token-goat 2.6.34 → 2.6.35

package/SECURITY.md

@@ -56,9 +56,10 @@ Without the overrides a consumer resolves `protobufjs` at 6.x, which carries mor
 | Package | Advisories it carries | Where it loads | Why the advisory does not reach you through Token-Goat |
 | --- | --- | --- | --- |
 | `@xenova/transformers` | [`protobufjs`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) (critical), `onnx-proto`, `onnxruntime-web`, and its own pinned `sharp` | optional; loaded only when semantic search builds or queries embeddings | not mitigated, so it is the one to weigh. Skip it with `npm install --omit=optional`, or leave `indexing.embeddings_enabled` off, and the code never loads |
-| `exceljs` | [`uuid`](https://github.com/advisories/GHSA-w5hq-g745-h8pq) | optional; loaded only when an `xlsx-*` command opens a workbook | the advisory is a missing bounds check on a caller-supplied `buf` argument; ExcelJS never passes one |
 
-`npm install --omit=optional` gives you an install without either of these, and `npm audit` reports it clean. Every command still starts; the ones that need a package you skipped say so. The `xlsx-*` commands report that ExcelJS is not installed rather than failing oddly, `zip-list`/`zip-read` do the same for fflate, and `semantic` keeps working on keyword search alone: it is the embedding half that goes away, not the command.
+`npm install --omit=optional` gives you an install without it, and `npm audit` reports it clean. Every command still starts; the ones that need a package you skipped say so. The `xlsx-*`, `docx-*` and `pptx-*` commands report that fflate is not installed rather than failing oddly, `zip-list`/`zip-read` do the same, and `semantic` keeps working on keyword search alone: it is the embedding half that goes away, not the command.
+
+`exceljs` used to appear in that table, carrying [`uuid`](https://github.com/advisories/GHSA-w5hq-g745-h8pq). It is now a development dependency instead. The `xlsx-*` commands read the workbook container directly with `fflate` and `fast-xml-parser`, the same two packages the `.docx` and `.pptx` readers already used, so `exceljs` is only a test fixture writer now. That removes 55 packages from a default install, including every deprecated one in the tree.
 
 `html-to-text` used to appear in that table, carrying [`deepmerge-ts`](https://github.com/advisories/GHSA-ggr8-5vv4-36mx). It is now a development dependency instead. esbuild inlines it into `dist/token-goat.mjs` at build time and nothing in the published bundle imports it, so it was a runtime dependency in name only: moving it removes `html-to-text`, `deepmerge-ts`, `htmlparser2`, `selderee`, and `dom-serializer` from an installed copy while the HTML-to-text output stays byte-for-byte identical. That is what takes the no-optional install to zero, and it is better than the alternative we had considered, rolling `html-to-text` back to 9.x: that version pins `htmlparser2` two majors lower, and `htmlparser2` is what parses fetched pages, so it would have traded an advisory in an options merger for an older parser on the one path that handles untrusted input.
 
@@ -89,8 +90,8 @@ Token-Goat is source-available under the PolyForm Noncommercial License 1.0.0. S
 
 Every production dependency is permissively licensed, but a scan does not read it that way on its
 own. Counted from `package-lock.json`, which lists the packages for every platform rather than only
-the ones this machine installed, 22 entries need a human answer: 7 declare a license a scanner
-cannot resolve, and 15 carry a copyleft term. All 22 arrive through optional dependencies. Install
+the ones this machine installed, 21 entries need a human answer: 7 declare a license a scanner
+cannot resolve, and 14 carry a copyleft term. All 21 arrive through optional dependencies. Install
 with `npm install --omit=optional token-goat` and not one of them is present.
 
 **Declarations a scanner cannot resolve.** Both are upstream mistakes, and both are the same
@@ -110,19 +111,19 @@ an unresolvable one.
 | --- | --- | --- |
 | `@img/sharp-libvips-<platform>` (10 packages) | `LGPL-3.0-or-later` | libvips, shipped as a prebuilt shared library and used unmodified. LGPL asks that the library stay replaceable, and it is: it is a separate package that `sharp` loads at runtime. |
 | `@img/sharp-<platform>` (4 packages) | `Apache-2.0 AND LGPL-3.0-or-later` | the Apache half is `sharp` itself, the LGPL half is the same libvips |
-| `jszip` | `(MIT OR GPL-3.0-or-later)` | a choice between the two, and the MIT half is taken |
 
-`sharp` and `jszip` are both optional: `sharp` powers image shrinking, `jszip` arrives through
-`exceljs` for the `xlsx-*` commands.
+`sharp` is optional: it powers image shrinking. `jszip` used to be listed here too; it arrived
+through `exceljs`, which is no longer a dependency a consumer installs.
 
 **Three packages with no license at all used to be here.** `buffers@0.1.1` and `chainsaw@0.1.0`
 shipped with neither a `license` field nor a license file, and `traverse@0.3.9` had the file but
 not the field. No grant at all is worse for a review than a copyleft grant, because there is
 nothing to apply policy to. They arrived through `exceljs`, which depends on `unzipper`, which
 depended on `binary`, which depended on all three. `unzipper` dropped `binary` in 0.11, so an
-override to `^0.12.5` removes the sub-chain, and the deprecated `fstream` with it. Token-goat reads
-workbooks through `wb.xlsx.readFile()`, which goes through `jszip`; `unzipper` is only reachable
-through the streaming reader in `exceljs`, which this code never calls.
+override to `^0.12.5` removes the sub-chain, and the deprecated `fstream` with it. `exceljs` is now
+a development dependency, so none of that chain reaches an installed copy either way; the override
+stays because it is what keeps this repository's own `npm audit`, which includes development
+dependencies, clean.
 
 Reproduce the whole picture:
 

package/dist/{token-goat-chunk-IYYQOPY4.mjs → token-goat-chunk-D5IZEGN2.mjs}

@@ -50,7 +50,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-I2KCEGIP.mjs";
 import {
   PER_FILE_COUNTERFACTUAL_CEILING,
   _detectOpenQuote,
@@ -100,7 +100,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-K7W3P2TJ.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -7644,10 +7644,16 @@ function buildChangedRefHint(cwd, ref) {
   const commitWord = commitCount === 1 ? "1 commit" : `${commitCount} commits`;
   return `Hint: this repo has only ${commitWord}; '${ref}' does not exist. Try: token-goat changed --since ${suggestedRef}`;
 }
+function refIsSafe(ref) {
+  return !ref.startsWith("-");
+}
+function emitUnsafeRef(ref) {
+  emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+}
 function runChanged(opts = {}) {
   const ref = opts.ref ?? "HEAD~5";
-  if (ref.startsWith("-")) {
-    emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+  if (!refIsSafe(ref)) {
+    emitUnsafeRef(ref);
     return 1;
   }
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7824,6 +7830,10 @@ function resolveSymbolSpecOrEmitError(commandName, spec, projectRoot) {
   return resolution.entry;
 }
 function runDiff(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("diff", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7911,6 +7921,10 @@ function parseLogDashLOutput(stdout) {
   return entries;
 }
 function runLog(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("log", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();

package/dist/{token-goat-chunk-WA2ER6TZ.mjs → token-goat-chunk-DQIT5JIF.mjs}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   redactSecrets,
   stripAnsiCodes
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-K7W3P2TJ.mjs";
 
 // src/tool_filters/helpers.ts
 import * as fs from "node:fs";

package/dist/{token-goat-chunk-L7QLEVO7.mjs → token-goat-chunk-DRAIYVUI.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-IYYQOPY4.mjs";
+} from "./token-goat-chunk-D5IZEGN2.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-I2KCEGIP.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-K7W3P2TJ.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 
@@ -126,7 +126,19 @@ function forCompare(p) {
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function resolveToolRoot(projectRoot) {
-  return resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  assertRootAllowed(resolved);
+  return resolved;
+}
+var RootNotAllowedError = class extends Error {
+};
+function assertRootAllowed(resolvedRoot) {
+  const allowedRoots = loadConfig().mcp.allowed_roots;
+  if (allowedRoots.length === 0) return;
+  if (allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) return;
+  throw new RootNotAllowedError(
+    `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`
+  );
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
@@ -150,16 +162,6 @@ function specFilePart(spec) {
 var NO_PINS = /* @__PURE__ */ new Map();
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
-  const allowedRoots = loadConfig().mcp.allowed_roots;
-  if (allowedRoots.length > 0 && !allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) {
-    return {
-      ok: false,
-      refusal: toCallToolResult({
-        text: `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`,
-        code: 1
-      })
-    };
-  }
   const checked = [];
   const pins = /* @__PURE__ */ new Map();
   for (const raw of targets) {

package/dist/{token-goat-chunk-GXBPEQR2.mjs → token-goat-chunk-HW4VUKJ5.mjs}

@@ -84,7 +84,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-IYYQOPY4.mjs";
+} from "./token-goat-chunk-D5IZEGN2.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
@@ -105,7 +105,7 @@ import {
   readStdinJson,
   searchRecall,
   storeWebOutput
-} from "./token-goat-chunk-OA3GFKP2.mjs";
+} from "./token-goat-chunk-SIHYQCTM.mjs";
 import {
   AGENT_SALT_MARKER,
   CONTEXT_AUTOCOMPACT_TOKENS,
@@ -243,7 +243,7 @@ import {
   vscodeDecoderConfigured,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-I2KCEGIP.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -322,7 +322,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-K7W3P2TJ.mjs";
 import {
   __export
 } from "./token-goat-chunk-AEX54RUZ.mjs";
@@ -13446,7 +13446,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-L7QLEVO7.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-DRAIYVUI.mjs"));
     ({ StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js"));
   } catch (err2) {
     process.stderr.write(
@@ -13467,7 +13467,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-FRMEOIRU.mjs");
+  const { relay } = await import("./token-goat-chunk-Y2NH6DGZ.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -14324,7 +14324,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-I6EQH27G.mjs");
+    const bashRunner = await import("./token-goat-chunk-UIZVX3HN.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -15002,7 +15002,13 @@ function writeReplacedBuffer(file, replacedBuf, preWriteStat) {
     const testDelayMs = Number(process.env["TOKEN_GOAT_TEST_REPLACE_DELAY_MS"] ?? "");
     if (Number.isFinite(testDelayMs) && testDelayMs > 0) {
       process.stderr.write("TOKEN_GOAT_TEST_REPLACE_DELAY_READY\n");
-      sleepSync(testDelayMs);
+      const until = process.env["TOKEN_GOAT_TEST_REPLACE_DELAY_UNTIL"];
+      const deadline = Date.now() + testDelayMs;
+      if (until !== void 0 && until !== "") {
+        while (Date.now() < deadline && !fs26.existsSync(until)) sleepSync(5);
+      } else {
+        sleepSync(testDelayMs);
+      }
     }
     let preRenameStat;
     try {