token-goat 2.6.35 → 2.6.36

package/README.md

@@ -349,8 +349,10 @@ For archive/document work specifically, token-goat's bounded SQLite, XLSX, and P
 brew install ast-grep uv ruff ripgrep fd bat eza git-delta jq yq sd miller sqlite gh hyperfine fzf lazygit
 
 # Debian / Ubuntu — note the binary renames: rg=ripgrep, fd=fdfind, bat=batcat
-sudo apt install -y ripgrep fd-find bat jq sqlite3 fzf
-curl -LsSf https://astral.sh/uv/install.sh | sh   # uv, then: uv tool install ruff
+sudo apt install -y ripgrep fd-find bat jq sqlite3 fzf pipx
+pipx install uv && pipx ensurepath     # pipx puts uv in ~/.local/bin
+export PATH="$HOME/.local/bin:$PATH"   # this shell; ensurepath covers later ones
+uv tool install ruff
 npm install -g @ast-grep/cli
 ```
 

package/SECURITY.md

@@ -46,7 +46,7 @@ The following are not treated as security issues unless paired with a working pr
 | What you scan | Command | Result |
 | --- | --- | --- |
 | this repository | `npm audit` | clean, development dependencies included |
-| an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 46 packages |
+| an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 40 packages |
 | a default install | `npm install token-goat` then `npm audit --omit=dev` | the optional packages in the table below |
 
 The repository is clean because [`package.json`](package.json) carries an `overrides` block that pins five transitive packages to patched versions. **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. We are saying so plainly rather than letting a clean repository scan stand in for a clean install: if your scanner reads this repository or its lockfile it will report nothing, and that is not the whole picture.
@@ -63,6 +63,8 @@ Without the overrides a consumer resolves `protobufjs` at 6.x, which carries mor
 
 `html-to-text` used to appear in that table, carrying [`deepmerge-ts`](https://github.com/advisories/GHSA-ggr8-5vv4-36mx). It is now a development dependency instead. esbuild inlines it into `dist/token-goat.mjs` at build time and nothing in the published bundle imports it, so it was a runtime dependency in name only: moving it removes `html-to-text`, `deepmerge-ts`, `htmlparser2`, `selderee`, and `dom-serializer` from an installed copy while the HTML-to-text output stays byte-for-byte identical. That is what takes the no-optional install to zero, and it is better than the alternative we had considered, rolling `html-to-text` back to 9.x: that version pins `htmlparser2` two majors lower, and `htmlparser2` is what parses fetched pages, so it would have traded an advisory in an options merger for an older parser on the one path that handles untrusted input.
 
+Five more packages were in `dependencies` for the same reason and have moved the same way: `commander`, `csv-parse`, `js-yaml`, `smol-toml` and `zod`. esbuild inlines each one into the bundle, and the published bundle resolves none of them, so a consumer was downloading code the artifact already carried. Moving them takes an install without optional packages from 46 packages to 40. `better-sqlite3` and `jsonc-parser` stay, because the bundle really does load them at run time: the first is a native addon, and the second is reached through `createRequire` rather than an import esbuild can inline. `zod` is the largest of the five on disk and the one that saves least in practice, because `@modelcontextprotocol/sdk` and `puppeteer-core` both depend on it and a default install still gets it from them.
+
 Direct dependencies with a forward patch are kept current rather than pinned: `sharp` and `puppeteer-core` were both moved across a major version to clear their advisories.
 
 For a scanner that ingests a bill of materials rather than a lockfile, `npm run sbom` writes CycloneDX 1.5 to stdout.

package/dist/{token-goat-chunk-DRAIYVUI.mjs → token-goat-chunk-65BKISIS.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-D5IZEGN2.mjs";
+} from "./token-goat-chunk-IYTVE6KN.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-I2KCEGIP.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/dist/{token-goat-chunk-UIZVX3HN.mjs → token-goat-chunk-CNDOJ3ZP.mjs}

@@ -10,11 +10,11 @@ import {
   selectFilter,
   shlexSplit,
   wrappedShell
-} from "./token-goat-chunk-DQIT5JIF.mjs";
+} from "./token-goat-chunk-MGOUYAA2.mjs";
 import {
   loadConfig,
   recordStat
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/dist/{token-goat-chunk-Y2NH6DGZ.mjs → token-goat-chunk-FRTBMRP7.mjs}

@@ -10,7 +10,7 @@ import {
   isRewriteWorthwhile,
   resolveMinNetSavingsBytes,
   shlexSplit
-} from "./token-goat-chunk-DQIT5JIF.mjs";
+} from "./token-goat-chunk-MGOUYAA2.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   HOOK_EVENTS,
@@ -29,7 +29,7 @@ import {
   storeBashOutput,
   storeWebOutput,
   summarizeOutputDelta
-} from "./token-goat-chunk-SIHYQCTM.mjs";
+} from "./token-goat-chunk-VYMGEVZS.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
@@ -119,7 +119,7 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-I2KCEGIP.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   VERSION,
   detectHarness,
@@ -138,7 +138,7 @@ import {
   runGit,
   shortFingerprint,
   toKB
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 
@@ -578,7 +578,7 @@ import crypto from "node:crypto";
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-YF67EWRH.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-LN6OUHTV.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {

package/dist/{token-goat-chunk-D5IZEGN2.mjs → token-goat-chunk-IYTVE6KN.mjs}

@@ -50,7 +50,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-I2KCEGIP.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   PER_FILE_COUNTERFACTUAL_CEILING,
   _detectOpenQuote,
@@ -83,6 +83,7 @@ import {
   loadConfig,
   normalizePath,
   offsetToLine,
+  pushAll,
   recordStat,
   redactIfDotenv,
   redactSecrets,
@@ -100,7 +101,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -563,9 +564,9 @@ function evalJsonPath(data, ops) {
       } else if (op.kind === "wildcard") {
         fanned = true;
         if (Array.isArray(item)) {
-          next.push(...item);
+          pushAll(next, item);
         } else if (typeof item === "object" && item !== null) {
-          next.push(...Object.values(item));
+          pushAll(next, Object.values(item));
         }
       } else {
         fanned = true;
@@ -997,7 +998,7 @@ function queryXml(xmlText, pathStr) {
       const attrName = step.attributeSelect;
       for (const cand of currentCandidates) {
         if (attrName === "*") {
-          attrVals.push(...Object.values(cand.attributes));
+          pushAll(attrVals, Object.values(cand.attributes));
         } else if (cand.attributes[attrName] !== void 0) {
           attrVals.push(cand.attributes[attrName]);
         }
@@ -1046,7 +1047,7 @@ function queryXml(xmlText, pathStr) {
         if (step.allIndices || matching.length > 1 || step.attributeFilter !== void 0) {
           hasFanned = true;
         }
-        nextCandidates.push(...matching);
+        pushAll(nextCandidates, matching);
       }
     }
     currentCandidates = nextCandidates;
@@ -6552,6 +6553,10 @@ function mergeListingJson(files, blocks, anyOk) {
   const payload = { items, truncated, totalCount, ...errors.length > 0 ? { errors } : {} };
   return { text: JSON.stringify(payload, null, 2), code: anyOk ? 0 : 1 };
 }
+function symbolCountLabel(shown, truncated, trueCount) {
+  if (!truncated || trueCount === void 0 || trueCount <= shown) return countNoun(shown, "symbol");
+  return `${shown} of ${countNoun(trueCount, "symbol")}`;
+}
 function runSkeleton(opts) {
   const multiFiles = parseMultiFileSpec(opts.file);
   if (multiFiles !== null) return runPerFileListing(multiFiles, (file) => runSkeleton({ ...opts, file, includeFilePath: true }), opts.json === true);
@@ -6584,7 +6589,7 @@ function runSkeleton(opts) {
     return { text: text2, code: 0 };
   }
   const totalLines = filtered.length > 0 ? Math.max(...filtered.map((s) => s.lineEnd)) : 0;
-  const lines = [`# Skeleton: ${opts.file}  (${countNoun(filtered.length, "symbol")}, ${countNoun(totalLines, "line")})`];
+  const lines = [`# Skeleton: ${opts.file}  (${symbolCountLabel(filtered.length, symbolsTruncated, trueSymbolCount)}, ${countNoun(totalLines, "line")})`];
   if (filtered.length === 0 && preFilterCount > 0) lines.push(filteredToEmptyNotice(preFilterCount, opts.minLines, opts.grep));
   for (const sym of filtered) {
     const lineStr = sym.lineStart.toString().padStart(6);
@@ -6626,7 +6631,7 @@ function runOutline(opts) {
     recordReadStat("outline", fullSourceBytes, text2, opts.file);
     return { text: text2, code: 0 };
   }
-  const lines = [`# Outline: ${opts.file}  (${countNoun(filtered.length, "symbol")})`];
+  const lines = [`# Outline: ${opts.file}  (${symbolCountLabel(filtered.length, symbolsTruncated, trueSymbolCount)})`];
   if (filtered.length === 0 && preFilterCount > 0) lines.push(filteredToEmptyNotice(preFilterCount, opts.minLines, opts.grep));
   for (const sym of filtered) {
     const rangeStr = `${sym.lineStart.toString().padStart(4)}-${sym.lineEnd.toString().padEnd(6)}`;

package/dist/{token-goat-chunk-HW4VUKJ5.mjs → token-goat-chunk-KYFJC37X.mjs}

@@ -84,7 +84,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-D5IZEGN2.mjs";
+} from "./token-goat-chunk-IYTVE6KN.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
@@ -105,7 +105,7 @@ import {
   readStdinJson,
   searchRecall,
   storeWebOutput
-} from "./token-goat-chunk-SIHYQCTM.mjs";
+} from "./token-goat-chunk-VYMGEVZS.mjs";
 import {
   AGENT_SALT_MARKER,
   CONTEXT_AUTOCOMPACT_TOKENS,
@@ -243,7 +243,7 @@ import {
   vscodeDecoderConfigured,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-I2KCEGIP.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -294,6 +294,8 @@ import {
   normalizePath,
   pad,
   parse,
+  pushAll,
+  readConfigSource,
   recordStat,
   redactIfDotenv,
   redactUrlQuery,
@@ -322,7 +324,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import {
   __export
 } from "./token-goat-chunk-AEX54RUZ.mjs";
@@ -5873,7 +5875,7 @@ function checkConfigValid(configPath2) {
     };
   }
   try {
-    const content = fs12.readFileSync(configPath2, "utf-8");
+    const content = readConfigSource(configPath2);
     parse(content);
     return {
       name: "Config",
@@ -9561,7 +9563,7 @@ function collectTodoFiles(patterns) {
       try {
         const stat = fs16.statSync(abs);
         if (stat.isDirectory()) {
-          results.push(...walkProject(abs).files);
+          pushAll(results, walkProject(abs).files);
         } else {
           results.push(abs);
         }
@@ -9579,7 +9581,7 @@ function cmdTodo(patterns, opts) {
   const files = collectTodoFiles(patterns);
   const items = [];
   for (const f of files) {
-    items.push(...scanFileForTodos(f, kindSet));
+    pushAll(items, scanFileForTodos(f, kindSet));
   }
   if (opts.json === true) {
     process.stdout.write(JSON.stringify({ items }, null, 2) + "\n");
@@ -11332,7 +11334,7 @@ function reclaimIndex(dbPath, opts = {}) {
         db.prepare(`DELETE FROM "${table}"`).run();
         dropped[table] = before;
       }
-    })();
+    }).immediate();
     if (tableExists(db, "symbols_fts")) {
       try {
         db.prepare(`INSERT INTO symbols_fts(symbols_fts) VALUES('rebuild')`).run();
@@ -11701,8 +11703,7 @@ function cmdConfig(opts) {
     let raw = {};
     let parseErr = null;
     try {
-      const text = fs19.readFileSync(cfgFile, "utf8");
-      raw = parse(text);
+      raw = parse(readConfigSource(cfgFile));
     } catch (e) {
       const code = e.code;
       if (code !== "ENOENT") {
@@ -13446,7 +13447,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-DRAIYVUI.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-65BKISIS.mjs"));
     ({ StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js"));
   } catch (err2) {
     process.stderr.write(
@@ -13467,7 +13468,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-Y2NH6DGZ.mjs");
+  const { relay } = await import("./token-goat-chunk-FRTBMRP7.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -14324,7 +14325,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-UIZVX3HN.mjs");
+    const bashRunner = await import("./token-goat-chunk-CNDOJ3ZP.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;

package/dist/{token-goat-chunk-YF67EWRH.mjs → token-goat-chunk-LN6OUHTV.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-HW4VUKJ5.mjs";
-import "./token-goat-chunk-D5IZEGN2.mjs";
-import "./token-goat-chunk-SIHYQCTM.mjs";
-import "./token-goat-chunk-I2KCEGIP.mjs";
-import "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-KYFJC37X.mjs";
+import "./token-goat-chunk-IYTVE6KN.mjs";
+import "./token-goat-chunk-VYMGEVZS.mjs";
+import "./token-goat-chunk-UFOVM7ZN.mjs";
+import "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {

package/dist/{token-goat-hook-chunk-NIPXIAPA.mjs → token-goat-chunk-MGOUYAA2.mjs}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   redactSecrets,
   stripAnsiCodes
-} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 
 // src/tool_filters/helpers.ts
 import * as fs from "node:fs";