token-goat 2.6.34 → 2.6.36

package/README.md

@@ -349,8 +349,10 @@ For archive/document work specifically, token-goat's bounded SQLite, XLSX, and P
 brew install ast-grep uv ruff ripgrep fd bat eza git-delta jq yq sd miller sqlite gh hyperfine fzf lazygit
 
 # Debian / Ubuntu — note the binary renames: rg=ripgrep, fd=fdfind, bat=batcat
-sudo apt install -y ripgrep fd-find bat jq sqlite3 fzf
-curl -LsSf https://astral.sh/uv/install.sh | sh   # uv, then: uv tool install ruff
+sudo apt install -y ripgrep fd-find bat jq sqlite3 fzf pipx
+pipx install uv && pipx ensurepath     # pipx puts uv in ~/.local/bin
+export PATH="$HOME/.local/bin:$PATH"   # this shell; ensurepath covers later ones
+uv tool install ruff
 npm install -g @ast-grep/cli
 ```
 

package/SECURITY.md

@@ -46,7 +46,7 @@ The following are not treated as security issues unless paired with a working pr
 | What you scan | Command | Result |
 | --- | --- | --- |
 | this repository | `npm audit` | clean, development dependencies included |
-| an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 46 packages |
+| an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 40 packages |
 | a default install | `npm install token-goat` then `npm audit --omit=dev` | the optional packages in the table below |
 
 The repository is clean because [`package.json`](package.json) carries an `overrides` block that pins five transitive packages to patched versions. **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. We are saying so plainly rather than letting a clean repository scan stand in for a clean install: if your scanner reads this repository or its lockfile it will report nothing, and that is not the whole picture.
@@ -56,12 +56,15 @@ Without the overrides a consumer resolves `protobufjs` at 6.x, which carries mor
 | Package | Advisories it carries | Where it loads | Why the advisory does not reach you through Token-Goat |
 | --- | --- | --- | --- |
 | `@xenova/transformers` | [`protobufjs`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) (critical), `onnx-proto`, `onnxruntime-web`, and its own pinned `sharp` | optional; loaded only when semantic search builds or queries embeddings | not mitigated, so it is the one to weigh. Skip it with `npm install --omit=optional`, or leave `indexing.embeddings_enabled` off, and the code never loads |
-| `exceljs` | [`uuid`](https://github.com/advisories/GHSA-w5hq-g745-h8pq) | optional; loaded only when an `xlsx-*` command opens a workbook | the advisory is a missing bounds check on a caller-supplied `buf` argument; ExcelJS never passes one |
 
-`npm install --omit=optional` gives you an install without either of these, and `npm audit` reports it clean. Every command still starts; the ones that need a package you skipped say so. The `xlsx-*` commands report that ExcelJS is not installed rather than failing oddly, `zip-list`/`zip-read` do the same for fflate, and `semantic` keeps working on keyword search alone: it is the embedding half that goes away, not the command.
+`npm install --omit=optional` gives you an install without it, and `npm audit` reports it clean. Every command still starts; the ones that need a package you skipped say so. The `xlsx-*`, `docx-*` and `pptx-*` commands report that fflate is not installed rather than failing oddly, `zip-list`/`zip-read` do the same, and `semantic` keeps working on keyword search alone: it is the embedding half that goes away, not the command.
+
+`exceljs` used to appear in that table, carrying [`uuid`](https://github.com/advisories/GHSA-w5hq-g745-h8pq). It is now a development dependency instead. The `xlsx-*` commands read the workbook container directly with `fflate` and `fast-xml-parser`, the same two packages the `.docx` and `.pptx` readers already used, so `exceljs` is only a test fixture writer now. That removes 55 packages from a default install, including every deprecated one in the tree.
 
 `html-to-text` used to appear in that table, carrying [`deepmerge-ts`](https://github.com/advisories/GHSA-ggr8-5vv4-36mx). It is now a development dependency instead. esbuild inlines it into `dist/token-goat.mjs` at build time and nothing in the published bundle imports it, so it was a runtime dependency in name only: moving it removes `html-to-text`, `deepmerge-ts`, `htmlparser2`, `selderee`, and `dom-serializer` from an installed copy while the HTML-to-text output stays byte-for-byte identical. That is what takes the no-optional install to zero, and it is better than the alternative we had considered, rolling `html-to-text` back to 9.x: that version pins `htmlparser2` two majors lower, and `htmlparser2` is what parses fetched pages, so it would have traded an advisory in an options merger for an older parser on the one path that handles untrusted input.
 
+Five more packages were in `dependencies` for the same reason and have moved the same way: `commander`, `csv-parse`, `js-yaml`, `smol-toml` and `zod`. esbuild inlines each one into the bundle, and the published bundle resolves none of them, so a consumer was downloading code the artifact already carried. Moving them takes an install without optional packages from 46 packages to 40. `better-sqlite3` and `jsonc-parser` stay, because the bundle really does load them at run time: the first is a native addon, and the second is reached through `createRequire` rather than an import esbuild can inline. `zod` is the largest of the five on disk and the one that saves least in practice, because `@modelcontextprotocol/sdk` and `puppeteer-core` both depend on it and a default install still gets it from them.
+
 Direct dependencies with a forward patch are kept current rather than pinned: `sharp` and `puppeteer-core` were both moved across a major version to clear their advisories.
 
 For a scanner that ingests a bill of materials rather than a lockfile, `npm run sbom` writes CycloneDX 1.5 to stdout.
@@ -89,8 +92,8 @@ Token-Goat is source-available under the PolyForm Noncommercial License 1.0.0. S
 
 Every production dependency is permissively licensed, but a scan does not read it that way on its
 own. Counted from `package-lock.json`, which lists the packages for every platform rather than only
-the ones this machine installed, 22 entries need a human answer: 7 declare a license a scanner
-cannot resolve, and 15 carry a copyleft term. All 22 arrive through optional dependencies. Install
+the ones this machine installed, 21 entries need a human answer: 7 declare a license a scanner
+cannot resolve, and 14 carry a copyleft term. All 21 arrive through optional dependencies. Install
 with `npm install --omit=optional token-goat` and not one of them is present.
 
 **Declarations a scanner cannot resolve.** Both are upstream mistakes, and both are the same
@@ -110,19 +113,19 @@ an unresolvable one.
 | --- | --- | --- |
 | `@img/sharp-libvips-<platform>` (10 packages) | `LGPL-3.0-or-later` | libvips, shipped as a prebuilt shared library and used unmodified. LGPL asks that the library stay replaceable, and it is: it is a separate package that `sharp` loads at runtime. |
 | `@img/sharp-<platform>` (4 packages) | `Apache-2.0 AND LGPL-3.0-or-later` | the Apache half is `sharp` itself, the LGPL half is the same libvips |
-| `jszip` | `(MIT OR GPL-3.0-or-later)` | a choice between the two, and the MIT half is taken |
 
-`sharp` and `jszip` are both optional: `sharp` powers image shrinking, `jszip` arrives through
-`exceljs` for the `xlsx-*` commands.
+`sharp` is optional: it powers image shrinking. `jszip` used to be listed here too; it arrived
+through `exceljs`, which is no longer a dependency a consumer installs.
 
 **Three packages with no license at all used to be here.** `buffers@0.1.1` and `chainsaw@0.1.0`
 shipped with neither a `license` field nor a license file, and `traverse@0.3.9` had the file but
 not the field. No grant at all is worse for a review than a copyleft grant, because there is
 nothing to apply policy to. They arrived through `exceljs`, which depends on `unzipper`, which
 depended on `binary`, which depended on all three. `unzipper` dropped `binary` in 0.11, so an
-override to `^0.12.5` removes the sub-chain, and the deprecated `fstream` with it. Token-goat reads
-workbooks through `wb.xlsx.readFile()`, which goes through `jszip`; `unzipper` is only reachable
-through the streaming reader in `exceljs`, which this code never calls.
+override to `^0.12.5` removes the sub-chain, and the deprecated `fstream` with it. `exceljs` is now
+a development dependency, so none of that chain reaches an installed copy either way; the override
+stays because it is what keeps this repository's own `npm audit`, which includes development
+dependencies, clean.
 
 Reproduce the whole picture:
 

package/dist/{token-goat-chunk-L7QLEVO7.mjs → token-goat-chunk-65BKISIS.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-IYYQOPY4.mjs";
+} from "./token-goat-chunk-IYTVE6KN.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 
@@ -126,7 +126,19 @@ function forCompare(p) {
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function resolveToolRoot(projectRoot) {
-  return resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  assertRootAllowed(resolved);
+  return resolved;
+}
+var RootNotAllowedError = class extends Error {
+};
+function assertRootAllowed(resolvedRoot) {
+  const allowedRoots = loadConfig().mcp.allowed_roots;
+  if (allowedRoots.length === 0) return;
+  if (allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) return;
+  throw new RootNotAllowedError(
+    `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`
+  );
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
@@ -150,16 +162,6 @@ function specFilePart(spec) {
 var NO_PINS = /* @__PURE__ */ new Map();
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
-  const allowedRoots = loadConfig().mcp.allowed_roots;
-  if (allowedRoots.length > 0 && !allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) {
-    return {
-      ok: false,
-      refusal: toCallToolResult({
-        text: `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`,
-        code: 1
-      })
-    };
-  }
   const checked = [];
   const pins = /* @__PURE__ */ new Map();
   for (const raw of targets) {

package/dist/{token-goat-chunk-I6EQH27G.mjs → token-goat-chunk-CNDOJ3ZP.mjs}

@@ -10,11 +10,11 @@ import {
   selectFilter,
   shlexSplit,
   wrappedShell
-} from "./token-goat-chunk-WA2ER6TZ.mjs";
+} from "./token-goat-chunk-MGOUYAA2.mjs";
 import {
   loadConfig,
   recordStat
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/dist/{token-goat-chunk-FRMEOIRU.mjs → token-goat-chunk-FRTBMRP7.mjs}

@@ -2,13 +2,15 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   canRunWrappedShell,
+  compressOutput,
   dedupeConsecutive,
   detectFromCommand,
+  filterByName,
   hasBareBackgroundOrNewline,
   isRewriteWorthwhile,
   resolveMinNetSavingsBytes,
   shlexSplit
-} from "./token-goat-chunk-WA2ER6TZ.mjs";
+} from "./token-goat-chunk-MGOUYAA2.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   HOOK_EVENTS,
@@ -27,7 +29,7 @@ import {
   storeBashOutput,
   storeWebOutput,
   summarizeOutputDelta
-} from "./token-goat-chunk-OA3GFKP2.mjs";
+} from "./token-goat-chunk-VYMGEVZS.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
@@ -117,7 +119,7 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   VERSION,
   detectHarness,
@@ -136,7 +138,7 @@ import {
   runGit,
   shortFingerprint,
   toKB
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 
@@ -576,7 +578,7 @@ import crypto from "node:crypto";
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-CKRATWCJ.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-LN6OUHTV.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -7905,12 +7907,151 @@ function extractRgStructuralSearch(cmd) {
 function extractGrepPipeChain(cmd) {
   return /^(?:rg|grep)\b.*\|\s*(?:rg|grep)\b/.test(cmd);
 }
+function splitCommandWords(cmd) {
+  const words = [];
+  let cur = "";
+  let quote = null;
+  let started = false;
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (quote !== null) {
+      if (ch === "\\" && quote === '"' && i + 1 < cmd.length) {
+        cur += cmd[i + 1];
+        i++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      else cur += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < cmd.length) {
+      cur += cmd[i + 1];
+      i++;
+      started = true;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (started) words.push(cur);
+      cur = "";
+      started = false;
+      continue;
+    }
+    cur += ch;
+    started = true;
+  }
+  if (started) words.push(cur);
+  return words;
+}
+var CURL_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-H",
+  "--header",
+  "-A",
+  "--user-agent",
+  "-e",
+  "--referer",
+  "-b",
+  "--cookie",
+  "-c",
+  "--cookie-jar",
+  "-o",
+  "--output",
+  "--output-dir",
+  "-u",
+  "--user",
+  "-U",
+  "--proxy-user",
+  "-x",
+  "--proxy",
+  "-X",
+  "--request",
+  "-d",
+  "--data",
+  "--data-raw",
+  "--data-binary",
+  "--data-urlencode",
+  "-F",
+  "--form",
+  "-T",
+  "--upload-file",
+  "-K",
+  "--config",
+  "-w",
+  "--write-out",
+  "-m",
+  "--max-time",
+  "--connect-to",
+  "--resolve",
+  "--retry",
+  "--cacert",
+  "-E",
+  "--cert",
+  "--key",
+  "--range",
+  "-r",
+  "--interface",
+  // Options whose own value is a URL or a host. Leaving these out was the same defect as reading
+  // the first URL in the string: `curl --doh-url https://doh/ -o f https://target` answered with
+  // the DoH resolver rather than the file being fetched. `--url-query` belongs here too -- it
+  // appends query data to the request, it does not name the request target.
+  "--url-query",
+  "--doh-url",
+  "--preproxy",
+  "--proxy1.0",
+  "--socks4",
+  "--socks4a",
+  "--socks5",
+  "--socks5-hostname",
+  "--proxy-header",
+  "--noproxy",
+  "--dns-servers",
+  "--aws-sigv4",
+  "--proxy-cacert",
+  "--proxy-cert",
+  "--proxy-key",
+  "--oauth2-bearer",
+  "--hsts",
+  "--alt-svc",
+  "--etag-save",
+  "--etag-compare",
+  "--trace",
+  "--trace-ascii",
+  "--dump-header",
+  "-D"
+]);
 function extractCurlUrl(cmd) {
-  const m = /(https?:\/\/[^\s'"]+)/.exec(cmd);
-  return m?.[1] ?? null;
+  const words = splitCommandWords(cmd);
+  let positional = null;
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (w === "--url") {
+      const next = words[i + 1];
+      if (next !== void 0 && /^https?:\/\//.test(next)) return next;
+      i++;
+      continue;
+    }
+    const eq = w.indexOf("=");
+    if (w.startsWith("--") && eq > 0) {
+      if (w.slice(0, eq) === "--url" && /^https?:\/\//.test(w.slice(eq + 1))) return w.slice(eq + 1);
+      continue;
+    }
+    if (CURL_VALUE_FLAGS.has(w)) {
+      i++;
+      continue;
+    }
+    if (w.startsWith("-") && w !== "-") continue;
+    if (/^https?:\/\//.test(w)) return w;
+    positional ??= /https?:\/\/[^\s'")}`]+/.exec(w)?.[0] ?? null;
+  }
+  if (positional !== null) return positional;
+  return null;
 }
 function extractTgSurgicalRead(cmd, cwd) {
-  const m = /^token-goat\s+(symbol|read|section|skill-body|skill-compact|map)(?:\s+(.*))?$/.exec(cmd);
+  const m = /^(?:token-goat|tg)\s+(symbol|read|section|skill-body|skill-compact|map)(?:\s+(.*))?$/.exec(cmd);
   if (!m) return null;
   const sub = m[1];
   const rest = (m[2] ?? "").trim();
@@ -7989,9 +8130,9 @@ function extractCurlDownload(cmd) {
   const outputPath = outputMatch[1] ?? outputMatch[2] ?? outputMatch[3];
   if (!outputPath) return null;
   if (curlHasUnsafeFlags(cmd)) return null;
-  const urlMatch = /(https?:\/\/[^\s'"]+)/.exec(cmd);
-  if (!urlMatch?.[1]) return null;
-  return { url: urlMatch[1], outputPath };
+  const url = extractCurlUrl(cmd);
+  if (url === null) return null;
+  return { url, outputPath };
 }
 function isTscCommand(cmd) {
   return /^\s*tsc(\s|$)/i.test(cmd);
@@ -8044,9 +8185,34 @@ function maybeCompressRewrite(event, rawCmd, cmd) {
   const wrapped = `token-goat compress -f ${filterName} --timeout ${cfg.timeout_seconds} -c ${shellQuoteSingle(rawCmd)}`;
   return { hookType: "rewriteInput", updatedInput: { ...event.toolInput, command: wrapped } };
 }
+async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes) {
+  if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
+  if (isCompressibleSingleCommand(cmd)) return null;
+  if (exitCode !== null && exitCode !== 0) return null;
+  let cfg;
+  try {
+    cfg = loadConfig().bash_compress;
+  } catch {
+    return null;
+  }
+  if (!cfg.enabled || cfg.disabled_filters.includes("generic")) return null;
+  if (Buffer.byteLength(output, "utf-8") < cacheMinBytes) return null;
+  const filter3 = filterByName("generic");
+  if (filter3 === null) return null;
+  const compressed = compressOutput(filter3, output, "", exitCode ?? 0, [], {
+    maxLines: cfg.max_lines,
+    maxBytes: cfg.max_bytes
+  });
+  const minNet = resolveMinNetSavingsBytes();
+  if (!compressed.worthApplying(minNet)) return null;
+  const id = await storeBashOutput(cmd, output, exitCode ?? 0, cwd);
+  recordStat("bash_compress:generic", compressed.bytesSaved, compressed.tokensSaved);
+  const body = compressed.withMarker(minNet) + "\n[token-goat] full output: bash-output " + id + " --full";
+  return { hookType: "rewriteOutput", updatedOutput: body };
+}
 function unwrapCompressCommand(executed) {
   const t = executed.trim();
-  if (!/^token-goat\s+compress\b/.test(t)) return null;
+  if (!/^(?:token-goat|tg)\s+compress\b/.test(t)) return null;
   let argv;
   try {
     argv = shlexSplit(t);
@@ -8098,6 +8264,28 @@ function detectUnbalancedShellSyntax(cmd) {
       i = j;
       continue;
     }
+    if (ch === "$" && cmd[i + 1] === "'") {
+      let j = i + 2;
+      let closed = false;
+      while (j < cmd.length) {
+        if (cmd[j] === "\\") {
+          j += 2;
+          continue;
+        }
+        if (cmd[j] === "'") {
+          j++;
+          closed = true;
+          break;
+        }
+        j++;
+      }
+      if (!closed) {
+        inSingle = true;
+        break;
+      }
+      i = j;
+      continue;
+    }
     if (ch === "#" && (i === 0 || /\s/.test(cmd[i - 1] ?? ""))) {
       const nl2 = cmd.indexOf("\n", i);
       i = nl2 === -1 ? cmd.length : nl2 + 1;
@@ -8704,7 +8892,11 @@ async function postBashHandler(event) {
       recordBashOutput(gitScopedCacheHash, gitScopedCacheId, Buffer.byteLength(output, "utf-8"));
     }
     const isMonitoring = getMonitoringRecallHint(cmd) !== null;
-    if (!isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) return passOutput();
+    if (!isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) {
+      const compound = await maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes);
+      if (compound !== null) return compound;
+      return passOutput();
+    }
     if (Buffer.byteLength(output, "utf-8") < cacheMinBytes) return passOutput();
     const cacheKey = isCurlGetCommand(cmd) ? extractCurlUrl(cmd) ?? cmd : stripOutputPipeline(cmd);
     const simpleHash = shortFingerprint(cacheKey);
@@ -9830,6 +10022,9 @@ async function relayInProcess(eventName, rawPayload) {
 async function relay(eventName) {
   try {
     if (!isHookEventName(eventName)) {
+      console.error(
+        `[relay] unknown hook event '${eventName}'; nothing ran. Valid events: ${HOOK_EVENTS.join(", ")}`
+      );
       process.stdout.write("{}");
       return;
     }

package/dist/{token-goat-chunk-IYYQOPY4.mjs → token-goat-chunk-IYTVE6KN.mjs}

@@ -50,7 +50,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   PER_FILE_COUNTERFACTUAL_CEILING,
   _detectOpenQuote,
@@ -83,6 +83,7 @@ import {
   loadConfig,
   normalizePath,
   offsetToLine,
+  pushAll,
   recordStat,
   redactIfDotenv,
   redactSecrets,
@@ -100,7 +101,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -563,9 +564,9 @@ function evalJsonPath(data, ops) {
       } else if (op.kind === "wildcard") {
         fanned = true;
         if (Array.isArray(item)) {
-          next.push(...item);
+          pushAll(next, item);
         } else if (typeof item === "object" && item !== null) {
-          next.push(...Object.values(item));
+          pushAll(next, Object.values(item));
         }
       } else {
         fanned = true;
@@ -997,7 +998,7 @@ function queryXml(xmlText, pathStr) {
       const attrName = step.attributeSelect;
       for (const cand of currentCandidates) {
         if (attrName === "*") {
-          attrVals.push(...Object.values(cand.attributes));
+          pushAll(attrVals, Object.values(cand.attributes));
         } else if (cand.attributes[attrName] !== void 0) {
           attrVals.push(cand.attributes[attrName]);
         }
@@ -1046,7 +1047,7 @@ function queryXml(xmlText, pathStr) {
         if (step.allIndices || matching.length > 1 || step.attributeFilter !== void 0) {
           hasFanned = true;
         }
-        nextCandidates.push(...matching);
+        pushAll(nextCandidates, matching);
       }
     }
     currentCandidates = nextCandidates;
@@ -6552,6 +6553,10 @@ function mergeListingJson(files, blocks, anyOk) {
   const payload = { items, truncated, totalCount, ...errors.length > 0 ? { errors } : {} };
   return { text: JSON.stringify(payload, null, 2), code: anyOk ? 0 : 1 };
 }
+function symbolCountLabel(shown, truncated, trueCount) {
+  if (!truncated || trueCount === void 0 || trueCount <= shown) return countNoun(shown, "symbol");
+  return `${shown} of ${countNoun(trueCount, "symbol")}`;
+}
 function runSkeleton(opts) {
   const multiFiles = parseMultiFileSpec(opts.file);
   if (multiFiles !== null) return runPerFileListing(multiFiles, (file) => runSkeleton({ ...opts, file, includeFilePath: true }), opts.json === true);
@@ -6584,7 +6589,7 @@ function runSkeleton(opts) {
     return { text: text2, code: 0 };
   }
   const totalLines = filtered.length > 0 ? Math.max(...filtered.map((s) => s.lineEnd)) : 0;
-  const lines = [`# Skeleton: ${opts.file}  (${countNoun(filtered.length, "symbol")}, ${countNoun(totalLines, "line")})`];
+  const lines = [`# Skeleton: ${opts.file}  (${symbolCountLabel(filtered.length, symbolsTruncated, trueSymbolCount)}, ${countNoun(totalLines, "line")})`];
   if (filtered.length === 0 && preFilterCount > 0) lines.push(filteredToEmptyNotice(preFilterCount, opts.minLines, opts.grep));
   for (const sym of filtered) {
     const lineStr = sym.lineStart.toString().padStart(6);
@@ -6626,7 +6631,7 @@ function runOutline(opts) {
     recordReadStat("outline", fullSourceBytes, text2, opts.file);
     return { text: text2, code: 0 };
   }
-  const lines = [`# Outline: ${opts.file}  (${countNoun(filtered.length, "symbol")})`];
+  const lines = [`# Outline: ${opts.file}  (${symbolCountLabel(filtered.length, symbolsTruncated, trueSymbolCount)})`];
   if (filtered.length === 0 && preFilterCount > 0) lines.push(filteredToEmptyNotice(preFilterCount, opts.minLines, opts.grep));
   for (const sym of filtered) {
     const rangeStr = `${sym.lineStart.toString().padStart(4)}-${sym.lineEnd.toString().padEnd(6)}`;
@@ -7644,10 +7649,16 @@ function buildChangedRefHint(cwd, ref) {
   const commitWord = commitCount === 1 ? "1 commit" : `${commitCount} commits`;
   return `Hint: this repo has only ${commitWord}; '${ref}' does not exist. Try: token-goat changed --since ${suggestedRef}`;
 }
+function refIsSafe(ref) {
+  return !ref.startsWith("-");
+}
+function emitUnsafeRef(ref) {
+  emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+}
 function runChanged(opts = {}) {
   const ref = opts.ref ?? "HEAD~5";
-  if (ref.startsWith("-")) {
-    emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+  if (!refIsSafe(ref)) {
+    emitUnsafeRef(ref);
     return 1;
   }
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7824,6 +7835,10 @@ function resolveSymbolSpecOrEmitError(commandName, spec, projectRoot) {
   return resolution.entry;
 }
 function runDiff(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("diff", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7911,6 +7926,10 @@ function parseLogDashLOutput(stdout) {
   return entries;
 }
 function runLog(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("log", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();