token-goat 2.6.34 → 2.6.35

package/dist/{token-goat-hook-chunk-CNLMPHXT.mjs → token-goat-hook-chunk-2O7P4Z6Q.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.34";
+    return "2.6.35";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -1183,6 +1183,9 @@ function getDisplayRoot(explicitRoot) {
   _displayRootCache = { cwd, root };
   return root;
 }
+registerReset(() => {
+  _displayRootCache = null;
+});
 function isUnderSystemTemp(filePath) {
   let sysTemp;
   try {
@@ -2495,7 +2498,7 @@ function getLastProjectConfigParseError() {
   return _lastProjectConfigParseError;
 }
 var PROJECT_LOCKED_SECTIONS = ["injection", "webfetch", "gdrive", "mcp", "network"];
-var PROJECT_LOCKED_KEYS = ["indexing.cross_project_symbols"];
+var PROJECT_LOCKED_KEYS = ["indexing.cross_project_symbols", "worker.blocked_roots"];
 var _lastProjectConfigLockedKeys = [];
 function stripLockedProjectKeys(projectRaw) {
   const cleaned = {};
@@ -2667,6 +2670,9 @@ function resolveConfigProjectRoot() {
   _projectRootCache = { cwd, root };
   return root;
 }
+registerReset(() => {
+  _projectRootCache = null;
+});
 function isAutoTriggerMultiplierExplicit() {
   const setsMultiplier = (text) => {
     const raw = parse(text);
@@ -4158,7 +4164,8 @@ function propagateEndLinesToSymbols(symbols, sections) {
     return sym;
   });
 }
-function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix) {
+function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix, opts) {
+  const block = opts?.blockComment;
   let depth = 0;
   let quote = null;
   for (let i = openBraceIndex; i < content.length; i++) {
@@ -4171,6 +4178,11 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       if (ch === quote) quote = null;
       continue;
     }
+    if (block !== void 0 && content.startsWith(block[0], i)) {
+      const close = content.indexOf(block[1], i + block[0].length);
+      i = close === -1 ? content.length : close + block[1].length - 1;
+      continue;
+    }
     if (lineCommentPrefix !== void 0 && content.startsWith(lineCommentPrefix, i)) {
       while (i < content.length && content[i] !== "\n") i++;
       continue;
@@ -4187,7 +4199,106 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       }
     }
   }
-  return totalLines;
+  return opts?.noMatchValue ?? totalLines;
+}
+function assignBraceBlockSpans(symbols, content, lineCommentPrefix) {
+  if (symbols.length === 0) return [...symbols];
+  const lines = content.split("\n");
+  const totalLines = lines.length;
+  const lineIndex = buildLineIndex(content);
+  const starts = [...new Set(symbols.map((s) => s.lineStart))].sort((a, b) => a - b);
+  const blockComment = lineCommentPrefix === "//" ? ["/*", "*/"] : lineCommentPrefix === "#" ? ["<#", "#>"] : void 0;
+  return symbols.map((sym) => {
+    if (sym.lineEnd !== sym.lineStart) return sym;
+    const nextStart = starts.find((s) => s > sym.lineStart);
+    const lastSearchLine = Math.min(nextStart !== void 0 ? nextStart - 1 : totalLines, sym.lineStart + BRACE_SEARCH_MAX_LINES);
+    const openIndex = findBlockOpenBrace(content, lineIndex, sym.lineStart, lastSearchLine, lineCommentPrefix, blockComment);
+    if (openIndex === null) return sym;
+    const endLine = findMatchingBraceEndLine(
+      content,
+      openIndex,
+      totalLines,
+      lineIndex,
+      lineCommentPrefix,
+      blockComment === void 0 ? { noMatchValue: -1 } : { blockComment, noMatchValue: -1 }
+    );
+    if (endLine <= sym.lineStart) return sym;
+    return { ...sym, lineEnd: endLine, body: lines.slice(sym.lineStart - 1, endLine).join("\n") };
+  });
+}
+var BRACE_SEARCH_MAX_LINES = 10;
+function findBlockOpenBrace(content, lineIndex, startLine, lastSearchLine, lineCommentPrefix, blockComment) {
+  const from = lineIndex[startLine - 1];
+  if (from === void 0) return null;
+  const to = lineIndex[lastSearchLine] ?? content.length;
+  let quote = null;
+  let parenDepth = 0;
+  let linesSeen = 0;
+  let atLineStart = false;
+  for (let i = from; i < to; i++) {
+    const ch = content[i];
+    if (ch === void 0) break;
+    if (quote !== null) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "\n") {
+      linesSeen++;
+      atLineStart = true;
+      continue;
+    }
+    if (blockComment !== void 0 && content.startsWith(blockComment[0], i)) {
+      const close = content.indexOf(blockComment[1], i + blockComment[0].length);
+      if (close === -1) return null;
+      i = close + blockComment[1].length - 1;
+      continue;
+    }
+    if (lineCommentPrefix !== void 0 && content.startsWith(lineCommentPrefix, i)) {
+      while (i + 1 < to && content[i + 1] !== "\n") i++;
+      continue;
+    }
+    if (atLineStart && !/\s/.test(ch)) {
+      atLineStart = false;
+      if (parenDepth === 0 && linesSeen >= 1 && startsWithBlockKeyword(content, i, to)) return null;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[") parenDepth++;
+    else if (ch === ")" || ch === "]") {
+      if (parenDepth > 0) parenDepth--;
+    } else if (ch === ";") return null;
+    else if (ch === "{") return i;
+  }
+  return null;
+}
+var BLOCK_OPENING_KEYWORDS = /* @__PURE__ */ new Set([
+  "if",
+  "for",
+  "while",
+  "do",
+  "switch",
+  "when",
+  "match",
+  "try",
+  "foreach",
+  "loop",
+  "guard",
+  "repeat",
+  "unless",
+  "until"
+]);
+function startsWithBlockKeyword(content, i, to) {
+  const first = content[i];
+  if (first === void 0 || !/[A-Za-z_]/.test(first)) return false;
+  let j = i + 1;
+  while (j < to && /[A-Za-z0-9_]/.test(content[j])) j++;
+  return BLOCK_OPENING_KEYWORDS.has(content.slice(i, j));
 }
 
 // src/languages/ini_idx.ts
@@ -5970,7 +6081,13 @@ var SECRET_PATTERNS = [
   // directly against the header name and the scheme directly against the space, so a body like
   // {"Authorization": "Bearer <token>"} -- the shape any logged fetch or MCP result arrives in
   // -- matched nothing and the token was cached verbatim.
-  ["auth_bearer_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Bearer[ \t])[A-Za-z0-9\-._~+/]{10,}=*/gi],
+  // `token` is the second scheme spelling in wide use -- it is what curl and gh examples pass for
+  // GitHub and many other APIs -- and an opaque value behind it carries exactly the same authority
+  // as one behind `Bearer`. The trailing gap is `{1,8}` rather than a single space for the same
+  // reason every other gap in this lookbehind already is: a hand-aligned or reformatted header
+  // ("Authorization:  Bearer  <token>") is ordinary, and demanding exactly one space there made
+  // this the one position in the pattern that a second space defeated.
+  ["auth_bearer_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}(?:Bearer|token)[ \t]{1,8})[A-Za-z0-9\-._~+/]{10,}=*/gi],
   ["auth_basic_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Basic[ \t])[A-Za-z0-9+/]{6,}=*/gi],
   // JWTs have no distinctive prefix of their own, but the base64url encoding of the smallest
   // realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical
@@ -6024,7 +6141,22 @@ var SECRET_PATTERNS = [
   // SECRET_KEY=, and DB_PASSWORD_HASH= all passed through in full. That class matches
   // identifier characters only, so prose that merely mentions a keyword still never reaches
   // a separator and stays unredacted. api[_-]?key covers the apikey and api-key spellings too.
-  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token)[a-z0-9_-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:\\[^\n]|[^\s\\&;#'"[\],{}:]){4,}/gi]
+  // `& ; # , :` play two incompatible roles. They separate one field from the next (a query
+  // string, a cookie header, an inline env list), and they are also perfectly ordinary password
+  // characters. Rejecting them outright got the first role right and the second badly wrong: the
+  // match stopped at the first one and left everything after it in plain text, so
+  // `password=corr&horse&battery` redacted four characters and printed the rest, and
+  // `DB_PASSWORD=Aa1:xyz` matched nothing at all because the run before the `:` was under the
+  // four-character floor. A tail left sitting in the open is the outcome this module's header
+  // calls worse than no redaction, because it reads as handled.
+  //
+  // So the separator role is decided by what follows rather than assumed: one of these characters
+  // ends the value only when the next thing along is another `name=` / `name:` pair, which is what
+  // an actual field separator is always followed by. `,OTHER=public` and `; other=1` still end it;
+  // the `&` in the middle of a passphrase does not. Whitespace, quotes and brackets are unchanged
+  // -- they end a value unconditionally, which is also what keeps this pattern from re-matching
+  // the `[REDACTED:...]` placeholder it just wrote.
+  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token)[a-z0-9_-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:\\[^\n]|[^\s\\&;#,:'"[\]{}]|[&;#,:](?![ \t]*[A-Za-z_][A-Za-z0-9_.-]*[ \t]*[:=])){4,}/gi]
 ];
 function redactSecrets(text) {
   let count = 0;
@@ -6221,6 +6353,7 @@ export {
   assignFlatEndLines,
   propagateEndLinesToSymbols,
   findMatchingBraceEndLine,
+  assignBraceBlockSpans,
   extractIni,
   _lineClosesQuote,
   _detectOpenQuote,

package/dist/{token-goat-hook-chunk-I5VM5PO5.mjs → token-goat-hook-chunk-3AAH72SO.mjs}

@@ -84,7 +84,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-hook-chunk-KGLMNOGD.mjs";
+} from "./token-goat-hook-chunk-NXVT4F3S.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
@@ -105,7 +105,7 @@ import {
   readStdinJson,
   searchRecall,
   storeWebOutput
-} from "./token-goat-hook-chunk-6C5RN3CM.mjs";
+} from "./token-goat-hook-chunk-CRBMPT74.mjs";
 import {
   AGENT_SALT_MARKER,
   CONTEXT_AUTOCOMPACT_TOKENS,
@@ -243,7 +243,7 @@ import {
   vscodeDecoderConfigured,
   walkProject,
   writeCompact
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -322,7 +322,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import {
   __export
@@ -13447,7 +13447,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-hook-chunk-OQML5EMA.mjs"));
+    ({ createMcpServer } = await import("./token-goat-hook-chunk-VU6VGZBM.mjs"));
     ({ StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js"));
   } catch (err2) {
     process.stderr.write(
@@ -13468,7 +13468,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-hook-chunk-ATEGFQAU.mjs");
+  const { relay } = await import("./token-goat-hook-chunk-J4HKWUWZ.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -14325,7 +14325,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-hook-chunk-QTZ6YUMQ.mjs");
+    const bashRunner = await import("./token-goat-hook-chunk-D6UJEFHX.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -15003,7 +15003,13 @@ function writeReplacedBuffer(file, replacedBuf, preWriteStat) {
     const testDelayMs = Number(process.env["TOKEN_GOAT_TEST_REPLACE_DELAY_MS"] ?? "");
     if (Number.isFinite(testDelayMs) && testDelayMs > 0) {
       process.stderr.write("TOKEN_GOAT_TEST_REPLACE_DELAY_READY\n");
-      sleepSync(testDelayMs);
+      const until = process.env["TOKEN_GOAT_TEST_REPLACE_DELAY_UNTIL"];
+      const deadline = Date.now() + testDelayMs;
+      if (until !== void 0 && until !== "") {
+        while (Date.now() < deadline && !fs26.existsSync(until)) sleepSync(5);
+      } else {
+        sleepSync(testDelayMs);
+      }
     }
     let preRenameStat;
     try {

package/dist/{token-goat-hook-chunk-BU5OFDGQ.mjs → token-goat-hook-chunk-4POU6OHK.mjs}

@@ -2,13 +2,15 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   canRunWrappedShell,
+  compressOutput,
   dedupeConsecutive,
   detectFromCommand,
+  filterByName,
   hasBareBackgroundOrNewline,
   isRewriteWorthwhile,
   resolveMinNetSavingsBytes,
   shlexSplit
-} from "./token-goat-hook-chunk-2ISZ4AZR.mjs";
+} from "./token-goat-hook-chunk-NIPXIAPA.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   HOOK_EVENTS,
@@ -26,7 +28,7 @@ import {
   storeBashOutput,
   storeWebOutput,
   summarizeOutputDelta
-} from "./token-goat-hook-chunk-6C5RN3CM.mjs";
+} from "./token-goat-hook-chunk-CRBMPT74.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
@@ -116,7 +118,7 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
 import {
   VERSION,
   detectHarness,
@@ -135,7 +137,7 @@ import {
   runGit,
   shortFingerprint,
   toKB
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 
 // src/hooks_grep.ts
 function grepIntInput(toolInput, key) {
@@ -573,7 +575,7 @@ import crypto from "node:crypto";
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-hook-chunk-I5VM5PO5.mjs");
+  const { buildProgram } = await import("./token-goat-hook-chunk-3AAH72SO.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -7902,12 +7904,151 @@ function extractRgStructuralSearch(cmd) {
 function extractGrepPipeChain(cmd) {
   return /^(?:rg|grep)\b.*\|\s*(?:rg|grep)\b/.test(cmd);
 }
+function splitCommandWords(cmd) {
+  const words = [];
+  let cur = "";
+  let quote = null;
+  let started = false;
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (quote !== null) {
+      if (ch === "\\" && quote === '"' && i + 1 < cmd.length) {
+        cur += cmd[i + 1];
+        i++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      else cur += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < cmd.length) {
+      cur += cmd[i + 1];
+      i++;
+      started = true;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (started) words.push(cur);
+      cur = "";
+      started = false;
+      continue;
+    }
+    cur += ch;
+    started = true;
+  }
+  if (started) words.push(cur);
+  return words;
+}
+var CURL_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-H",
+  "--header",
+  "-A",
+  "--user-agent",
+  "-e",
+  "--referer",
+  "-b",
+  "--cookie",
+  "-c",
+  "--cookie-jar",
+  "-o",
+  "--output",
+  "--output-dir",
+  "-u",
+  "--user",
+  "-U",
+  "--proxy-user",
+  "-x",
+  "--proxy",
+  "-X",
+  "--request",
+  "-d",
+  "--data",
+  "--data-raw",
+  "--data-binary",
+  "--data-urlencode",
+  "-F",
+  "--form",
+  "-T",
+  "--upload-file",
+  "-K",
+  "--config",
+  "-w",
+  "--write-out",
+  "-m",
+  "--max-time",
+  "--connect-to",
+  "--resolve",
+  "--retry",
+  "--cacert",
+  "-E",
+  "--cert",
+  "--key",
+  "--range",
+  "-r",
+  "--interface",
+  // Options whose own value is a URL or a host. Leaving these out was the same defect as reading
+  // the first URL in the string: `curl --doh-url https://doh/ -o f https://target` answered with
+  // the DoH resolver rather than the file being fetched. `--url-query` belongs here too -- it
+  // appends query data to the request, it does not name the request target.
+  "--url-query",
+  "--doh-url",
+  "--preproxy",
+  "--proxy1.0",
+  "--socks4",
+  "--socks4a",
+  "--socks5",
+  "--socks5-hostname",
+  "--proxy-header",
+  "--noproxy",
+  "--dns-servers",
+  "--aws-sigv4",
+  "--proxy-cacert",
+  "--proxy-cert",
+  "--proxy-key",
+  "--oauth2-bearer",
+  "--hsts",
+  "--alt-svc",
+  "--etag-save",
+  "--etag-compare",
+  "--trace",
+  "--trace-ascii",
+  "--dump-header",
+  "-D"
+]);
 function extractCurlUrl(cmd) {
-  const m = /(https?:\/\/[^\s'"]+)/.exec(cmd);
-  return m?.[1] ?? null;
+  const words = splitCommandWords(cmd);
+  let positional = null;
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (w === "--url") {
+      const next = words[i + 1];
+      if (next !== void 0 && /^https?:\/\//.test(next)) return next;
+      i++;
+      continue;
+    }
+    const eq = w.indexOf("=");
+    if (w.startsWith("--") && eq > 0) {
+      if (w.slice(0, eq) === "--url" && /^https?:\/\//.test(w.slice(eq + 1))) return w.slice(eq + 1);
+      continue;
+    }
+    if (CURL_VALUE_FLAGS.has(w)) {
+      i++;
+      continue;
+    }
+    if (w.startsWith("-") && w !== "-") continue;
+    if (/^https?:\/\//.test(w)) return w;
+    positional ??= /https?:\/\/[^\s'")}`]+/.exec(w)?.[0] ?? null;
+  }
+  if (positional !== null) return positional;
+  return null;
 }
 function extractTgSurgicalRead(cmd, cwd) {
-  const m = /^token-goat\s+(symbol|read|section|skill-body|skill-compact|map)(?:\s+(.*))?$/.exec(cmd);
+  const m = /^(?:token-goat|tg)\s+(symbol|read|section|skill-body|skill-compact|map)(?:\s+(.*))?$/.exec(cmd);
   if (!m) return null;
   const sub = m[1];
   const rest = (m[2] ?? "").trim();
@@ -7986,9 +8127,9 @@ function extractCurlDownload(cmd) {
   const outputPath = outputMatch[1] ?? outputMatch[2] ?? outputMatch[3];
   if (!outputPath) return null;
   if (curlHasUnsafeFlags(cmd)) return null;
-  const urlMatch = /(https?:\/\/[^\s'"]+)/.exec(cmd);
-  if (!urlMatch?.[1]) return null;
-  return { url: urlMatch[1], outputPath };
+  const url = extractCurlUrl(cmd);
+  if (url === null) return null;
+  return { url, outputPath };
 }
 function isTscCommand(cmd) {
   return /^\s*tsc(\s|$)/i.test(cmd);
@@ -8041,9 +8182,34 @@ function maybeCompressRewrite(event, rawCmd, cmd) {
   const wrapped = `token-goat compress -f ${filterName} --timeout ${cfg.timeout_seconds} -c ${shellQuoteSingle(rawCmd)}`;
   return { hookType: "rewriteInput", updatedInput: { ...event.toolInput, command: wrapped } };
 }
+async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes) {
+  if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
+  if (isCompressibleSingleCommand(cmd)) return null;
+  if (exitCode !== null && exitCode !== 0) return null;
+  let cfg;
+  try {
+    cfg = loadConfig().bash_compress;
+  } catch {
+    return null;
+  }
+  if (!cfg.enabled || cfg.disabled_filters.includes("generic")) return null;
+  if (Buffer.byteLength(output, "utf-8") < cacheMinBytes) return null;
+  const filter3 = filterByName("generic");
+  if (filter3 === null) return null;
+  const compressed = compressOutput(filter3, output, "", exitCode ?? 0, [], {
+    maxLines: cfg.max_lines,
+    maxBytes: cfg.max_bytes
+  });
+  const minNet = resolveMinNetSavingsBytes();
+  if (!compressed.worthApplying(minNet)) return null;
+  const id = await storeBashOutput(cmd, output, exitCode ?? 0, cwd);
+  recordStat("bash_compress:generic", compressed.bytesSaved, compressed.tokensSaved);
+  const body = compressed.withMarker(minNet) + "\n[token-goat] full output: bash-output " + id + " --full";
+  return { hookType: "rewriteOutput", updatedOutput: body };
+}
 function unwrapCompressCommand(executed) {
   const t = executed.trim();
-  if (!/^token-goat\s+compress\b/.test(t)) return null;
+  if (!/^(?:token-goat|tg)\s+compress\b/.test(t)) return null;
   let argv;
   try {
     argv = shlexSplit(t);
@@ -8095,6 +8261,28 @@ function detectUnbalancedShellSyntax(cmd) {
       i = j;
       continue;
     }
+    if (ch === "$" && cmd[i + 1] === "'") {
+      let j = i + 2;
+      let closed = false;
+      while (j < cmd.length) {
+        if (cmd[j] === "\\") {
+          j += 2;
+          continue;
+        }
+        if (cmd[j] === "'") {
+          j++;
+          closed = true;
+          break;
+        }
+        j++;
+      }
+      if (!closed) {
+        inSingle = true;
+        break;
+      }
+      i = j;
+      continue;
+    }
     if (ch === "#" && (i === 0 || /\s/.test(cmd[i - 1] ?? ""))) {
       const nl2 = cmd.indexOf("\n", i);
       i = nl2 === -1 ? cmd.length : nl2 + 1;
@@ -8701,7 +8889,11 @@ async function postBashHandler(event) {
       recordBashOutput(gitScopedCacheHash, gitScopedCacheId, Buffer.byteLength(output, "utf-8"));
     }
     const isMonitoring = getMonitoringRecallHint(cmd) !== null;
-    if (!isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) return passOutput();
+    if (!isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) {
+      const compound = await maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes);
+      if (compound !== null) return compound;
+      return passOutput();
+    }
     if (Buffer.byteLength(output, "utf-8") < cacheMinBytes) return passOutput();
     const cacheKey = isCurlGetCommand(cmd) ? extractCurlUrl(cmd) ?? cmd : stripOutputPipeline(cmd);
     const simpleHash = shortFingerprint(cacheKey);
@@ -9827,6 +10019,9 @@ async function relayInProcess(eventName, rawPayload) {
 async function relay(eventName) {
   try {
     if (!isHookEventName(eventName)) {
+      console.error(
+        `[relay] unknown hook event '${eventName}'; nothing ran. Valid events: ${HOOK_EVENTS.join(", ")}`
+      );
       process.stdout.write("{}");
       return;
     }

package/dist/{token-goat-hook-chunk-6C5RN3CM.mjs → token-goat-hook-chunk-CRBMPT74.mjs}

@@ -6,7 +6,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -16,7 +16,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import {
   registerReset
 } from "./token-goat-hook-chunk-BUOCULAM.mjs";

package/dist/{token-goat-hook-chunk-QTZ6YUMQ.mjs → token-goat-hook-chunk-D6UJEFHX.mjs}

@@ -10,11 +10,11 @@ import {
   selectFilter,
   shlexSplit,
   wrappedShell
-} from "./token-goat-hook-chunk-2ISZ4AZR.mjs";
+} from "./token-goat-hook-chunk-NIPXIAPA.mjs";
 import {
   loadConfig,
   recordStat
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";
 

package/dist/{token-goat-hook-chunk-ATEGFQAU.mjs → token-goat-hook-chunk-J4HKWUWZ.mjs}

@@ -4,14 +4,14 @@ import {
   buildEvent,
   relay,
   relayInProcess
-} from "./token-goat-hook-chunk-BU5OFDGQ.mjs";
-import "./token-goat-hook-chunk-2ISZ4AZR.mjs";
+} from "./token-goat-hook-chunk-4POU6OHK.mjs";
+import "./token-goat-hook-chunk-NIPXIAPA.mjs";
 import {
   MAX_STDIN_BYTES,
   readStdinJson
-} from "./token-goat-hook-chunk-6C5RN3CM.mjs";
-import "./token-goat-hook-chunk-6QTWMSRO.mjs";
-import "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-CRBMPT74.mjs";
+import "./token-goat-hook-chunk-XM4W3WCO.mjs";
+import "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";
 export {

package/dist/{token-goat-hook-chunk-2ISZ4AZR.mjs → token-goat-hook-chunk-NIPXIAPA.mjs}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   redactSecrets,
   stripAnsiCodes
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 
 // src/tool_filters/helpers.ts
 import * as fs from "node:fs";