token-goat 2.6.33 → 2.6.35

package/dist/{token-goat-chunk-FN6WLFIX.mjs → token-goat-chunk-D5IZEGN2.mjs}

@@ -50,7 +50,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-TDYTBCT4.mjs";
+} from "./token-goat-chunk-I2KCEGIP.mjs";
 import {
   PER_FILE_COUNTERFACTUAL_CEILING,
   _detectOpenQuote,
@@ -61,11 +61,14 @@ import {
   colorStdout,
   compileGrepMatcher,
   countNoun,
+  decodeSource,
   detectLanguage,
+  displaySafeText,
   ensureNewline,
   escapeRegExp,
   excludeTestsHiddenNote,
   extractErrorMessage,
+  fileIsAbsent,
   findHtmlHeadingMatches,
   findProject,
   fingerprintContent,
@@ -97,7 +100,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-WFRR2DBG.mjs";
+} from "./token-goat-chunk-K7W3P2TJ.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -387,7 +390,7 @@ function readTextForSections(filePath, readFn) {
     text = read;
   } else {
     try {
-      text = readFileSync(filePath, "utf-8");
+      text = decodeSource(readFileSync(filePath));
     } catch {
       return null;
     }
@@ -489,13 +492,13 @@ function formatJsonOutline(outline) {
   if (outline.kind === "primitive") return `(scalar ${outline.type})`;
   if (outline.kind === "object") {
     if (outline.fields.length === 0) return "(empty object)";
-    return outline.fields.map((f) => `${f.name}: ${f.type}${f.size !== void 0 ? ` (${f.size})` : ""}`).join("\n");
+    return outline.fields.map((f) => `${displaySafeText(f.name)}: ${f.type}${f.size !== void 0 ? ` (${f.size})` : ""}`).join("\n");
   }
   const lines = [`array of ${outline.length} element${outline.length === 1 ? "" : "s"} (${outline.elementType})`];
   if (outline.sampleKeys !== void 0) {
     lines.push(outline.heterogeneous === true ? "keys (from first elements, shape varies across sample):" : "keys (from first elements):");
     for (const f of outline.sampleKeys) {
-      lines.push(`  ${f.name}: ${f.type}${f.size !== void 0 ? ` (${f.size})` : ""}`);
+      lines.push(`  ${displaySafeText(f.name)}: ${f.type}${f.size !== void 0 ? ` (${f.size})` : ""}`);
     }
   }
   return lines.join("\n");
@@ -583,6 +586,474 @@ function queryJson(data, spec) {
   return evalJsonPath(data, parseJsonPath(spec));
 }
 
+// src/xml_query.ts
+var XML_NAME_START = "A-Za-z_:\xC0-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uD800-\uDFFF\uF900-\uFDCF\uFDF0-\uFFFD";
+var XML_NAME_REST = "A-Za-z_:\xC0-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uD800-\uDFFF\uF900-\uFDCF\uFDF0-\uFFFD0-9.\xB7\u0300-\u036F\u203F-\u2040-";
+var XML_NAME = `[${XML_NAME_START}][${XML_NAME_REST}]*`;
+var XML_ATTR_REGION = `(?:[^>"']|"[^"]*"|'[^']*'|["'])*?`;
+var XML_DOCTYPE_TOKEN = `<!DOCTYPE(?:[^>"']|"[^"]*"|'[^']*')*>`;
+function decodeXmlEntities(text) {
+  return text.replace(/&(?:quot|apos|lt|gt|amp|#x([0-9a-fA-F]+)|#([0-9]+));/g, (match, hex, dec) => {
+    if (match === "&quot;") return '"';
+    if (match === "&apos;") return "'";
+    if (match === "&lt;") return "<";
+    if (match === "&gt;") return ">";
+    if (match === "&amp;") return "&";
+    if (hex !== void 0) {
+      const code = parseInt(hex, 16);
+      try {
+        return code >= 0 && code <= 1114111 ? String.fromCodePoint(code) : match;
+      } catch {
+        return match;
+      }
+    }
+    if (dec !== void 0) {
+      const code = parseInt(dec, 10);
+      try {
+        return code >= 0 && code <= 1114111 ? String.fromCodePoint(code) : match;
+      } catch {
+        return match;
+      }
+    }
+    return match;
+  });
+}
+function escapeXmlText(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escapeXmlAttr(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;").replace(/\n/g, "&#xA;").replace(/\r/g, "&#xD;").replace(/\t/g, "&#x9;");
+}
+function parseXmlTree(xmlText) {
+  const leadingTrim = xmlText.length - xmlText.trimStart().length;
+  let text = xmlText.trim();
+  let lineOffset = (xmlText.slice(0, leadingTrim).match(/\n/g) ?? []).length;
+  if (text.charCodeAt(0) === 65279) text = text.slice(1);
+  let doctype = null;
+  const namespaces = {};
+  let totalElements = 0;
+  const doctypeMatch = new RegExp(
+    `<!DOCTYPE\\s+((?:[^>[\\]"']|"[^"]*"|'[^']*'|\\[[\\s\\S]*?\\])*)\\s*>`,
+    "i"
+  ).exec(text);
+  if (doctypeMatch) {
+    doctype = doctypeMatch[1]?.trim() ?? null;
+  }
+  function parseAttributes(attrString) {
+    const attrs = {};
+    const attrRegex = new RegExp(`(${XML_NAME})(?:\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+)))?`, "g");
+    let m;
+    while ((m = attrRegex.exec(attrString)) !== null) {
+      const name = m[1];
+      const rawVal = m[2] !== void 0 ? m[2] : m[3] !== void 0 ? m[3] : m[4] ?? "";
+      const val = decodeXmlEntities(rawVal);
+      attrs[name] = val;
+      if (name === "xmlns" || name.startsWith("xmlns:")) {
+        namespaces[name] = val;
+      }
+    }
+    return attrs;
+  }
+  const tagRegex = new RegExp(
+    // eslint-disable-next-line no-misleading-character-class
+    `<(\\/)?(${XML_NAME})(${XML_ATTR_REGION})(\\/)?>|<!--[\\s\\S]*?-->|<!\\[CDATA\\[([\\s\\S]*?)\\]\\]>|<\\?[\\s\\S]*?\\?>|${XML_DOCTYPE_TOKEN}`,
+    "gi"
+  );
+  const stack = [];
+  let rootNode = null;
+  let match;
+  let lastIndex = 0;
+  let lineScan = 0;
+  while ((match = tagRegex.exec(text)) !== null) {
+    const fullMatch = match[0];
+    const isClosing = match[1] === "/";
+    const tagName = match[2];
+    const attrText = match[3] ?? "";
+    const isSelfClosing = match[4] === "/" || fullMatch.endsWith("/>");
+    const cdataContent = match[5];
+    if (stack.length > 0 && match.index > lastIndex) {
+      const raw = text.slice(lastIndex, match.index);
+      if (raw.trim()) {
+        stack[stack.length - 1].text += decodeXmlEntities(raw);
+      }
+    }
+    if (cdataContent !== void 0) {
+      if (stack.length > 0) {
+        stack[stack.length - 1].text += cdataContent;
+      }
+      lastIndex = tagRegex.lastIndex;
+      continue;
+    }
+    if (!tagName) {
+      lastIndex = tagRegex.lastIndex;
+      continue;
+    }
+    while (lineScan < match.index) {
+      if (text.charCodeAt(lineScan) === 10) lineOffset++;
+      lineScan++;
+    }
+    const line = lineOffset + 1;
+    if (isClosing) {
+      if (stack.length > 0) {
+        let popIdx = stack.length - 1;
+        while (popIdx >= 0 && stack[popIdx].tag !== tagName) {
+          popIdx--;
+        }
+        if (popIdx >= 0) {
+          while (stack.length > popIdx) {
+            stack.pop();
+          }
+        }
+      }
+    } else {
+      totalElements++;
+      const attrs = parseAttributes(attrText);
+      const newNode = {
+        tag: tagName,
+        attributes: attrs,
+        children: [],
+        text: "",
+        line
+      };
+      if (stack.length === 0) {
+        if (!rootNode) rootNode = newNode;
+      } else {
+        stack[stack.length - 1].children.push(newNode);
+      }
+      if (!isSelfClosing) {
+        stack.push(newNode);
+      }
+    }
+    lastIndex = tagRegex.lastIndex;
+  }
+  return { root: rootNode, namespaces, doctype, totalElements };
+}
+function outlineXml(xmlText, opts = {}) {
+  const maxDepth = opts.maxDepth ?? 4;
+  const { root, namespaces, doctype, totalElements } = parseXmlTree(xmlText);
+  if (!root) {
+    throw new Error("No valid XML root element found");
+  }
+  const uniqueTags = /* @__PURE__ */ new Set();
+  let maxTreeDepth = 1;
+  function buildElementOutline(node, currentDepth) {
+    uniqueTags.add(node.tag);
+    if (currentDepth > maxTreeDepth) maxTreeDepth = currentDepth;
+    const keyAttrs = {};
+    for (const [k, v] of Object.entries(node.attributes)) {
+      if (!k.startsWith("xmlns")) {
+        keyAttrs[k] = v;
+      }
+    }
+    const children = [];
+    if (currentDepth < maxDepth) {
+      const tagCounts = {};
+      for (const child of node.children) {
+        tagCounts[child.tag] = (tagCounts[child.tag] || 0) + 1;
+      }
+      for (const child of node.children) {
+        const count = tagCounts[child.tag] || 0;
+        const existingWithTag = children.filter((c) => c.tag === child.tag).length;
+        if (count > 5 && existingWithTag >= 3) {
+          if (existingWithTag === 3) {
+            children.push({
+              tag: `... (${count - 3} more <${child.tag}> elements)`,
+              attributes: {},
+              childCount: 0,
+              children: [],
+              textLength: 0
+            });
+          }
+          continue;
+        }
+        children.push(buildElementOutline(child, currentDepth + 1));
+      }
+    }
+    return {
+      tag: node.tag,
+      attributes: keyAttrs,
+      childCount: node.children.length,
+      children,
+      textLength: node.text.length
+    };
+  }
+  const tree = buildElementOutline(root, 1);
+  return {
+    rootTag: root.tag,
+    namespaces,
+    doctype,
+    totalElements,
+    uniqueTags: Array.from(uniqueTags).sort(),
+    maxDepth: maxTreeDepth,
+    tree
+  };
+}
+function formatXmlOutline(summary) {
+  const lines = [];
+  lines.push(
+    `Root element: <${summary.rootTag}> (${summary.totalElements} total elements, ${summary.uniqueTags.length} unique tags, max depth ${summary.maxDepth})`
+  );
+  if (summary.doctype) {
+    lines.push(`DOCTYPE: ${summary.doctype}`);
+  }
+  const nsKeys = Object.keys(summary.namespaces);
+  if (nsKeys.length > 0) {
+    lines.push("Namespaces:");
+    for (const [k, v] of Object.entries(summary.namespaces)) {
+      lines.push(`  ${k}: ${v}`);
+    }
+  }
+  lines.push("");
+  lines.push("Element hierarchy:");
+  function renderNode(node, indent) {
+    const pad = "  ".repeat(indent);
+    const attrParts = [];
+    const attrKeys = Object.keys(node.attributes);
+    for (const [k, v] of Object.entries(node.attributes)) {
+      if (["id", "name", "type", "key", "class", "code", "status", "value"].includes(k.toLowerCase()) || attrKeys.length <= 3) {
+        const valPreview = v.length > 35 ? `${v.slice(0, 32)}...` : v;
+        attrParts.push(`${k}="${valPreview}"`);
+      }
+    }
+    const attrStr = attrParts.length > 0 ? ` [${attrParts.join(" ")}]` : "";
+    const countStr = node.childCount > 0 ? ` (${node.childCount} children)` : node.textLength > 0 ? ` (~${node.textLength} chars text)` : " (empty)";
+    lines.push(`${pad}<${node.tag}>${attrStr}${countStr}`);
+    for (const child of node.children) {
+      renderNode(child, indent + 1);
+    }
+  }
+  renderNode(summary.tree, 0);
+  return lines.join("\n");
+}
+function parseXmlPath(pathStr) {
+  let normalized = pathStr.trim();
+  if (normalized === "" || normalized === "/") return [];
+  const isGlobalRecursive = normalized.startsWith("//");
+  if (isGlobalRecursive) {
+    normalized = normalized.slice(2);
+  } else if (normalized.startsWith("/")) {
+    normalized = normalized.slice(1);
+  }
+  const segments = [];
+  let inBracket = false;
+  let currentSegment = "";
+  for (let i = 0; i < normalized.length; i++) {
+    const ch = normalized[i];
+    if (ch === "[") {
+      inBracket = true;
+      currentSegment += ch;
+    } else if (ch === "]") {
+      inBracket = false;
+      currentSegment += ch;
+    } else if (!inBracket && (ch === "/" || ch === ".")) {
+      if (currentSegment) {
+        segments.push(currentSegment);
+        currentSegment = "";
+      }
+      if (ch === "/" && normalized[i + 1] === "/") {
+        segments.push("//");
+        i++;
+      }
+    } else {
+      currentSegment += ch;
+    }
+  }
+  if (currentSegment) segments.push(currentSegment);
+  const steps = [];
+  let nextIsRecursive = isGlobalRecursive;
+  for (let i = 0; i < segments.length; i++) {
+    const s = segments[i];
+    if (s === "//") {
+      nextIsRecursive = true;
+      continue;
+    }
+    const isRecursive = nextIsRecursive;
+    nextIsRecursive = false;
+    const attrSelectMatch = /^@([a-zA-Z0-9_:.\\-]+|\*)$/.exec(s);
+    if (attrSelectMatch) {
+      steps.push({ tag: "", isRecursive, attributeSelect: attrSelectMatch[1] });
+      continue;
+    }
+    const indexMatch = /\[(-?\d+)\]$/.exec(s);
+    const wildcardMatch = /\[\*\]$/.exec(s);
+    const attrMatch = /\[@?([a-zA-Z0-9_:.\\-]+)(?:(!?=)\s*["']?([^"'\]]*)["']?)?\]$/.exec(s);
+    let tag = s.replace(/\[.*\]$/, "");
+    if (!tag) tag = "*";
+    let index;
+    let allIndices;
+    let attributeFilter;
+    if (indexMatch) {
+      index = parseInt(indexMatch[1], 10);
+    } else if (wildcardMatch) {
+      allIndices = true;
+    } else if (attrMatch) {
+      const [, attrName, op, attrVal] = attrMatch;
+      attributeFilter = {
+        name: attrName,
+        ...attrVal !== void 0 ? { value: attrVal } : {},
+        ...op === "!=" ? { notEqual: true } : {}
+      };
+    }
+    const step = { tag, isRecursive };
+    if (index !== void 0) step.index = index;
+    if (allIndices !== void 0) step.allIndices = allIndices;
+    if (attributeFilter !== void 0) step.attributeFilter = attributeFilter;
+    steps.push(step);
+  }
+  return steps;
+}
+function serializeXmlNode(node, indent = 0) {
+  const pad = "  ".repeat(indent);
+  const attrParts = [];
+  for (const [k, v] of Object.entries(node.attributes)) {
+    attrParts.push(`${k}="${escapeXmlAttr(v)}"`);
+  }
+  const attrStr = attrParts.length > 0 ? " " + attrParts.join(" ") : "";
+  if (node.children.length === 0 && !node.text) {
+    return `${pad}<${node.tag}${attrStr}/>`;
+  }
+  if (node.children.length === 0) {
+    return `${pad}<${node.tag}${attrStr}>${escapeXmlText(node.text)}</${node.tag}>`;
+  }
+  const lines = [];
+  lines.push(`${pad}<${node.tag}${attrStr}>`);
+  if (node.text) {
+    lines.push(`${pad}  ${escapeXmlText(node.text)}`);
+  }
+  for (const child of node.children) {
+    lines.push(serializeXmlNode(child, indent + 1));
+  }
+  lines.push(`${pad}</${node.tag}>`);
+  return lines.join("\n");
+}
+function getAllDescendants(node) {
+  const desc = [];
+  function walk(n) {
+    for (const c of n.children) {
+      desc.push(c);
+      walk(c);
+    }
+  }
+  walk(node);
+  return desc;
+}
+function xmlNodeToJson(node) {
+  const hasAttrs = Object.keys(node.attributes).length > 0;
+  const hasChildren = node.children.length > 0;
+  if (!hasChildren && !hasAttrs) {
+    return node.text;
+  }
+  if (!hasChildren) {
+    const result2 = {};
+    for (const [k, v] of Object.entries(node.attributes)) {
+      result2[`@${k}`] = v;
+    }
+    if (node.text) {
+      result2["#text"] = node.text;
+    }
+    return result2;
+  }
+  const result = {};
+  for (const [k, v] of Object.entries(node.attributes)) {
+    result[`@${k}`] = v;
+  }
+  const childGroups = /* @__PURE__ */ new Map();
+  for (const child of node.children) {
+    const existing = childGroups.get(child.tag);
+    if (existing !== void 0) {
+      existing.push(child);
+    } else {
+      childGroups.set(child.tag, [child]);
+    }
+  }
+  for (const [tag, group] of childGroups) {
+    if (group.length === 1) {
+      result[tag] = xmlNodeToJson(group[0]);
+    } else {
+      result[tag] = group.map(xmlNodeToJson);
+    }
+  }
+  if (node.text) {
+    result["#text"] = node.text;
+  }
+  return result;
+}
+function queryXml(xmlText, pathStr) {
+  const { root } = parseXmlTree(xmlText);
+  if (!root) {
+    throw new Error("No valid XML root element found");
+  }
+  const steps = parseXmlPath(pathStr);
+  if (steps.length === 0) {
+    return { items: [root], fanned: false };
+  }
+  let currentCandidates = [root];
+  let hasFanned = false;
+  let isAtRootLevel = true;
+  for (let sIdx = 0; sIdx < steps.length; sIdx++) {
+    const step = steps[sIdx];
+    if (step.attributeSelect !== void 0) {
+      const attrVals = [];
+      const attrName = step.attributeSelect;
+      for (const cand of currentCandidates) {
+        if (attrName === "*") {
+          attrVals.push(...Object.values(cand.attributes));
+        } else if (cand.attributes[attrName] !== void 0) {
+          attrVals.push(cand.attributes[attrName]);
+        }
+      }
+      return {
+        items: currentCandidates,
+        attributeValues: attrVals,
+        fanned: hasFanned || attrVals.length > 1
+      };
+    }
+    const nextCandidates = [];
+    const evaluateOnCurrentNode = isAtRootLevel && !step.isRecursive && (step.tag === "*" || step.tag.toLowerCase() === root.tag.toLowerCase());
+    isAtRootLevel = false;
+    for (const cand of currentCandidates) {
+      let targets;
+      if (evaluateOnCurrentNode) {
+        targets = [cand];
+      } else if (step.isRecursive) {
+        targets = [cand, ...getAllDescendants(cand)];
+      } else {
+        targets = cand.children;
+      }
+      let matching = targets.filter((c) => step.tag === "*" || c.tag.toLowerCase() === step.tag.toLowerCase());
+      if (step.attributeFilter) {
+        const af = step.attributeFilter;
+        matching = matching.filter((c) => {
+          const attrVal = c.attributes[af.name];
+          if (attrVal !== void 0) {
+            if (af.value === void 0) return true;
+            return af.notEqual ? attrVal !== af.value : attrVal === af.value;
+          }
+          const childElem = c.children.find((child) => child.tag.toLowerCase() === af.name.toLowerCase());
+          if (childElem !== void 0) {
+            if (af.value === void 0) return true;
+            return af.notEqual ? childElem.text !== af.value : childElem.text === af.value;
+          }
+          return af.notEqual === true;
+        });
+      }
+      if (step.index !== void 0) {
+        const idx = step.index < 0 ? matching.length + step.index : step.index;
+        if (idx >= 0 && idx < matching.length) {
+          nextCandidates.push(matching[idx]);
+        }
+      } else {
+        if (step.allIndices || matching.length > 1 || step.attributeFilter !== void 0) {
+          hasFanned = true;
+        }
+        nextCandidates.push(...matching);
+      }
+    }
+    currentCandidates = nextCandidates;
+  }
+  return { items: currentCandidates, fanned: hasFanned || currentCandidates.length > 1 };
+}
+
 // node_modules/js-yaml/dist/js-yaml.mjs
 var NOT_RESOLVED = /* @__PURE__ */ Symbol("NOT_RESOLVED");
 function defineScalarTag(tagName, options) {
@@ -3094,7 +3565,7 @@ async function listZipEntries(data) {
 }
 function formatZipList(entries) {
   if (entries.length === 0) return "(no entries found)";
-  return entries.map((e) => `${String(e.size).padStart(10)}  ${e.path}`).join("\n");
+  return entries.map((e) => `${String(e.size).padStart(10)}  ${displaySafeText(e.path)}`).join("\n");
 }
 async function extractZipEntry(data, entryPath) {
   const fflate = await requireFflate();
@@ -4733,8 +5204,8 @@ function readFileText(p) {
       verifyStillAbsent(p);
       return null;
     }
-    if (pinned !== void 0) return redactIfDotenv(p, readPinnedBytes(p, pinned).toString("utf-8"));
-    return redactIfDotenv(p, fs5.readFileSync(p, "utf-8"));
+    if (pinned !== void 0) return redactIfDotenv(p, decodeSource(readPinnedBytes(p, pinned)));
+    return redactIfDotenv(p, decodeSource(fs5.readFileSync(p)));
   } catch (err) {
     if (err instanceof ConfinementIdentityError) throw err;
     return null;
@@ -4764,11 +5235,21 @@ function resolveBody(entry) {
   return source.split(/\r?\n/).slice(Math.max(0, entry.lineStart - 1), entry.lineEnd).join("\n");
 }
 var STALE_WARNING = "\u26A0 STALE: index is older than the file on disk (worker hasn't reindexed yet \u2014 retry shortly, or read the file directly)";
+var DELETED_WARNING = "\u26A0 DELETED: this file is no longer on disk \u2014 what follows is what the index last saw of it";
+var DELETED_TAG = "\u26A0 DELETED: file no longer on disk";
+function fileIsGone(absPath) {
+  if (!path5.isAbsolute(absPath)) return false;
+  return fileIsAbsent(absPath);
+}
 function staleWarning(resolvedPath) {
   const entry = getFileEntry(resolvedPath);
   if (entry === null || entry.sha === "") return "";
   const diskSha = fingerprintFile(resolvedPath);
-  if (diskSha === null || diskSha === entry.sha) return "";
+  if (diskSha === null) {
+    return fileIsGone(resolvedPath) ? `${DELETED_WARNING}
+` : "";
+  }
+  if (diskSha === entry.sha) return "";
   return `${STALE_WARNING}
 `;
 }
@@ -5055,18 +5536,14 @@ function runSymbol(opts) {
   }
   const matchesGrep = opts.grep !== void 0 ? compileGrepMatcher(opts.grep) : void 0;
   const excludeTests = opts.excludeTests === true;
-  const confineToProject = !loadConfig().indexing.cross_project_symbols;
-  const confinedRoot = confineToProject ? resolveProjectRoot() : null;
+  const confinedRoot = confinedProjectRoot();
   if (confinedRoot !== null) {
     const requested = opts.projectRoot;
-    if (requested !== void 0 && !isInsideRoot(requested, confinedRoot)) {
-      return { text: `--project is outside this project root, and indexing.cross_project_symbols = false confines symbol lookups to it: ${toDisplayPath(confinedRoot, requested)}`, code: 1 };
-    }
+    const projectDenial = requested === void 0 ? null : confinementRefusal("--project", requested, confinedRoot);
+    if (projectDenial !== null) return { text: projectDenial, code: 1 };
     if (opts.file !== void 0) {
-      const resolved = resolveIndexPath(opts.file, requested ?? process.cwd());
-      if (!isInsideRoot(resolved, confinedRoot)) {
-        return { text: `--file is outside this project root, and indexing.cross_project_symbols = false confines symbol lookups to it: ${toDisplayPath(confinedRoot, resolved)}`, code: 1 };
-      }
+      const fileDenial = confinementRefusal("--file", resolveIndexPath(opts.file, requested ?? process.cwd()), confinedRoot);
+      if (fileDenial !== null) return { text: fileDenial, code: 1 };
     }
   }
   const queryOpts = {};
@@ -5151,6 +5628,9 @@ ${emptyIndexMessage(emptyIndexRoot)}`;
     const items = capped.items.map((s) => ({
       ...s,
       filePath: toDisplayPath(symbolDisplayRoot, s.filePath),
+      // Only present when true, so a result set of live files stays byte-identical to what this
+      // command has always emitted and only the genuinely-gone rows grow a field.
+      ...fileIsGone(s.filePath) ? { deleted: true } : {},
       ...refCounts !== void 0 ? { refCount: refCounts.get(s.name) ?? 0, hasDoc: hasRealDocstring(s.docstring) } : {}
     }));
     const payload = { items, truncated: truncatedFlag, totalCount: trueTotal };
@@ -5160,7 +5640,8 @@ ${emptyIndexMessage(emptyIndexRoot)}`;
   }
   const blocks = results.map((sym) => {
     const statsStr = formatStatsSuffix(refCounts, sym);
-    const header = `# ${sym.name} (${sym.kind}) \u2014 ${toDisplayPath(symbolDisplayRoot, sym.filePath)}:${sym.lineStart}-${sym.lineEnd}${statsStr}`;
+    const goneTag = fileIsGone(sym.filePath) ? `  ${DELETED_TAG}` : "";
+    const header = `# ${sym.name} (${sym.kind}) \u2014 ${toDisplayPath(symbolDisplayRoot, sym.filePath)}:${sym.lineStart}-${sym.lineEnd}${statsStr}${goneTag}`;
     const body = resolveBody(sym);
     const preview = body.split(/\r?\n/).slice(0, 5).join("\n");
     return preview.trim() !== "" ? `${header}
@@ -5169,7 +5650,24 @@ ${preview}` : header;
   const warning = opts.file !== void 0 ? staleWarning(resolveIndexPath(opts.file, opts.projectRoot ?? process.cwd())) : "";
   const text = guardText(warning + blocks.join("\n\n"), "symbol");
   recordReadStat("symbol_lookup", fullSourceBytes, text, opts.name ?? opts.file ?? opts.grep);
-  return { text, code: 0 };
+  const symbolTotal = () => anyClientFilter ? { count: filtered.length, exact: rawResults.length < FIND_SCAN_LIMIT } : { count: countSymbols(queryOpts), exact: true };
+  return { text: text + truncationFooter(results.length, effectiveLimit, symbolTotal, "matches", "--limit"), code: 0 };
+}
+function truncationFooter(shown, limit, total, plural, flag) {
+  const notice = truncationNotice(shown, limit, total, plural, flag);
+  return notice === null ? "" : `
+
+token-goat: ${notice}`;
+}
+function refsTotal(clientFiltered, filteredTotal, shown, countExact, preScanCount) {
+  if (!clientFiltered) return { count: countExact(), exact: true };
+  return { count: filteredTotal ?? shown, exact: preScanCount < REFS_TOP_SCAN_LIMIT };
+}
+function truncationNotice(shown, limit, total, plural, flag) {
+  if (shown < limit) return null;
+  const { count, exact } = total();
+  if (count <= shown) return null;
+  return exact ? `showing ${shown} of ${count} ${plural}; rerun with ${flag} ${count} to see them all` : `showing ${shown} of at least ${count} ${plural}; rerun with ${flag} ${count} and a narrower filter to see more`;
 }
 function parseReadSpec(spec) {
   const colonIdx = findSpecSeparator(spec);
@@ -5311,6 +5809,18 @@ function formatAmbiguity(symbol, file, candidates, explicitRoot, commandName = "
   }
   return lines.join("\n");
 }
+function confinedProjectRoot() {
+  return loadConfig().indexing.cross_project_symbols ? null : resolveProjectRoot();
+}
+function confinementRefusal(label, resolved, root) {
+  if (root === null || isInsideRoot(resolved, root)) return null;
+  return `${label} is outside this project root, and indexing.cross_project_symbols = false confines symbol lookups to it: ${toDisplayPath(root, resolved)}`;
+}
+function fileConfinementRefusal(label, file, projectRoot) {
+  const root = confinedProjectRoot();
+  if (root === null) return null;
+  return confinementRefusal(label, resolveIndexPath(file, projectRoot ?? process.cwd()), root);
+}
 function resolveSymbolSpec(spec, forceRefresh, projectRoot) {
   const { file, symbol: rawSymbol } = parseReadSpec(spec);
   if (rawSymbol === void 0 || rawSymbol === "") return { kind: "none" };
@@ -5318,6 +5828,8 @@ function resolveSymbolSpec(spec, forceRefresh, projectRoot) {
   const symbol = anchorMatch !== null ? anchorMatch[1] : rawSymbol;
   const lineAnchor = anchorMatch !== null ? parseInt(anchorMatch[2], 10) : void 0;
   const resolved = resolveIndexPath(file, projectRoot ?? process.cwd());
+  const confined = confinementRefusal("This file", resolved, confinedProjectRoot());
+  if (confined !== null) return { kind: "confined", message: confined };
   if (forceRefresh === true) {
     indexFileSyncPinned(resolved, globalDbPath());
     enqueueDirtyPathSafe(resolved, { alreadyResolved: true });
@@ -5399,6 +5911,7 @@ function runRead(opts) {
     return { text: guardText(text2, "symbol"), code: 0 };
   }
   const resolution = resolveSymbolSpec(opts.spec, opts.forceRefresh, opts.projectRoot);
+  if (resolution.kind === "confined") return { text: resolution.message, code: 1 };
   if (resolution.kind === "ambiguous") {
     return {
       text: formatAmbiguity(
@@ -5433,6 +5946,9 @@ function runRead(opts) {
       {
         ...match,
         body: resolveBody(match),
+        // The text branch below prepends staleWarning's DELETED line; without this the JSON form
+        // would be the one surface that still passes a deleted file's body off as a live read.
+        ...fileIsGone(match.filePath) ? { deleted: true } : {},
         ...refCounts !== void 0 ? { refCount: refCounts.get(match.name) ?? 0 } : {}
       },
       null,
@@ -5619,6 +6135,15 @@ function parseMultiRefsSpec(spec) {
   const symbols = symPart.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
   return { file, symbols };
 }
+function refsRootDir(opts) {
+  return opts.projectRoot ?? confinedProjectRoot() ?? void 0;
+}
+function refsSpecFiles(spec) {
+  const crossFile = parseCrossFileMultiSpec(spec);
+  if (crossFile !== null) return [...new Set(crossFile.map((p) => p.file))];
+  const { file } = parseMultiRefsSpec(spec);
+  return file === void 0 ? [] : [file];
+}
 function runRefs(opts) {
   if (opts.limit !== void 0 && opts.limit <= 0) {
     emitErr(`--limit must be a positive number, got: ${opts.limit}`);
@@ -5628,6 +6153,21 @@ function runRefs(opts) {
     emitErr(`--top must be a positive number, got: ${opts.top}`);
     return 1;
   }
+  const confinedRoot = confinedProjectRoot();
+  if (confinedRoot !== null) {
+    const projectDenial = opts.projectRoot === void 0 ? null : confinementRefusal("--project", opts.projectRoot, confinedRoot);
+    if (projectDenial !== null) {
+      emitErr(projectDenial);
+      return 1;
+    }
+    for (const file2 of refsSpecFiles(opts.spec)) {
+      const denial = confinementRefusal("This file", resolveIndexPath(file2, opts.projectRoot ?? process.cwd()), confinedRoot);
+      if (denial !== null) {
+        emitErr(denial);
+        return 1;
+      }
+    }
+  }
   const crossFilePairs = parseCrossFileMultiSpec(opts.spec);
   if (crossFilePairs !== null) return runRefsCrossFile(crossFilePairs, opts);
   const { file, symbols } = parseMultiRefsSpec(opts.spec);
@@ -5641,8 +6181,11 @@ function runRefs(opts) {
     if (opts.excludeTests === true || opts.grep !== void 0) queryOpts.limit = REFS_TOP_SCAN_LIMIT;
     else if (opts.limit !== void 0) queryOpts.limit = opts.limit;
     else if (opts.top !== void 0) queryOpts.limit = REFS_TOP_SCAN_LIMIT;
-    if (opts.projectRoot !== void 0) queryOpts.rootDir = opts.projectRoot;
-    let results = applyTypedRefsTier(sym, file, queryRefs(queryOpts));
+    const rootDir = refsRootDir(opts);
+    if (rootDir !== void 0) queryOpts.rootDir = rootDir;
+    const scanned = queryRefs(queryOpts);
+    const preScanCount = scanned.length;
+    let results = applyTypedRefsTier(sym, file, scanned);
     let suppressed = 0;
     if (opts.excludeTests === true) {
       const f = applyExcludeTestsFilter(results);
@@ -5689,6 +6232,16 @@ function runRefs(opts) {
       if (opts.excludeTests === true && suppressed > 0) lines.push(`  ${countNoun(results.length, "reference")} (${excludeTestsHiddenNote(suppressed)})`);
       for (const ref of results) lines.push(...renderRefLines(ref, opts.context ?? 0));
     }
+    if (opts.top === void 0) {
+      const notice = truncationNotice(
+        results.length,
+        opts.limit ?? 100,
+        () => refsTotal(opts.excludeTests === true || matchesGrep !== void 0, filteredTotal, results.length, () => countRefs(queryOpts), preScanCount),
+        "references",
+        "--limit"
+      );
+      if (notice !== null) lines.push(`  token-goat: ${notice}`);
+    }
   }
   const fullSourceBytes = sumFileSizes(refFilePaths);
   if (opts.json === true) {
@@ -5715,8 +6268,11 @@ function runRefsCrossFile(pairs, opts) {
     if (opts.excludeTests === true || opts.grep !== void 0) queryOpts.limit = REFS_TOP_SCAN_LIMIT;
     else if (opts.limit !== void 0) queryOpts.limit = opts.limit;
     else if (opts.top !== void 0) queryOpts.limit = REFS_TOP_SCAN_LIMIT;
-    if (opts.projectRoot !== void 0) queryOpts.rootDir = opts.projectRoot;
-    let results = applyTypedRefsTier(symbol, file, queryRefs(queryOpts));
+    const rootDir = refsRootDir(opts);
+    if (rootDir !== void 0) queryOpts.rootDir = rootDir;
+    const scanned = queryRefs(queryOpts);
+    const preScanCount = scanned.length;
+    let results = applyTypedRefsTier(symbol, file, scanned);
     let suppressed = 0;
     if (opts.excludeTests === true) {
       const f = applyExcludeTestsFilter(results);
@@ -5761,6 +6317,16 @@ function runRefsCrossFile(pairs, opts) {
       if (opts.excludeTests === true && suppressed > 0) lines.push(`  ${countNoun(results.length, "reference")} (${excludeTestsHiddenNote(suppressed)})`);
       for (const ref of results) lines.push(...renderRefLines(ref, opts.context ?? 0));
     }
+    if (opts.top === void 0) {
+      const notice = truncationNotice(
+        results.length,
+        opts.limit ?? 100,
+        () => refsTotal(opts.excludeTests === true || matchesGrep !== void 0, filteredTotal, results.length, () => countRefs(queryOpts), preScanCount),
+        "references",
+        "--limit"
+      );
+      if (notice !== null) lines.push(`  token-goat: ${notice}`);
+    }
   }
   const fullSourceBytes = sumFileSizes(refFilePaths);
   if (opts.json === true) {
@@ -5782,8 +6348,11 @@ function runRefsSingle(opts) {
   if (opts.excludeTests === true || opts.grep !== void 0) queryOpts.limit = REFS_TOP_SCAN_LIMIT;
   else if (opts.limit !== void 0) queryOpts.limit = opts.limit;
   else if (opts.top !== void 0) queryOpts.limit = REFS_TOP_SCAN_LIMIT;
-  if (opts.projectRoot !== void 0) queryOpts.rootDir = opts.projectRoot;
-  let results = applyTypedRefsTier(symName, defFileHint, queryRefs(queryOpts));
+  const rootDir = refsRootDir(opts);
+  if (rootDir !== void 0) queryOpts.rootDir = rootDir;
+  const scanned = queryRefs(queryOpts);
+  const preScanCount = scanned.length;
+  let results = applyTypedRefsTier(symName, defFileHint, scanned);
   let suppressed = 0;
   if (opts.excludeTests === true) {
     const f = applyExcludeTestsFilter(results);
@@ -5811,15 +6380,15 @@ function runRefsSingle(opts) {
       emitErr(`No non-test references found for '${symName}' (${excludeTestsHiddenNote(suppressed)})`);
       return 1;
     }
-    const rootDir = opts.projectRoot ?? resolveProjectRoot({ project: process.cwd() });
-    if (querySymbols({ name: symName, rootDir, limit: 1 }).length === 0) {
-      emitErr(`Symbol not found: ${symName}${unknownSymbolSuggestion(symName, rootDir)}`);
-      if (opts.json !== true && isIndexEmptyForProject(globalDbPath(), rootDir)) emitErr(emptyIndexMessage(rootDir));
+    const rootDir2 = opts.projectRoot ?? resolveProjectRoot({ project: process.cwd() });
+    if (querySymbols({ name: symName, rootDir: rootDir2, limit: 1 }).length === 0) {
+      emitErr(`Symbol not found: ${symName}${unknownSymbolSuggestion(symName, rootDir2)}`);
+      if (opts.json !== true && isIndexEmptyForProject(globalDbPath(), rootDir2)) emitErr(emptyIndexMessage(rootDir2));
       return 1;
     }
     emitErr(`No references found for '${symName}'`);
     if (opts.json !== true) {
-      if (isIndexEmptyForProject(globalDbPath(), rootDir)) emitErr(emptyIndexMessage(rootDir));
+      if (isIndexEmptyForProject(globalDbPath(), rootDir2)) emitErr(emptyIndexMessage(rootDir2));
     }
     return 1;
   }
@@ -5840,9 +6409,10 @@ function runRefsSingle(opts) {
     return 0;
   }
   const lines = opts.top !== void 0 ? renderTopFilesSummary(results, opts.top, suppressed) : opts.callers === true ? [...opts.excludeTests === true && suppressed > 0 ? [`${countNoun(results.length, "reference")} (${excludeTestsHiddenNote(suppressed)})`] : [], ...renderCallerGroups(results, opts.context ?? 0)] : [...opts.excludeTests === true && suppressed > 0 ? [`${countNoun(results.length, "reference")} (${excludeTestsHiddenNote(suppressed)})`] : [], ...results.flatMap((ref) => renderRefLines(ref, opts.context ?? 0, ""))];
+  const refsFooter = opts.top !== void 0 ? "" : truncationFooter(results.length, opts.limit ?? 100, () => refsTotal(opts.excludeTests === true || matchesGrep !== void 0, filteredTotal, results.length, () => countRefs(queryOpts), preScanCount), "references", "--limit");
   const text = lines.join("\n");
-  emitGuarded(text, "symbol");
-  recordReadStat("symbol_read", fullSourceBytes, text, symName);
+  emit(guardText(text, "symbol") + refsFooter);
+  recordReadStat("symbol_read", fullSourceBytes, text + refsFooter, symName);
   return 0;
 }
 function applyExcludeTestsFilter(refs) {
@@ -5924,6 +6494,8 @@ function filteredToEmptyNotice(preFilterCount, minLines, grep) {
 }
 function prepareSymbolListing(file, opts) {
   const resolved = resolveIndexPath(file, opts.projectRoot ?? process.cwd());
+  const confined = confinementRefusal("This file", resolved, confinedProjectRoot());
+  if (confined !== null) return { kind: "confined", text: confined };
   if (opts.forceRefresh === true) {
     indexFileSyncPinned(resolved, globalDbPath());
     enqueueDirtyPathSafe(resolved, { alreadyResolved: true });
@@ -5984,7 +6556,7 @@ function runSkeleton(opts) {
   const multiFiles = parseMultiFileSpec(opts.file);
   if (multiFiles !== null) return runPerFileListing(multiFiles, (file) => runSkeleton({ ...opts, file, includeFilePath: true }), opts.json === true);
   const prep = prepareSymbolListing(opts.file, opts);
-  if (prep.kind === "empty") {
+  if (prep.kind === "confined" || prep.kind === "empty") {
     return { text: prep.text, code: 1 };
   }
   const { resolved, displayRoot, filtered, preFilterCount, refCounts, fullSourceBytes, symbolsTruncated, trueSymbolCount } = prep;
@@ -6001,7 +6573,11 @@ function runSkeleton(opts) {
     const payload = {
       items: capped.items,
       truncated: capped.truncated || symbolsTruncated,
-      totalCount: symbolsTruncated ? Math.max(trueSymbolCount ?? 0, capped.totalCount) : capped.totalCount
+      totalCount: symbolsTruncated ? Math.max(trueSymbolCount ?? 0, capped.totalCount) : capped.totalCount,
+      // Envelope-level, not per row: this listing is one named file, so the fact belongs to the
+      // whole payload. Only added when true, so live output keeps the exact three-key shape
+      // tests/json_envelope_shape.test.ts pins.
+      ...fileIsGone(resolved) ? { deleted: true } : {}
     };
     const text2 = JSON.stringify(payload, null, 2);
     recordReadStat("stub_view", fullSourceBytes, text2, opts.file);
@@ -6023,7 +6599,7 @@ function runOutline(opts) {
   const multiFiles = parseMultiFileSpec(opts.file);
   if (multiFiles !== null) return runPerFileListing(multiFiles, (file) => runOutline({ ...opts, file, includeFilePath: true }), opts.json === true);
   const prep = prepareSymbolListing(opts.file, opts);
-  if (prep.kind === "empty") {
+  if (prep.kind === "confined" || prep.kind === "empty") {
     return { text: prep.text, code: 1 };
   }
   const { resolved, displayRoot, filtered, preFilterCount, refCounts, fullSourceBytes, symbolsTruncated, trueSymbolCount } = prep;
@@ -6042,7 +6618,9 @@ function runOutline(opts) {
     const payload = {
       items: capped.items,
       truncated: capped.truncated || symbolsTruncated,
-      totalCount: symbolsTruncated ? Math.max(trueSymbolCount ?? 0, capped.totalCount) : capped.totalCount
+      totalCount: symbolsTruncated ? Math.max(trueSymbolCount ?? 0, capped.totalCount) : capped.totalCount,
+      // Same envelope-level flag, and same reason, as runSkeleton's payload above.
+      ...fileIsGone(resolved) ? { deleted: true } : {}
     };
     const text2 = JSON.stringify(payload, null, 2);
     recordReadStat("outline", fullSourceBytes, text2, opts.file);
@@ -6228,6 +6806,133 @@ function runYamlOutline(opts) {
 function runYamlQuery(opts) {
   return runQueryCommand(opts, parseYamlDocument, "YAML", "yaml-query", "yaml_query");
 }
+function runXmlOutline(opts) {
+  const text = readFileText(opts.file);
+  if (text === null) {
+    emitErr(`Could not read: ${opts.file}`);
+    return 1;
+  }
+  let summary;
+  try {
+    summary = outlineXml(text, { ...opts.maxDepth !== void 0 ? { maxDepth: opts.maxDepth } : {} });
+  } catch (e) {
+    emitErr(`Failed to parse XML: ${opts.file}
+${extractErrorMessage(e)}`);
+    return 1;
+  }
+  const fullSourceBytes = sumFileSizes([opts.file]);
+  if (opts.json === true) {
+    const jsonText = JSON.stringify(summary, null, 2);
+    emit(jsonText);
+    recordReadStat("xml_outline", fullSourceBytes, jsonText, opts.file);
+  } else {
+    const outlineText = formatXmlOutline(summary);
+    emitGuarded(outlineText, "xml-outline");
+    recordReadStat("xml_outline", fullSourceBytes, outlineText, opts.file);
+  }
+  return 0;
+}
+function runXmlQuery(opts) {
+  const text = readFileText(opts.file);
+  if (text === null) {
+    emitErr(`Could not read: ${opts.file}`);
+    return 1;
+  }
+  let head;
+  try {
+    head = opts.head !== void 0 ? requireNonNegativeStrictInt("--head", opts.head) : void 0;
+  } catch (e) {
+    emitErr(extractErrorMessage(e));
+    return 1;
+  }
+  try {
+    const result = queryXml(text, opts.path);
+    const fullSourceBytes = sumFileSizes([opts.file]);
+    if (result.attributeValues !== void 0) {
+      if (result.attributeValues.length === 0) {
+        if (opts.json === true) {
+          const jsonText = JSON.stringify({ items: [], truncated: false, totalCount: 0 });
+          emit(jsonText);
+          recordReadStat("xml_query", fullSourceBytes, jsonText, opts.file);
+        } else {
+          emit(`No attributes matched path: '${opts.path}'`);
+        }
+        return 0;
+      }
+      if (!result.fanned) {
+        const val = result.attributeValues[0] ?? "";
+        const outText = opts.json === true ? JSON.stringify(val) : val;
+        emit(outText);
+        recordReadStat("xml_query", fullSourceBytes, outText, opts.file);
+        return 0;
+      }
+      const totalCount2 = result.attributeValues.length;
+      const limited2 = head !== void 0 ? result.attributeValues.slice(0, head) : result.attributeValues;
+      const headTruncated2 = limited2.length < totalCount2;
+      if (opts.json === true) {
+        const capped = guardJsonRows(limited2);
+        const jsonText = JSON.stringify({ items: capped.items, truncated: capped.truncated || headTruncated2, totalCount: totalCount2 });
+        emit(jsonText);
+        recordReadStat("xml_query", fullSourceBytes, jsonText, opts.file);
+      } else {
+        const lines = limited2.map((item) => item);
+        if (headTruncated2) {
+          lines.push(`...(${totalCount2 - limited2.length} more items elided; use --head to see more)`);
+        }
+        const plainText = lines.join("\n");
+        emitGuarded(plainText, "xml-query");
+        recordReadStat("xml_query", fullSourceBytes, plainText, opts.file);
+      }
+      return 0;
+    }
+    if (result.items.length === 0) {
+      if (opts.json === true) {
+        const jsonText = JSON.stringify({ items: [], truncated: false, totalCount: 0 });
+        emit(jsonText);
+        recordReadStat("xml_query", fullSourceBytes, jsonText, opts.file);
+      } else {
+        emit(`No elements matched path: '${opts.path}'`);
+      }
+      return 0;
+    }
+    if (!result.fanned) {
+      const node = result.items[0];
+      if (opts.json === true) {
+        const jsonVal = xmlNodeToJson(node);
+        const jsonText = JSON.stringify(jsonVal, null, 2);
+        emit(jsonText);
+        recordReadStat("xml_query", fullSourceBytes, jsonText, opts.file);
+      } else {
+        const xmlText = serializeXmlNode(node);
+        emitGuarded(xmlText, "xml-query");
+        recordReadStat("xml_query", fullSourceBytes, xmlText, opts.file);
+      }
+      return 0;
+    }
+    const totalCount = result.items.length;
+    const limited = head !== void 0 ? result.items.slice(0, head) : result.items;
+    const headTruncated = limited.length < totalCount;
+    if (opts.json === true) {
+      const jsonItems = limited.map(xmlNodeToJson);
+      const capped = guardJsonRows(jsonItems);
+      const jsonText = JSON.stringify({ items: capped.items, truncated: capped.truncated || headTruncated, totalCount });
+      emit(jsonText);
+      recordReadStat("xml_query", fullSourceBytes, jsonText, opts.file);
+    } else {
+      const blocks = limited.map((node) => serializeXmlNode(node));
+      if (headTruncated) {
+        blocks.push(`...(${totalCount - limited.length} more elements elided; use --head to see more)`);
+      }
+      const plainText = blocks.join("\n");
+      emitGuarded(plainText, "xml-query");
+      recordReadStat("xml_query", fullSourceBytes, plainText, opts.file);
+    }
+    return 0;
+  } catch (e) {
+    emitErr(extractErrorMessage(e));
+    return 1;
+  }
+}
 function loadOpenApiOperations(file) {
   const text = readFileText(file);
   if (text === null) {
@@ -6646,6 +7351,7 @@ async function runScreenshot(url, destPath, opts) {
 }
 function runBriefCore(opts) {
   const resolution = resolveSymbolSpec(opts.spec, void 0, opts.projectRoot);
+  if (resolution.kind === "confined") return { text: resolution.message, code: 1 };
   if (resolution.kind === "ambiguous") {
     return {
       // Name the command explicitly: formatAmbiguity defaults to 'read', so brief's retry lines would otherwise tell the user to run `token-goat read`, which answers a different question than the one they asked.
@@ -6819,8 +7525,10 @@ function runFind(opts) {
     fuzzyNames = rankSimilarNames(rawSymbols.map((s) => s.name), opts.pattern);
   }
   const matched = fuzzyNames.length > 0 ? fuzzyNames.flatMap((n) => rawSymbols.filter((s) => s.name === n)) : symbols;
-  const files = [...new Set(matched.map((s) => s.filePath))].slice(0, opts.limit ?? 50);
-  const truncated = rawSymbols.length === FIND_SCAN_LIMIT;
+  const allFiles = [...new Set(matched.map((s) => s.filePath))];
+  const files = allFiles.slice(0, opts.limit ?? 50);
+  const limitDropped = allFiles.length - files.length;
+  const truncated = rawSymbols.length === FIND_SCAN_LIMIT || limitDropped > 0;
   if (files.length === 0) {
     emitErr(`No indexed files match '${opts.pattern}'`);
     return 1;
@@ -6836,7 +7544,10 @@ function runFind(opts) {
   for (const f of files) {
     emit(toDisplayPath(rootDir, f));
   }
-  if (truncated) {
+  if (limitDropped > 0) {
+    emitErr(`Showing ${files.length} of ${allFiles.length} matching files; rerun with --limit ${allFiles.length} to see them all`);
+  }
+  if (rawSymbols.length === FIND_SCAN_LIMIT) {
     emitErr(`Results may be incomplete; index scan hit limit of ${FIND_SCAN_LIMIT} symbols`);
   }
   return 0;
@@ -6933,10 +7644,16 @@ function buildChangedRefHint(cwd, ref) {
   const commitWord = commitCount === 1 ? "1 commit" : `${commitCount} commits`;
   return `Hint: this repo has only ${commitWord}; '${ref}' does not exist. Try: token-goat changed --since ${suggestedRef}`;
 }
+function refIsSafe(ref) {
+  return !ref.startsWith("-");
+}
+function emitUnsafeRef(ref) {
+  emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+}
 function runChanged(opts = {}) {
   const ref = opts.ref ?? "HEAD~5";
-  if (ref.startsWith("-")) {
-    emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+  if (!refIsSafe(ref)) {
+    emitUnsafeRef(ref);
     return 1;
   }
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7082,6 +7799,10 @@ function resolveSymbolSpecOrEmitError(commandName, spec, projectRoot) {
     return null;
   }
   const resolution = resolveSymbolSpec(spec, void 0, projectRoot);
+  if (resolution.kind === "confined") {
+    emitErr(resolution.message);
+    return null;
+  }
   if (resolution.kind === "ambiguous") {
     emitErr(
       formatAmbiguity(
@@ -7109,6 +7830,10 @@ function resolveSymbolSpecOrEmitError(commandName, spec, projectRoot) {
   return resolution.entry;
 }
 function runDiff(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("diff", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7196,6 +7921,10 @@ function parseLogDashLOutput(stdout) {
   return entries;
 }
 function runLog(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("log", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7589,6 +8318,11 @@ function runPerFileEmitting(files, label, run) {
 function runExports(opts) {
   const multiFiles = parseMultiFileSpec(opts.file);
   if (multiFiles !== null) return runPerFileEmitting(multiFiles, "Exports", (file) => runExports({ ...opts, file }));
+  const confined = fileConfinementRefusal("This file", opts.file, opts.projectRoot);
+  if (confined !== null) {
+    emitErr(confined);
+    return 1;
+  }
   const diskPath = resolveAgainstProjectRoot(opts.file, opts.projectRoot);
   const symbols = querySymbols({ filePath: resolveIndexPath(diskPath), limit: 500 });
   const kindOf = (name) => symbols.find((s) => s.name === name)?.kind ?? "export";
@@ -8612,29 +9346,49 @@ function hasAncestorDispatchRef(methodName, scopeName, classFile, rootDir) {
   }
   return false;
 }
-var CORE_SYMBOL_KINDS = [
+var GENERIC_SYMBOL_KINDS = [
   "function",
   "method",
   "class",
-  "interface",
-  "enum",
-  "type",
   "variable",
   "const",
-  "struct",
-  "trait",
   "namespace",
   "module",
   "property",
   "field",
   "constructor",
   "macro",
-  "union",
   "alias",
   "directive",
-  "extension",
-  "mixin",
-  "protocol"
+  "var",
+  "impl"
+];
+var OTHER_ADAPTER_SYMBOL_KINDS = [
+  "heading",
+  "selector",
+  "env_key",
+  "key",
+  "section",
+  "html_class",
+  "html_id",
+  "apex_method",
+  "sf_record_type",
+  "sf_apex_class",
+  "sf_flow",
+  "sf_flow_record_lookup",
+  "sf_flow_action",
+  "sf_flow_subflow",
+  "sf_mystery_type",
+  "sf_lightning_component_bundle",
+  "sf_lwc_target",
+  "sf_lwc_property",
+  "liquid_schema",
+  "liquid_section_file",
+  "lwc_bundle",
+  "lwc_component_alias",
+  "lwc_api_property",
+  "lwc_api_method",
+  "lwc_ref"
 ];
 function runDead(opts) {
   if (opts.top !== void 0 && opts.top <= 0) {
@@ -8735,7 +9489,7 @@ var SOURCE_EXTENSIONS = [
 function runDeps(opts) {
   let text;
   try {
-    text = fs6.readFileSync(opts.file, "utf-8");
+    text = decodeSource(fs6.readFileSync(opts.file));
   } catch {
     emitErr2(`Could not read: ${opts.file}`);
     return 1;
@@ -8884,6 +9638,9 @@ var TYPE_KINDS = [
   // Kotlin/Scala object.
   "graphql_extend"
 ];
+var CORE_SYMBOL_KINDS = [
+  .../* @__PURE__ */ new Set([...GENERIC_SYMBOL_KINDS, ...TYPE_KINDS, ...OTHER_ADAPTER_SYMBOL_KINDS])
+];
 var TYPES_EXCLUDE_TESTS_SCAN_LIMIT = 5e3;
 function runTypes(opts) {
   if (opts.limit !== void 0 && opts.limit <= 0) {
@@ -8991,6 +9748,11 @@ function runScope(opts) {
     emitErr2(`Invalid line number: ${lineStr}`);
     return 1;
   }
+  const confined = fileConfinementRefusal("This file", file, void 0);
+  if (confined !== null) {
+    emitErr2(confined);
+    return 1;
+  }
   const filePath = resolveIndexPath(file);
   const syms = querySymbols({ filePath, limit: ALL_SYMBOLS_IN_FILE_LIMIT });
   const enclosing = syms.filter((s) => s.lineStart <= line && line <= s.lineEnd).sort((a, b) => b.lineStart - a.lineStart);
@@ -9600,6 +10362,8 @@ export {
   runJsonQuery,
   runYamlOutline,
   runYamlQuery,
+  runXmlOutline,
+  runXmlQuery,
   runOpenApiOutline,
   runOpenApiOp,
   runZipList,