts
 init_define_import_meta_env();
-import * as fs5 from "node:fs";
-import * as os8 from "node:os";
+import * as fs7 from "node:fs";
+import * as os7 from "node:os";
 import * as path7 from "node:path";
 var TENANT_HOST_RE = /^([a-z0-9-]+?)(-my)?\.sharepoint\.com$/i;
 function parseShareUrl(url) {
@@ -4944,7 +4871,7 @@ function candidateRoots(env, home) {
   if (commercial !== void 0) roots.push(commercial);
   if (personal !== void 0 && personal !== commercial) roots.push(personal);
   try {
-    for (const entry of fs5.readdirSync(home, { withFileTypes: true })) {
+    for (const entry of fs7.readdirSync(home, { withFileTypes: true })) {
       if (entry.isDirectory() && /onedrive/i.test(entry.name)) {
         const full = path7.join(home, entry.name);
         if (!roots.includes(full)) roots.push(full);
@@ -4957,18 +4884,18 @@ function candidateRoots(env, home) {
 function tryLibraryPaths(root, libSegments, triedPaths) {
   const rawJoined = path7.join(root, ...libSegments);
   triedPaths.push(rawJoined);
-  if (fs5.existsSync(rawJoined)) return rawJoined;
+  if (fs7.existsSync(rawJoined)) return rawJoined;
   if (libSegments.length > 0) {
     const aliasedFirst = normalizeLibrarySegment(libSegments[0]);
     if (aliasedFirst !== libSegments[0]) {
       const aliasedJoined = path7.join(root, aliasedFirst, ...libSegments.slice(1));
       triedPaths.push(aliasedJoined);
-      if (fs5.existsSync(aliasedJoined)) return aliasedJoined;
+      if (fs7.existsSync(aliasedJoined)) return aliasedJoined;
     }
   }
   return null;
 }
-function resolveLocalPath(parsed, env = process.env, home = os8.homedir()) {
+function resolveLocalPath(parsed, env = process.env, home = os7.homedir()) {
   const roots = candidateRoots(env, home);
   const libSegments = parsed.libraryPath.split(/[/\\]+/).filter((s) => s.length > 0 && s !== "." && s !== "..");
   const triedPaths = [];
@@ -4987,7 +4914,7 @@ function resolveLocalPath(parsed, env = process.env, home = os8.homedir()) {
     if (found !== null) return { resolvedPath: found, triedPaths };
     if (parsed.siteType === "site" && parsed.siteName.length > 0) {
       try {
-        for (const entry of fs5.readdirSync(root, { withFileTypes: true })) {
+        for (const entry of fs7.readdirSync(root, { withFileTypes: true })) {
           if (!entry.isDirectory() || !entry.name.toLowerCase().includes(parsed.siteName.toLowerCase())) continue;
           const siteRoot = path7.join(root, entry.name);
           const siteFound = safeTryLibraryPaths(siteRoot, libSegments, triedPaths);
@@ -5002,12 +4929,12 @@ function resolveLocalPath(parsed, env = process.env, home = os8.homedir()) {
 
 // src/video_chapters.ts
 init_define_import_meta_env();
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync } from "node:child_process";
 var _ffprobeAvailable;
 function isFfprobeAvailable() {
   if (_ffprobeAvailable !== void 0) return _ffprobeAvailable;
   try {
-    const res = spawnSync2("ffprobe", ["-version"], { stdio: "ignore" });
+    const res = spawnSync("ffprobe", ["-version"], { stdio: "ignore" });
     _ffprobeAvailable = res.status === 0;
   } catch {
     _ffprobeAvailable = false;
@@ -5018,7 +4945,7 @@ function extractVideoChapters(file) {
   if (!isFfprobeAvailable()) {
     throw new Error("ffprobe not found on PATH; video-chapters requires ffmpeg (install ffmpeg and ensure ffprobe is on PATH)");
   }
-  const res = spawnSync2(
+  const res = spawnSync(
     "ffprobe",
     ["-v", "error", "-print_format", "json", "-show_chapters", "-show_streams", file],
     { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
@@ -5050,7 +4977,7 @@ function extractVideoChapters(file) {
 
 // src/transcript_extract.ts
 init_define_import_meta_env();
-import * as fs6 from "node:fs";
+import * as fs8 from "node:fs";
 var TIMESTAMP_RE = /(\d{1,2}:)?(\d{2}):(\d{2})[.,](\d{1,3})/;
 var CUE_LINE_RE = new RegExp(`^\\s*${TIMESTAMP_RE.source}\\s*-->\\s*${TIMESTAMP_RE.source}`);
 var V_TAG_RE = /^<v(?:\.\w+)?\s+([^>]+)>\s*(.*)$/;
@@ -5102,7 +5029,7 @@ function parseTranscript(content) {
   return cues;
 }
 function readTranscript(filePath) {
-  const content = fs6.readFileSync(filePath, "utf8");
+  const content = fs8.readFileSync(filePath, "utf8");
   return parseTranscript(content);
 }
 function formatTimestamp(seconds) {
@@ -5162,10 +5089,64 @@ function formatCues(cues) {
   return cues.map((cue) => `[${formatTimestamp(cue.startSeconds)}]${cue.speaker !== null ? ` ${cue.speaker}:` : ""} ${cue.text}`).join("\n");
 }
 
-// src/cli_stats.ts
+// src/purge.ts
 init_define_import_meta_env();
-import * as fs7 from "node:fs";
+import * as fs9 from "node:fs";
 import * as path8 from "node:path";
+function directorySize(root) {
+  let total = 0;
+  let entries;
+  try {
+    entries = fs9.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    const full = path8.join(root, entry.name);
+    if (entry.isDirectory()) {
+      total += directorySize(full);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    try {
+      total += fs9.statSync(full).size;
+    } catch {
+    }
+  }
+  return total;
+}
+function purgeRoots() {
+  const roots = [dataDir(), tokenGoatHome()];
+  return roots.filter((root, index) => roots.indexOf(root) === index);
+}
+function purgeDataDirectories() {
+  const result = { removed: [], absent: [], failed: [] };
+  for (const root of purgeRoots()) {
+    if (!fs9.existsSync(root)) {
+      result.absent.push(root);
+      continue;
+    }
+    const bytes = directorySize(root);
+    try {
+      fs9.rmSync(root, { recursive: true, force: true });
+      result.removed.push({ path: root, bytes });
+    } catch (e) {
+      result.failed.push({ path: root, reason: e instanceof Error ? e.message : String(e) });
+    }
+  }
+  return result;
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+
+// src/cli_stats.ts
+init_define_import_meta_env();
+import * as fs10 from "node:fs";
+import * as path9 from "node:path";
 function writeRaw(text) {
   const payload = colorStdout() ? text : stripAnsi(text);
   process.stdout.write(ensureNewline(payload));
@@ -5177,8 +5158,8 @@ function formatTopFiles(ranked) {
   if (ranked.length === 0) return "";
   const lines = ["Top files this session:"];
   for (const { path: filePath, count } of ranked) {
-    const basename6 = path8.basename(filePath);
-    lines.push(`  ${count.toString().padStart(3)}x  ${basename6}  (${filePath})`);
+    const basename7 = path9.basename(filePath);
+    lines.push(`  ${count.toString().padStart(3)}x  ${basename7}  (${filePath})`);
   }
   return lines.join("\n");
 }
@@ -5194,12 +5175,12 @@ function renderTopSessionFiles(topN = 5) {
 }
 function renderTopSessionFilesFromDisk(topN = 5, overrideSessionsDir) {
   try {
-    const sessionsDir = overrideSessionsDir ?? path8.join(dataDir(), "sessions");
-    if (!fs7.existsSync(sessionsDir)) return "";
-    const files = fs7.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, mtime: fs7.statSync(path8.join(sessionsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(0, 3);
+    const sessionsDir = overrideSessionsDir ?? path9.join(dataDir(), "sessions");
+    if (!fs10.existsSync(sessionsDir)) return "";
+    const files = fs10.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, mtime: fs10.statSync(path9.join(sessionsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(0, 3);
     for (const { name } of files) {
       try {
-        const raw = fs7.readFileSync(path8.join(sessionsDir, name), "utf-8");
+        const raw = fs10.readFileSync(path9.join(sessionsDir, name), "utf-8");
         const data = JSON.parse(raw);
         const filesList = data["files"];
         if (!Array.isArray(filesList)) continue;
@@ -5281,58 +5262,596 @@ function runStats(opts = {}) {
   }
 }
 
-// src/gdrive.ts
-init_define_import_meta_env();
-
-// src/webfetch.ts
+// src/cli_doctor.ts
 init_define_import_meta_env();
-import { existsSync as existsSync4, readdirSync as readdirSync3, statSync as statSync2, unlinkSync as unlinkSync2 } from "fs";
-import * as http from "http";
-import * as https from "https";
-import { isIPv4, isIPv6 } from "net";
-import { resolve as resolve3, join as join8 } from "path";
-import { URL as URL2 } from "url";
-import { promisify } from "util";
-import { lookup as dnsLookup } from "dns";
-var dnsLookupAsync = promisify(dnsLookup);
-var MAX_URL_IN_ERROR = 200;
-var ALLOW_UNRESOLVED = (process.env["TOKEN_GOAT_WEBFETCH_ALLOW_UNRESOLVED"] ?? "").toLowerCase() === "true";
-function webCacheDir() {
-  return join8(dataDir(), "web_cache");
-}
-var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
-  "localhost",
-  "ip6-localhost",
-  "ip6-loopback",
-  "metadata.google.internal",
-  "169.254.169.254"
-]);
-function truncateUrl(url, maxLen = MAX_URL_IN_ERROR) {
-  const sanitized = url.replace(/[\r\n]/g, "");
-  return sanitized.length > maxLen ? sanitized.slice(0, maxLen) + "\u2026" : sanitized;
-}
-async function resolveSsrfSafeAddress(hostname) {
-  const hostnameLower = hostname.toLowerCase().replace(/\.$/, "");
-  if (BLOCKED_HOSTNAMES.has(hostnameLower)) return { kind: "blocked" };
-  let results;
+import * as fs11 from "fs";
+import * as os8 from "os";
+import * as path10 from "path";
+import { execSync, spawnSync as spawnSync2 } from "child_process";
+function globalMcpConfigPath() {
+  const copilotHome = process.env["COPILOT_HOME"];
+  const root = copilotHome !== void 0 && copilotHome.trim() !== "" ? path10.resolve(copilotHome) : path10.join(os8.homedir(), ".copilot");
+  return path10.join(root, "mcp-config.json");
+}
+function checkGlobalMcpConfig(configPath2 = globalMcpConfigPath()) {
+  if (!fs11.existsSync(configPath2)) {
+    return { name: "Global MCP configuration", status: "ok", message: `no global Copilot MCP configuration found at ${configPath2}` };
+  }
+  let parsed;
   try {
-    const r = await dnsLookupAsync(hostnameLower, { all: true });
-    if (!Array.isArray(r) || r.length === 0) return { kind: "unresolved" };
-    results = r;
+    parsed = JSON.parse(fs11.readFileSync(configPath2, "utf8"));
   } catch {
-    return { kind: "unresolved" };
+    return {
+      name: "Global MCP configuration",
+      status: "warn",
+      message: `could not read global Copilot MCP configuration at ${configPath2}; unable to audit heavy launchers.`
+    };
   }
-  for (const addr of results) {
-    const ip = addr.address || "";
-    const isPrivate = isIPv4(ip) ? isPrivateIPv4(ip) : isIPv6(ip) ? isPrivateIPv6(ip) : true;
-    if (isPrivate) return { kind: "blocked" };
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return {
+      name: "Global MCP configuration",
+      status: "warn",
+      message: `global Copilot MCP configuration at ${configPath2} has an unsupported format; unable to audit heavy launchers.`
+    };
   }
-  const first = results[0];
-  if (!first) return { kind: "unresolved" };
-  return { kind: "safe", address: first.address, family: first.family, addresses: results };
+  const configuredServers = parsed["mcpServers"];
+  if (typeof configuredServers !== "object" || configuredServers === null || Array.isArray(configuredServers)) {
+    return { name: "Global MCP configuration", status: "ok", message: `no global stdio MCP servers configured at ${configPath2}` };
+  }
+  let chromeDevTools = 0;
+  let playwright = 0;
+  for (const server of Object.values(configuredServers)) {
+    if (typeof server !== "object" || server === null || Array.isArray(server)) continue;
+    const entry = server;
+    const rawCommand = entry["command"];
+    const command = typeof rawCommand === "string" ? rawCommand : "";
+    const args = entry["args"];
+    if (!/\bnpx(?:\.cmd)?\b/i.test(command) || !Array.isArray(args)) continue;
+    const invocation = args.filter((arg) => typeof arg === "string").join(" ");
+    if (/\bchrome-devtools-mcp\b/i.test(invocation)) chromeDevTools += 1;
+    if (/@playwright[\\/]mcp\b/i.test(invocation)) playwright += 1;
+  }
+  if (chromeDevTools > 0 || playwright > 0) {
+    const launchers = [];
+    if (chromeDevTools > 0) launchers.push(`${chromeDevTools} Chrome DevTools MCP launcher${chromeDevTools === 1 ? "" : "s"}`);
+    if (playwright > 0) launchers.push(`${playwright} Playwright MCP launcher${playwright === 1 ? "" : "s"}`);
+    return {
+      name: "Global MCP configuration",
+      status: "warn",
+      message: `${launchers.join(" and ")} configured at ${configPath2}. Move heavy launchers to project scope or remove them when not actively needed.`
+    };
+  }
+  return { name: "Global MCP configuration", status: "ok", message: `no known heavy global MCP launchers configured at ${configPath2}` };
 }
-function ssrfPinnedLookup(hostname, options, callback) {
-  resolveSsrfSafeAddress(hostname).then((result) => {
+function checkMcpProcessHealth(processes) {
+  if (processes === null) {
+    return {
+      name: "MCP process health",
+      status: "warn",
+      message: "could not read the process list (PowerShell did not answer), so duplicate MCP launchers and orphaned Node processes were not checked"
+    };
+  }
+  const byPid = new Set(processes.map((process2) => process2.processId));
+  const nodeProcesses = processes.filter((process2) => process2.name.toLowerCase() === "node.exe");
+  const chromeLaunchers = nodeProcesses.filter((process2) => /npx-cli\.js.*chrome-devtools-mcp/i.test(process2.commandLine));
+  const playwrightLaunchers = nodeProcesses.filter((process2) => /npx-cli\.js.*@playwright[\\/]mcp/i.test(process2.commandLine));
+  const orphanedNodeProcesses = nodeProcesses.filter((process2) => !byPid.has(process2.parentProcessId));
+  const launchers = chromeLaunchers.length + playwrightLaunchers.length;
+  if (launchers > 2 || orphanedNodeProcesses.length > 0) {
+    const details = [];
+    if (chromeLaunchers.length > 1) details.push(`${chromeLaunchers.length} Chrome DevTools MCP launchers`);
+    if (playwrightLaunchers.length > 1) details.push(`${playwrightLaunchers.length} Playwright MCP launchers`);
+    if (orphanedNodeProcesses.length > 0) details.push(`${orphanedNodeProcesses.length} orphaned Node process${orphanedNodeProcesses.length === 1 ? "" : "es"}`);
+    return {
+      name: "MCP process health",
+      status: "warn",
+      message: `${details.join("; ")} detected. These are host-managed processes; close stale Copilot sessions before terminating a specific confirmed orphan.`
+    };
+  }
+  return { name: "MCP process health", status: "ok", message: "no duplicate MCP launchers or orphaned Node processes detected" };
+}
+function runProcessListCommand() {
+  const command = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress";
+  return execSync(`powershell.exe -NoProfile -NonInteractive -Command "${command}"`, {
+    encoding: "utf8",
+    timeout: 2e4,
+    maxBuffer: 10 * 1024 * 1024,
+    windowsHide: true
+  });
+}
+function readWindowsProcesses(runCommand = runProcessListCommand) {
+  if (process.platform !== "win32") return [];
+  try {
+    const output = runCommand().trim();
+    if (output === "") return [];
+    const parsed = JSON.parse(output);
+    const rows = Array.isArray(parsed) ? parsed : [parsed];
+    return rows.flatMap((row) => {
+      if (typeof row !== "object" || row === null) return [];
+      const value = row;
+      if (typeof value["ProcessId"] !== "number" || typeof value["ParentProcessId"] !== "number" || typeof value["Name"] !== "string") return [];
+      return [{
+        processId: value["ProcessId"],
+        parentProcessId: value["ParentProcessId"],
+        name: value["Name"],
+        commandLine: typeof value["CommandLine"] === "string" ? value["CommandLine"] : ""
+      }];
+    });
+  } catch {
+    return null;
+  }
+}
+function checkWorkerRunning(dataDir2) {
+  return dataDir2 !== void 0 ? isWorkerRunning(dataDir2) : isWorkerRunning();
+}
+var DB_SIZE_WARN_BYTES = 1024 * 1024 * 1024;
+function checkDbExists(dataDir2) {
+  const dbPath = path10.join(dataDir2, "global.db");
+  if (!fs11.existsSync(dbPath)) {
+    return {
+      name: "Database",
+      status: "warn",
+      message: `global.db not found at ${dbPath}`
+    };
+  }
+  const sizeBytes = fs11.statSync(dbPath).size;
+  const SQLITE_HEADER = "SQLite format 3\0";
+  let header = "";
+  try {
+    const fd = fs11.openSync(dbPath, "r");
+    try {
+      const buf = Buffer.alloc(SQLITE_HEADER.length);
+      const bytesRead = fs11.readSync(fd, buf, 0, buf.length, 0);
+      header = buf.toString("latin1", 0, bytesRead);
+    } finally {
+      fs11.closeSync(fd);
+    }
+  } catch {
+  }
+  if (header !== SQLITE_HEADER) {
+    return {
+      name: "Database",
+      status: "fail",
+      message: `global.db at ${dbPath} is not a valid SQLite file (${sizeBytes} bytes) \u2014 likely truncated or corrupt`
+    };
+  }
+  if (sizeBytes > DB_SIZE_WARN_BYTES) {
+    return {
+      name: "Database",
+      status: "warn",
+      message: `global.db is ${Math.round(sizeBytes / (1024 * 1024))} MB at ${dbPath} \u2014 far larger than a healthy index. Large writes against it can exceed the 15s busy_timeout and appear as "database is locked". Try 'token-goat reclaim-index' first (a plain VACUUM, cheap, can recover a useful amount on its own); only reach for 'token-goat reclaim-index --rebuild' if that isn't enough, since --rebuild reparses and re-embeds every indexed file across every project and can take a long time on a large multi-project index`
+    };
+  }
+  return {
+    name: "Database",
+    status: "ok",
+    message: `global.db exists (${toKB(sizeBytes)} KB) at ${dbPath}`
+  };
+}
+function checkSymbolCount(dbPath, rootDir) {
+  if (!fs11.existsSync(dbPath)) {
+    return { name: "Symbols", status: "ok", message: "no database yet" };
+  }
+  try {
+    const { fileCount, symbolCount } = getProjectIndexCounts(dbPath, rootDir);
+    if (fileCount > 0 && symbolCount === 0) {
+      return {
+        name: "Symbols",
+        status: "warn",
+        message: `${fileCount} file(s) indexed but 0 symbols extracted \u2014 the parser may not be running (check the worker log); try 'token-goat index --force'`
+      };
+    }
+    if (fileCount === 0 && symbolCount === 0) {
+      return {
+        name: "Symbols",
+        status: "warn",
+        message: emptyIndexMessage(rootDir ?? process.cwd())
+      };
+    }
+    return {
+      name: "Symbols",
+      status: "ok",
+      message: `${symbolCount} symbol(s) across ${fileCount} indexed file(s)`
+    };
+  } catch (err2) {
+    return {
+      name: "Symbols",
+      status: "warn",
+      message: `could not query symbol count: ${extractErrorMessage(err2)}`
+    };
+  }
+}
+var DIRTY_QUEUE_BACKLOG_WARN_THRESHOLD = 500;
+function checkDirtyQueueHealth(dataDir2) {
+  let pendingCount = 0;
+  try {
+    const raw = fs11.readFileSync(dirtyQueuePathFor(dataDir2), "utf8");
+    pendingCount = raw.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).length;
+  } catch {
+  }
+  if (pendingCount > DIRTY_QUEUE_BACKLOG_WARN_THRESHOLD) {
+    return {
+      name: "Dirty queue",
+      status: "warn",
+      message: `${pendingCount} file(s) pending reindex -- the worker may be falling behind or stalled; check 'token-goat worker status'`
+    };
+  }
+  if (!isWorkerRunning(dataDir2)) {
+    return { name: "Dirty queue", status: "ok", message: `${pendingCount} file(s) pending (worker not running)` };
+  }
+  let heartbeatAgeMs = null;
+  try {
+    heartbeatAgeMs = Date.now() - fs11.statSync(drainHeartbeatPathFor(dataDir2)).mtimeMs;
+  } catch {
+  }
+  if (heartbeatAgeMs !== null && heartbeatAgeMs > WORKER_HEARTBEAT_STALE_MS) {
+    return {
+      name: "Dirty queue",
+      status: "warn",
+      message: `worker process is running but hasn't completed a drain cycle in ${Math.round(heartbeatAgeMs / 1e3)}s -- possibly deadlocked or stuck; check the worker error log`
+    };
+  }
+  return { name: "Dirty queue", status: "ok", message: `${pendingCount} file(s) pending, worker actively draining` };
+}
+function checkInstall() {
+  try {
+    const output = execSync("token-goat --version", { encoding: "utf-8" });
+    return {
+      name: "Installation",
+      status: "ok",
+      message: output.trim()
+    };
+  } catch {
+    return {
+      name: "Installation",
+      status: "fail",
+      message: "token-goat command not found; run: npm install -g token-goat-ts"
+    };
+  }
+}
+function checkTsCompiler() {
+  if (isAvailable()) {
+    return { name: "TypeScript compiler", status: "ok", message: "available" };
+  }
+  const err2 = loadError();
+  return {
+    name: "TypeScript compiler",
+    status: "warn",
+    message: err2 !== null ? `unavailable: ${extractErrorMessage(err2)}` : "unavailable (not attempted)"
+  };
+}
+function checkConfigValid(configPath2) {
+  if (!fs11.existsSync(configPath2)) {
+    return {
+      name: "Config",
+      status: "warn",
+      message: `config file not found at ${configPath2}`
+    };
+  }
+  try {
+    const content = fs11.readFileSync(configPath2, "utf-8");
+    parse(content);
+    return {
+      name: "Config",
+      status: "ok",
+      message: `config file valid (${content.length} bytes)`
+    };
+  } catch (err2) {
+    return {
+      name: "Config",
+      status: "fail",
+      message: `config invalid: ${extractErrorMessage(err2, "unknown error")}`
+    };
+  }
+}
+function formatDiskSpace(bytes) {
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  let value = bytes;
+  let unitIndex = 0;
+  while (value >= 1024 && unitIndex < units.length - 1) {
+    value /= 1024;
+    unitIndex++;
+  }
+  return `${value.toFixed(1)} ${units[unitIndex]}`;
+}
+var LOW_DISK_WARN_BYTES = 1024 * 1024 * 1024;
+function checkDiskSpace(dataDir2) {
+  if (typeof fs11.statfsSync === "function") {
+    try {
+      const stats = fs11.statfsSync(dataDir2);
+      const availableBytes = stats.bavail * stats.bsize;
+      const status = availableBytes < LOW_DISK_WARN_BYTES ? "warn" : "ok";
+      const suffix = status === "warn" ? " \u2014 running low, indexing/embeddings writes may start failing" : "";
+      return { name: "Disk Space", status, message: `${formatDiskSpace(availableBytes)} available${suffix}` };
+    } catch {
+    }
+  }
+  if (process.platform !== "win32") {
+    try {
+      const result = spawnSync2("df", ["-Pk", dataDir2], { encoding: "utf-8" });
+      const stdout = typeof result.stdout === "string" ? result.stdout : "";
+      if (result.error === void 0 && result.status === 0 && stdout) {
+        const lines = stdout.trim().split("\n");
+        if (lines.length >= 2) {
+          const parts = lines[1].trim().split(/\s+/);
+          const availableKb = Number.parseInt(parts[3] ?? "", 10);
+          if (Number.isFinite(availableKb)) {
+            const availableBytes = availableKb * 1024;
+            const status = availableBytes < LOW_DISK_WARN_BYTES ? "warn" : "ok";
+            const suffix = status === "warn" ? " \u2014 running low, indexing/embeddings writes may start failing" : "";
+            return { name: "Disk Space", status, message: `${formatDiskSpace(availableBytes)} available${suffix}` };
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return { name: "Disk Space", status: "warn", message: "disk space check unavailable on this platform" };
+}
+function checkCopilotCli(configPath2, scriptPath) {
+  if (!fs11.existsSync(configPath2) || !fs11.existsSync(scriptPath)) {
+    return null;
+  }
+  let config;
+  try {
+    config = JSON.parse(fs11.readFileSync(configPath2, "utf-8"));
+  } catch (err2) {
+    return {
+      name: "Copilot CLI",
+      status: "fail",
+      message: `hook config at ${configPath2} is not valid JSON: ${extractErrorMessage(err2, "unknown error")}`
+    };
+  }
+  const preToolUseCommand = config.hooks?.["preToolUse"]?.[0]?.command;
+  if (typeof preToolUseCommand !== "string" || preToolUseCommand === "") {
+    return {
+      name: "Copilot CLI",
+      status: "fail",
+      message: `hook config at ${configPath2} has no preToolUse entry; run: token-goat install --copilot`
+    };
+  }
+  const bakedExecPath = /^"([^"]+)"/.exec(preToolUseCommand)?.[1];
+  if (bakedExecPath !== void 0 && !fs11.existsSync(bakedExecPath)) {
+    return {
+      name: "Copilot CLI",
+      status: "fail",
+      message: `hook points at a node binary that no longer exists (${bakedExecPath}) -- likely stale after an nvm/fnm/volta node upgrade. Recovery: run "token-goat install --copilot", then fully restart Copilot CLI (renaming/reinstalling the hook has no effect on an already-running session -- Copilot caches hook configs at startup).`
+    };
+  }
+  const synthetic = JSON.stringify({
+    sessionId: "doctor-check",
+    cwd: process.cwd(),
+    toolName: "view",
+    toolArgs: { path: "doctor-check.txt" }
+  });
+  const res = spawnSync2(preToolUseCommand, {
+    input: synthetic,
+    encoding: "utf-8",
+    shell: true,
+    windowsHide: true,
+    timeout: 15e3
+  });
+  if (res.error) {
+    return {
+      name: "Copilot CLI",
+      status: "fail",
+      message: `hook failed to launch: ${extractErrorMessage(res.error, "unknown error")}. Recovery: run "token-goat install --copilot", then fully restart Copilot CLI.`
+    };
+  }
+  if (res.status !== 0) {
+    return {
+      name: "Copilot CLI",
+      status: "fail",
+      message: `hook exited with status ${res.status} -- Copilot's preToolUse fails closed on a non-zero exit and denies every tool call for the rest of the session. Recovery: run "token-goat install --copilot", then fully restart Copilot CLI (a live session won't pick up the fix).`
+    };
+  }
+  try {
+    JSON.parse(res.stdout ?? "");
+  } catch {
+    return {
+      name: "Copilot CLI",
+      status: "fail",
+      message: 'hook did not return valid JSON -- Copilot treats this as a hook error and denies every tool call. Recovery: run "token-goat install --copilot", then fully restart Copilot CLI.'
+    };
+  }
+  return { name: "Copilot CLI", status: "ok", message: "preToolUse hook invokes cleanly and returns valid JSON" };
+}
+function checkStrayClaudeMdBlocks(searchRoot) {
+  const strays = findStrayClaudeMdBlocks(searchRoot);
+  if (strays.length === 0) {
+    return { name: "CLAUDE.md block", status: "ok", message: "no stray copies outside CLAUDE.md" };
+  }
+  return {
+    name: "CLAUDE.md block",
+    status: "warn",
+    message: `${strays.length} stray cop${strays.length === 1 ? "y" : "ies"} outside CLAUDE.md (never refreshed by install, never removed by uninstall, will go stale): ${strays.join(", ")}`
+  };
+}
+function checkSecurityPosture(cfg, dataDirPath) {
+  const results = [];
+  results.push({
+    name: "Security network",
+    status: "ok",
+    message: cfg.network.offline ? "offline mode is on: no fetch, model download, OCR data, screenshot, or Drive call" : "offline mode is off (network.offline)"
+  });
+  results.push(
+    cfg.injection.enabled ? { name: "Security injection", status: "ok", message: "fetched and MCP content is scanned and fenced" } : { name: "Security injection", status: "warn", message: "scanning is off (injection.enabled): fetched and MCP content reaches the model unfenced" }
+  );
+  results.push({
+    name: "Security gdrive",
+    status: "ok",
+    message: cfg.gdrive.enabled ? "enabled (gdrive.enabled = false turns it off)" : "disabled"
+  });
+  const allow = cfg.webfetch.allow.length;
+  const deny = cfg.webfetch.deny.length;
+  results.push({
+    name: "Security fetch policy",
+    status: "ok",
+    message: allow > 0 ? `${allow} allowed host pattern${allow === 1 ? "" : "s"}, ${deny} denied: nothing outside the allow list is fetched` : `no allow list, ${deny} denied pattern${deny === 1 ? "" : "s"}: any host not denied can be fetched`
+  });
+  const extraRoots = cfg.mcp.allowed_roots.length;
+  results.push(
+    cfg.mcp.confine_reads_to_project_root ? {
+      name: "Security mcp roots",
+      status: "ok",
+      message: extraRoots === 0 ? "reads are confined to the project root" : `reads are confined to the project root plus ${extraRoots} configured root${extraRoots === 1 ? "" : "s"}`
+    } : { name: "Security mcp roots", status: "warn", message: "confinement is off (mcp.confine_reads_to_project_root): a read can leave the project" }
+  );
+  results.push(dataDirPermissionResult(dataDirPath));
+  return results;
+}
+function dataDirPermissionResult(dataDirPath) {
+  if (process.platform === "win32") {
+    return { name: "Security data dir", status: "ok", message: "inherits the parent ACL (POSIX modes do not apply on Windows)" };
+  }
+  try {
+    const mode = fs11.statSync(dataDirPath).mode & 511;
+    if ((mode & 63) !== 0) {
+      return {
+        name: "Security data dir",
+        status: "warn",
+        message: `mode ${mode.toString(8).padStart(3, "0")}: other local users can read the indexed source text`
+      };
+    }
+    return { name: "Security data dir", status: "ok", message: `mode ${mode.toString(8).padStart(3, "0")}: owner only` };
+  } catch {
+    return { name: "Security data dir", status: "warn", message: "could not be read, so its permissions are unknown" };
+  }
+}
+function runDoctor(dataDir2, configPath2, rootDir, processes) {
+  const results = [];
+  const actualDataDir = dataDir2 || dataDir();
+  results.push(checkInstall());
+  results.push(checkTsCompiler());
+  results.push(checkStrayClaudeMdBlocks());
+  results.push(checkWorkerRunning(actualDataDir) ? { name: "Worker", status: "ok", message: "running" } : { name: "Worker", status: "warn", message: "not running" });
+  results.push(checkDbExists(actualDataDir));
+  results.push(checkSymbolBodySize(path10.join(actualDataDir, "global.db")));
+  results.push(checkSymbolCount(path10.join(actualDataDir, "global.db"), rootDir));
+  results.push(checkDirtyQueueHealth(actualDataDir));
+  const actualConfigPath = configPath2 || configPath();
+  results.push(checkConfigValid(actualConfigPath));
+  for (const result of checkSecurityPosture(loadConfig(rootDir), actualDataDir)) results.push(result);
+  results.push(checkDiskSpace(actualDataDir));
+  const copilotResult = checkCopilotCli(copilotCliConfigPath(), copilotCliScriptPath());
+  if (copilotResult) results.push(copilotResult);
+  results.push(checkGlobalMcpConfig());
+  if (process.platform === "win32") results.push(checkMcpProcessHealth(processes ?? readWindowsProcesses()));
+  return results;
+}
+function printDoctorResults(results) {
+  console.log("\ntoken-goat doctor\n");
+  const grouped = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    const key = result.name.split(" ")[0];
+    if (!grouped.has(key)) {
+      grouped.set(key, []);
+    }
+    grouped.get(key).push(result);
+  }
+  for (const [, items] of grouped) {
+    for (const item of items) {
+      const prefix = item.status === "ok" ? "  " : `  [${item.status.toUpperCase()}] `;
+      console.log(`${prefix}${item.name}: ${item.message}`);
+    }
+  }
+  const hasFailures = results.some((r) => r.status === "fail");
+  console.log(hasFailures ? "\nFAILURES DETECTED" : "\nAll checks passed");
+  console.log();
+}
+async function runDoctorAndExit(opts) {
+  const results = runDoctor(opts?.dataDir, opts?.configPath, opts?.rootDir, opts?.processes);
+  printDoctorResults(results);
+  if (opts?.context === true) {
+    console.log("\n## Context footprint\n");
+    await runContextStats({});
+    console.log();
+    try {
+      const dir = skillOutputsDir();
+      const pregenPath = path10.join(dir, "pregen.json");
+      if (fs11.existsSync(pregenPath)) {
+        const content = JSON.parse(fs11.readFileSync(pregenPath, "utf-8"));
+        const pregenNames = new Set(content.names || []);
+        const skillsSeen = /* @__PURE__ */ new Set();
+        try {
+          const entries = fs11.readdirSync(dir, { withFileTypes: true });
+          for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.endsWith(".meta")) continue;
+            try {
+              const meta = JSON.parse(fs11.readFileSync(path10.join(dir, entry.name), "utf-8"));
+              if (meta.skillName && !pregenNames.has(meta.skillName)) {
+                skillsSeen.add(meta.skillName);
+              }
+            } catch {
+            }
+          }
+        } catch {
+        }
+        const skills = [...skillsSeen];
+        if (skills.length > 0) {
+          console.log(`Missing from pregen.json: ${skills.join(", ")}`);
+          console.log(`Remediation: token-goat skill-compact --all
+`);
+        }
+      }
+    } catch {
+    }
+  }
+  return results.some((r) => r.status === "fail") ? 1 : 0;
+}
+
+// src/gdrive.ts
+init_define_import_meta_env();
+
+// src/webfetch.ts
+init_define_import_meta_env();
+import { existsSync as existsSync8, readdirSync as readdirSync5, statSync as statSync4, unlinkSync as unlinkSync2 } from "fs";
+import * as http from "http";
+import * as https from "https";
+import { isIPv4, isIPv6 } from "net";
+import { resolve as resolve4, join as join10 } from "path";
+import { URL as URL2 } from "url";
+import { promisify } from "util";
+import { lookup as dnsLookup } from "dns";
+var dnsLookupAsync = promisify(dnsLookup);
+var MAX_URL_IN_ERROR = 200;
+var ALLOW_UNRESOLVED = (process.env["TOKEN_GOAT_WEBFETCH_ALLOW_UNRESOLVED"] ?? "").toLowerCase() === "true";
+function webCacheDir() {
+  return join10(dataDir(), "web_cache");
+}
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "ip6-localhost",
+  "ip6-loopback",
+  "metadata.google.internal",
+  "169.254.169.254"
+]);
+function truncateUrl(url, maxLen = MAX_URL_IN_ERROR) {
+  const sanitized = url.replace(/[\r\n]/g, "");
+  return sanitized.length > maxLen ? sanitized.slice(0, maxLen) + "\u2026" : sanitized;
+}
+async function resolveSsrfSafeAddress(hostname) {
+  const hostnameLower = hostname.toLowerCase().replace(/\.$/, "");
+  if (BLOCKED_HOSTNAMES.has(hostnameLower)) return { kind: "blocked" };
+  let results;
+  try {
+    const r = await dnsLookupAsync(hostnameLower, { all: true });
+    if (!Array.isArray(r) || r.length === 0) return { kind: "unresolved" };
+    results = r;
+  } catch {
+    return { kind: "unresolved" };
+  }
+  for (const addr of results) {
+    const ip = addr.address || "";
+    const isPrivate = isIPv4(ip) ? isPrivateIPv4(ip) : isIPv6(ip) ? isPrivateIPv6(ip) : true;
+    if (isPrivate) return { kind: "blocked" };
+  }
+  const first = results[0];
+  if (!first) return { kind: "unresolved" };
+  return { kind: "safe", address: first.address, family: first.family, addresses: results };
+}
+function ssrfPinnedLookup(hostname, options, callback) {
+  resolveSsrfSafeAddress(hostname).then((result) => {
     if (result.kind === "safe") {
       if (options.all) {
         callback(null, result.addresses);
@@ -5380,13 +5899,18 @@ function isPrivateIPv4(ip) {
   if (octets.length !== 4 || octets.some((o) => !Number.isFinite(o))) return false;
   const a = octets[0];
   const b = octets[1];
+  const c = octets[2];
   return a === 0 || // 0.0.0.0/8 ("this network" / unspecified-source range)
   a === 127 || // 127.x.x.x
   a === 10 || // 10.x.x.x
   a === 100 && b >= 64 && b <= 127 || // 100.64.0.0/10 (carrier-grade NAT, RFC 6598)
   a === 172 && b >= 16 && b <= 31 || // 172.16-31.x.x
   a === 192 && b === 168 || // 192.168.x.x
-  a === 169 && b === 254;
+  a === 169 && b === 254 || // 169.254.x.x
+  a === 192 && b === 0 && c === 0 || // 192.0.0.0/24 (IETF protocol assignments, RFC 6890)
+  a === 198 && (b === 18 || b === 19) || // 198.18.0.0/15 (benchmarking, RFC 2544)
+  a >= 224 && a <= 239 || // 224.0.0.0/4 multicast, including the all-hosts group
+  a >= 240;
 }
 function parseIPv6Groups(ip) {
   if (!isIPv6(ip)) return null;
@@ -5435,6 +5959,13 @@ function matchesIPv6Prefix(groups, prefixGroups, prefixBits) {
 }
 var FC00_PREFIX = [64512, 0, 0, 0, 0, 0, 0, 0];
 var FE80_PREFIX = [65152, 0, 0, 0, 0, 0, 0, 0];
+var FEC0_PREFIX = [65216, 0, 0, 0, 0, 0, 0, 0];
+var FF00_PREFIX = [65280, 0, 0, 0, 0, 0, 0, 0];
+var SIXTOFOUR_PREFIX = [8194, 0, 0, 0, 0, 0, 0, 0];
+var NAT64_PREFIX = [100, 65435, 0, 0, 0, 0, 0, 0];
+function embeddedIPv4(hi, lo) {
+  return `${hi >> 8 & 255}.${hi & 255}.${lo >> 8 & 255}.${lo & 255}`;
+}
 function isPrivateIPv6(ip) {
   const lower = ip.toLowerCase();
   if (lower === "::1") return true;
@@ -5444,27 +5975,32 @@ function isPrivateIPv6(ip) {
   const isIPv4Translated = groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0;
   const isIPv4Compatible = groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 0;
   if (isIPv4Mapped || isIPv4Translated || isIPv4Compatible) {
-    const hi = groups[6] ?? 0;
-    const lo = groups[7] ?? 0;
-    const embedded = `${hi >> 8 & 255}.${hi & 255}.${lo >> 8 & 255}.${lo & 255}`;
-    return isPrivateIPv4(embedded);
+    return isPrivateIPv4(embeddedIPv4(groups[6] ?? 0, groups[7] ?? 0));
+  }
+  if (matchesIPv6Prefix(groups, SIXTOFOUR_PREFIX, 16)) {
+    return isPrivateIPv4(embeddedIPv4(groups[1] ?? 0, groups[2] ?? 0));
+  }
+  if (matchesIPv6Prefix(groups, NAT64_PREFIX, 96)) {
+    return isPrivateIPv4(embeddedIPv4(groups[6] ?? 0, groups[7] ?? 0));
   }
   if (matchesIPv6Prefix(groups, FC00_PREFIX, 7)) return true;
   if (matchesIPv6Prefix(groups, FE80_PREFIX, 10)) return true;
+  if (matchesIPv6Prefix(groups, FEC0_PREFIX, 10)) return true;
+  if (matchesIPv6Prefix(groups, FF00_PREFIX, 8)) return true;
   return false;
 }
 var STALE_DOWNLOAD_AGE_MS = 10 * 60 * 1e3;
 function cleanupStaleDownloads() {
   const cacheDir = webCacheDir();
-  if (!existsSync4(cacheDir)) return 0;
+  if (!existsSync8(cacheDir)) return 0;
   let removed = 0;
   try {
-    const files = readdirSync3(cacheDir);
+    const files = readdirSync5(cacheDir);
     for (const file of files) {
       if (file.endsWith(".tmp")) {
-        const filePath = resolve3(cacheDir, file);
+        const filePath = resolve4(cacheDir, file);
         try {
-          const stat = statSync2(filePath);
+          const stat = statSync4(filePath);
           if (Date.now() - stat.mtimeMs < STALE_DOWNLOAD_AGE_MS) continue;
           unlinkSync2(filePath);
           removed++;
@@ -5489,6 +6025,15 @@ function performHttpFetch(targetUrl, opts) {
       rejectPromise(new Error(`URL blocked by SSRF safety check: ${truncateUrl(targetUrl)}`));
       return;
     }
+    if (loadConfig().network.offline) {
+      rejectPromise(new Error(`Offline mode is on (network.offline): refusing to fetch ${truncateUrl(targetUrl)}`));
+      return;
+    }
+    const policyDenial = urlPolicyDenialReason(targetUrl, loadConfig().webfetch);
+    if (policyDenial !== null) {
+      rejectPromise(new Error(`${policyDenial}: ${truncateUrl(targetUrl)}`));
+      return;
+    }
     const literalIp = parsed.hostname.startsWith("[") && parsed.hostname.endsWith("]") ? parsed.hostname.slice(1, -1) : parsed.hostname;
     const isLiteralPrivate = isIPv4(literalIp) ? isPrivateIPv4(literalIp) : isIPv6(literalIp) ? isPrivateIPv6(literalIp) : false;
     if (isLiteralPrivate) {
@@ -5537,7 +6082,7 @@ function performHttpFetch(targetUrl, opts) {
           rejectPromise(new Error(`Invalid redirect location fetching ${truncateUrl(targetUrl)}`));
           return;
         }
-        const sameOrigin = nextParsed.host === parsed.host;
+        const sameOrigin = nextParsed.origin === parsed.origin;
         const nextOpts = {
           ...opts,
           redirectsLeft: opts.redirectsLeft - 1,
@@ -5656,11 +6201,11 @@ function parseDocSections(text) {
     const newlineLen = newlineMatch ? newlineMatch[0].length : 0;
     const fenceMatch = /^\s*(`{3,}|~{3,})/.exec(line);
     if (fenceMatch !== null && fenceMatch[1] !== void 0) {
-      const run3 = fenceMatch[1];
-      const ch = run3[0] ?? "";
+      const run2 = fenceMatch[1];
+      const ch = run2[0] ?? "";
       if (fence === null) {
-        fence = { ch, len: run3.length };
-      } else if (ch === fence.ch && run3.length >= fence.len && /^[ \t]*$/.test(line.slice(fenceMatch[0].length))) {
+        fence = { ch, len: run2.length };
+      } else if (ch === fence.ch && run2.length >= fence.len && /^[ \t]*$/.test(line.slice(fenceMatch[0].length))) {
         fence = null;
       }
       if (currentSection !== null) {
@@ -5719,8 +6264,8 @@ async function getSectionContent(fileId, heading, opts = {}) {
 
 // src/pack.ts
 init_define_import_meta_env();
-import * as fs8 from "node:fs";
-import * as path10 from "node:path";
+import * as fs12 from "node:fs";
+import * as path12 from "node:path";
 
 // node_modules/minimatch/dist/esm/index.js
 var esm_exports = {};
@@ -6803,11 +7348,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path9 = {
+var path11 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep2 = defaultPlatform === "win32" ? path9.win32.sep : path9.posix.sep;
+var sep2 = defaultPlatform === "win32" ? path11.win32.sep : path11.posix.sep;
 minimatch.sep = sep2;
 var GLOBSTAR = Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -7592,7 +8137,7 @@ var LANG_MAP = {
   ".exs": "elixir"
 };
 function getLang(filePath) {
-  const ext2 = path10.extname(filePath).toLowerCase();
+  const ext2 = path12.extname(filePath).toLowerCase();
   return LANG_MAP[ext2] ?? "";
 }
 function matches(rel, patterns) {
@@ -7602,30 +8147,30 @@ function matches(rel, patterns) {
   return patterns.some((pat) => mm.minimatch(norm, pat) || mm.minimatch(base, pat));
 }
 function isPathWithinRoot(rootReal, resolvedPath) {
-  const rel = path10.relative(rootReal, resolvedPath);
-  return rel !== "" && rel !== ".." && !rel.startsWith(".." + path10.sep) && !path10.isAbsolute(rel);
+  const rel = path12.relative(rootReal, resolvedPath);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + path12.sep) && !path12.isAbsolute(rel);
 }
 function openWithinRoot(rootReal, p) {
   let fd;
   try {
-    fd = fs8.openSync(p, "r");
+    fd = fs12.openSync(p, "r");
   } catch {
     return null;
   }
   let ownershipTransferred = false;
   try {
-    const stat = fs8.fstatSync(fd);
+    const stat = fs12.fstatSync(fd);
     if (!stat.isFile()) return null;
     let realPath;
     try {
-      realPath = fs8.realpathSync(p);
+      realPath = fs12.realpathSync(p);
     } catch {
       return "outside-root";
     }
     if (!isPathWithinRoot(rootReal, realPath)) return "outside-root";
     let realStat;
     try {
-      realStat = fs8.statSync(realPath);
+      realStat = fs12.statSync(realPath);
     } catch {
       return "outside-root";
     }
@@ -7635,7 +8180,7 @@ function openWithinRoot(rootReal, p) {
   } finally {
     if (!ownershipTransferred) {
       try {
-        fs8.closeSync(fd);
+        fs12.closeSync(fd);
       } catch {
       }
     }
@@ -7643,11 +8188,11 @@ function openWithinRoot(rootReal, p) {
 }
 function* resolveOpenCandidates(projectRoot, patterns, rootReal, ignorePatterns, seen, skipped) {
   for (const pattern of patterns) {
-    const p = path10.isAbsolute(pattern) ? pattern : path10.join(projectRoot, pattern);
+    const p = path12.isAbsolute(pattern) ? pattern : path12.join(projectRoot, pattern);
     if (seen.has(p)) continue;
     let rel;
     try {
-      rel = path10.relative(projectRoot, p).replace(/\\/g, "/");
+      rel = path12.relative(projectRoot, p).replace(/\\/g, "/");
     } catch {
       skipped.push(`${p} (outside project root)`);
       continue;
@@ -7659,7 +8204,7 @@ function* resolveOpenCandidates(projectRoot, patterns, rootReal, ignorePatterns,
       continue;
     }
     if (ignorePatterns && matches(rel, ignorePatterns)) {
-      fs8.closeSync(opened.fd);
+      fs12.closeSync(opened.fd);
       continue;
     }
     yield { p, rel, fd: opened.fd, stat: opened.stat };
@@ -7721,7 +8266,7 @@ function stripBlockComments(content, pattern, lineStates) {
   );
 }
 function stripComments(content, filePath) {
-  const ext2 = path10.extname(filePath).toLowerCase();
+  const ext2 = path12.extname(filePath).toLowerCase();
   const lineStates = computeLineStartQuoteStates(content);
   if (ext2 === ".py") {
     return stripLineComments(content, PY_LINE_COMMENT_RE, lineStates);
@@ -7759,7 +8304,7 @@ var SAFE_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp
 function scanSecrets(files) {
   const hits = [];
   for (const pf of files) {
-    if (SAFE_EXTS.has(path10.extname(pf.path).toLowerCase())) {
+    if (SAFE_EXTS.has(path12.extname(pf.path).toLowerCase())) {
       continue;
     }
     for (const [lineno, line] of pf.content.split("\n").entries()) {
@@ -7782,10 +8327,10 @@ function scanSecrets(files) {
 function collectFiles(projectRoot, patterns, opts = {}) {
   const result = { files: [], skipped: [], total_lines: 0, total_tokens: 0 };
   const seen = /* @__PURE__ */ new Set();
-  const rootResolved = path10.resolve(projectRoot);
+  const rootResolved = path12.resolve(projectRoot);
   let rootReal;
   try {
-    rootReal = fs8.realpathSync(rootResolved);
+    rootReal = fs12.realpathSync(rootResolved);
   } catch {
     rootReal = rootResolved;
   }
@@ -7799,7 +8344,7 @@ function collectFiles(projectRoot, patterns, opts = {}) {
       }
       let content;
       try {
-        content = fs8.readFileSync(fd, "utf8");
+        content = fs12.readFileSync(fd, "utf8");
       } catch {
         result.skipped.push(`${rel} (unreadable)`);
         continue;
@@ -7821,13 +8366,13 @@ function collectFiles(projectRoot, patterns, opts = {}) {
       result.total_lines += lines;
       result.total_tokens += tokens;
     } finally {
-      fs8.closeSync(fd);
+      fs12.closeSync(fd);
     }
   }
   return result;
 }
 function collectFromStdin(projectRoot, opts = {}) {
-  const input = fs8.readFileSync(0, "utf8");
+  const input = fs12.readFileSync(0, "utf8");
   const paths = input.split("\n").map((ln) => ln.trim()).filter((ln) => ln.length > 0);
   return collectFiles(projectRoot, paths, opts);
 }
@@ -7957,10 +8502,10 @@ function formatPack(result, style, opts = {}) {
 function estimateBudget(projectRoot, patterns, opts = {}) {
   const result = { entries: [], skipped: [], total_lines: 0, total_tokens: 0 };
   const seen = /* @__PURE__ */ new Set();
-  const rootResolved = path10.resolve(projectRoot);
+  const rootResolved = path12.resolve(projectRoot);
   let rootReal;
   try {
-    rootReal = fs8.realpathSync(rootResolved);
+    rootReal = fs12.realpathSync(rootResolved);
   } catch {
     rootReal = rootResolved;
   }
@@ -7975,7 +8520,7 @@ function estimateBudget(projectRoot, patterns, opts = {}) {
       let lines;
       let tokens;
       try {
-        const data = fs8.readFileSync(fd);
+        const data = fs12.readFileSync(fd);
         const sampleSize = Math.min(1e3, data.length);
         const sampleLines = (data.toString("utf8", 0, sampleSize).match(/\n/g) || []).length;
         lines = data.length > sampleSize ? Math.ceil(sampleLines * (data.length / sampleSize)) : sampleLines + 1;
@@ -7993,7 +8538,7 @@ function estimateBudget(projectRoot, patterns, opts = {}) {
       result.total_lines += lines;
       result.total_tokens += tokens;
     } finally {
-      fs8.closeSync(fd);
+      fs12.closeSync(fd);
     }
   }
   result.entries.sort((a, b) => b.tokens - a.tokens);
@@ -8269,193 +8814,1407 @@ function extractCargo(lines) {
     const body = detail && detail.length > 0 ? detail.join("\n").trim() : summaryByName.get(name);
     result.blocks.push({ name, body });
   }
-  return result;
+  return result;
+}
+function extractGeneric(lines) {
+  const result = {
+    runner: "unknown",
+    blocks: [],
+    summaryLines: [],
+    statsLine: ""
+  };
+  for (const line of lines) {
+    const s = line.trimEnd();
+    if (/\b(FAILED|FAILURE|ERROR)\b/i.test(s)) {
+      result.summaryLines.push(s);
+    }
+  }
+  return result;
+}
+function extractFailures(text, options) {
+  const cleaned = stripAnsi(text);
+  const lines = cleaned.split("\n");
+  const detected = options?.runner ?? detectRunner(cleaned);
+  if (detected === "pytest") {
+    return extractPytest(lines);
+  }
+  if (detected === "jest") {
+    return extractJest(lines);
+  }
+  if (detected === "go") {
+    return extractGo(lines);
+  }
+  if (detected === "cargo") {
+    return extractCargo(lines);
+  }
+  return extractGeneric(lines);
+}
+function formatFailuresText(result) {
+  if (result.blocks.length === 0 && result.summaryLines.length === 0) {
+    return "No failures found.";
+  }
+  const parts = [];
+  const sep5 = "\u2500".repeat(60);
+  for (const block of result.blocks) {
+    parts.push(sep5, `FAIL  ${block.name}`, sep5, block.body, "");
+  }
+  if (result.summaryLines.length > 0) {
+    if (parts.length > 0) {
+      parts.push(sep5);
+    }
+    parts.push(...result.summaryLines);
+  }
+  if (result.statsLine) {
+    parts.push(result.statsLine);
+  }
+  const n = getFailureCount(result);
+  parts.push(`
+${n} failure(s)  [${result.runner}]`);
+  return parts.join("\n");
+}
+function formatFailuresJson(result) {
+  return JSON.stringify(
+    {
+      runner: result.runner,
+      count: getFailureCount(result),
+      failures: result.blocks.map((b) => ({ name: b.name, body: b.body })),
+      summary: result.summaryLines,
+      stats: result.statsLine
+    },
+    null,
+    2
+  );
+}
+function failureSignatures(result) {
+  const raw = result.blocks.length > 0 ? result.blocks.map((b) => b.name.trim()) : result.summaryLines.map((s) => s.trim()).filter((s) => s !== "");
+  return Array.from(new Set(raw));
+}
+function computeFailureDelta(prevSignatures, currSignatures) {
+  if (prevSignatures === null) {
+    return { hasBaseline: false, newlyFailing: [...currSignatures], newlyFixed: [], stillFailing: [] };
+  }
+  const prevSet = new Set(prevSignatures);
+  const currSet = new Set(currSignatures);
+  return {
+    hasBaseline: true,
+    newlyFailing: currSignatures.filter((s) => !prevSet.has(s)),
+    newlyFixed: prevSignatures.filter((s) => !currSet.has(s)),
+    stillFailing: currSignatures.filter((s) => prevSet.has(s))
+  };
+}
+function formatFailureDeltaText(delta, runner) {
+  if (!delta.hasBaseline) {
+    const lines2 = [
+      `No baseline yet for this project/key -- showing all ${delta.newlyFailing.length} current failure(s) as new.  [${runner}]`
+    ];
+    if (delta.newlyFailing.length === 0) {
+      lines2.push("(no failures)");
+    } else {
+      for (const name of delta.newlyFailing) lines2.push(`+ ${name}`);
+    }
+    return lines2.join("\n");
+  }
+  const lines = [];
+  lines.push(`Newly failing (${delta.newlyFailing.length}):`);
+  if (delta.newlyFailing.length === 0) {
+    lines.push("  (none)");
+  } else {
+    for (const name of delta.newlyFailing) lines.push(`  + ${name}`);
+  }
+  lines.push("");
+  lines.push(`Newly fixed (${delta.newlyFixed.length}):`);
+  if (delta.newlyFixed.length === 0) {
+    lines.push("  (none)");
+  } else {
+    for (const name of delta.newlyFixed) lines.push(`  - ${name}`);
+  }
+  lines.push("");
+  lines.push(`Still failing (unchanged): ${delta.stillFailing.length}`);
+  lines.push(
+    `
+[${runner}]  ${delta.newlyFailing.length} newly failing, ${delta.newlyFixed.length} newly fixed, ${delta.stillFailing.length} still failing`
+  );
+  return lines.join("\n");
+}
+function formatFailureDeltaJson(delta, runner) {
+  return JSON.stringify(
+    {
+      runner,
+      hasBaseline: delta.hasBaseline,
+      newlyFailing: delta.newlyFailing,
+      newlyFixed: delta.newlyFixed,
+      stillFailingCount: delta.stillFailing.length
+    },
+    null,
+    2
+  );
+}
+
+// src/failures_state.ts
+init_define_import_meta_env();
+import * as fs13 from "node:fs";
+import * as path13 from "node:path";
+var KEY_RE = /^[A-Za-z0-9_-]{1,80}$/;
+var DEFAULT_FAILURES_STATE_KEY = "default";
+function validateKey(key) {
+  if (!KEY_RE.test(key)) {
+    throw new Error(
+      `Invalid --key ${JSON.stringify(key)}: use only letters, digits, hyphens, underscores (max 80 chars)`
+    );
+  }
+}
+function failuresStatePath(projectHash, key) {
+  validateKey(key);
+  return path13.join(dataDir(), "projects", `${projectHash}_failures_${key}.json`);
+}
+function loadFailureSnapshot(projectHash, key) {
+  const p = failuresStatePath(projectHash, key);
+  try {
+    if (!fs13.existsSync(p)) return null;
+    const parsed = JSON.parse(fs13.readFileSync(p, "utf-8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const obj = parsed;
+    if (!Array.isArray(obj.signatures)) return null;
+    return {
+      signatures: obj.signatures.filter((s) => typeof s === "string"),
+      runner: typeof obj.runner === "string" ? obj.runner : "unknown",
+      storedAt: typeof obj.storedAt === "number" ? obj.storedAt : 0
+    };
+  } catch {
+    return null;
+  }
+}
+function saveFailureSnapshot(projectHash, key, snapshot) {
+  const p = failuresStatePath(projectHash, key);
+  const dir = path13.dirname(p);
+  ensureDirSync(dir);
+  const content = JSON.stringify(snapshot);
+  const doSave = () => {
+    atomicWriteText(p, content);
+    return true;
+  };
+  if (withFileLock(`${p}.lock`, doSave) === void 0) doSave();
+}
+
+// src/text_commands.ts
+init_define_import_meta_env();
+import * as fs15 from "fs";
+import * as path15 from "path";
+
+// src/project_memory.ts
+init_define_import_meta_env();
+import * as fs14 from "node:fs";
+import * as path14 from "node:path";
+var MAX_ENTRIES = 30;
+var KEY_RE2 = /^[A-Za-z0-9_-]{1,80}$/;
+function ordinal(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function memoryPath(projectHash) {
+  return path14.join(dataDir(), "projects", `${projectHash}_memory.toml`);
+}
+function validateKey2(key) {
+  if (!KEY_RE2.test(key)) {
+    throw new Error(
+      `Invalid memory key ${JSON.stringify(key)}: use only letters, digits, hyphens, underscores (max 80 chars)`
+    );
+  }
+}
+function parseTOML(content) {
+  const result = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const match2 = trimmed.match(/^([A-Za-z0-9_-]+)\s*=\s*"(.*)"\s*$/);
+    if (match2) {
+      const [, key, value] = match2;
+      if (key && value !== void 0) {
+        const unescaped = value.replace(/\\([\\nrt"])/g, (_, c) => {
+          switch (c) {
+            case "\\":
+              return "\\";
+            case "n":
+              return "\n";
+            case "r":
+              return "\r";
+            case '"':
+              return '"';
+            default:
+              return _;
+          }
+        });
+        result[key] = unescaped;
+      }
+    }
+  }
+  return result;
+}
+function loadRaw(filePath) {
+  try {
+    if (!fs14.existsSync(filePath)) {
+      return {};
+    }
+    const content = fs14.readFileSync(filePath, "utf-8");
+    return parseTOML(content);
+  } catch {
+    return {};
+  }
+}
+function save(filePath, entries) {
+  const lines = [];
+  const sorted = Object.entries(entries).sort(([a], [b]) => ordinal(a, b));
+  for (const [k, v] of sorted) {
+    const escaped = v.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+    lines.push(`${k} = "${escaped}"`);
+  }
+  const content = lines.length > 0 ? lines.join("\n") + "\n" : "";
+  const dir = path14.dirname(filePath);
+  ensureDirSync(dir);
+  atomicWriteText(filePath, content);
+}
+function loadEntries(projectHash) {
+  return loadRaw(memoryPath(projectHash));
+}
+function setEntry(projectHash, key, value) {
+  validateKey2(key);
+  const p = memoryPath(projectHash);
+  const dir = path14.dirname(p);
+  ensureDirSync(dir);
+  const doSet = () => {
+    const entries = loadRaw(p);
+    const isNewKey = !(key in entries);
+    if (isNewKey && Object.keys(entries).length >= MAX_ENTRIES) {
+      const keysToKeep = MAX_ENTRIES - 1;
+      const allKeys = Object.keys(entries).sort((a, b) => ordinal(a, b));
+      for (const k of allKeys.slice(keysToKeep)) {
+        delete entries[k];
+      }
+    }
+    entries[key] = value;
+    save(p, entries);
+    return true;
+  };
+  if (withFileLock(`${p}.lock`, doSet) === void 0) doSet();
+}
+function unsetEntry(projectHash, key) {
+  validateKey2(key);
+  const p = memoryPath(projectHash);
+  const doUnset = () => {
+    const entries = loadRaw(p);
+    if (key in entries) {
+      delete entries[key];
+      save(p, entries);
+    }
+    return true;
+  };
+  if (withFileLock(`${p}.lock`, doUnset) === void 0) doUnset();
+}
+function clearAll(projectHash) {
+  const p = memoryPath(projectHash);
+  const doClear = () => {
+    if (fs14.existsSync(p)) {
+      save(p, {});
+    }
+    return true;
+  };
+  if (withFileLock(`${p}.lock`, doClear) === void 0) doClear();
+}
+
+// src/text_commands.ts
+function readInput(src) {
+  if (src !== void 0) return fs15.readFileSync(src, "utf8");
+  return fs15.readFileSync(0, "utf8");
+}
+function splitLines(text) {
+  return text.split(/\r?\n/);
+}
+var DEFAULT_KINDS = ["TODO", "FIXME", "HACK", "XXX", "NOTE"];
+function countUnescapedQuotes(text, quoteChar) {
+  let count = 0;
+  let backslashes = 0;
+  for (const ch of text) {
+    if (ch === "\\") {
+      backslashes++;
+      continue;
+    }
+    if (ch === quoteChar && backslashes % 2 === 0) count++;
+    backslashes = 0;
+  }
+  return count;
+}
+function isInsideStringLiteral2(line, markerIndex) {
+  const before = line.slice(0, markerIndex);
+  const dqCount = countUnescapedQuotes(before, '"');
+  return dqCount % 2 !== 0;
+}
+function isMarkerOccurrence(matched, hasColon) {
+  return hasColon || matched === matched.toUpperCase();
+}
+function scanFileForTodos(filePath, kindSet) {
+  let text;
+  try {
+    text = fs15.readFileSync(filePath, "utf8");
+  } catch {
+    return [];
+  }
+  const kindPattern = [...kindSet].map(escapeRegExp).join("|");
+  const re = new RegExp(`\\b(${kindPattern})\\b(\\s*:)?\\s*(.*)`, "i");
+  const items = [];
+  const lines = splitLines(text);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const m = re.exec(line);
+    if (m === null) continue;
+    if (!isMarkerOccurrence(m[1] ?? "", m[2] !== void 0)) continue;
+    const idx = m.index ?? 0;
+    if (isInsideStringLiteral2(line, idx)) continue;
+    items.push({ file: filePath, line: i + 1, kind: m[1]?.toUpperCase() ?? "", text: (m[3] ?? "").trim() });
+  }
+  return items;
+}
+function collectTodoFiles(patterns) {
+  if (patterns.length > 0) {
+    const results = [];
+    for (const p of patterns) {
+      const abs = path15.resolve(p);
+      try {
+        const stat = fs15.statSync(abs);
+        if (stat.isDirectory()) {
+          results.push(...walkProject(abs).files);
+        } else {
+          results.push(abs);
+        }
+      } catch {
+      }
+    }
+    return results;
+  }
+  return walkProject(process.cwd()).files;
+}
+function cmdTodo(patterns, opts) {
+  const kindSet = new Set(
+    opts.kinds !== void 0 && opts.kinds.length > 0 ? opts.kinds.split(",").map((k) => k.trim().toUpperCase()) : DEFAULT_KINDS
+  );
+  const files = collectTodoFiles(patterns);
+  const items = [];
+  for (const f of files) {
+    items.push(...scanFileForTodos(f, kindSet));
+  }
+  if (opts.json === true) {
+    process.stdout.write(JSON.stringify({ items }, null, 2) + "\n");
+    return;
+  }
+  if (items.length === 0) {
+    process.stdout.write("No TODO markers found.\n");
+    return;
+  }
+  const groupBy = opts.group ?? "file";
+  if (groupBy === "kind") {
+    const byKind = /* @__PURE__ */ new Map();
+    for (const item of items) {
+      const arr = byKind.get(item.kind) ?? [];
+      arr.push(item);
+      byKind.set(item.kind, arr);
+    }
+    for (const [kind, group] of byKind) {
+      process.stdout.write(`
+[${kind}]
+`);
+      for (const item of group) {
+        process.stdout.write(`  ${item.file}:${item.line}  ${item.text}
+`);
+      }
+    }
+  } else {
+    const byFile = /* @__PURE__ */ new Map();
+    for (const item of items) {
+      const arr = byFile.get(item.file) ?? [];
+      arr.push(item);
+      byFile.set(item.file, arr);
+    }
+    for (const [file, group] of byFile) {
+      for (const item of group) {
+        process.stdout.write(`${file}:${item.line}  ${item.kind}  ${item.text}
+`);
+      }
+    }
+  }
+}
+function parsePythonBlock(lines, start) {
+  if (!/^Traceback \(most recent call last\):/.test(lines[start] ?? "")) return null;
+  let i = start + 1;
+  const frames = [];
+  let block = null;
+  while (i < lines.length) {
+    const fl = lines[i] ?? "";
+    const fm = /^\s{2}File "([^"]+)", line (\d+), in (\S+)/.exec(fl);
+    if (fm !== null) {
+      i++;
+      const peek = lines[i]?.trim();
+      const hasContext = peek !== void 0 && !peek.startsWith("File ") && !peek.startsWith("Traceback");
+      if (hasContext) i++;
+      frames.push({ file: fm[1] ?? "", lineNo: Number.parseInt(fm[2] ?? "0", 10), func: fm[3] ?? "", context: hasContext ? peek ?? "" : "" });
+      continue;
+    }
+    if (/^Traceback \(most recent call last\):/.test(fl)) {
+      break;
+    }
+    if (!/^\s/.test(fl) && fl.trim() !== "") {
+      block = { frames, exception: fl.trim() };
+      i++;
+      break;
+    }
+    i++;
+  }
+  if (frames.length > 0 && block === null) {
+    block = { frames, exception: "" };
+  }
+  return { block, nextIndex: i };
+}
+var NODE_FRAME_WITH_FUNC_RE = /^\s+at\s+(.+?)\s+\(([^)]+)\)\s*$/;
+var NODE_FRAME_ANON_RE = /^\s+at\s+([^\s()][^()]*)\s*$/;
+var NODE_LOC_RE = /^(.*):(\d+):(\d+)$/;
+function parseNodeFrameLine(line) {
+  const withFunc = NODE_FRAME_WITH_FUNC_RE.exec(line);
+  if (withFunc !== null) {
+    const loc = NODE_LOC_RE.exec(withFunc[2] ?? "");
+    if (loc === null) return null;
+    return { file: loc[1] ?? "", lineNo: Number.parseInt(loc[2] ?? "0", 10), func: withFunc[1] ?? "" };
+  }
+  const anon = NODE_FRAME_ANON_RE.exec(line);
+  if (anon !== null) {
+    const loc = NODE_LOC_RE.exec((anon[1] ?? "").trim());
+    if (loc === null) return null;
+    return { file: loc[1] ?? "", lineNo: Number.parseInt(loc[2] ?? "0", 10), func: "" };
+  }
+  return null;
+}
+function parseNodeBlock(lines, start) {
+  const header = (lines[start] ?? "").trim();
+  if (header === "") return null;
+  const firstFrame = parseNodeFrameLine(lines[start + 1] ?? "");
+  if (firstFrame === null) return null;
+  const frames = [firstFrame];
+  let i = start + 2;
+  while (i < lines.length) {
+    const f = parseNodeFrameLine(lines[i] ?? "");
+    if (f === null) break;
+    frames.push(f);
+    i++;
+  }
+  return { block: { frames, exception: header }, nextIndex: i };
+}
+var RUST_PANIC_HEADER_RE = /^thread '[^']*' panicked at (.+):(\d+):(\d+):\s*$/;
+var RUST_BACKTRACE_NOTE_RE = /^note: run with `RUST_BACKTRACE=1`/;
+var RUST_BACKTRACE_NUM_RE = /^\s*\d+:\s+(.+)$/;
+var RUST_BACKTRACE_AT_RE = /^\s+at\s+(.+):(\d+):(\d+)\s*$/;
+function parseRustBlock(lines, start) {
+  const header = lines[start] ?? "";
+  const hm = RUST_PANIC_HEADER_RE.exec(header);
+  if (hm === null) return null;
+  const panicFrame = { file: hm[1] ?? "", lineNo: Number.parseInt(hm[2] ?? "0", 10), func: "" };
+  let i = start + 1;
+  const msgLines = [];
+  while (i < lines.length) {
+    const l = lines[i] ?? "";
+    if (l.trim() === "") {
+      i++;
+      break;
+    }
+    if (RUST_BACKTRACE_NOTE_RE.test(l)) {
+      i++;
+      break;
+    }
+    if (l.trim() === "stack backtrace:") break;
+    msgLines.push(l.trim());
+    i++;
+  }
+  const exception = msgLines.join(" ");
+  if ((lines[i] ?? "").trim() === "stack backtrace:") {
+    i++;
+    const frames = [];
+    while (i < lines.length) {
+      const numMatch = RUST_BACKTRACE_NUM_RE.exec(lines[i] ?? "");
+      if (numMatch === null) break;
+      const atMatch = RUST_BACKTRACE_AT_RE.exec(lines[i + 1] ?? "");
+      if (atMatch === null) {
+        i += 1;
+        continue;
+      }
+      frames.push({ file: atMatch[1] ?? "", lineNo: Number.parseInt(atMatch[2] ?? "0", 10), func: (numMatch[1] ?? "").trim() });
+      i += 2;
+    }
+    if (frames.length > 0) {
+      return { block: { frames, exception }, nextIndex: i };
+    }
+  }
+  return { block: { frames: [panicFrame], exception }, nextIndex: i };
+}
+var JVM_HEADER_RE = /^(?:Exception in thread "[^"]*" )?(?:Caused by: )?((?:[A-Za-z_$][\w$]*\.)+[A-Za-z_$][\w$]*): (.*)$/;
+var JVM_FRAME_RE = /^\s+at\s+(\S+)\(([^)]*)\)\s*$/;
+var JVM_MORE_RE = /^\s*\.\.\.\s+\d+\s+more\s*$/;
+function parseJvmFrameLine(line) {
+  const m = JVM_FRAME_RE.exec(line);
+  if (m === null) return null;
+  const func = m[1] ?? "";
+  const inner = m[2] ?? "";
+  if (inner === "Native Method" || inner === "Unknown Source") {
+    return { file: inner, lineNo: 0, func };
+  }
+  const lm = /^(.+):(\d+)$/.exec(inner);
+  if (lm === null) return null;
+  return { file: lm[1] ?? "", lineNo: Number.parseInt(lm[2] ?? "0", 10), func };
+}
+function parseJvmBlock(lines, start) {
+  const header = lines[start] ?? "";
+  if (JVM_HEADER_RE.exec(header) === null) return null;
+  const firstFrame = parseJvmFrameLine(lines[start + 1] ?? "");
+  if (firstFrame === null) return null;
+  const frames = [firstFrame];
+  let i = start + 2;
+  while (i < lines.length) {
+    const l = lines[i] ?? "";
+    if (JVM_MORE_RE.test(l)) {
+      i++;
+      break;
+    }
+    const f = parseJvmFrameLine(l);
+    if (f === null) break;
+    frames.push(f);
+    i++;
+  }
+  return { block: { frames, exception: header.trim() }, nextIndex: i };
+}
+var DOTNET_HEADER_RE = /^(?:Unhandled exception\. )?((?:[A-Za-z_][\w]*\.)+[A-Za-z_][\w]*): (.*)$/;
+var DOTNET_FRAME_WITH_LOC_RE = /^\s+at\s+(.+?)\s+in\s+(.+):line\s+(\d+)\s*$/;
+var DOTNET_FRAME_NO_LOC_RE = /^\s+at\s+(.+)$/;
+function parseDotnetFrameLine(line) {
+  const withLoc = DOTNET_FRAME_WITH_LOC_RE.exec(line);
+  if (withLoc !== null) {
+    return { file: withLoc[2] ?? "", lineNo: Number.parseInt(withLoc[3] ?? "0", 10), func: withLoc[1] ?? "" };
+  }
+  const noLoc = DOTNET_FRAME_NO_LOC_RE.exec(line);
+  if (noLoc !== null) {
+    return { file: "", lineNo: 0, func: (noLoc[1] ?? "").trim() };
+  }
+  return null;
+}
+function parseDotnetBlock(lines, start) {
+  const header = lines[start] ?? "";
+  if (DOTNET_HEADER_RE.exec(header) === null) return null;
+  const firstFrame = DOTNET_FRAME_WITH_LOC_RE.exec(lines[start + 1] ?? "") !== null ? parseDotnetFrameLine(lines[start + 1] ?? "") : null;
+  if (firstFrame === null) return null;
+  const frames = [firstFrame];
+  let i = start + 2;
+  while (i < lines.length) {
+    const f = parseDotnetFrameLine(lines[i] ?? "");
+    if (f === null) break;
+    frames.push(f);
+    i++;
+  }
+  return { block: { frames, exception: header.trim() }, nextIndex: i };
+}
+function parseTracebacks(text) {
+  const lines = splitLines(text);
+  const blocks = [];
+  let i = 0;
+  while (i < lines.length) {
+    const result = parsePythonBlock(lines, i) ?? parseRustBlock(lines, i) ?? parseNodeBlock(lines, i) ?? parseJvmBlock(lines, i) ?? parseDotnetBlock(lines, i);
+    if (result === null) {
+      i++;
+      continue;
+    }
+    if (result.block !== null) blocks.push(result.block);
+    i = result.nextIndex;
+  }
+  return blocks;
+}
+function isPathUnderRoot(normalPath, normalRoot) {
+  if (!normalPath.startsWith(normalRoot)) return false;
+  if (normalPath === normalRoot) return true;
+  const nextChar = normalPath[normalRoot.length];
+  return nextChar === "/" || nextChar === "\\";
+}
+function isProjectFrame(framePath, cwd) {
+  if (framePath.startsWith("node:")) return false;
+  if (framePath === "" || framePath === "Native Method" || framePath === "Unknown Source") return false;
+  const normalCwd = normalizeDarwinSystemAlias(foldPath(canonicalize(cwd)));
+  const normalAbs = normalizeDarwinSystemAlias(foldPath(canonicalize(framePath, cwd)));
+  if (isPathUnderRoot(normalAbs, normalCwd)) {
+    return true;
+  }
+  if (framePath.includes("site-packages") || framePath.includes("lib/python")) return false;
+  if (framePath.includes("/rustc/")) return false;
+  if (framePath.includes(".cargo/registry") || framePath.includes(".cargo\\registry")) return false;
+  if (/^<.+>$/.test(framePath)) return false;
+  if (!path15.isAbsolute(framePath) && !framePath.startsWith("..")) return true;
+  return false;
+}
+function resolveFrameSymbol(frame, projectRoot) {
+  const filePath = resolveIndexPath(frame.file, projectRoot);
+  const syms = querySymbols({ filePath, limit: ALL_SYMBOLS_IN_FILE_LIMIT });
+  const match2 = enclosingSymbol(syms, frame.lineNo);
+  if (match2 === null) return null;
+  return {
+    key: `${match2.filePath}::${match2.name}`,
+    name: match2.name,
+    kind: match2.kind,
+    filePath: match2.filePath,
+    lineStart: match2.lineStart,
+    lineEnd: match2.lineEnd,
+    body: resolveBody(match2)
+  };
+}
+function formatFrameBody(frame, projectRoot, seen) {
+  const resolved = resolveFrameSymbol(frame, projectRoot);
+  if (resolved === null) {
+    return [`    # body: No symbols enclosing line ${frame.lineNo} in '${frame.file}'`];
+  }
+  const header = `    # body: ${resolved.name}  ${resolved.kind}  ${resolved.filePath}:${resolved.lineStart}-${resolved.lineEnd}`;
+  if (seen.has(resolved.key)) {
+    return [`${header} (same as above)`];
+  }
+  seen.set(resolved.key, true);
+  return [header, resolved.body];
+}
+function cmdTrace(src, opts) {
+  const text = readInput(src);
+  const blocks = parseTracebacks(text);
+  if (blocks.length === 0) {
+    process.stderr.write("token-goat: no traceback found\n");
+    process.exitCode = 0;
+    return;
+  }
+  const cwd = process.cwd();
+  const keepN = opts.keep !== void 0 ? requireNonNegativeStrictInt("--keep", opts.keep) : 0;
+  const filtered = blocks.map((b) => {
+    let frames = b.frames.filter((f) => isProjectFrame(f.file, cwd));
+    if (keepN > 0 && frames.length > keepN) frames = frames.slice(frames.length - keepN);
+    return { ...b, frames };
+  });
+  if (opts.json === true) {
+    if (opts.bodies !== true) {
+      process.stdout.write(JSON.stringify({ tracebacks: filtered }, null, 2) + "\n");
+      return;
+    }
+    const seenJson = /* @__PURE__ */ new Map();
+    const withBodies = filtered.map((b) => ({
+      ...b,
+      frames: b.frames.map((f) => {
+        const resolved = resolveFrameSymbol(f, cwd);
+        if (resolved === null) return { ...f };
+        if (seenJson.has(resolved.key)) {
+          return { ...f, bodyDuplicateOf: resolved.key };
+        }
+        seenJson.set(resolved.key, true);
+        return {
+          ...f,
+          bodySymbol: { name: resolved.name, kind: resolved.kind, filePath: resolved.filePath, lineStart: resolved.lineStart, lineEnd: resolved.lineEnd },
+          body: resolved.body
+        };
+      })
+    }));
+    process.stdout.write(JSON.stringify({ tracebacks: withBodies }, null, 2) + "\n");
+    return;
+  }
+  const seenBodies = /* @__PURE__ */ new Map();
+  for (const [blockIndex, block] of filtered.entries()) {
+    process.stdout.write("Traceback (most recent call last):\n");
+    const projectFrameCount = blocks[blockIndex]?.frames.filter((f) => isProjectFrame(f.file, cwd)).length ?? 0;
+    const droppedByKeep = projectFrameCount - block.frames.length;
+    if (droppedByKeep > 0) {
+      const noun = droppedByKeep === 1 ? "frame" : "frames";
+      process.stdout.write(`  ...(${droppedByKeep} more ${noun} elided; use a higher --keep to see more)
+`);
+    }
+    for (const f of block.frames) {
+      process.stdout.write(`  File "${f.file}", line ${f.lineNo}, in ${f.func}
+`);
+      if (f.context) process.stdout.write(`    ${f.context}
+`);
+      if (opts.bodies === true) {
+        for (const line of formatFrameBody(f, cwd, seenBodies)) process.stdout.write(`${line}
+`);
+      }
+    }
+    if (block.frames.length === 0) {
+      const preFilterCount = blocks[blockIndex]?.frames.length ?? 0;
+      const noun = preFilterCount === 1 ? "frame" : "frames";
+      const verb = preFilterCount === 1 ? "was" : "were";
+      process.stdout.write(`  (all ${preFilterCount} ${noun} ${verb} filtered out as non-project -- this traceback runs entirely through dependency or runtime code)
+`);
+    }
+    if (block.exception) process.stdout.write(`${block.exception}
+`);
+    process.stdout.write("\n");
+  }
+}
+var VOLATILE_SUBS = [
+  { re: /\b\d{1,2}:\d{2}:\d{2}(?:\.\d+)?\b/g, placeholder: "[HH:MM:SS]" },
+  { re: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, placeholder: "[UUID]" },
+  { re: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, placeholder: "[IP]" },
+  { re: /\b[0-9a-f]{8,}\b/g, placeholder: "[HEX]" },
+  // Bare integers (counters, PIDs, ports, line numbers, byte counts, elapsed-ms values). Must run last: it operates on a string that has already had HH:MM:SS/UUID/IP/HEX replaced with their placeholders, so it never competes with those rules for the same digits. The lookbehind/lookahead exclude letters, digits AND underscore (not just \b, which treats underscore as a word character) so a digit run embedded in a longer token like v2, utf8, x86_64, sha256, or test_3_case is left untouched.
+  { re: /(?<![A-Za-z0-9_])\d+(?![A-Za-z0-9_])/g, placeholder: "[N]" }
+];
+function normalizeVolatile(line) {
+  let out2 = line;
+  for (const sub of VOLATILE_SUBS) {
+    out2 = out2.replace(sub.re, sub.placeholder);
+  }
+  return out2;
+}
+var MAX_FOLD_REPEATS_KEYS = 2e4;
+function applyFiltersAndFold(lines, noNormalize, foldRepeats) {
+  const dropped = [];
+  for (const raw of lines) {
+    let cur = raw;
+    for (const filter2 of FILTERS) {
+      if (cur === null) break;
+      if (filter2.pattern !== null && !filter2.pattern.test(cur)) continue;
+      cur = filter2.replacer(cur);
+      break;
+    }
+    if (cur !== null) dropped.push(cur);
+  }
+  const folded = [];
+  if (!foldRepeats) {
+    let prevKey2 = null;
+    let lastText = "";
+    let count = 0;
+    for (const line of dropped) {
+      const key = noNormalize ? line : normalizeVolatile(line);
+      if (key === prevKey2) {
+        count++;
+      } else {
+        if (prevKey2 !== null) folded.push({ text: lastText, count });
+        prevKey2 = key;
+        lastText = line;
+        count = 1;
+      }
+    }
+    if (prevKey2 !== null) folded.push({ text: lastText, count });
+    return folded;
+  }
+  const keyIndex = /* @__PURE__ */ new Map();
+  let prevKey = null;
+  for (const line of dropped) {
+    const key = noNormalize ? line : normalizeVolatile(line);
+    const seenIdx = keyIndex.get(key);
+    if (seenIdx !== void 0) {
+      const entry = folded[seenIdx];
+      if (entry !== void 0) entry.count++;
+    } else if (key === prevKey && folded.length > 0) {
+      const entry = folded[folded.length - 1];
+      if (entry !== void 0) entry.count++;
+    } else {
+      folded.push({ text: line, count: 1 });
+      if (keyIndex.size < MAX_FOLD_REPEATS_KEYS) keyIndex.set(key, folded.length - 1);
+    }
+    prevKey = key;
+  }
+  return folded;
+}
+function cmdLogfold(src, opts) {
+  const text = readInput(src);
+  let lines = splitLines(text);
+  if (opts.tail !== void 0) {
+    const n = requireNonNegativeStrictInt("--tail", opts.tail);
+    lines = lines.slice(Math.max(0, lines.length - n));
+  }
+  const folded = applyFiltersAndFold(lines, opts.noNormalize === true, opts.foldRepeats === true);
+  if (opts.json === true) {
+    process.stdout.write(JSON.stringify({ lines: folded }, null, 2) + "\n");
+    return;
+  }
+  for (const item of folded) {
+    if (item.count > 1) {
+      process.stdout.write(`${item.text}  (x${item.count})
+`);
+    } else {
+      process.stdout.write(`${item.text}
+`);
+    }
+  }
+}
+var LOCK_PRIORITY = [
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Cargo.lock"
+];
+function findLockfile(startPath) {
+  const stat = fs15.statSync(startPath, { throwIfNoEntry: false });
+  if (stat !== void 0 && stat.isFile()) {
+    return { file: startPath, others: [] };
+  }
+  const dir = stat !== void 0 && stat.isDirectory() ? startPath : path15.dirname(startPath);
+  const found = [];
+  for (const name of LOCK_PRIORITY) {
+    const candidate = path15.join(dir, name);
+    if (fs15.existsSync(candidate)) found.push(candidate);
+  }
+  try {
+    const entries = fs15.readdirSync(dir);
+    for (const e of entries) {
+      if (/^requirements.*\.txt$/.test(e)) {
+        const p = path15.join(dir, e);
+        if (!found.includes(p)) found.push(p);
+      }
+    }
+  } catch {
+  }
+  if (found.length === 0) return null;
+  const primary = found[0];
+  return { file: primary, others: found.slice(1) };
+}
+function collectV1Dependencies(deps, isDirect, out2) {
+  for (const [name, val] of Object.entries(deps)) {
+    out2.push({ name, version: val.version ?? "", kind: isDirect ? "direct" : "transitive" });
+    if (val.dependencies !== void 0) collectV1Dependencies(val.dependencies, false, out2);
+  }
+}
+function parsePackageLockJson(content) {
+  const raw = JSON.parse(content);
+  if (raw.packages === void 0 && raw.dependencies !== void 0) {
+    const deps2 = [];
+    collectV1Dependencies(raw.dependencies, true, deps2);
+    return deps2;
+  }
+  const pkgs = raw.packages ?? {};
+  const directDeps = pkgs[""] ?? {};
+  const allDirect = /* @__PURE__ */ new Set([
+    ...Object.keys(directDeps.dependencies ?? {}),
+    ...Object.keys(directDeps.devDependencies ?? {}),
+    ...Object.keys(directDeps.optionalDependencies ?? {})
+  ]);
+  const deps = [];
+  for (const [key, val] of Object.entries(pkgs)) {
+    if (key === "") continue;
+    const name = key.split("node_modules/").pop() ?? key;
+    const version = val.version ?? "";
+    const isTopLevel = key === `node_modules/${name}`;
+    deps.push({ name, version, kind: isTopLevel && allDirect.has(name) ? "direct" : "transitive" });
+  }
+  return deps;
+}
+function parseYarnLock(content) {
+  const deps = [];
+  const headerRe = /^"?(@?[^@"]+)@/;
+  const versionRe = /^\s{2}version[:\s]+"?([^"\s]+)"?/;
+  const lines = splitLines(content);
+  let pendingName = null;
+  for (const line of lines) {
+    if (line.trim() === "" || line.startsWith("#")) {
+      pendingName = null;
+      continue;
+    }
+    if (!line.startsWith(" ") && !line.startsWith("	")) {
+      const m = headerRe.exec(line);
+      if (m !== null) pendingName = m[1]?.trim() ?? null;
+      continue;
+    }
+    if (pendingName !== null) {
+      const vm = versionRe.exec(line);
+      if (vm !== null) {
+        deps.push({ name: pendingName, version: vm[1] ?? "", kind: "unknown" });
+        pendingName = null;
+      }
+    }
+  }
+  return deps;
+}
+function parseTomlPackages(content) {
+  const deps = [];
+  const lines = splitLines(content);
+  let inPackage = false;
+  let name = "";
+  let version = "";
+  for (const line of lines) {
+    if (/^\[\[package\]\]/.test(line)) {
+      if (inPackage && name) deps.push({ name, version, kind: "unknown" });
+      inPackage = true;
+      name = "";
+      version = "";
+      continue;
+    }
+    if (inPackage && /^name\s*=/.test(line)) {
+      const m = /=\s*"([^"]+)"/.exec(line);
+      if (m !== null) name = m[1] ?? "";
+    }
+    if (inPackage && /^version\s*=/.test(line)) {
+      const m = /=\s*"([^"]+)"/.exec(line);
+      if (m !== null) version = m[1] ?? "";
+    }
+  }
+  if (inPackage && name) deps.push({ name, version, kind: "unknown" });
+  return deps;
+}
+function parsePipfileLock(content) {
+  const raw = JSON.parse(content);
+  const deps = [];
+  for (const [name, meta] of Object.entries(raw.default ?? {})) {
+    deps.push({ name, version: (meta.version ?? "").replace(/^==/, ""), kind: "unknown" });
+  }
+  for (const [name, meta] of Object.entries(raw.develop ?? {})) {
+    deps.push({ name, version: (meta.version ?? "").replace(/^==/, ""), kind: "unknown" });
+  }
+  return deps;
+}
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of splitLines(content)) {
+    if (/^\s*#/.test(raw)) continue;
+    const eggMatch = /^\s*(?:-e\s+|--editable[\s=]+)?(?:git|hg|svn|bzr)\+.*#egg=([A-Za-z0-9_.-]+)/.exec(raw);
+    if (eggMatch !== null) {
+      deps.push({ name: eggMatch[1] ?? "", version: "", kind: "unknown" });
+      continue;
+    }
+    const line = raw.split("#")[0]?.trim() ?? "";
+    if (!line || line.startsWith("-")) continue;
+    const m = /^([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?\s*(?:[>=!~<]+\s*([^\s,;]+))?/.exec(line);
+    if (m !== null) {
+      deps.push({ name: m[1] ?? "", version: m[2] ?? "", kind: "unknown" });
+    }
+  }
+  return deps;
+}
+function stripPnpmPeerSuffix(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === ")") {
+    let depth = 0;
+    let i = end - 1;
+    for (; i >= 0; i--) {
+      const ch = value[i];
+      if (ch === ")") depth++;
+      else if (ch === "(") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (depth !== 0 || i < 0) break;
+    end = i;
+  }
+  return value.slice(0, end);
+}
+function stripPnpmLegacyPeerHash(value) {
+  const idx = value.indexOf("_");
+  return idx === -1 ? value : value.slice(0, idx);
+}
+function splitPnpmPackageKey(rawKey) {
+  const key = stripPnpmPeerSuffix(rawKey.startsWith("/") ? rawKey.slice(1) : rawKey);
+  const scoped = key.startsWith("@");
+  const nameSearchStart = scoped ? key.indexOf("/") : 0;
+  if (scoped && nameSearchStart === -1) return null;
+  const additionalSlashIdx = key.indexOf("/", nameSearchStart + 1);
+  if (additionalSlashIdx !== -1) {
+    const name2 = key.slice(0, additionalSlashIdx);
+    const version2 = stripPnpmLegacyPeerHash(key.slice(additionalSlashIdx + 1));
+    if (!name2 || !version2) return null;
+    return { name: name2, version: version2 };
+  }
+  const versionSepIdx = key.indexOf("@", nameSearchStart + 1);
+  if (versionSepIdx === -1) return null;
+  const name = key.slice(0, versionSepIdx);
+  const version = key.slice(versionSepIdx + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+function collectPnpmDirectVersions(section, out2) {
+  if (section === null || typeof section !== "object") return;
+  for (const [name, val] of Object.entries(section)) {
+    if (typeof val === "string" && val) {
+      out2.set(name, stripPnpmLegacyPeerHash(stripPnpmPeerSuffix(val)));
+      continue;
+    }
+    const version = val?.version;
+    if (typeof version === "string" && version) out2.set(name, stripPnpmPeerSuffix(version));
+  }
+}
+function parsePnpmLock(content) {
+  let raw;
+  try {
+    raw = load(content);
+  } catch {
+    return [];
+  }
+  if (raw === null || typeof raw !== "object") return [];
+  const doc = raw;
+  const directVersions = /* @__PURE__ */ new Map();
+  const rootSections = doc.importers !== void 0 ? doc.importers["."] : doc;
+  collectPnpmDirectVersions(rootSections?.dependencies, directVersions);
+  collectPnpmDirectVersions(rootSections?.devDependencies, directVersions);
+  collectPnpmDirectVersions(rootSections?.optionalDependencies, directVersions);
+  const deps = [];
+  for (const key of Object.keys(doc.packages ?? {})) {
+    const parsed = splitPnpmPackageKey(key);
+    if (parsed === null) continue;
+    const isDirect = directVersions.get(parsed.name) === parsed.version;
+    deps.push({ name: parsed.name, version: parsed.version, kind: isDirect ? "direct" : "transitive" });
+  }
+  return deps;
+}
+function parseLockFile(filePath) {
+  const base = path15.basename(filePath);
+  const content = fs15.readFileSync(filePath, "utf8");
+  if (base === "package-lock.json") return { format: "npm", deps: parsePackageLockJson(content) };
+  if (base === "yarn.lock") return { format: "yarn", deps: parseYarnLock(content) };
+  if (base === "pnpm-lock.yaml") return { format: "pnpm", deps: parsePnpmLock(content) };
+  if (base === "poetry.lock") return { format: "poetry", deps: parseTomlPackages(content) };
+  if (base === "uv.lock") return { format: "uv", deps: parseTomlPackages(content) };
+  if (base === "Cargo.lock") return { format: "cargo", deps: parseTomlPackages(content) };
+  if (base === "Pipfile.lock") return { format: "pipfile", deps: parsePipfileLock(content) };
+  return { format: "requirements", deps: parseRequirementsTxt(content) };
+}
+function buildNpmEdges(content) {
+  const raw = JSON.parse(content);
+  if (raw.packages === void 0 && raw.dependencies !== void 0) {
+    const edges2 = /* @__PURE__ */ new Map();
+    const directNames2 = new Set(Object.keys(raw.dependencies));
+    const walk = (deps) => {
+      for (const [name, val] of Object.entries(deps)) {
+        if (!edges2.has(name)) edges2.set(name, val.dependencies !== void 0 ? Object.keys(val.dependencies) : []);
+        if (val.dependencies !== void 0) walk(val.dependencies);
+      }
+    };
+    walk(raw.dependencies);
+    return { edges: edges2, directNames: directNames2 };
+  }
+  const pkgs = raw.packages;
+  if (pkgs === void 0) return null;
+  const rootEntry = pkgs[""];
+  const directNames = /* @__PURE__ */ new Set([
+    ...Object.keys(rootEntry?.dependencies ?? {}),
+    ...Object.keys(rootEntry?.devDependencies ?? {}),
+    ...Object.keys(rootEntry?.optionalDependencies ?? {})
+  ]);
+  const edges = /* @__PURE__ */ new Map();
+  for (const [key, val] of Object.entries(pkgs)) {
+    if (key === "") continue;
+    const name = key.split("node_modules/").pop() ?? key;
+    if (edges.has(name)) continue;
+    edges.set(name, [
+      .../* @__PURE__ */ new Set([...Object.keys(val.dependencies ?? {}), ...Object.keys(val.devDependencies ?? {}), ...Object.keys(val.optionalDependencies ?? {})])
+    ]);
+  }
+  return { edges, directNames };
+}
+function findReverseDirectDeps(target, edges, directNames) {
+  const result = [];
+  for (const direct of directNames) {
+    if (direct === target) continue;
+    const seen = /* @__PURE__ */ new Set([direct]);
+    const stack = [...edges.get(direct) ?? []];
+    let reaches = false;
+    while (stack.length > 0) {
+      const cur = stack.pop();
+      if (seen.has(cur)) continue;
+      seen.add(cur);
+      if (cur === target) {
+        reaches = true;
+        break;
+      }
+      for (const next of edges.get(cur) ?? []) stack.push(next);
+    }
+    if (reaches) result.push(direct);
+  }
+  return result.sort();
+}
+function cmdLockdepsPackage(lockfile, format, deps, query, json) {
+  const matches2 = deps.filter((d) => d.name === query);
+  if (matches2.length === 0) {
+    const suggestions = suggestPackageNames(query, deps.map((d) => d.name));
+    const hint = suggestions.length > 0 ? ` (did you mean: ${suggestions.join(", ")}?)` : "";
+    throw new Error(`Package '${query}' not found in ${lockfile}${hint}`);
+  }
+  const primary = matches2.find((d) => d.kind === "direct") ?? matches2[0];
+  const otherVersions = [...new Set(matches2.filter((d) => d.version !== primary.version).map((d) => d.version))];
+  const graph = format === "npm" ? buildNpmEdges(fs15.readFileSync(lockfile, "utf8")) : null;
+  const graphAvailable = graph !== null;
+  const dependsOn = graph !== null ? [...graph.edges.get(query) ?? []].sort() : [];
+  const dependedOnBy = graph !== null ? findReverseDirectDeps(query, graph.edges, graph.directNames) : [];
+  if (json) {
+    process.stdout.write(
+      JSON.stringify(
+        { file: lockfile, format, package: primary.name, version: primary.version, kind: primary.kind, otherVersions, graphAvailable, dependsOn, dependedOnBy },
+        null,
+        2
+      ) + "\n"
+    );
+    return;
+  }
+  process.stdout.write(`Lockfile: ${lockfile}  (${format})
+`);
+  process.stdout.write(`Package: ${primary.name}
+`);
+  process.stdout.write(`Version: ${primary.version}${primary.kind === "unknown" ? "" : `  (${primary.kind})`}
+`);
+  if (otherVersions.length > 0) process.stdout.write(`Other versions in lockfile: ${otherVersions.join(", ")}
+`);
+  if (!graphAvailable) {
+    process.stdout.write(`
+Dependency graph not available for format '${format}' (only npm package-lock.json exposes package-to-package edges).
+`);
+    return;
+  }
+  process.stdout.write(`
+Depends on (${dependsOn.length}):
+`);
+  if (dependsOn.length === 0) process.stdout.write("  (none)\n");
+  for (const n of dependsOn) process.stdout.write(`  ${n}
+`);
+  process.stdout.write(`
+Depended on by direct/top-level deps (${dependedOnBy.length}):
+`);
+  if (dependedOnBy.length === 0) process.stdout.write("  (none)\n");
+  for (const n of dependedOnBy) process.stdout.write(`  ${n}
+`);
+}
+function cmdLockdeps(filePath, opts) {
+  const target = filePath !== void 0 ? path15.resolve(filePath) : process.cwd();
+  const found = findLockfile(target);
+  if (found === null) {
+    throw new Error("No lockfile found. Expected one of: " + LOCK_PRIORITY.join(", ") + ", requirements*.txt");
+  }
+  const { deps, format } = parseLockFile(found.file);
+  const others = found.others;
+  if (opts.package !== void 0) {
+    cmdLockdepsPackage(found.file, format, deps, opts.package, opts.json === true);
+    return;
+  }
+  if (opts.json === true) {
+    process.stdout.write(JSON.stringify({ file: found.file, format, total: deps.length, others, deps }, null, 2) + "\n");
+    return;
+  }
+  process.stdout.write(`Lockfile: ${found.file}  (${format})
+`);
+  if (others.length > 0) process.stdout.write(`Other lockfiles found (not parsed): ${others.join(", ")}
+`);
+  process.stdout.write(`Total: ${deps.length} packages
+
+`);
+  for (const dep of deps) {
+    const kindLabel = dep.kind === "unknown" ? "" : `  (${dep.kind})`;
+    process.stdout.write(`${dep.name}  ${dep.version}${kindLabel}
+`);
+  }
 }
-function extractGeneric(lines) {
-  const result = {
-    runner: "unknown",
-    blocks: [],
-    summaryLines: [],
-    statsLine: ""
-  };
-  for (const line of lines) {
-    const s = line.trimEnd();
-    if (/\b(FAILED|FAILURE|ERROR)\b/i.test(s)) {
-      result.summaryLines.push(s);
+function resolveProjectHash() {
+  const project = findProject(process.cwd());
+  if (project === null) throw new Error("No project root found from cwd. Is this inside a project (git repo, package.json, etc.)?");
+  return project.hash;
+}
+function cmdNote(action, key, value, opts) {
+  const act = action.toLowerCase();
+  if (act === "list") {
+    const hash = resolveProjectHash();
+    const entries = loadEntries(hash);
+    if (opts.json === true) {
+      process.stdout.write(JSON.stringify(entries, null, 2) + "\n");
+    } else {
+      const pairs = Object.entries(entries);
+      if (pairs.length === 0) {
+        process.stdout.write("(no notes set)\n");
+      } else {
+        for (const [k, v] of pairs) {
+          process.stdout.write(`${k} = ${v}
+`);
+        }
+      }
     }
+    return;
   }
-  return result;
-}
-function extractFailures(text, options) {
-  const cleaned = stripAnsi(text);
-  const lines = cleaned.split("\n");
-  const detected = options?.runner ?? detectRunner(cleaned);
-  if (detected === "pytest") {
-    return extractPytest(lines);
+  if (act === "clear") {
+    const hash = resolveProjectHash();
+    clearAll(hash);
+    process.stdout.write("Cleared all notes for this project.\n");
+    return;
   }
-  if (detected === "jest") {
-    return extractJest(lines);
+  if (act === "get") {
+    if (key === void 0) throw new Error("note get requires a key");
+    const hash = resolveProjectHash();
+    const entries = loadEntries(hash);
+    const v = entries[key];
+    if (v === void 0) throw new Error(`Key not found: ${key}`);
+    process.stdout.write(v + "\n");
+    return;
   }
-  if (detected === "go") {
-    return extractGo(lines);
+  if (act === "unset") {
+    if (key === void 0) throw new Error("note unset requires a key");
+    const hash = resolveProjectHash();
+    unsetEntry(hash, key);
+    process.stdout.write(`Unset: ${key}
+`);
+    return;
   }
-  if (detected === "cargo") {
-    return extractCargo(lines);
+  if (act === "set") {
+    if (key === void 0) throw new Error("note set requires a key");
+    if (value === void 0) throw new Error("note set requires a value");
+    const hash = resolveProjectHash();
+    setEntry(hash, key, value);
+    process.stdout.write(`Set: ${key} = ${value}
+`);
+    return;
   }
-  return extractGeneric(lines);
+  throw new Error(`Unknown note action: ${action}. Use: set, get, unset, list, clear`);
 }
-function formatFailuresText(result) {
-  if (result.blocks.length === 0 && result.summaryLines.length === 0) {
-    return "No failures found.";
+function loadAllSessionReadCounts() {
+  const sessionsDir = path15.join(tokenGoatHome(), "sessions");
+  const totals = /* @__PURE__ */ new Map();
+  let entries;
+  try {
+    entries = fs15.readdirSync(sessionsDir, { withFileTypes: true });
+  } catch {
+    return totals;
   }
-  const parts = [];
-  const sep5 = "\u2500".repeat(60);
-  for (const block of result.blocks) {
-    parts.push(sep5, `FAIL  ${block.name}`, sep5, block.body, "");
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+    const filePath = path15.join(sessionsDir, entry.name);
+    let raw;
+    try {
+      raw = JSON.parse(fs15.readFileSync(filePath, "utf8"));
+    } catch {
+      continue;
+    }
+    if (raw === null || typeof raw !== "object") continue;
+    const files = raw["files"];
+    if (!Array.isArray(files)) continue;
+    for (const f of files) {
+      if (f === null || typeof f !== "object") continue;
+      const fp = f["path"];
+      const rc = f["readCount"];
+      if (typeof fp !== "string" || typeof rc !== "number") continue;
+      const key = foldPath(fp);
+      const existing = totals.get(key);
+      totals.set(key, { path: existing?.path ?? fp, readCount: (existing?.readCount ?? 0) + rc });
+    }
+  }
+  return totals;
+}
+function cmdHot(opts) {
+  const limit = opts.limit !== void 0 ? requireNonNegativeStrictInt("--limit", opts.limit) : 20;
+  if (opts.limit !== void 0 && limit === 0) {
+    throw new Error(`--limit must be a positive number, got: "${opts.limit}"`);
+  }
+  const totals = loadAllSessionReadCounts();
+  let entries = [...totals.values()].map(({ path: p, readCount: rc }) => ({ path: p, readCount: rc }));
+  const preProjectCount = entries.length;
+  if (opts.project === true) {
+    const project = findProject(process.cwd());
+    if (project !== null) {
+      const root = foldPath(project.root);
+      entries = entries.filter((e) => isPathUnderRoot(foldPath(e.path), root));
+    }
+  }
+  entries.sort((a, b) => b.readCount - a.readCount);
+  entries = entries.slice(0, limit);
+  if (opts.json === true) {
+    process.stdout.write(JSON.stringify({ entries }, null, 2) + "\n");
+    return;
   }
-  if (result.summaryLines.length > 0) {
-    if (parts.length > 0) {
-      parts.push(sep5);
+  if (entries.length === 0) {
+    if (opts.project === true && preProjectCount > 0) {
+      const noun = preProjectCount === 1 ? "file" : "files";
+      process.stdout.write(`No session read data under this project root (${preProjectCount} ${noun} recorded outside it).
+`);
+      return;
     }
-    parts.push(...result.summaryLines);
+    process.stdout.write("No session read data found.\n");
+    return;
   }
-  if (result.statsLine) {
-    parts.push(result.statsLine);
+  const hotDisplayRoot = getDisplayRoot();
+  for (const e of entries) {
+    process.stdout.write(`${e.readCount}	${toDisplayPath(hotDisplayRoot, e.path)}
+`);
   }
-  const n = getFailureCount(result);
-  parts.push(`
-${n} failure(s)  [${result.runner}]`);
-  return parts.join("\n");
-}
-function formatFailuresJson(result) {
-  return JSON.stringify(
-    {
-      runner: result.runner,
-      count: getFailureCount(result),
-      failures: result.blocks.map((b) => ({ name: b.name, body: b.body })),
-      summary: result.summaryLines,
-      stats: result.statsLine
-    },
-    null,
-    2
-  );
-}
-function failureSignatures(result) {
-  const raw = result.blocks.length > 0 ? result.blocks.map((b) => b.name.trim()) : result.summaryLines.map((s) => s.trim()).filter((s) => s !== "");
-  return Array.from(new Set(raw));
 }
-function computeFailureDelta(prevSignatures, currSignatures) {
-  if (prevSignatures === null) {
-    return { hasBaseline: false, newlyFailing: [...currSignatures], newlyFixed: [], stillFailing: [] };
+function cmdRecent(nStr, opts) {
+  const n = nStr !== void 0 ? requireNonNegativeStrictInt("recent", nStr) : 20;
+  if (nStr !== void 0 && n === 0) {
+    throw new Error(`recent: limit must be a positive number, got: "${nStr}"`);
+  }
+  const sessionFiles = getSessionFiles();
+  const entries = [...sessionFiles.values()].map((e) => ({ path: e.path, readCount: e.readCount, lastReadAt: e.lastReadAt, wasEdited: e.wasEdited })).sort((a, b) => b.lastReadAt - a.lastReadAt).slice(0, n);
+  if (opts.json === true) {
+    process.stdout.write(JSON.stringify({ entries, scope: "current-session" }, null, 2) + "\n");
+    return;
+  }
+  process.stdout.write("# Recent files (current session only \u2014 use `token-goat hot` for cross-session)\n");
+  if (entries.length === 0) {
+    process.stdout.write("No files read in this session yet.\n");
+    return;
+  }
+  const recentDisplayRoot = getDisplayRoot();
+  for (const e of entries) {
+    const edited = e.wasEdited ? "  [edited]" : "";
+    const ts = new Date(e.lastReadAt).toISOString();
+    process.stdout.write(`${ts}  ${toDisplayPath(recentDisplayRoot, e.path)}${edited}
+`);
   }
-  const prevSet = new Set(prevSignatures);
-  const currSet = new Set(currSignatures);
-  return {
-    hasBaseline: true,
-    newlyFailing: currSignatures.filter((s) => !prevSet.has(s)),
-    newlyFixed: prevSignatures.filter((s) => !currSet.has(s)),
-    stillFailing: currSignatures.filter((s) => prevSet.has(s))
-  };
 }
-function formatFailureDeltaText(delta, runner) {
-  if (!delta.hasBaseline) {
-    const lines2 = [
-      `No baseline yet for this project/key -- showing all ${delta.newlyFailing.length} current failure(s) as new.  [${runner}]`
-    ];
-    if (delta.newlyFailing.length === 0) {
-      lines2.push("(no failures)");
-    } else {
-      for (const name of delta.newlyFailing) lines2.push(`+ ${name}`);
-    }
-    return lines2.join("\n");
+function cmdIgnores(opts) {
+  const cwd = process.cwd();
+  const cfg = loadConfig();
+  const walkMode = detectWalkMode(cwd);
+  const walkIndexBuiltinExclusions = [".env", ".env.*", "*.d.ts"];
+  const report = {
+    walkMode,
+    indexRespectsGitignore: walkMode === "git",
+    walkIndexBuiltinExclusions,
+    skipDirs: [...SKIP_DIRS].sort(),
+    blockedRoots: cfg.worker.blocked_roots,
+    excludeTests: cfg.repomap.exclude_tests,
+    packIgnorePatterns: countPackIgnorePatterns(cwd)
+  };
+  if (opts.json === true) {
+    process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    return;
   }
-  const lines = [];
-  lines.push(`Newly failing (${delta.newlyFailing.length}):`);
-  if (delta.newlyFailing.length === 0) {
-    lines.push("  (none)");
+  process.stdout.write(`Walk mode: ${walkMode}
+`);
+  if (walkMode === "git") {
+    process.stdout.write("token-goat index: .gitignore exclusions are active (via git ls-files).\n");
   } else {
-    for (const name of delta.newlyFailing) lines.push(`  + ${name}`);
+    process.stdout.write(
+      `token-goat index --walk: built-in exclusions ${walkIndexBuiltinExclusions.join(", ")}.
+`
+    );
   }
-  lines.push("");
-  lines.push(`Newly fixed (${delta.newlyFixed.length}):`);
-  if (delta.newlyFixed.length === 0) {
-    lines.push("  (none)");
+  process.stdout.write(
+    `map/todo/conflicts (and hot --project) ignore neither .gitignore nor ${walkIndexBuiltinExclusions.join(", ")} in either mode -- they only skip: ${report.skipDirs.join(", ")} (and hidden directories).
+`
+  );
+  if (cfg.worker.blocked_roots.length > 0) {
+    process.stdout.write(`Blocked roots (config, enforced by token-goat index / index --walk / worker only): ${cfg.worker.blocked_roots.join(", ")}
+`);
   } else {
-    for (const name of delta.newlyFixed) lines.push(`  - ${name}`);
+    process.stdout.write("Blocked roots (config, enforced by token-goat index / index --walk / worker only): none\n");
   }
-  lines.push("");
-  lines.push(`Still failing (unchanged): ${delta.stillFailing.length}`);
-  lines.push(
-    `
-[${runner}]  ${delta.newlyFailing.length} newly failing, ${delta.newlyFixed.length} newly fixed, ${delta.stillFailing.length} still failing`
-  );
-  return lines.join("\n");
-}
-function formatFailureDeltaJson(delta, runner) {
-  return JSON.stringify(
-    {
-      runner,
-      hasBaseline: delta.hasBaseline,
-      newlyFailing: delta.newlyFailing,
-      newlyFixed: delta.newlyFixed,
-      stillFailingCount: delta.stillFailing.length
-    },
-    null,
-    2
+  process.stdout.write(`Exclude tests from repomap: ${cfg.repomap.exclude_tests}
+`);
+  process.stdout.write(
+    report.packIgnorePatterns > 0 ? `.tokengoatignore: ${report.packIgnorePatterns} pattern${report.packIgnorePatterns === 1 ? "" : "s"}, applied by token-goat pack only -- it does not exclude anything from the symbol index. To keep a path out of the index, run "token-goat project exclude <path>".
+` : '.tokengoatignore: not present. It would apply to token-goat pack only -- to keep a path out of the symbol index, run "token-goat project exclude <path>".\n'
   );
 }
-
-// src/failures_state.ts
-init_define_import_meta_env();
-import * as fs9 from "node:fs";
-import * as path11 from "node:path";
-var KEY_RE = /^[A-Za-z0-9_-]{1,80}$/;
-var DEFAULT_FAILURES_STATE_KEY = "default";
-function validateKey(key) {
-  if (!KEY_RE.test(key)) {
-    throw new Error(
-      `Invalid --key ${JSON.stringify(key)}: use only letters, digits, hyphens, underscores (max 80 chars)`
-    );
-  }
-}
-function failuresStatePath(projectHash, key) {
-  validateKey(key);
-  return path11.join(dataDir(), "projects", `${projectHash}_failures_${key}.json`);
-}
-function loadFailureSnapshot(projectHash, key) {
-  const p = failuresStatePath(projectHash, key);
+function countPackIgnorePatterns(root) {
   try {
-    if (!fs9.existsSync(p)) return null;
-    const parsed = JSON.parse(fs9.readFileSync(p, "utf-8"));
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const obj = parsed;
-    if (!Array.isArray(obj.signatures)) return null;
-    return {
-      signatures: obj.signatures.filter((s) => typeof s === "string"),
-      runner: typeof obj.runner === "string" ? obj.runner : "unknown",
-      storedAt: typeof obj.storedAt === "number" ? obj.storedAt : 0
-    };
+    return fs15.readFileSync(path15.join(root, ".tokengoatignore"), "utf8").split("\n").map((ln) => ln.trim()).filter((ln) => ln.length > 0 && !ln.startsWith("#")).length;
   } catch {
-    return null;
+    return 0;
   }
 }
-function saveFailureSnapshot(projectHash, key, snapshot) {
-  const p = failuresStatePath(projectHash, key);
-  const dir = path11.dirname(p);
-  ensureDirSync(dir);
-  const content = JSON.stringify(snapshot);
-  const doSave = () => {
-    atomicWriteText(p, content);
-    return true;
-  };
-  if (withFileLock(`${p}.lock`, doSave) === void 0) doSave();
-}
 
 // src/dep_docs.ts
 init_define_import_meta_env();
 import { createRequire } from "node:module";
-import * as fs10 from "node:fs";
-import * as path12 from "node:path";
+import * as fs16 from "node:fs";
+import * as path16 from "node:path";
 var _require = createRequire(import.meta.url);
 var _ts = null;
 var _tsLoadAttempted = false;
@@ -8474,21 +10233,21 @@ function loadTs() {
 }
 function dirExists(p) {
   try {
-    return fs10.statSync(p).isDirectory();
+    return fs16.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function fileExists(p) {
   try {
-    return fs10.statSync(p).isFile();
+    return fs16.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function readFileTextOrNull(p) {
   try {
-    return fs10.readFileSync(p, "utf8");
+    return fs16.readFileSync(p, "utf8");
   } catch {
     return null;
   }
@@ -8496,7 +10255,7 @@ function readFileTextOrNull(p) {
 function listInstalledPackageNames(nodeModulesDir) {
   let entries;
   try {
-    entries = fs10.readdirSync(nodeModulesDir, { withFileTypes: true });
+    entries = fs16.readdirSync(nodeModulesDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -8506,7 +10265,7 @@ function listInstalledPackageNames(nodeModulesDir) {
     if (entry.name.startsWith("@")) {
       let scoped;
       try {
-        scoped = fs10.readdirSync(path12.join(nodeModulesDir, entry.name), { withFileTypes: true });
+        scoped = fs16.readdirSync(path16.join(nodeModulesDir, entry.name), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8523,12 +10282,12 @@ var README_NAME_RE = /^readme(\.(md|markdown|txt))?$/i;
 function findReadmeFile(pkgDir) {
   const direct = findReadmeIn(pkgDir);
   if (direct !== null) return direct;
-  return findReadmeIn(path12.join(pkgDir, "docs"));
+  return findReadmeIn(path16.join(pkgDir, "docs"));
 }
 function findReadmeIn(dir) {
   let entries;
   try {
-    entries = fs10.readdirSync(dir, { withFileTypes: true });
+    entries = fs16.readdirSync(dir, { withFileTypes: true });
   } catch {
     return null;
   }
@@ -8540,7 +10299,7 @@ function findReadmeIn(dir) {
     return 1;
   };
   matches2.sort((a, b) => rank(a.name) - rank(b.name));
-  return path12.join(dir, matches2[0].name);
+  return path16.join(dir, matches2[0].name);
 }
 function typesPackageDirName(pkgName) {
   if (pkgName.startsWith("@")) {
@@ -8567,30 +10326,30 @@ function resolveTypesLocation(pkgDir, pkgJson, nodeModulesDir, pkgName) {
   if (declared !== void 0) {
     const candidates = [declared, declared.endsWith(".d.ts") ? declared : `${declared}.d.ts`, declared.replace(/\.[cm]?[jt]s$/, ".d.ts")];
     for (const c of candidates) {
-      const p = path12.join(pkgDir, c);
+      const p = path16.join(pkgDir, c);
       if (fileExists(p)) return { path: p, source: "bundled" };
     }
   }
   const main = typeof pkgJson["main"] === "string" ? pkgJson["main"] : "index.js";
-  const mainDts = path12.join(pkgDir, main.replace(/\.[cm]?js$/, ".d.ts"));
+  const mainDts = path16.join(pkgDir, main.replace(/\.[cm]?js$/, ".d.ts"));
   if (fileExists(mainDts)) return { path: mainDts, source: "bundled" };
-  const indexDts = path12.join(pkgDir, "index.d.ts");
+  const indexDts = path16.join(pkgDir, "index.d.ts");
   if (fileExists(indexDts)) return { path: indexDts, source: "bundled" };
   const typesDirName = typesPackageDirName(pkgName);
-  const typesPkgDir = path12.join(nodeModulesDir, "@types", typesDirName);
-  const typesPkgJsonRaw = readFileTextOrNull(path12.join(typesPkgDir, "package.json"));
+  const typesPkgDir = path16.join(nodeModulesDir, "@types", typesDirName);
+  const typesPkgJsonRaw = readFileTextOrNull(path16.join(typesPkgDir, "package.json"));
   if (typesPkgJsonRaw !== null) {
     try {
       const typesPkgJson = JSON.parse(typesPkgJsonRaw);
       const entry = (typeof typesPkgJson["types"] === "string" ? typesPkgJson["types"] : void 0) ?? (typeof typesPkgJson["main"] === "string" ? typesPkgJson["main"] : void 0) ?? "index.d.ts";
       const entryCandidates = [entry, entry.endsWith(".d.ts") ? entry : `${entry}.d.ts`, entry.replace(/\.[cm]?[jt]s$/, ".d.ts")];
       for (const c of entryCandidates) {
-        const entryPath = path12.join(typesPkgDir, c);
+        const entryPath = path16.join(typesPkgDir, c);
         if (fileExists(entryPath)) return { path: entryPath, source: "@types" };
       }
     } catch {
     }
-    const fallback = path12.join(typesPkgDir, "index.d.ts");
+    const fallback = path16.join(typesPkgDir, "index.d.ts");
     if (fileExists(fallback)) return { path: fallback, source: "@types" };
   }
   return null;
@@ -8657,16 +10416,16 @@ function recordDepDocsStat(fullSourceBytes, emittedText, packageName) {
 }
 function runDepDocs(opts) {
   const root = resolveProjectRoot({ project: opts.projectRoot ?? process.cwd() });
-  const nodeModulesDir = path12.join(root, "node_modules");
-  const pkgDir = path12.join(nodeModulesDir, opts.packageName);
-  const pkgJsonPath = path12.join(pkgDir, "package.json");
+  const nodeModulesDir = path16.join(root, "node_modules");
+  const pkgDir = path16.join(nodeModulesDir, opts.packageName);
+  const pkgJsonPath = path16.join(pkgDir, "package.json");
   if (!dirExists(pkgDir) || !fileExists(pkgJsonPath)) {
     const known = listInstalledPackageNames(nodeModulesDir);
     const suggestions = suggestPackageNames(opts.packageName, known);
     const hint = suggestions.length > 0 ? ` (did you mean: ${suggestions.join(", ")}?)` : "";
     return { text: `Package '${opts.packageName}' not found under ${nodeModulesDir}${hint}`, code: 1 };
   }
-  const pkgJsonRaw = fs10.readFileSync(pkgJsonPath, "utf8");
+  const pkgJsonRaw = fs16.readFileSync(pkgJsonPath, "utf8");
   let pkgJson;
   try {
     pkgJson = JSON.parse(pkgJsonRaw);
@@ -9170,14 +10929,14 @@ function cmdBaseline(opts) {
 
 // src/index_reclaim.ts
 init_define_import_meta_env();
-import * as fs11 from "node:fs";
-import * as path13 from "node:path";
+import * as fs17 from "node:fs";
+import * as path17 from "node:path";
 var DERIVED_TABLES = ["chunk_vectors", "chunks", "refs", "symbols", "files"];
 function indexSizeBytes(dbPath) {
   let total = 0;
   for (const p of [dbPath, `${dbPath}-wal`]) {
     try {
-      total += fs11.statSync(p).size;
+      total += fs17.statSync(p).size;
     } catch {
     }
   }
@@ -9239,7 +10998,7 @@ function mb(bytes) {
 }
 function cmdReclaimIndex(opts) {
   const dbPath = opts.dbPath ?? globalDbPath();
-  if (opts.force !== true && isWorkerRunning(path13.dirname(dbPath))) {
+  if (opts.force !== true && isWorkerRunning(path17.dirname(dbPath))) {
     throw new Error(
       "reclaim-index: the worker daemon is running and writing to this index. Stop it first with 'token-goat worker stop', then re-run. Pass --force to proceed anyway (results may be inaccurate if the worker is really live)."
     );
@@ -9274,7 +11033,7 @@ function cmdReclaimIndex(opts) {
   }
   if (result.checkpointBusy) {
     process.stdout.write(
-      `  note: a concurrent reader blocked WAL truncation, so some space may still be held in ${path13.basename(dbPath)}-wal
+      `  note: a concurrent reader blocked WAL truncation, so some space may still be held in ${path17.basename(dbPath)}-wal
 `
     );
   }
@@ -9282,9 +11041,9 @@ function cmdReclaimIndex(opts) {
 
 // src/config_commands.ts
 init_define_import_meta_env();
-import * as fs12 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os9 from "node:os";
-import * as path14 from "node:path";
+import * as path18 from "node:path";
 function emit(text) {
   const payload = colorStdout() ? text : stripAnsi(text);
   process.stdout.write(ensureNewline(payload));
@@ -9293,7 +11052,7 @@ function emitErr2(text) {
   process.stderr.write(ensureNewline(text));
 }
 function saveConfigSafe(cfg) {
-  ensureDirSync(path14.dirname(configPath()));
+  ensureDirSync(path18.dirname(configPath()));
   saveConfig(cfg);
 }
 function levenshtein(a, b, cap = 3) {
@@ -9504,7 +11263,7 @@ function cmdConfig(opts) {
       const parseErrAtLoad = getLastConfigParseError();
       if (parseErrAtLoad !== null) {
         try {
-          fs12.copyFileSync(configPath(), `${configPath()}.bak`);
+          fs18.copyFileSync(configPath(), `${configPath()}.bak`);
           emitErr2(`config set: warning: config.toml failed to parse (${parseErrAtLoad}); backed up the original to config.toml.bak and rewriting it from defaults`);
         } catch {
         }
@@ -9540,8 +11299,8 @@ function cmdConfig(opts) {
       saveConfigSafe(cfg);
       return coercedValue;
     };
-    ensureDirSync(path14.dirname(configPath()));
-    const lockPath = path14.join(path14.dirname(configPath()), ".config.lock");
+    ensureDirSync(path18.dirname(configPath()));
+    const lockPath = path18.join(path18.dirname(configPath()), ".config.lock");
     const lockResult = withFileLock(lockPath, applySet, { waitMs: LOCK_WAIT_MS_HARDENED });
     const coerced = lockResult === void 0 ? applySet() : lockResult;
     invalidateConfigCache();
@@ -9570,7 +11329,7 @@ function cmdConfig(opts) {
     let raw = {};
     let parseErr = null;
     try {
-      const text = fs12.readFileSync(cfgFile, "utf8");
+      const text = fs18.readFileSync(cfgFile, "utf8");
       raw = parse(text);
     } catch (e) {
       const code = e.code;
@@ -9677,7 +11436,7 @@ function cmdProject(opts) {
       emitErr2("project exclude requires a path argument");
       throw new Error("missing path");
     }
-    const target = path14.resolve(opts.pathArg);
+    const target = path18.resolve(opts.pathArg);
     const cfg = loadPersistedConfig();
     const targetFolded = foldPath(normalizePath(target));
     if (cfg.worker.blocked_roots.some((r) => foldPath(normalizePath(r)) === targetFolded)) {
@@ -9699,7 +11458,7 @@ function cmdProject(opts) {
     const before = cfg.worker.blocked_roots;
     const after = before.filter((r) => {
       try {
-        return fs12.existsSync(r);
+        return fs18.existsSync(r);
       } catch {
         return false;
       }
@@ -9746,14 +11505,14 @@ function recordCompactDocStat(fullSourceBytes, emittedText, detail) {
   recordStat("compact_doc", bytesSaved, Math.round(bytesSaved / 4), void 0, detail);
 }
 function cmdCompactDoc(opts) {
-  const resolved = path14.resolve(opts.filePath);
+  const resolved = path18.resolve(opts.filePath);
   if (opts.heading !== void 0) {
     const result = compactDoc(resolved, opts.heading);
     if (result === null) {
       emitErr2(`compact-doc: could not read or compact '${resolved}'`);
       throw new Error(`could not compact: ${resolved}`);
     }
-    const legacyFullBytes = fs12.statSync(resolved).size;
+    const legacyFullBytes = fs18.statSync(resolved).size;
     if (opts.json === true) {
       const jsonText = JSON.stringify({ path: resolved, compact: result }, null, 2);
       emit(jsonText);
@@ -9780,7 +11539,7 @@ function cmdCompactDoc(opts) {
   if (opts.force === true || opts.sentences !== void 0 || !fresh) {
     let sourceText;
     try {
-      sourceText = fs12.readFileSync(resolved, "utf-8");
+      sourceText = fs18.readFileSync(resolved, "utf-8");
     } catch {
       emitErr2(`compact-doc: could not read or compact '${resolved}'`);
       throw new Error(`could not compact: ${resolved}`);
@@ -9796,7 +11555,7 @@ function cmdCompactDoc(opts) {
     }
     body = existing;
   }
-  const extractiveFullBytes = fs12.statSync(resolved).size;
+  const extractiveFullBytes = fs18.statSync(resolved).size;
   if (opts.json === true) {
     const jsonText = JSON.stringify({ path: resolved, compactPath, rebuilt, compact: body }, null, 2);
     emit(jsonText);
@@ -9853,7 +11612,7 @@ async function cmdFetchImage(opts) {
     throw new Error(`fetch failed: ${opts.url}`, { cause: e });
   }
   const buf = fetched.body;
-  const outPath = opts.out ?? path14.join(os9.tmpdir(), `tg-fetch-${Date.now()}${extensionForContentType(fetched.contentType)}`);
+  const outPath = opts.out ?? path18.join(os9.tmpdir(), `tg-fetch-${Date.now()}${extensionForContentType(fetched.contentType)}`);
   const originalBytes = buf.length;
   let shrunkBytes;
   let outData;
@@ -9935,9 +11694,9 @@ function cmdHistory(opts) {
 
 // src/cli_bootstrap_audit.ts
 init_define_import_meta_env();
-import * as fs13 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os10 from "node:os";
-import * as path15 from "node:path";
+import * as path19 from "node:path";
 import * as readline from "node:readline";
 var FRONTMATTER_KEYS = /* @__PURE__ */ new Set(["description", "tools", "allowed-tools", "allowed_tools"]);
 function parseBudget(name, value) {
@@ -9946,7 +11705,7 @@ function parseBudget(name, value) {
   return value;
 }
 async function readFrontmatter(filePath) {
-  const stream = fs13.createReadStream(filePath, { encoding: "utf8" });
+  const stream = fs19.createReadStream(filePath, { encoding: "utf8" });
   const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
   let first = true;
   let inFrontmatter = false;
@@ -9992,44 +11751,44 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
   let logicalRoot;
   let rootIsLink;
   try {
-    rootIsLink = (await fs13.promises.lstat(root)).isSymbolicLink();
-    logicalRoot = await fs13.promises.realpath(root);
+    rootIsLink = (await fs19.promises.lstat(root)).isSymbolicLink();
+    logicalRoot = await fs19.promises.realpath(root);
   } catch (error) {
     if (error.code === "ENOENT") return entries;
-    diagnostics.push({ path: path15.resolve(root), reason: "unreadable root" });
+    diagnostics.push({ path: path19.resolve(root), reason: "unreadable root" });
     return entries;
   }
   if (rootIsLink && !followLinks) {
-    diagnostics.push({ path: path15.resolve(root), reason: "external root link skipped (use --follow-links)" });
+    diagnostics.push({ path: path19.resolve(root), reason: "external root link skipped (use --follow-links)" });
     return entries;
   }
   const canonicalKey = (candidate) => process.platform === "win32" ? candidate.toLocaleLowerCase() : candidate;
   const isContained = (candidate, allowedRoot) => {
-    const relative3 = path15.relative(canonicalKey(allowedRoot), canonicalKey(candidate));
-    return relative3 === "" || relative3 !== ".." && !relative3.startsWith(`..${path15.sep}`) && !path15.isAbsolute(relative3);
+    const relative3 = path19.relative(canonicalKey(allowedRoot), canonicalKey(candidate));
+    return relative3 === "" || relative3 !== ".." && !relative3.startsWith(`..${path19.sep}`) && !path19.isAbsolute(relative3);
   };
   async function visit(candidate, allowedRoot, topLevel = false) {
     let real;
     let candidateIsLink;
     try {
-      candidateIsLink = (await fs13.promises.lstat(candidate)).isSymbolicLink();
-      real = await fs13.promises.realpath(candidate);
+      candidateIsLink = (await fs19.promises.lstat(candidate)).isSymbolicLink();
+      real = await fs19.promises.realpath(candidate);
     } catch {
-      diagnostics.push({ path: path15.resolve(candidate), reason: "broken or unreadable link" });
+      diagnostics.push({ path: path19.resolve(candidate), reason: "broken or unreadable link" });
       return;
     }
     const withinAllowedRoot = allowedRoot === void 0 ? isContained(real, logicalRoot) : isContained(real, allowedRoot);
     const canFollowExternal = followLinks && topLevel;
     if (!withinAllowedRoot && !canFollowExternal) {
-      diagnostics.push({ path: path15.resolve(candidate), reason: candidateIsLink ? "external link skipped (use --follow-links)" : "canonical target outside scan root" });
+      diagnostics.push({ path: path19.resolve(candidate), reason: candidateIsLink ? "external link skipped (use --follow-links)" : "canonical target outside scan root" });
       return;
     }
     const trustedRoot = !withinAllowedRoot && canFollowExternal ? real : allowedRoot ?? real;
     let stat;
     try {
-      stat = await fs13.promises.stat(real);
+      stat = await fs19.promises.stat(real);
     } catch {
-      diagnostics.push({ path: path15.resolve(candidate), reason: "unreadable" });
+      diagnostics.push({ path: path19.resolve(candidate), reason: "unreadable" });
       return;
     }
     const canonical = process.platform === "win32" ? real.toLocaleLowerCase() : real;
@@ -10038,16 +11797,16 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       visitedDirs.add(canonical);
       let children;
       try {
-        children = await fs13.promises.readdir(real, { withFileTypes: true });
+        children = await fs19.promises.readdir(real, { withFileTypes: true });
       } catch {
-        diagnostics.push({ path: path15.resolve(candidate), reason: "unreadable directory" });
+        diagnostics.push({ path: path19.resolve(candidate), reason: "unreadable directory" });
         return;
       }
       children.sort((a, b) => a.name.localeCompare(b.name));
-      for (const child of children) await visit(path15.join(real, child.name), trustedRoot);
+      for (const child of children) await visit(path19.join(real, child.name), trustedRoot);
       return;
     }
-    if (!stat.isFile() || path15.extname(real).toLowerCase() !== ".md") return;
+    if (!stat.isFile() || path19.extname(real).toLowerCase() !== ".md") return;
     if (seenFiles.has(canonical)) return;
     seenFiles.add(canonical);
     try {
@@ -10057,35 +11816,35 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       const toolsBytes = Buffer.byteLength(metadata.tools, "utf8");
       entries.push({
         kind,
-        path: path15.resolve(real),
+        path: path19.resolve(real),
         description_bytes: descriptionBytes,
         tools_bytes: toolsBytes,
         metadata_bytes: descriptionBytes + toolsBytes,
         estimated_tokens: Math.floor((descriptionBytes + toolsBytes) / 4)
       });
     } catch {
-      diagnostics.push({ path: path15.resolve(candidate), reason: "unreadable file" });
+      diagnostics.push({ path: path19.resolve(candidate), reason: "unreadable file" });
     }
   }
   try {
-    const children = await fs13.promises.readdir(logicalRoot, { withFileTypes: true });
+    const children = await fs19.promises.readdir(logicalRoot, { withFileTypes: true });
     children.sort((a, b) => a.name.localeCompare(b.name));
-    for (const child of children) await visit(path15.join(logicalRoot, child.name), void 0, true);
+    for (const child of children) await visit(path19.join(logicalRoot, child.name), void 0, true);
   } catch {
-    diagnostics.push({ path: path15.resolve(root), reason: "unreadable root" });
+    diagnostics.push({ path: path19.resolve(root), reason: "unreadable root" });
   }
   return entries;
 }
 async function buildBootstrapAudit(opts = {}) {
   const project = resolveProjectRoot(opts.project === void 0 ? {} : { project: opts.project });
-  const home = path15.resolve(opts.home ?? os10.homedir());
+  const home = path19.resolve(opts.home ?? os10.homedir());
   const context = buildStats(project, home, opts.project === void 0 ? [] : [opts.project]);
   const diagnostics = [];
   const top = opts.top === void 0 ? 10 : parseBudget("--top", opts.top) ?? 10;
   const visitedDirs = /* @__PURE__ */ new Set();
   const seenFiles = /* @__PURE__ */ new Set();
-  const agents = await scanMetadataRoot(path15.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
-  const skills = await scanMetadataRoot(path15.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
+  const agents = await scanMetadataRoot(path19.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
+  const skills = await scanMetadataRoot(path19.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
   const largest = [...agents, ...skills].sort((a, b) => b.metadata_bytes - a.metadata_bytes || a.path.localeCompare(b.path)).slice(0, top);
   const metadataBytes = [...agents, ...skills].reduce((sum, entry) => sum + entry.metadata_bytes, 0);
   const totalTokens = context.total_tokens + Math.floor(metadataBytes / 4);
@@ -10146,8 +11905,8 @@ async function runBootstrapAudit(opts = {}) {
 
 // src/cli_memory.ts
 init_define_import_meta_env();
-import * as fs14 from "node:fs";
-import * as path16 from "node:path";
+import * as fs20 from "node:fs";
+import * as path20 from "node:path";
 function removeExactDupLines(text, report) {
   if (report.exactDupLines.length === 0) return text;
   const toRemove = new Set(report.exactDupLines.map(([, dupIdx]) => dupIdx));
@@ -10205,7 +11964,7 @@ function printReport(reports, clusters) {
   } else {
     for (const cluster of clusters) {
       w(
-        `  [${cluster.method}, similarity ${cluster.similarity}, ~${cluster.tokens} tok] ${cluster.members.map((m) => path16.basename(m)).join(", ")}
+        `  [${cluster.method}, similarity ${cluster.similarity}, ~${cluster.tokens} tok] ${cluster.members.map((m) => path20.basename(m)).join(", ")}
 `
       );
     }
@@ -10220,7 +11979,7 @@ async function runMemoryCommand(opts = {}) {
   const claudeMds = findClaudeMdFiles(projectRoot);
   const reports = auditClaudeMd(claudeMds);
   const memoryMdPath = findMemoryMd(projectRoot);
-  const clusters = memoryMdPath !== null ? await findContentDuplicates(path16.dirname(memoryMdPath)) : [];
+  const clusters = memoryMdPath !== null ? await findContentDuplicates(path20.dirname(memoryMdPath)) : [];
   printReport(reports, clusters);
   if (opts.fix !== true) return;
   const changes = [];
@@ -10228,7 +11987,7 @@ async function runMemoryCommand(opts = {}) {
     if (report.exactDupLines.length === 0) continue;
     let before;
     try {
-      before = fs14.readFileSync(report.path, "utf-8");
+      before = fs20.readFileSync(report.path, "utf-8");
     } catch {
       continue;
     }
@@ -10266,33 +12025,33 @@ async function runMemoryCommand(opts = {}) {
 
 // src/cli_waste.ts
 init_define_import_meta_env();
-import * as fs16 from "node:fs";
-import * as path18 from "node:path";
+import * as fs22 from "node:fs";
+import * as path22 from "node:path";
 
 // src/waste.ts
 init_define_import_meta_env();
-import * as fs15 from "node:fs";
+import * as fs21 from "node:fs";
 import * as os11 from "node:os";
-import * as path17 from "node:path";
+import * as path21 from "node:path";
 function projectTranscriptsDir(projectRoot) {
-  const rootStr = path17.resolve(projectRoot);
+  const rootStr = path21.resolve(projectRoot);
   const slug = rootStr.replace(/[^A-Za-z0-9]/g, "-");
-  return path17.join(os11.homedir(), ".claude", "projects", slug);
+  return path21.join(os11.homedir(), ".claude", "projects", slug);
 }
 function findLatestTranscript(projectRoot) {
   const dir = projectTranscriptsDir(projectRoot);
   let entries;
   try {
-    entries = fs15.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
+    entries = fs21.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
   } catch {
     return null;
   }
   let best = null;
   for (const name of entries) {
-    const full = path17.join(dir, name);
+    const full = path21.join(dir, name);
     let stat;
     try {
-      stat = fs15.statSync(full);
+      stat = fs21.statSync(full);
     } catch {
       continue;
     }
@@ -10349,7 +12108,7 @@ function extractResultText(content) {
   return "";
 }
 function parseTranscript2(transcriptPath) {
-  const raw = fs15.readFileSync(transcriptPath, "utf-8");
+  const raw = fs21.readFileSync(transcriptPath, "utf-8");
   const calls = [];
   const resultTextById = /* @__PURE__ */ new Map();
   const assistantTurns = [];
@@ -10570,7 +12329,7 @@ function printReport2(report) {
 }
 async function runWasteCommand(opts = {}) {
   const projectRoot = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
-  const transcriptPath = opts.transcript !== void 0 ? path18.resolve(opts.transcript) : findLatestTranscript(projectRoot);
+  const transcriptPath = opts.transcript !== void 0 ? path22.resolve(opts.transcript) : findLatestTranscript(projectRoot);
   if (transcriptPath === null) {
     if (opts.json === true) {
       process.stdout.write(`${JSON.stringify({ error: "no session transcript found", project: projectRoot })}
@@ -10584,7 +12343,7 @@ async function runWasteCommand(opts = {}) {
     process.exitCode = 1;
     return;
   }
-  if (!fs16.existsSync(transcriptPath)) {
+  if (!fs22.existsSync(transcriptPath)) {
     process.stderr.write(`token-goat: transcript not found: ${transcriptPath}
 `);
     process.exitCode = 1;
@@ -10601,17 +12360,17 @@ async function runWasteCommand(opts = {}) {
 
 // src/session_read.ts
 init_define_import_meta_env();
-import * as fs17 from "node:fs";
-import * as path19 from "node:path";
+import * as fs23 from "node:fs";
+import * as path23 from "node:path";
 import * as readline2 from "node:readline";
 function resolveSessionTranscript(arg, opts = {}) {
   if (arg !== void 0 && arg !== "") {
-    if (fs17.existsSync(arg) && fs17.statSync(arg).isFile()) return arg;
+    if (fs23.existsSync(arg) && fs23.statSync(arg).isFile()) return arg;
     const projectRoot2 = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
     const dir = projectTranscriptsDir(projectRoot2);
     const byId = arg.endsWith(".jsonl") ? arg : `${arg}.jsonl`;
-    const candidate = path19.join(dir, byId);
-    if (fs17.existsSync(candidate) && fs17.statSync(candidate).isFile()) return candidate;
+    const candidate = path23.join(dir, byId);
+    if (fs23.existsSync(candidate) && fs23.statSync(candidate).isFile()) return candidate;
     return null;
   }
   const projectRoot = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
@@ -10669,7 +12428,7 @@ function toolCallsForBlocks(blocks) {
   return blocks.filter((b) => b.type === "tool_use" && b.name !== void 0).map((b) => b.name);
 }
 async function* streamTurns(transcriptPath) {
-  const input = fs17.createReadStream(transcriptPath, { encoding: "utf8" });
+  const input = fs23.createReadStream(transcriptPath, { encoding: "utf8" });
   const rl = readline2.createInterface({ input, crlfDelay: Infinity });
   try {
     let lineNumber = 0;
@@ -10768,15 +12527,15 @@ function formatSessionSlice(turns) {
 
 // src/cli_mcp_audit.ts
 init_define_import_meta_env();
-import * as fs18 from "node:fs";
-import * as path20 from "node:path";
+import * as fs24 from "node:fs";
+import * as path24 from "node:path";
 function readMcpConfig(projectRoot) {
-  const configPath2 = path20.join(projectRoot, ".mcp.json");
+  const configPath2 = path24.join(projectRoot, ".mcp.json");
   try {
-    if (!fs18.existsSync(configPath2)) {
+    if (!fs24.existsSync(configPath2)) {
       return null;
     }
-    const content = fs18.readFileSync(configPath2, "utf-8");
+    const content = fs24.readFileSync(configPath2, "utf-8");
     const parsed = JSON.parse(content);
     return parsed.mcpServers || parsed;
   } catch {
@@ -10791,8 +12550,9 @@ function analyzeMcpCache() {
     const entry = value;
     const command = typeof entry["command"] === "string" ? entry["command"] : "";
     const sizeBytes = typeof entry["sizeBytes"] === "number" ? entry["sizeBytes"] : 0;
-    const toolMatch = command.match(/^mcp:mcp__([a-z0-9_-]+)__/i);
-    const toolName = toolMatch?.[1] ?? "unknown";
+    const toolMatch = command.match(/^mcp:mcp__(.+?)__/i);
+    if (!toolMatch) continue;
+    const toolName = toolMatch[1];
     if (!serverMetrics.has(toolName)) {
       serverMetrics.set(toolName, { callCount: 0, perCallEstimate: 0, totalBytes: 0 });
     }
@@ -11073,10 +12833,10 @@ function readBoundedText(text, file) {
   if (text === void 0 && file === void 0) throw new CliError("provide text or --file");
   let value;
   if (file !== void 0) {
-    if (fs19.statSync(file).size > CONTENT_MAX_INPUT_CHARS) {
+    if (fs25.statSync(file).size > CONTENT_MAX_INPUT_CHARS) {
       throw new CliError(`file exceeds the ${CONTENT_MAX_INPUT_CHARS}-byte safety limit`);
     }
-    value = fs19.readFileSync(file, "utf8");
+    value = fs25.readFileSync(file, "utf8");
   } else {
     if (text === void 0) throw new CliError("provide text or --file");
     value = text;
@@ -11293,7 +13053,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-hook-chunk-FMQ37OQD.mjs"));
+    ({ createMcpServer } = await import("./token-goat-hook-chunk-K6HLYRRI.mjs"));
     ({ StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js"));
   } catch (err2) {
     process.stderr.write(
@@ -11306,14 +13066,15 @@ async function cmdMcpServe() {
   const server = await createMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  await new Promise((resolve10) => {
-    server.server.onclose = resolve10;
+  await new Promise((resolve12) => {
+    server.server.onclose = resolve12;
   });
 }
 async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
+  const { relay } = await import("./token-goat-hook-chunk-ULGSXGZK.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -11409,16 +13170,16 @@ async function cmdInstall(opts) {
     );
   }
   try {
-    const skillDir = path21.join(homedir10(), ".claude", "skills");
-    if (fs19.existsSync(skillDir)) {
-      const entries = fs19.readdirSync(skillDir, { withFileTypes: true });
+    const skillDir = path25.join(homedir11(), ".claude", "skills");
+    if (fs25.existsSync(skillDir)) {
+      const entries = fs25.readdirSync(skillDir, { withFileTypes: true });
       const skillNames = [];
       const sessionId = getSessionId();
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const skillFile = path21.join(skillDir, entry.name, "SKILL.md");
-        if (fs19.existsSync(skillFile)) {
-          const body = fs19.readFileSync(skillFile, "utf-8");
+        const skillFile = path25.join(skillDir, entry.name, "SKILL.md");
+        if (fs25.existsSync(skillFile)) {
+          const body = fs25.readFileSync(skillFile, "utf-8");
           const compact = extractCompactFromMarker(body);
           if (compact === null) continue;
           const sourceSha = contentHash(body);
@@ -11428,10 +13189,10 @@ async function cmdInstall(opts) {
       }
       if (skillNames.length > 0) {
         const dir = skillOutputsDir();
-        await fs19.promises.mkdir(dir, { recursive: true });
-        const pregenPath = path21.join(dir, "pregen.json");
+        await fs25.promises.mkdir(dir, { recursive: true });
+        const pregenPath = path25.join(dir, "pregen.json");
         const pregenData = { ts: Date.now(), names: skillNames };
-        await fs19.promises.writeFile(pregenPath, JSON.stringify(pregenData, null, 2));
+        await fs25.promises.writeFile(pregenPath, JSON.stringify(pregenData, null, 2));
         out(`Pre-generated ${skillNames.length} skill compacts.`);
       }
     }
@@ -11472,6 +13233,9 @@ function cmdUninstall(opts) {
     const removed2 = removal.run();
     out(removed2 ? `Removed token-goat ${removal.label}.` : `No token-goat ${removal.label} to remove.`);
   }
+  for (const leftover of leftoverIntegrations(opts)) {
+    out(`NOTE: the token-goat ${leftover.label} is still installed. Run "token-goat uninstall ${leftover.flag}" to remove it.`);
+  }
   if (opts.vscode === true && otherScopeHasManagedServer({ project: opts.project === true })) {
     const otherScope = opts.project === true ? "user" : "project";
     out(`NOTE: token-goat is still registered in VS Code ${otherScope} scope. Run "token-goat uninstall --vscode${otherScope === "project" ? " --project" : ""}" to remove it too.`);
@@ -11479,6 +13243,43 @@ function cmdUninstall(opts) {
   if (opts.hermes === true) {
     out("No separate Hermes integration to remove (it shares the Claude Code hook entries).");
   }
+  if (opts.purge === true) runPurge();
+}
+function leftoverIntegrations(opts) {
+  const candidates = [
+    { skipped: opts.codex !== true, present: isCodexInstalled, flag: "--codex", label: "Codex CLI integration" },
+    { skipped: opts.gemini !== true, present: isGeminiInstalled, flag: "--gemini", label: "Gemini CLI integration" },
+    { skipped: opts.qwen !== true, present: isQwenInstalled, flag: "--qwen", label: "Qwen Code integration" },
+    { skipped: opts.pi !== true, present: () => isPiInstalled() || isPiInstalled({ local: true }), flag: "--pi", label: "pi extension" },
+    { skipped: opts.openclaw !== true, present: isOpenclawInstalled, flag: "--openclaw", label: "OpenClaw integration" },
+    {
+      skipped: opts.copilot !== true,
+      present: () => isCopilotCliInstalled() || isCopilotCliInstalled({ local: true }),
+      flag: "--copilot",
+      label: "Copilot CLI integration"
+    },
+    { skipped: opts.opencode !== true, present: isOpencodeInstalled, flag: "--opencode", label: "opencode plugin" },
+    { skipped: opts.grok !== true, present: isGrokInstalled, flag: "--grok", label: "Grok CLI integration" }
+  ];
+  const found = [];
+  for (const candidate of candidates) {
+    if (!candidate.skipped) continue;
+    try {
+      if (candidate.present()) found.push({ flag: candidate.flag, label: candidate.label });
+    } catch {
+    }
+  }
+  return found;
+}
+function runPurge() {
+  if (isWorkerRunning()) {
+    err('token-goat: the background worker is running, so --purge would delete files it is about to rewrite. Run "token-goat worker stop" first.');
+    return;
+  }
+  const result = purgeDataDirectories();
+  for (const root of result.absent) out(`Nothing to purge at ${root}.`);
+  for (const removed of result.removed) out(`Purged ${removed.path} (${formatBytes(removed.bytes)} reclaimed).`);
+  for (const failure of result.failed) err(`token-goat: could not purge ${failure.path}: ${failure.reason}`);
 }
 function cmdWorkerStart() {
   if (isWorkerRunning()) {
@@ -11583,7 +13384,7 @@ ${formatSessionOutline(turns)}`;
 }
 function sessionTranscriptSize(transcriptPath) {
   try {
-    return fs19.statSync(transcriptPath).size;
+    return fs25.statSync(transcriptPath).size;
   } catch {
     return 0;
   }
@@ -11640,7 +13441,27 @@ function cmdHintStats(opts = {}) {
     ...opts.markIneffective !== void 0 && isHintCategory(opts.markIneffective) ? { markIneffective: opts.markIneffective } : {}
   });
 }
-function _applyFiltersAndPrint(content, opts) {
+function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag = UNTRUSTED_WEB_TAG) {
+  const emit2 = (text) => {
+    if (!fenceUntrusted || text === "") {
+      out(text);
+      return text;
+    }
+    let matches2 = [];
+    try {
+      if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(text);
+    } catch {
+      matches2 = [];
+    }
+    if (matches2.length === 0) {
+      out(text);
+      return text;
+    }
+    recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
+    const fenced = fenceUntrustedContent(text, matches2, fenceTag);
+    out(fenced);
+    return fenced;
+  };
   if (opts.section !== void 0) {
     const sectionResult = extractSection(content, opts.section);
     if (sectionResult === null) {
@@ -11669,9 +13490,7 @@ function _applyFiltersAndPrint(content, opts) {
   }
   const lines = content.split(/\r?\n/);
   if (opts.full === true) {
-    const printedFull = lines.join("\n");
-    out(printedFull);
-    return printedFull;
+    return emit2(lines.join("\n"));
   }
   const headN = opts.head !== void 0 ? requireNonNegativeInt("--head", opts.head) : 30;
   const tailN = opts.tail !== void 0 ? requireNonNegativeInt("--tail", opts.tail) : 80;
@@ -11686,13 +13505,11 @@ function _applyFiltersAndPrint(content, opts) {
   } else if (opts.tail !== void 0) {
     result = lines.slice(Math.max(0, lines.length - tailN));
   }
-  const printed = result.join("\n");
-  out(printed);
-  return printed;
+  return emit2(result.join("\n"));
 }
 function fileSizeOrZero(filePath) {
   try {
-    return fs19.statSync(filePath).size;
+    return fs25.statSync(filePath).size;
   } catch {
     return 0;
   }
@@ -11707,16 +13524,16 @@ function cmdBashOutput(id, opts) {
     }
     let content;
     try {
-      const st = fs19.statSync(opts.file);
+      const st = fs25.statSync(opts.file);
       if (st.isFIFO() || st.isSocket()) {
         throw new CliError(`--file '${opts.file}' is a special file (FIFO or socket) \u2014 only regular files are supported`);
       }
-      content = fs19.readFileSync(opts.file, "utf-8");
+      content = fs25.readFileSync(opts.file, "utf-8");
     } catch (e) {
       if (e instanceof CliError) throw e;
       throw new CliError(`cannot read file: ${opts.file}`);
     }
-    _applyFiltersAndPrint(opts.transcript === true ? extractTranscriptText(content) : content, opts);
+    _applyFiltersAndPrint(opts.transcript === true ? extractTranscriptText(content) : content, opts, true, UNTRUSTED_TOOL_TAG);
     return;
   }
   if (id === void 0) {
@@ -11726,7 +13543,7 @@ function cmdBashOutput(id, opts) {
   if (entry === null) {
     throw new CliError(`no cached bash output for id: ${id}. If this id is from a background task, recall its output file directly with: token-goat bash-output --file <path-to-output-file>`);
   }
-  _applyFiltersAndPrint(entry.output, opts);
+  _applyFiltersAndPrint(entry.output, opts, true, UNTRUSTED_TOOL_TAG);
 }
 function cmdWebOutput(id, opts) {
   if (id === void 0) {
@@ -11736,7 +13553,7 @@ function cmdWebOutput(id, opts) {
   if (content === null) {
     throw new CliError(`no cached web output for id: ${id}. The cache may have expired; re-run the WebFetch to repopulate it.`);
   }
-  _applyFiltersAndPrint(content, opts);
+  _applyFiltersAndPrint(content, opts, true);
 }
 function cmdMcpOutput(id, opts) {
   if (id === void 0) {
@@ -11749,7 +13566,7 @@ function cmdMcpOutput(id, opts) {
   if (entry === null) {
     throw new CliError(`no cached mcp output for id: ${id}. The cache may have expired; re-run the MCP tool call to repopulate it.`);
   }
-  _applyFiltersAndPrint(entry.output, opts);
+  _applyFiltersAndPrint(entry.output, opts, true, UNTRUSTED_TOOL_TAG);
 }
 async function cmdPdfExtract(file, opts) {
   const text = await runPdfExtractText(file, opts.pages, opts.layout === true);
@@ -12092,16 +13909,17 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
   if (extras === void 0 || extras.length === 0) return;
   out(extraFileArgsNote(command, first, extras, opts));
 }
-function cmdCompress(opts) {
+async function cmdCompress(opts) {
   try {
+    const bashRunner = await import("./token-goat-hook-chunk-3OJELLK5.mjs");
     if (opts.compress === false) {
-      process.exitCode = runRaw(opts.cmd, parseTimeout(opts.timeout));
+      process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
     }
     const maxTokens = opts.maxTokens !== void 0 ? requireNonNegativeInt("--max-tokens", opts.maxTokens) : 0;
-    process.exitCode = run(opts.cmd, {
+    process.exitCode = bashRunner.run(opts.cmd, {
       filterName: opts.filter,
-      timeout: parseTimeout(opts.timeout),
+      timeout: parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS),
       maxTokens,
       ...opts.profile !== void 0 ? { compressionProfile: opts.profile } : {}
     });
@@ -12110,16 +13928,16 @@ function cmdCompress(opts) {
     process.exitCode = 1;
   }
 }
-function parseTimeout(raw) {
+function parseTimeout(raw, fallbackSeconds) {
   const sec = raw ? parseInt(raw, 10) : 0;
-  return Number.isFinite(sec) && sec > 0 ? sec : DEFAULT_TIMEOUT_SECONDS;
+  return Number.isFinite(sec) && sec > 0 ? sec : fallbackSeconds;
 }
 async function cmdSkillBody(name, opts) {
   const filePath = await getSkillFilePath(name);
   if (filePath === null) {
     throw new CliError(`skill '${name}' not found`);
   }
-  const body = fs19.readFileSync(filePath, "utf-8");
+  const body = fs25.readFileSync(filePath, "utf-8");
   if (opts.compact === true) {
     out(extractCompactFromMarker(body) ?? body);
   } else {
@@ -12136,7 +13954,7 @@ async function cmdSkillCompact(name, opts) {
     for (const skill of skills) {
       const filePath = await getSkillFilePath(skill.name);
       if (!filePath) continue;
-      const body2 = fs19.readFileSync(filePath, "utf-8");
+      const body2 = fs25.readFileSync(filePath, "utf-8");
       const compact2 = extractCompactFromMarker(body2);
       if (compact2 === null) continue;
       const sourceSha2 = contentHash(body2);
@@ -12157,19 +13975,19 @@ async function cmdSkillCompact(name, opts) {
     if (!opts.path.trim()) {
       throw new CliError("--path cannot be empty");
     }
-    if (!fs19.existsSync(opts.path)) {
+    if (!fs25.existsSync(opts.path)) {
       throw new CliError(`skill file not found: ${opts.path}`);
     }
     try {
-      body = fs19.readFileSync(opts.path, "utf-8");
+      body = fs25.readFileSync(opts.path, "utf-8");
     } catch (e) {
       if (e.code === "ENOENT") {
         throw new CliError(`skill file not found: ${opts.path}`);
       }
       throw new CliError(`failed to read skill file '${opts.path}': ${extractErrorMessage(e)}`);
     }
-    cacheName = name ?? path21.basename(path21.dirname(path21.resolve(opts.path)));
-    sourcePath = path21.resolve(opts.path);
+    cacheName = name ?? path25.basename(path25.dirname(path25.resolve(opts.path)));
+    sourcePath = path25.resolve(opts.path);
   } else {
     if (name === void 0 || !name.trim()) {
       throw new CliError("skill-compact requires a <name> or --path <file>");
@@ -12178,7 +13996,7 @@ async function cmdSkillCompact(name, opts) {
     if (filePath === null) {
       throw new CliError(`skill '${name}' not found`);
     }
-    body = fs19.readFileSync(filePath, "utf-8");
+    body = fs25.readFileSync(filePath, "utf-8");
     cacheName = name;
     sourcePath = filePath;
   }
@@ -12310,8 +14128,8 @@ async function cmdSkillDiff(name) {
   }
   const newer = versions[0];
   const older = versions[1];
-  const newerBody = await fs19.promises.readFile(path21.resolve(dir, `${newer.outputId}.txt`), "utf-8").catch(() => null);
-  const olderBody = await fs19.promises.readFile(path21.resolve(dir, `${older.outputId}.txt`), "utf-8").catch(() => null);
+  const newerBody = await fs25.promises.readFile(path25.resolve(dir, `${newer.outputId}.txt`), "utf-8").catch(() => null);
+  const olderBody = await fs25.promises.readFile(path25.resolve(dir, `${older.outputId}.txt`), "utf-8").catch(() => null);
   if (newerBody === null || olderBody === null) {
     out(`a cached version of '${name}' was evicted while diffing -- try again`);
     return;
@@ -12340,7 +14158,7 @@ async function cmdSkillSection(nameHeading, headingArg) {
   if (!filePath) {
     throw new CliError(`skill '${skillName}' not found`);
   }
-  const body = fs19.readFileSync(filePath, "utf-8");
+  const body = fs25.readFileSync(filePath, "utf-8");
   const extracted = extractNamedSection(body, heading);
   if (!extracted) {
     process.exitCode = 1;
@@ -12350,7 +14168,7 @@ async function cmdSkillSection(nameHeading, headingArg) {
 }
 function atomicWriteBuffer(dest, data) {
   try {
-    if (fs19.statSync(dest).isDirectory()) {
+    if (fs25.statSync(dest).isDirectory()) {
       const e = Object.assign(new Error(`EISDIR: illegal operation on a directory, open '${dest}'`), { code: "EISDIR", path: dest });
       throw e;
     }
@@ -12358,23 +14176,23 @@ function atomicWriteBuffer(dest, data) {
     if (e.code !== "ENOENT") throw e;
   }
   const rnd = Math.random().toString(36).slice(2, 8);
-  const tmp = path21.join(path21.dirname(path21.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
+  const tmp = path25.join(path25.dirname(path25.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
   try {
-    fs19.writeFileSync(tmp, data, { mode: 384 });
+    fs25.writeFileSync(tmp, data, { mode: 384 });
     try {
-      const destMode = fs19.statSync(dest).mode;
-      fs19.chmodSync(tmp, destMode);
+      const destMode = fs25.statSync(dest).mode;
+      fs25.chmodSync(tmp, destMode);
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
     }
     withRetryOnLock(() => {
       try {
-        fs19.renameSync(tmp, dest);
+        fs25.renameSync(tmp, dest);
       } catch (e) {
         if (e.code === "EXDEV") {
-          fs19.copyFileSync(tmp, dest);
+          fs25.copyFileSync(tmp, dest);
           try {
-            fs19.unlinkSync(tmp);
+            fs25.unlinkSync(tmp);
           } catch (ue) {
             process.stderr.write(`token-goat write-file: warning: could not remove temp file ${tmp}: ${ue.message}
 `);
@@ -12386,7 +14204,7 @@ function atomicWriteBuffer(dest, data) {
     });
   } catch (e) {
     try {
-      fs19.unlinkSync(tmp);
+      fs25.unlinkSync(tmp);
     } catch {
     }
     throw e;
@@ -12396,9 +14214,9 @@ function mapFsError(e, src, dest, srcLabel = "source") {
   const fe = e;
   if (fe.code === "ENOENT") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && path21.resolve(errPath) === path21.resolve(src);
+    const isSource = src !== void 0 && path25.resolve(errPath) === path25.resolve(src);
     if (isSource) throw new CliError(`${srcLabel} file not found: ${src}`);
-    const destDir = dest ? path21.dirname(path21.resolve(dest)) : path21.dirname(path21.resolve(errPath || "."));
+    const destDir = dest ? path25.dirname(path25.resolve(dest)) : path25.dirname(path25.resolve(errPath || "."));
     throw new CliError(`destination directory does not exist: ${destDir}`);
   }
   if (fe.code === "ENOTDIR") {
@@ -12409,7 +14227,7 @@ function mapFsError(e, src, dest, srcLabel = "source") {
   }
   if (fe.code === "EISDIR") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && (errPath === "" || path21.resolve(errPath) === path21.resolve(src));
+    const isSource = src !== void 0 && (errPath === "" || path25.resolve(errPath) === path25.resolve(src));
     if (isSource) throw new CliError(`source is a directory, not a file: ${src}`);
     throw new CliError(`destination is a directory, not a file: ${dest ?? (errPath || "(unknown)")}`);
   }
@@ -12478,7 +14296,7 @@ function validateWritablePath(dest, label) {
     throw new CliError(`${label} path contains a null byte`);
   }
   if (isWindows()) {
-    const base = path21.basename(dest);
+    const base = path25.basename(dest);
     const stem = base.replace(/\.[^.]*$/, "").toUpperCase();
     if (WIN_RESERVED.has(stem)) {
       throw new CliError(`${label} '${base}' is a reserved Windows device name`);
@@ -12508,7 +14326,7 @@ function readFileBoundedRaw(filePath, label, allowStdIn = false) {
     throw new CliError(`${label} ${filePath} requires piped input; use ${altLabel} for interactive use`);
   }
   try {
-    const st = fs19.statSync(filePath);
+    const st = fs25.statSync(filePath);
     if (st.isFIFO() || st.isSocket()) {
       throw new CliError(`${label} '${filePath}' is a special file (FIFO or socket) \u2014 only regular files are supported`);
     }
@@ -12516,7 +14334,7 @@ function readFileBoundedRaw(filePath, label, allowStdIn = false) {
     if (st.size > maxBytes) {
       throw new CliError(`${label} '${filePath}' exceeds size limit (${Math.round(st.size / 1024 / 1024)} MB); set TOKEN_GOAT_MAX_STDIN_MB to override`);
     }
-    return fs19.readFileSync(filePath);
+    return fs25.readFileSync(filePath);
   } catch (e) {
     if (e instanceof CliError) throw e;
     mapFsError(e, filePath, void 0, label);
@@ -12560,7 +14378,7 @@ function cmdNoteAdd(file, opts) {
     throw new CliError("note content must be valid UTF-8 text");
   }
   const resolvedPath = resolveIndexPath(file);
-  if (!fs19.existsSync(resolvedPath)) {
+  if (!fs25.existsSync(resolvedPath)) {
     throw new CliError(`File not found: '${resolvedPath}'`);
   }
   healStaleIndex(resolvedPath);
@@ -12619,7 +14437,7 @@ function cmdWriteFile(dest, opts) {
     throw new CliError(`TOKEN_GOAT_MAX_STDIN_MB must be a positive integer; got '${process.env["TOKEN_GOAT_MAX_STDIN_MB"] ?? ""}'`);
   }
   const maxBytes = maxMB * 1024 * 1024;
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve12, reject) => {
     const chunks = [];
     let totalBytes = 0;
     let settled = false;
@@ -12643,7 +14461,7 @@ function cmdWriteFile(dest, opts) {
       try {
         atomicWriteBuffer(dest, Buffer.concat(chunks));
         enqueueDirtyPathSafe(dest);
-        resolve10();
+        resolve12();
       } catch (e) {
         try {
           mapFsError(e, void 0, dest);
@@ -12775,7 +14593,7 @@ function writeReplacedBuffer(file, replacedBuf, preWriteStat) {
     }
     let preRenameStat;
     try {
-      preRenameStat = fs19.statSync(file);
+      preRenameStat = fs25.statSync(file);
     } catch {
     }
     if (preRenameStat !== void 0 && (preRenameStat.mtimeMs !== preWriteStat.mtimeMs || preRenameStat.size !== preWriteStat.size)) {
@@ -12816,7 +14634,7 @@ function cmdReplace(file, opts) {
   const targetBuf = readFileBoundedRaw(file, "target file", true);
   let preWriteStat;
   try {
-    preWriteStat = fs19.statSync(file);
+    preWriteStat = fs25.statSync(file);
   } catch {
   }
   const usingFrom = opts.oldFrom !== void 0 || opts.newFrom !== void 0;
@@ -12910,7 +14728,7 @@ function cmdInsertSection(file, opts) {
   }
   let preWriteStat;
   try {
-    preWriteStat = fs19.statSync(file);
+    preWriteStat = fs25.statSync(file);
   } catch {
   }
   const result = readSection(file, opts.after);
@@ -12924,7 +14742,7 @@ function cmdInsertSection(file, opts) {
   }
   let rawText;
   try {
-    rawText = fs19.readFileSync(file, "utf-8");
+    rawText = fs25.readFileSync(file, "utf-8");
   } catch (e) {
     mapFsError(e, void 0, file);
   }
@@ -12939,7 +14757,7 @@ function cmdInsertSection(file, opts) {
   if (preWriteStat !== void 0) {
     let preRenameStat;
     try {
-      preRenameStat = fs19.statSync(file);
+      preRenameStat = fs25.statSync(file);
     } catch {
     }
     if (preRenameStat !== void 0 && (preRenameStat.mtimeMs !== preWriteStat.mtimeMs || preRenameStat.size !== preWriteStat.size)) {
@@ -12956,6 +14774,9 @@ function cmdInsertSection(file, opts) {
   out(`inserted after '${result.heading}'${redirectNote} in ${file}`);
 }
 async function cmdGdriveSections(fileId, opts) {
+  if (!loadConfig().gdrive.enabled) {
+    throw new CliError("gdrive-sections is disabled by gdrive.enabled = false in this install");
+  }
   const fetchOpts = { fresh: opts.fresh === true };
   const text = await fetchDoc(fileId, fetchOpts);
   const fullSourceBytes = Buffer.byteLength(text, "utf8");
@@ -12977,25 +14798,25 @@ ${content}`;
 }
 function expandGlobs(root, patterns, globFnOverride) {
   const out2 = [];
-  const globFn = globFnOverride ?? fs19["globSync"];
+  const globFn = globFnOverride ?? fs25["globSync"];
   for (const p of patterns) {
     if (globFn !== void 0 && (p.includes("*") || p.includes("?") || p.includes("{"))) {
       try {
         const hits = globFn(p, { cwd: root });
-        for (const h of hits) out2.push(path21.isAbsolute(h) ? h : path21.join(root, h));
+        for (const h of hits) out2.push(path25.isAbsolute(h) ? h : path25.join(root, h));
         continue;
       } catch {
       }
     }
-    out2.push(path21.isAbsolute(p) ? p : path21.join(root, p));
+    out2.push(path25.isAbsolute(p) ? p : path25.join(root, p));
   }
   return out2;
 }
 function readIgnoreFile(root) {
-  const ignorePath = path21.join(root, ".tokengoatignore");
+  const ignorePath = path25.join(root, ".tokengoatignore");
   let raw;
   try {
-    raw = fs19.readFileSync(ignorePath, "utf8");
+    raw = fs25.readFileSync(ignorePath, "utf8");
   } catch {
     return void 0;
   }
@@ -13036,14 +14857,14 @@ function cmdPack(patterns, opts) {
   }
   let instruction;
   if (opts.instructionFile !== void 0) {
-    instruction = fs19.readFileSync(opts.instructionFile, "utf8");
+    instruction = fs25.readFileSync(opts.instructionFile, "utf8");
   }
   const formatted = formatPack(result, style, {
     ...opts.lineNumbers === true ? { line_numbers: true } : {},
     ...instruction !== void 0 ? { instruction } : {}
   });
   if (opts.output !== void 0) {
-    fs19.writeFileSync(opts.output, formatted, "utf8");
+    fs25.writeFileSync(opts.output, formatted, "utf8");
   } else {
     out(formatted);
   }
@@ -13061,7 +14882,7 @@ function cmdTokens(patterns, opts) {
   if (opts.tree === true) {
     const dirs = /* @__PURE__ */ new Map();
     for (const e of entries) {
-      const dir = path21.dirname(e.rel_path);
+      const dir = path25.dirname(e.rel_path);
       if (!dirs.has(dir)) dirs.set(dir, []);
       dirs.get(dir).push(e);
     }
@@ -13071,7 +14892,7 @@ function cmdTokens(patterns, opts) {
       const pct = result.total_tokens > 0 ? Math.round(dirTokens / result.total_tokens * 100) : 0;
       lines2.push(`${dir}/ (${dirTokens} tokens, ${pct}%)`);
       for (const e of dirEntries) {
-        lines2.push(`  ${path21.basename(e.rel_path).padEnd(30)}  ${String(e.tokens).padStart(8)} tokens`);
+        lines2.push(`  ${path25.basename(e.rel_path).padEnd(30)}  ${String(e.tokens).padStart(8)} tokens`);
       }
     }
     out(lines2.join("\n"));
@@ -13102,7 +14923,7 @@ function cmdBudget(patterns, opts) {
   }
 }
 function cmdFailures(src, opts) {
-  const text = src !== void 0 ? fs19.readFileSync(src, "utf8") : fs19.readFileSync(0, "utf8");
+  const text = src !== void 0 ? fs25.readFileSync(src, "utf8") : fs25.readFileSync(0, "utf8");
   const result = extractFailures(text, opts.runner !== void 0 ? { runner: opts.runner } : {});
   if (opts.delta !== true) {
     out(opts.json === true ? formatFailuresJson(result) : formatFailuresText(result));
@@ -13143,6 +14964,12 @@ function buildProgram() {
     if (projectParseErr !== null) {
       err(`token-goat: .token-goat.toml failed to parse (${projectParseErr}); ignoring project override`);
     }
+    const lockedKeys = lastProjectConfigLockedKeys();
+    if (lockedKeys.length > 0) {
+      err(
+        `token-goat: .token-goat.toml may not set ${lockedKeys.join(", ")}; these are security settings and come from the global config or the environment only`
+      );
+    }
     try {
       await fn(...args);
       if (process.exitCode === void 0) {
@@ -13289,7 +15116,7 @@ function buildProgram() {
   program2.command("handoff-resolve <name>").description("resolve a project-local handoff compactly, or return it in full").option("--full", "return the full handoff text").action(guard(cmdHandoffResolve));
   program2.command("hook <event>").description("hook relay entrypoint (reads JSON on stdin)").option("--harness <name>", "override harness detection for this invocation (sets TOKEN_GOAT_HARNESS_OVERRIDE)").action(guard(cmdHook));
   program2.command("install").description("install hooks into Claude Code settings").option("-p, --project", "install into project scope instead of user scope").option("--codex", "also patch Codex CLI (~/.codex/config.toml, ~/.codex/AGENTS.md)").option("--gemini", "also patch Gemini CLI (~/.gemini/settings.json)").option("--qwen", "also patch Qwen Code (~/.qwen/settings.json)").option("--pi", "also drop a pi (pi-coding-agent) extension (~/.pi/agent/extensions/token-goat.ts)").option("--opencode", "also drop an opencode plugin (~/.config/opencode/plugins/token-goat.ts, %APPDATA%\\opencode\\plugins\\token-goat.ts on Windows)").option("--hermes", "verify token-goat hooks are present for Hermes Agent (writes nothing new)").option("--openclaw", "also register an OpenClaw plugin (~/.openclaw/openclaw.json, ~/.openclaw/plugins/token-goat.ts)").option("--copilot", "also register a Copilot CLI hook config and routing block (~/.copilot/hooks/token-goat.json, ~/.copilot/hooks/token-goat-shim.js, ~/.copilot/copilot-instructions.md; with --local, <project>/.github/hooks/token-goat.json, <project>/.github/hooks/token-goat-shim.js, <project>/.github/copilot-instructions.md)").option("--grok", "also register a Grok CLI (xAI Grok Build) hook config (~/.grok/hooks/token-goat.json, ~/.grok/hooks/token-goat-shim.js)").option("--vscode", "also configure a VS Code MCP server (user-profile mcp.json by default; -p/--project for the workspace .vscode/mcp.json) and Copilot routing guidance").option("--local", "with --pi, install the project-local extension (<project>/.pi/extensions/token-goat.ts) instead of the global one").action(guard(cmdInstall));
-  program2.command("uninstall").description("remove token-goat hooks from Claude Code settings").option("-p, --project", "uninstall from project scope instead of user scope").option("--codex", "also strip the Codex CLI integration (~/.codex/config.toml, ~/.codex/AGENTS.md)").option("--gemini", "also strip the Gemini CLI integration (~/.gemini/settings.json)").option("--qwen", "also strip the Qwen Code integration (~/.qwen/settings.json)").option("--pi", "also remove the pi (pi-coding-agent) extension").option("--opencode", "also remove the opencode plugin").option("--hermes", "no-op verification flag for symmetry with install (removes no files)").option("--openclaw", "also remove the OpenClaw plugin and config entry").option("--copilot", "also remove the Copilot CLI hook config and shim script, and strip the token-goat block from ~/.copilot/copilot-instructions.md (or <project>/.github/copilot-instructions.md with --local)").option("--grok", "also remove the Grok CLI hook config and shim script").option("--vscode", "also remove the VS Code MCP server (user scope by default; -p/--project for the workspace one) and routing guidance").option("--local", "with --pi, remove the project-local extension instead of the global one").action(guard(cmdUninstall));
+  program2.command("uninstall").description("remove token-goat hooks from Claude Code settings").option("-p, --project", "uninstall from project scope instead of user scope").option("--codex", "also strip the Codex CLI integration (~/.codex/config.toml, ~/.codex/AGENTS.md)").option("--gemini", "also strip the Gemini CLI integration (~/.gemini/settings.json)").option("--qwen", "also strip the Qwen Code integration (~/.qwen/settings.json)").option("--pi", "also remove the pi (pi-coding-agent) extension").option("--opencode", "also remove the opencode plugin").option("--hermes", "no-op verification flag for symmetry with install (removes no files)").option("--openclaw", "also remove the OpenClaw plugin and config entry").option("--copilot", "also remove the Copilot CLI hook config and shim script, and strip the token-goat block from ~/.copilot/copilot-instructions.md (or <project>/.github/copilot-instructions.md with --local)").option("--grok", "also remove the Grok CLI hook config and shim script").option("--vscode", "also remove the VS Code MCP server (user scope by default; -p/--project for the workspace one) and routing guidance").option("--local", "with --pi, remove the project-local extension instead of the global one").option("--purge", "also delete the data directories (index, caches, session state, logs); refuses while the worker is running").action(guard(cmdUninstall));
   program2.command("mcp-status").description("check whether an MCP integration is already configured (used by the VS Code extension)").option("--vscode", "check VS Code mcp.json (user scope, plus workspace scope with --project)").option("-p, --project", "also check the workspace .vscode/mcp.json (relative to --cwd or the real cwd)").action(guard(cmdMcpStatus));
   const worker = program2.command("worker").description("background indexer lifecycle");
   worker.command("start").description("start the background indexer").action(guard(cmdWorkerStart));
@@ -13674,14 +15501,14 @@ function applyExitOverride(command) {
   command.exitOverride();
   for (const sub of command.commands) applyExitOverride(sub);
 }
-async function run2(argv = process.argv) {
+async function run(argv = process.argv) {
   if (argv[2] === "--worker-daemon") {
     runDetachedWorkerDaemon();
     return;
   }
   if (argv[2] === "--batch-serve" && typeof argv[3] === "string") {
-    const { serveBatch } = await import("./token-goat-hook-chunk-ZRJUZZQE.mjs");
-    serveBatch(argv[3], (a) => run2(a));
+    const { serveBatch } = await import("./token-goat-hook-chunk-5AQYD2SZ.mjs");
+    serveBatch(argv[3], (a) => run(a));
     return;
   }
   const program2 = buildProgram();
@@ -13713,5 +15540,6 @@ export {
   buildProgram,
   cmdIndex,
   expandGlobs,
-  run2 as run
+  leftoverIntegrations,
+  run
 };