token-goat 2.6.34 → 2.6.36

package/dist/{token-goat-chunk-7FWBSPCT.mjs → token-goat-chunk-V465YKOR.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.34";
+    return "2.6.36";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -770,6 +770,9 @@ function countContentLines(content) {
   const n = content.split("\n").length;
   return content.endsWith("\n") ? n - 1 : n;
 }
+function pushAll(target, items) {
+  for (const item of items) target.push(item);
+}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1196,6 +1199,9 @@ function getDisplayRoot(explicitRoot) {
   _displayRootCache = { cwd, root };
   return root;
 }
+registerReset(() => {
+  _displayRootCache = null;
+});
 function isUnderSystemTemp(filePath) {
   let sysTemp;
   try {
@@ -2446,7 +2452,6 @@ var ENV_KEYS2 = [
   "TOKEN_GOAT_OVERFLOW_MAX_TOKENS",
   "TOKEN_GOAT_HINT_JSON_SIDECAR",
   "TOKEN_GOAT_LARGE_READ_BYTES",
-  "TOKEN_GOAT_CURATOR",
   "TOKEN_GOAT_HINT_BUDGET",
   "TOKEN_GOAT_HOOK_WATCHDOG_MS",
   "TOKEN_GOAT_WEB_COMPRESS",
@@ -2507,8 +2512,19 @@ var _lastProjectConfigParseError = null;
 function getLastProjectConfigParseError() {
   return _lastProjectConfigParseError;
 }
-var PROJECT_LOCKED_SECTIONS = ["injection", "webfetch", "gdrive", "mcp", "network"];
-var PROJECT_LOCKED_KEYS = ["indexing.cross_project_symbols"];
+var PROJECT_LOCKED_SECTIONS = [
+  "injection",
+  "webfetch",
+  "gdrive",
+  "mcp",
+  "network",
+  "screenshot"
+];
+var PROJECT_LOCKED_KEYS = [
+  "image_shrink.max_image_pixels",
+  "indexing.cross_project_symbols",
+  "worker.blocked_roots"
+];
 var _lastProjectConfigLockedKeys = [];
 function stripLockedProjectKeys(projectRaw) {
   const cleaned = {};
@@ -2639,10 +2655,12 @@ function resolveConfigKeyLayer(key, effectiveValue, cfg, projectInfo) {
   if (rawValueEquals(rawValue, effectiveValue)) return { layer: "project", path: projectInfo.path };
   return { layer: "project-invalid", path: projectInfo.path, rawValue, effectiveValue, reason: rejectionReason(key, rawValue, effectiveValue, cfg) };
 }
+function readConfigSource(p) {
+  return decodeSource(fs5.readFileSync(p));
+}
 function readConfigToml(p) {
   try {
-    const text = fs5.readFileSync(p, "utf8");
-    return { raw: parse(text), parseError: null };
+    return { raw: parse(readConfigSource(p)), parseError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { raw: {}, parseError: null };
@@ -2651,7 +2669,7 @@ function readConfigToml(p) {
 }
 function readConfigText(p) {
   try {
-    return { text: fs5.readFileSync(p, "utf8"), readError: null };
+    return { text: readConfigSource(p), readError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { text: null, readError: null };
@@ -2680,6 +2698,9 @@ function resolveConfigProjectRoot() {
   _projectRootCache = { cwd, root };
   return root;
 }
+registerReset(() => {
+  _projectRootCache = null;
+});
 function isAutoTriggerMultiplierExplicit() {
   const setsMultiplier = (text) => {
     const raw = parse(text);
@@ -2690,11 +2711,11 @@ function isAutoTriggerMultiplierExplicit() {
     return ca_raw["auto_trigger_multiplier"] !== void 0;
   };
   try {
-    if (setsMultiplier(fs5.readFileSync(configPath(), "utf8"))) return true;
+    if (setsMultiplier(readConfigSource(configPath()))) return true;
   } catch {
   }
   try {
-    return setsMultiplier(fs5.readFileSync(projectConfigPath(resolveConfigProjectRoot()), "utf8"));
+    return setsMultiplier(readConfigSource(projectConfigPath(resolveConfigProjectRoot())));
   } catch {
     return false;
   }
@@ -4171,7 +4192,9 @@ function propagateEndLinesToSymbols(symbols, sections) {
     return sym;
   });
 }
-function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix) {
+function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix, opts) {
+  const block = opts?.blockComment;
+  const backtick = opts?.backtickQuote === true;
   let depth = 0;
   let quote = null;
   for (let i = openBraceIndex; i < content.length; i++) {
@@ -4184,11 +4207,16 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       if (ch === quote) quote = null;
       continue;
     }
+    if (block !== void 0 && content.startsWith(block[0], i)) {
+      const close = content.indexOf(block[1], i + block[0].length);
+      i = close === -1 ? content.length : close + block[1].length - 1;
+      continue;
+    }
     if (lineCommentPrefix !== void 0 && content.startsWith(lineCommentPrefix, i)) {
       while (i < content.length && content[i] !== "\n") i++;
       continue;
     }
-    if (ch === '"' || ch === "'") {
+    if (ch === '"' || ch === "'" || backtick && ch === "`") {
       quote = ch;
       continue;
     }
@@ -4200,7 +4228,106 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       }
     }
   }
-  return totalLines;
+  return opts?.noMatchValue ?? totalLines;
+}
+function assignBraceBlockSpans(symbols, content, lineCommentPrefix) {
+  if (symbols.length === 0) return [...symbols];
+  const lines = content.split("\n");
+  const totalLines = lines.length;
+  const lineIndex = buildLineIndex(content);
+  const starts = [...new Set(symbols.map((s) => s.lineStart))].sort((a, b) => a - b);
+  const blockComment = lineCommentPrefix === "//" ? ["/*", "*/"] : lineCommentPrefix === "#" ? ["<#", "#>"] : void 0;
+  return symbols.map((sym) => {
+    if (sym.lineEnd !== sym.lineStart) return sym;
+    const nextStart = starts.find((s) => s > sym.lineStart);
+    const lastSearchLine = Math.min(nextStart !== void 0 ? nextStart - 1 : totalLines, sym.lineStart + BRACE_SEARCH_MAX_LINES);
+    const openIndex = findBlockOpenBrace(content, lineIndex, sym.lineStart, lastSearchLine, lineCommentPrefix, blockComment);
+    if (openIndex === null) return sym;
+    const endLine = findMatchingBraceEndLine(
+      content,
+      openIndex,
+      totalLines,
+      lineIndex,
+      lineCommentPrefix,
+      blockComment === void 0 ? { noMatchValue: -1 } : { blockComment, noMatchValue: -1 }
+    );
+    if (endLine <= sym.lineStart) return sym;
+    return { ...sym, lineEnd: endLine, body: lines.slice(sym.lineStart - 1, endLine).join("\n") };
+  });
+}
+var BRACE_SEARCH_MAX_LINES = 10;
+function findBlockOpenBrace(content, lineIndex, startLine, lastSearchLine, lineCommentPrefix, blockComment) {
+  const from = lineIndex[startLine - 1];
+  if (from === void 0) return null;
+  const to = lineIndex[lastSearchLine] ?? content.length;
+  let quote = null;
+  let parenDepth = 0;
+  let linesSeen = 0;
+  let atLineStart = false;
+  for (let i = from; i < to; i++) {
+    const ch = content[i];
+    if (ch === void 0) break;
+    if (quote !== null) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "\n") {
+      linesSeen++;
+      atLineStart = true;
+      continue;
+    }
+    if (blockComment !== void 0 && content.startsWith(blockComment[0], i)) {
+      const close = content.indexOf(blockComment[1], i + blockComment[0].length);
+      if (close === -1) return null;
+      i = close + blockComment[1].length - 1;
+      continue;
+    }
+    if (lineCommentPrefix !== void 0 && content.startsWith(lineCommentPrefix, i)) {
+      while (i + 1 < to && content[i + 1] !== "\n") i++;
+      continue;
+    }
+    if (atLineStart && !/\s/.test(ch)) {
+      atLineStart = false;
+      if (parenDepth === 0 && linesSeen >= 1 && startsWithBlockKeyword(content, i, to)) return null;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[") parenDepth++;
+    else if (ch === ")" || ch === "]") {
+      if (parenDepth > 0) parenDepth--;
+    } else if (ch === ";") return null;
+    else if (ch === "{") return i;
+  }
+  return null;
+}
+var BLOCK_OPENING_KEYWORDS = /* @__PURE__ */ new Set([
+  "if",
+  "for",
+  "while",
+  "do",
+  "switch",
+  "when",
+  "match",
+  "try",
+  "foreach",
+  "loop",
+  "guard",
+  "repeat",
+  "unless",
+  "until"
+]);
+function startsWithBlockKeyword(content, i, to) {
+  const first = content[i];
+  if (first === void 0 || !/[A-Za-z_]/.test(first)) return false;
+  let j = i + 1;
+  while (j < to && /[A-Za-z0-9_]/.test(content[j])) j++;
+  return BLOCK_OPENING_KEYWORDS.has(content.slice(i, j));
 }
 
 // src/languages/ini_idx.ts
@@ -4612,7 +4739,7 @@ function purgeDotenvEmbeddings(conn) {
 var MIGRATIONS = {
   // v1 -> v2: adds files.embed_sha, tracked separately from files.sha so embedding freshness can be gated independently of parse freshness (see makeIndexer in worker.ts). A pre-existing v1 database's `files` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, so a genuine ALTER TABLE failure is never silently lost.
   1: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN embed_sha TEXT"),
-  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / resetTransientRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant resetTransientRetryCount -- called from appendDirtyPath (hooks_index.ts) in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
+  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / clearRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant the retry-count reset -- run at the time in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
   2: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN retry_count INTEGER NOT NULL DEFAULT 0"),
   // v8 -> v9: adds symbols.parent (see SCHEMA_VERSION comment above for why). A pre-existing v8 database's `symbols` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 above.
   8: (conn) => alterTableIdempotent(conn, "ALTER TABLE symbols ADD COLUMN parent TEXT NOT NULL DEFAULT ''"),
@@ -4632,13 +4759,32 @@ function runMigrations(conn, fromVersion, toVersion) {
     MIGRATIONS[v]?.(conn);
   }
 }
-function initConnection(conn) {
-  const walMode = conn.pragma("journal_mode = WAL", { simple: true });
-  if (String(walMode).toLowerCase() !== "wal") {
-    throw new Error(`db: failed to enable WAL mode (got: ${walMode})`);
+var WAL_SWITCH_DEADLINE_MS = 15e3;
+function enableWalWithRetry(conn, budgetMs = WAL_SWITCH_DEADLINE_MS) {
+  const deadline = Date.now() + budgetMs;
+  let lastError;
+  for (; ; ) {
+    try {
+      const mode = conn.pragma("journal_mode = WAL", { simple: true });
+      if (String(mode).toLowerCase() === "wal") return;
+      lastError = new Error(`got: ${String(mode)}`);
+    } catch (e) {
+      lastError = e;
+    }
+    try {
+      if (String(conn.pragma("journal_mode", { simple: true })).toLowerCase() === "wal") return;
+    } catch {
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`db: failed to enable WAL mode (${lastError instanceof Error ? lastError.message : String(lastError)})`);
+    }
+    sleepSync(25);
   }
-  conn.pragma("synchronous = NORMAL");
+}
+function initConnection(conn) {
   conn.pragma("busy_timeout = 15000");
+  enableWalWithRetry(conn);
+  conn.pragma("synchronous = NORMAL");
   conn.function(
     "TG_LOWER",
     { deterministic: true },
@@ -5983,13 +6129,26 @@ var SECRET_PATTERNS = [
   // directly against the header name and the scheme directly against the space, so a body like
   // {"Authorization": "Bearer <token>"} -- the shape any logged fetch or MCP result arrives in
   // -- matched nothing and the token was cached verbatim.
-  ["auth_bearer_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Bearer[ \t])[A-Za-z0-9\-._~+/]{10,}=*/gi],
+  // `token` is the second scheme spelling in wide use -- it is what curl and gh examples pass for
+  // GitHub and many other APIs -- and an opaque value behind it carries exactly the same authority
+  // as one behind `Bearer`. The trailing gap is `{1,8}` rather than a single space for the same
+  // reason every other gap in this lookbehind already is: a hand-aligned or reformatted header
+  // ("Authorization:  Bearer  <token>") is ordinary, and demanding exactly one space there made
+  // this the one position in the pattern that a second space defeated.
+  ["auth_bearer_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}(?:Bearer|token)[ \t]{1,8})[A-Za-z0-9\-._~+/]{10,}=*/gi],
   ["auth_basic_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Basic[ \t])[A-Za-z0-9+/]{6,}=*/gi],
   // JWTs have no distinctive prefix of their own, but the base64url encoding of the smallest
   // realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical
   // anchor here -- each of the three dot-separated segments requires a minimum length to avoid
   // matching a short, coincidentally dotted token.
-  ["jwt", /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g],
+  //
+  // The trailing `={0,2}` on each segment is what makes a padded token match. Base64url as the JWT
+  // spec defines it drops the `=` padding, but producers that reach for a plain base64 encoder
+  // emit it anyway, and a `=` in the header or payload segment used to defeat the match outright:
+  // not a partial redaction, but none at all, so the entire token was printed. `=` cannot appear
+  // anywhere except the end of a segment, since it is not one of the characters the segment body
+  // allows, so accepting it here cannot widen the match onto anything else.
+  ["jwt", /eyJ[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}/g],
   ["npm_token", /npm_[A-Za-z0-9]{36}/g],
   // rk_live_ (restricted keys) share the sk_live_/sk_test_ secret-key shape and risk level, so
   // one pattern covers all three rather than adding a near-duplicate entry.
@@ -6037,7 +6196,22 @@ var SECRET_PATTERNS = [
   // SECRET_KEY=, and DB_PASSWORD_HASH= all passed through in full. That class matches
   // identifier characters only, so prose that merely mentions a keyword still never reaches
   // a separator and stays unredacted. api[_-]?key covers the apikey and api-key spellings too.
-  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token)[a-z0-9_-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:\\[^\n]|[^\s\\&;#'"[\],{}:]){4,}/gi]
+  // `& ; # , :` play two incompatible roles. They separate one field from the next (a query
+  // string, a cookie header, an inline env list), and they are also perfectly ordinary password
+  // characters. Rejecting them outright got the first role right and the second badly wrong: the
+  // match stopped at the first one and left everything after it in plain text, so
+  // `password=corr&horse&battery` redacted four characters and printed the rest, and
+  // `DB_PASSWORD=Aa1:xyz` matched nothing at all because the run before the `:` was under the
+  // four-character floor. A tail left sitting in the open is the outcome this module's header
+  // calls worse than no redaction, because it reads as handled.
+  //
+  // So the separator role is decided by what follows rather than assumed: one of these characters
+  // ends the value only when the next thing along is another `name=` / `name:` pair, which is what
+  // an actual field separator is always followed by. `,OTHER=public` and `; other=1` still end it;
+  // the `&` in the middle of a passphrase does not. Whitespace, quotes and brackets are unchanged
+  // -- they end a value unconditionally, which is also what keeps this pattern from re-matching
+  // the `[REDACTED:...]` placeholder it just wrote.
+  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token)[a-z0-9_-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:\\[^\n]|[^\s\\&;#,:'"[\]{}]|[&;#,:](?![ \t]*[A-Za-z_][A-Za-z0-9_.-]*[ \t]*[:=])){4,}/gi]
 ];
 function redactSecrets(text) {
   let count = 0;
@@ -6169,6 +6343,7 @@ export {
   countNoun,
   excludeTestsHiddenNote,
   countContentLines,
+  pushAll,
   escapeRegExp,
   windowsCmdQuoteArg,
   redactUrlQuery,
@@ -6206,6 +6381,7 @@ export {
   lastProjectConfigLockedKeys,
   getProjectConfigInfo,
   resolveConfigKeyLayer,
+  readConfigSource,
   isAutoTriggerMultiplierExplicit,
   loadConfig,
   invalidateConfigCache,
@@ -6234,6 +6410,7 @@ export {
   assignFlatEndLines,
   propagateEndLinesToSymbols,
   findMatchingBraceEndLine,
+  assignBraceBlockSpans,
   extractIni,
   _lineClosesQuote,
   _detectOpenQuote,

package/dist/{token-goat-chunk-OA3GFKP2.mjs → token-goat-chunk-VYMGEVZS.mjs}

@@ -6,7 +6,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-chunk-CN7GUPX6.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -16,7 +16,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-chunk-7FWBSPCT.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -790,6 +790,7 @@ function formatCommandManifest(manifest) {
 
 // src/stdin_json.ts
 var DEFAULT_STDIN_TIMEOUT_MS = 5e3;
+var MAX_STDIN_WALL_MS = 6e4;
 var MAX_STDIN_BYTES = 64 * 1024 * 1024;
 function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDIN_BYTES) {
   return new Promise((resolve2, reject) => {
@@ -799,16 +800,27 @@ function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDI
     const finish = (fn) => {
       if (settled) return;
       settled = true;
-      clearTimeout(timer);
+      clearTimeout(idleTimer);
+      clearTimeout(wallTimer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", onEnd);
       process.stdin.removeListener("error", onError);
       fn();
     };
-    const timer = setTimeout(() => {
+    let idleTimer = setTimeout(() => {
       finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
     }, timeoutMs);
+    const wallTimer = setTimeout(() => {
+      finish(() => {
+        process.stdin.destroy();
+        reject(new Error(`readStdinJson: stdin took longer than ${MAX_STDIN_WALL_MS} ms`));
+      });
+    }, MAX_STDIN_WALL_MS);
     const onData = (chunk) => {
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
+      }, timeoutMs);
       totalBytes += chunk.length;
       if (totalBytes > maxBytes) {
         finish(() => {

package/dist/{token-goat-hook-chunk-2ISZ4AZR.mjs → token-goat-hook-chunk-3ZDBWJDF.mjs}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   redactSecrets,
   stripAnsiCodes
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 
 // src/tool_filters/helpers.ts
 import * as fs from "node:fs";

package/dist/{token-goat-hook-chunk-6C5RN3CM.mjs → token-goat-hook-chunk-5UH54CW6.mjs}

@@ -6,7 +6,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-A77A26A7.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -16,7 +16,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 import {
   registerReset
 } from "./token-goat-hook-chunk-BUOCULAM.mjs";
@@ -183,6 +183,7 @@ var HOOK_EVENTS = [
 
 // src/stdin_json.ts
 var DEFAULT_STDIN_TIMEOUT_MS = 5e3;
+var MAX_STDIN_WALL_MS = 6e4;
 var MAX_STDIN_BYTES = 64 * 1024 * 1024;
 function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDIN_BYTES) {
   return new Promise((resolve2, reject) => {
@@ -192,16 +193,27 @@ function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDI
     const finish = (fn) => {
       if (settled) return;
       settled = true;
-      clearTimeout(timer);
+      clearTimeout(idleTimer);
+      clearTimeout(wallTimer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", onEnd);
       process.stdin.removeListener("error", onError);
       fn();
     };
-    const timer = setTimeout(() => {
+    let idleTimer = setTimeout(() => {
       finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
     }, timeoutMs);
+    const wallTimer = setTimeout(() => {
+      finish(() => {
+        process.stdin.destroy();
+        reject(new Error(`readStdinJson: stdin took longer than ${MAX_STDIN_WALL_MS} ms`));
+      });
+    }, MAX_STDIN_WALL_MS);
     const onData = (chunk) => {
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
+      }, timeoutMs);
       totalBytes += chunk.length;
       if (totalBytes > maxBytes) {
         finish(() => {

package/dist/{token-goat-hook-chunk-OQML5EMA.mjs → token-goat-hook-chunk-6ODM3MP7.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-hook-chunk-KGLMNOGD.mjs";
+} from "./token-goat-hook-chunk-MW5HPEGD.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-A77A26A7.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";
 
@@ -126,7 +126,19 @@ function forCompare(p) {
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function resolveToolRoot(projectRoot) {
-  return resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  assertRootAllowed(resolved);
+  return resolved;
+}
+var RootNotAllowedError = class extends Error {
+};
+function assertRootAllowed(resolvedRoot) {
+  const allowedRoots = loadConfig().mcp.allowed_roots;
+  if (allowedRoots.length === 0) return;
+  if (allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) return;
+  throw new RootNotAllowedError(
+    `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`
+  );
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
@@ -150,16 +162,6 @@ function specFilePart(spec) {
 var NO_PINS = /* @__PURE__ */ new Map();
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
-  const allowedRoots = loadConfig().mcp.allowed_roots;
-  if (allowedRoots.length > 0 && !allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) {
-    return {
-      ok: false,
-      refusal: toCallToolResult({
-        text: `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`,
-        code: 1
-      })
-    };
-  }
   const checked = [];
   const pins = /* @__PURE__ */ new Map();
   for (const raw of targets) {