token-goat 2.6.31 → 2.6.33

package/README.md

@@ -9,6 +9,8 @@ permalink: /
 
 ![Token-Goat](assets/logo.png)
 
+***Give the model what it needs, not everything you have.***
+
 **85%** smaller reads · **97.4%** image compression · **180+** filter & interception rules · **94–99%** skill overhead cut · compaction memory · **prompt injection** guard · **3.7 GB** never reached the model · **1.1 Gt** tokens saved
 
 **Reduces AI token use/costs by 40–90%, and improves its focus. Fully automated, always online.**
@@ -19,7 +21,7 @@ permalink: /
 
 Token-Goat sits silently between your AI and your tools. Re-read a file? It gets a one-line hint and a narrow-slice suggestion instead of the full file again. Grab a screenshot? A 100 KB copy reaches the model instead of 10 MB. Run `pytest`, `npm install`, `docker build`, or `cargo`? The thousands of progress bars and passing-test names are stripped to the failures before the output even reaches the context window. Open a PDF, a large Markdown doc, or a CSV? The hook intercepts it — heading tree, page count, or column preview — so the model never pays for the full file. Run `gh run watch` or `next dev` a second time? Prior output is recalled rather than re-run. Compact a long session? It gets a clean structured manifest of edited files and key symbols so nothing important is forgotten. Sessions drop 40–90%+ in cost. You change nothing about how you work.
 
-Works with **Claude Code**, **Gemini CLI**, **Qwen Code**, **Codex CLI**, **Aider**, **Cursor**, **Cline**, **Windsurf**, **Copilot CLI**, **Grok CLI** (xAI Grok Build), and OpenCode, plus **pi** ([pi-coding-agent](https://github.com/earendil-works/pi-mono)).
+Works with **Claude Code**, **Gemini CLI**, **Qwen Code**, **Codex CLI**, **Aider**, **Cursor**, **Cline**, **Windsurf**, **Copilot CLI**, **Kimi Code**, **Grok CLI** (xAI Grok Build), and OpenCode, plus **pi** ([pi-coding-agent](https://github.com/earendil-works/pi-mono)).
 
 **Ask your AI to install it fully (give it this GitHub link), or install in one command:**
 
@@ -393,6 +395,14 @@ token-goat install --qwen
 
 This writes hook entries into `~/.qwen/settings.json`. Unlike Gemini CLI (its own ancestor, with a custom `BeforeTool`/`AfterTool`/`PreCompress` event/matcher scheme), Qwen Code's hooks system diverged and now mirrors Claude Code's own natively — `PreToolUse`/`PostToolUse`/`PreCompact`/`UserPromptSubmit`/`SubagentStop` event names and snake_case stdin JSON — so token-goat wires all five events with no wire-format translation needed. Qwen Code's own tool-name taxonomy is only partially documented, so token-goat uses a catch-all matcher per event rather than an incomplete per-tool list. Image shrinking, session hints, post-edit indexing, compact assist, and bash output compression all work. This bridge was built from QwenLM/qwen-code's published docs, not dogfooded against a live Qwen Code install — if hooks aren't firing, `token-goat doctor` and the settings.json contents are the first things to check. To remove: `token-goat uninstall --qwen`.
 
+### Kimi Code users
+
+```
+token-goat install --kimi
+```
+
+This writes `[[hooks]]` entries into `~/.kimi-code/config.toml` (or `$KIMI_CODE_HOME/config.toml`), covering Kimi Code's `PreToolUse`, `PostToolUse`, `PreCompact`, `UserPromptSubmit`, `SubagentStop`, and `SessionStart` events. Kimi Code sends a Claude-Code-shaped snake_case payload on stdin, but it reads a different response: only a top-level `message` and `hookSpecificOutput.permissionDecision` / `permissionDecisionReason`. So the install also writes a small shim at `~/.kimi-code/hooks/token-goat-shim.js` that translates token-goat's answer into that contract, turns a hint into `message`, and writes nothing at all for a no-op. Image shrinking, session hints, post-edit indexing, compact assist, and bash output compression all work. `Notification` and `Stop` are not wired, because token-goat has no handler for them. Input and output rewriting are not wired either: Kimi Code offers no channel to replace a tool's input or its result. This bridge was built from MoonshotAI/kimi-code's own source and docs, not dogfooded against a live Kimi Code install, so if hooks are not firing, `token-goat doctor` and the `config.toml` contents are the first things to check. To remove: `token-goat uninstall --kimi`.
+
 ### opencode users
 
 ```
@@ -637,7 +647,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat hot [--limit N]` | Cross-session file frequency table: read and edit counts tallied from all stored sessions, ranked by total activity. Shows which files dominate your token spend across your entire history. `--project <dir>` filters to one project; `--json` for structured output. |
 | `token-goat note set/get/unset/list/clear` | Persistent per-project notes stored as key-value pairs. Token-goat injects them at session start and after compaction so they survive conversation rollover. Use to pin decisions, constraints, or reminders that would otherwise vanish after compaction. `note list --json` for machine-readable output; `note clear` removes everything at once. |
 | `token-goat project list` | Show all project roots indexed by token-goat with their file counts. Roots on the blocklist appear tagged `[excluded]`. `--json` for structured output. |
-| `token-goat project exclude <path>` | Add a project root to the blocklist so the worker never indexes it. Writes the resolved absolute path to `[worker] blocked_roots` in `config.toml`; idempotent. Remove the entry from the config to re-enable indexing. |
+| `token-goat project exclude <path>` | Add a project root to the blocklist so the worker never indexes it. Writes the resolved absolute path to `[worker] blocked_roots` in `config.toml`; idempotent. It also removes anything already indexed under that path and says how many files went, so excluding a directory means its contents stop being readable through `symbol` rather than merely stopping future indexing. Remove the entry from the config to re-enable indexing, then run `token-goat index` to bring the contents back. |
 | `token-goat project prune [--dry-run]` | Remove blocked/excluded roots that no longer exist on disk. `--dry-run` previews removals without touching the config file. Useful after deleting or moving projects. |
 | `token-goat install` | Wire up hooks (and, with the harness flags below, other AI tool integrations). No `--dry-run` or `--verify` flag — run `token-goat doctor` after install to audit the result. |
 | `token-goat doctor` | Confirm everything is wired correctly. Surfaces install state, cold-import timing, cache hit rates, compaction-budget telemetry, opt-in flag status, and canonical-root sanity. A **Security** section reports the posture in one place: whether offline mode is on, whether injection scanning is on, whether the Google Drive integration is enabled, whether fetching runs against an allow list or a deny list, whether MCP reads are confined to the project root, and whether the data directory is readable by other local users. It only warns when a protection that ships on has been switched off, so a default install stays quiet. It read-only audits `~/.copilot/mcp-config.json` for globally configured Chrome DevTools or Playwright `npx` launchers, recommending project scope or removal when inactive; it never prints server configuration or secrets. On Windows, it also reports duplicate Chrome DevTools/Playwright MCP launchers and orphaned Node processes without terminating anything. Pass `--context` to show the **Context footprint** section: a fill bar with severity (ok / warn / high / URGENT), per-component breakdown (skills catalog, loaded skill bodies, CLAUDE.md+MEMORY.md, conversation estimate), session-to-session growth trend with sessions-to-URGENT projection, and tiered compaction recommendations (Tier 0–4) naming the exact commands to run. Auto-shown when fill > 40 % or any loaded skill > 2 K tokens lacks a compact. `--json` emits the check results (one entry per check, with `ok`/`warn`/`fail` status) as JSON instead of text. |
@@ -937,6 +947,15 @@ Three things follow, and they are worth knowing before you decide. It never leav
 |------|------|
 | `~/.qwen/settings.json` | Hook entries under Qwen Code's `PreToolUse`, `PostToolUse`, `PreCompact`, `UserPromptSubmit`, and `SubagentStop` events (Claude-Code-native names and payload shape, not Gemini's), using a catch-all matcher per event. Existing hooks preserved; a timestamped `.bak` is written before any change. |
 
+**With `--kimi`** (Kimi Code integration)
+
+| Path | What |
+|------|------|
+| `~/.kimi-code/config.toml` | `[[hooks]]` entries for Kimi Code's `PreToolUse`, `PostToolUse`, `PreCompact`, `UserPromptSubmit`, `SubagentStop`, and `SessionStart` events. Each entry carries only `event` and `command`, the keys Kimi Code's strict schema accepts. Existing hooks and other config keys preserved; a timestamped `.bak` is written before any change. |
+| `~/.kimi-code/hooks/token-goat-shim.js` | The hook script those commands invoke. Rewrites a token-goat block into `hookSpecificOutput.permissionDecision` and a hint into a top-level `message`, and writes empty stdout for a no-op. Regenerated on every `install --kimi` run. |
+| `~/.kimi-code/AGENTS.md` | A delimited block (`<!-- token-goat-kimi-begin -->` ... `<!-- token-goat-kimi-end -->`) with the routing guidance, adapted for Kimi Code tool names. |
+| `~/.kimi-code/skills/token-goat/SKILL.md` | The same guidance as a Kimi Code skill. |
+
 **With `--opencode`** (opencode plugin)
 
 | Path | What |

package/SECURITY.md

@@ -41,18 +41,31 @@ The following are not treated as security issues unless paired with a working pr
 
 ## Dependency advisories
 
-`npm audit --omit=dev` on the published package is not empty, and pretending otherwise would waste your review time. Every runtime advisory that remains traces to one of three packages. All three are already at their latest published version, so there is no forward patch to take: the only version npm offers as a "fix" is an older major that drops features Token-Goat uses.
+`npm audit` gives three different answers for Token-Goat depending on what you scan, and the gap between them is the first thing to understand. All three numbers below are reproducible with the commands shown.
+
+| What you scan | Command | Result |
+| --- | --- | --- |
+| this repository | `npm audit` | clean, development dependencies included |
+| an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 46 packages |
+| a default install | `npm install token-goat` then `npm audit --omit=dev` | the optional packages in the table below |
+
+The repository is clean because [`package.json`](package.json) carries an `overrides` block that pins five transitive packages to patched versions. **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. We are saying so plainly rather than letting a clean repository scan stand in for a clean install: if your scanner reads this repository or its lockfile it will report nothing, and that is not the whole picture.
+
+Without the overrides a consumer resolves `protobufjs` at 6.x, which carries more advisories than the 7.x line the repository would otherwise use. Every one of those paths is optional.
 
 | Package | Advisories it carries | Where it loads | Why the advisory does not reach you through Token-Goat |
 | --- | --- | --- | --- |
 | `@xenova/transformers` | [`protobufjs`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) (critical), `onnx-proto`, `onnxruntime-web`, and its own pinned `sharp` | optional; loaded only when semantic search builds or queries embeddings | not mitigated, so it is the one to weigh. Skip it with `npm install --omit=optional`, or leave `indexing.embeddings_enabled` off, and the code never loads |
 | `exceljs` | [`uuid`](https://github.com/advisories/GHSA-w5hq-g745-h8pq) | optional; loaded only when an `xlsx-*` command opens a workbook | the advisory is a missing bounds check on a caller-supplied `buf` argument; ExcelJS never passes one |
-| `html-to-text` | [`deepmerge-ts`](https://github.com/advisories/GHSA-ggr8-5vv4-36mx) | required, and bundled into `dist/token-goat.mjs`; runs when a fetched page is converted to text | the advisory is stack exhaustion while merging a recursive object graph. The only object merged is the fixed options literal in `extractCleanText`; page content is never merged |
 
-`npm install --omit=optional` gives you an install without the first two. The `xlsx-*` commands then say ExcelJS is not installed rather than failing oddly, and `semantic` keeps working on keyword search alone: it is the embedding half that goes away, not the command.
+`npm install --omit=optional` gives you an install without either of these, and `npm audit` reports it clean. Every command still starts; the ones that need a package you skipped say so. The `xlsx-*` commands report that ExcelJS is not installed rather than failing oddly, `zip-list`/`zip-read` do the same for fflate, and `semantic` keeps working on keyword search alone: it is the embedding half that goes away, not the command.
+
+`html-to-text` used to appear in that table, carrying [`deepmerge-ts`](https://github.com/advisories/GHSA-ggr8-5vv4-36mx). It is now a development dependency instead. esbuild inlines it into `dist/token-goat.mjs` at build time and nothing in the published bundle imports it, so it was a runtime dependency in name only: moving it removes `html-to-text`, `deepmerge-ts`, `htmlparser2`, `selderee`, and `dom-serializer` from an installed copy while the HTML-to-text output stays byte-for-byte identical. That is what takes the no-optional install to zero, and it is better than the alternative we had considered, rolling `html-to-text` back to 9.x: that version pins `htmlparser2` two majors lower, and `htmlparser2` is what parses fetched pages, so it would have traded an advisory in an options merger for an older parser on the one path that handles untrusted input.
 
 Direct dependencies with a forward patch are kept current rather than pinned: `sharp` and `puppeteer-core` were both moved across a major version to clear their advisories.
 
+For a scanner that ingests a bill of materials rather than a lockfile, `npm run sbom` writes CycloneDX 1.5 to stdout.
+
 ## Verifying what you installed
 
 Every published version is built and pushed by one workflow, [`.github/workflows/publish.yml`](.github/workflows/publish.yml), which runs only when a GitHub release is published (or manually, and then only from `main`). It publishes with npm provenance, so npm holds a signed attestation tying the tarball to the commit and workflow run that produced it. Nothing is ever published from a laptop.
@@ -70,3 +83,54 @@ Every action used by that workflow, and by CI, is pinned to a full commit SHA ra
 ## License
 
 Token-Goat is source-available under the PolyForm Noncommercial License 1.0.0. Submitting a security report does not grant the reporter any license to Token-Goat's code beyond what PolyForm Noncommercial already permits. See LICENSE for the full terms.
+
+
+## Dependency licenses
+
+Every production dependency is permissively licensed, but a scan does not read it that way on its
+own. Counted from `package-lock.json`, which lists the packages for every platform rather than only
+the ones this machine installed, 22 entries need a human answer: 7 declare a license a scanner
+cannot resolve, and 15 carry a copyleft term. All 22 arrive through optional dependencies. Install
+with `npm install --omit=optional token-goat` and not one of them is present.
+
+**Declarations a scanner cannot resolve.** Both are upstream mistakes, and both are the same
+mistake this project made in its own manifest and fixed. `SEE LICENSE IN <file>` is npm's form for
+a license that is not on the SPDX list, and `MIT OR Apache` is not a valid expression because the
+identifier is `Apache-2.0`. For the second, `npm sbom` emits no `licenses` field at all rather than
+an unresolvable one.
+
+| Package | Declares | Actually grants | Reached through |
+| --- | --- | --- | --- |
+| `flatbuffers` | `SEE LICENSE IN LICENSE.txt` | Apache-2.0, in its own `LICENSE.txt` | `@xenova/transformers` |
+| `sqlite-vec` and its 5 platform packages | `MIT OR Apache` | MIT or Apache-2.0, your choice | direct optional dependency |
+
+**Copyleft terms.** Two families, and neither puts a copyleft obligation on Token-Goat's own code.
+
+| Package | Declares | Why it is not a problem |
+| --- | --- | --- |
+| `@img/sharp-libvips-<platform>` (10 packages) | `LGPL-3.0-or-later` | libvips, shipped as a prebuilt shared library and used unmodified. LGPL asks that the library stay replaceable, and it is: it is a separate package that `sharp` loads at runtime. |
+| `@img/sharp-<platform>` (4 packages) | `Apache-2.0 AND LGPL-3.0-or-later` | the Apache half is `sharp` itself, the LGPL half is the same libvips |
+| `jszip` | `(MIT OR GPL-3.0-or-later)` | a choice between the two, and the MIT half is taken |
+
+`sharp` and `jszip` are both optional: `sharp` powers image shrinking, `jszip` arrives through
+`exceljs` for the `xlsx-*` commands.
+
+**Three packages with no license at all used to be here.** `buffers@0.1.1` and `chainsaw@0.1.0`
+shipped with neither a `license` field nor a license file, and `traverse@0.3.9` had the file but
+not the field. No grant at all is worse for a review than a copyleft grant, because there is
+nothing to apply policy to. They arrived through `exceljs`, which depends on `unzipper`, which
+depended on `binary`, which depended on all three. `unzipper` dropped `binary` in 0.11, so an
+override to `^0.12.5` removes the sub-chain, and the deprecated `fstream` with it. Token-goat reads
+workbooks through `wb.xlsx.readFile()`, which goes through `jszip`; `unzipper` is only reachable
+through the streaming reader in `exceljs`, which this code never calls.
+
+Reproduce the whole picture:
+
+```bash
+npm run sbom
+```
+
+Like the advisory disclosure above, this is checked by a test rather than by review: see
+[tests/guards/dependency_licenses.test.ts](tests/guards/dependency_licenses.test.ts). Any
+production package that a scanner cannot resolve, or that carries a copyleft term, has to be named
+here or that test fails.

package/dist/{token-goat-chunk-QL2743EW.mjs → token-goat-chunk-72R7M5H7.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-P7I6LS5H.mjs";
+} from "./token-goat-chunk-FN6WLFIX.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-HPY7XE77.mjs";
+} from "./token-goat-chunk-TDYTBCT4.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,14 +45,11 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-chunk-X7PIWZMB.mjs";
-import "./token-goat-chunk-VYC34TBW.mjs";
-import {
-  init_define_import_meta_env
-} from "./token-goat-chunk-4WGVGN6W.mjs";
+} from "./token-goat-chunk-WFRR2DBG.mjs";
+import "./token-goat-chunk-AO2QD2AG.mjs";
+import "./token-goat-chunk-AEX54RUZ.mjs";
 
 // src/mcp_server.ts
-init_define_import_meta_env();
 import * as fs from "fs";
 import * as path from "path";
 var TOKEN_GOAT_RETRY_RE = /token-goat (\w[\w-]*) "([^"]+)"/g;
@@ -202,7 +199,7 @@ function withConfinedRead(pins, fn) {
   }
 }
 async function createMcpServer() {
-  const [{ McpServer }, { z }] = await Promise.all([import("@modelcontextprotocol/sdk/server/mcp.js"), import("./token-goat-chunk-Q4N6SQWR.mjs")]);
+  const [{ McpServer }, { z }] = await Promise.all([import("@modelcontextprotocol/sdk/server/mcp.js"), import("./token-goat-chunk-DG53MVNJ.mjs")]);
   const server = new McpServer({ name: "token-goat", version: VERSION });
   const makeProjectRootField = (verb) => z.string().optional().describe(
     `absolute path to the workspace root to scope this ${verb} to; defaults to the MCP server process's cwd, which is not always the actual workspace root for MCP clients -- pass this explicitly when it might differ`

package/dist/{token-goat-chunk-56C3XUQY.mjs → token-goat-chunk-77CX3MCN.mjs}

@@ -10,18 +10,15 @@ import {
   selectFilter,
   shlexSplit,
   wrappedShell
-} from "./token-goat-chunk-N2S7UAVU.mjs";
+} from "./token-goat-chunk-RQQ4SY2P.mjs";
 import {
   loadConfig,
   recordStat
-} from "./token-goat-chunk-X7PIWZMB.mjs";
-import "./token-goat-chunk-VYC34TBW.mjs";
-import {
-  init_define_import_meta_env
-} from "./token-goat-chunk-4WGVGN6W.mjs";
+} from "./token-goat-chunk-WFRR2DBG.mjs";
+import "./token-goat-chunk-AO2QD2AG.mjs";
+import "./token-goat-chunk-AEX54RUZ.mjs";
 
 // src/bash_runner.ts
-init_define_import_meta_env();
 import { spawnSync } from "node:child_process";
 import * as os from "node:os";
 var IdentityFilter = class extends ToolFilter {

package/dist/token-goat-chunk-AEX54RUZ.mjs

@@ -0,0 +1,11 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};

package/dist/{token-goat-chunk-VYC34TBW.mjs → token-goat-chunk-AO2QD2AG.mjs}

@@ -1,11 +1,7 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
-import {
-  init_define_import_meta_env
-} from "./token-goat-chunk-4WGVGN6W.mjs";
 
 // src/reset.ts
-init_define_import_meta_env();
 var _resets = [];
 function registerReset(fn) {
   _resets.push(fn);