token-goat 2.6.35 → 2.6.36

package/dist/{token-goat-hook-chunk-2O7P4Z6Q.mjs → token-goat-hook-chunk-Y2WHX2P3.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.35";
+    return "2.6.36";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -742,6 +742,9 @@ function countContentLines(content) {
   const n = content.split("\n").length;
   return content.endsWith("\n") ? n - 1 : n;
 }
+function pushAll(target, items) {
+  for (const item of items) target.push(item);
+}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2436,7 +2439,6 @@ var ENV_KEYS2 = [
   "TOKEN_GOAT_OVERFLOW_MAX_TOKENS",
   "TOKEN_GOAT_HINT_JSON_SIDECAR",
   "TOKEN_GOAT_LARGE_READ_BYTES",
-  "TOKEN_GOAT_CURATOR",
   "TOKEN_GOAT_HINT_BUDGET",
   "TOKEN_GOAT_HOOK_WATCHDOG_MS",
   "TOKEN_GOAT_WEB_COMPRESS",
@@ -2497,8 +2499,19 @@ var _lastProjectConfigParseError = null;
 function getLastProjectConfigParseError() {
   return _lastProjectConfigParseError;
 }
-var PROJECT_LOCKED_SECTIONS = ["injection", "webfetch", "gdrive", "mcp", "network"];
-var PROJECT_LOCKED_KEYS = ["indexing.cross_project_symbols", "worker.blocked_roots"];
+var PROJECT_LOCKED_SECTIONS = [
+  "injection",
+  "webfetch",
+  "gdrive",
+  "mcp",
+  "network",
+  "screenshot"
+];
+var PROJECT_LOCKED_KEYS = [
+  "image_shrink.max_image_pixels",
+  "indexing.cross_project_symbols",
+  "worker.blocked_roots"
+];
 var _lastProjectConfigLockedKeys = [];
 function stripLockedProjectKeys(projectRaw) {
   const cleaned = {};
@@ -2629,10 +2642,12 @@ function resolveConfigKeyLayer(key, effectiveValue, cfg, projectInfo) {
   if (rawValueEquals(rawValue, effectiveValue)) return { layer: "project", path: projectInfo.path };
   return { layer: "project-invalid", path: projectInfo.path, rawValue, effectiveValue, reason: rejectionReason(key, rawValue, effectiveValue, cfg) };
 }
+function readConfigSource(p) {
+  return decodeSource(fs5.readFileSync(p));
+}
 function readConfigToml(p) {
   try {
-    const text = fs5.readFileSync(p, "utf8");
-    return { raw: parse(text), parseError: null };
+    return { raw: parse(readConfigSource(p)), parseError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { raw: {}, parseError: null };
@@ -2641,7 +2656,7 @@ function readConfigToml(p) {
 }
 function readConfigText(p) {
   try {
-    return { text: fs5.readFileSync(p, "utf8"), readError: null };
+    return { text: readConfigSource(p), readError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { text: null, readError: null };
@@ -2683,11 +2698,11 @@ function isAutoTriggerMultiplierExplicit() {
     return ca_raw["auto_trigger_multiplier"] !== void 0;
   };
   try {
-    if (setsMultiplier(fs5.readFileSync(configPath(), "utf8"))) return true;
+    if (setsMultiplier(readConfigSource(configPath()))) return true;
   } catch {
   }
   try {
-    return setsMultiplier(fs5.readFileSync(projectConfigPath(resolveConfigProjectRoot()), "utf8"));
+    return setsMultiplier(readConfigSource(projectConfigPath(resolveConfigProjectRoot())));
   } catch {
     return false;
   }
@@ -4166,6 +4181,7 @@ function propagateEndLinesToSymbols(symbols, sections) {
 }
 function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix, opts) {
   const block = opts?.blockComment;
+  const backtick = opts?.backtickQuote === true;
   let depth = 0;
   let quote = null;
   for (let i = openBraceIndex; i < content.length; i++) {
@@ -4187,7 +4203,7 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       while (i < content.length && content[i] !== "\n") i++;
       continue;
     }
-    if (ch === '"' || ch === "'") {
+    if (ch === '"' || ch === "'" || backtick && ch === "`") {
       quote = ch;
       continue;
     }
@@ -4710,7 +4726,7 @@ function purgeDotenvEmbeddings(conn) {
 var MIGRATIONS = {
   // v1 -> v2: adds files.embed_sha, tracked separately from files.sha so embedding freshness can be gated independently of parse freshness (see makeIndexer in worker.ts). A pre-existing v1 database's `files` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, so a genuine ALTER TABLE failure is never silently lost.
   1: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN embed_sha TEXT"),
-  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / resetTransientRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant resetTransientRetryCount -- called from appendDirtyPath (hooks_index.ts) in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
+  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / clearRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant the retry-count reset -- run at the time in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
   2: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN retry_count INTEGER NOT NULL DEFAULT 0"),
   // v8 -> v9: adds symbols.parent (see SCHEMA_VERSION comment above for why). A pre-existing v8 database's `symbols` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 above.
   8: (conn) => alterTableIdempotent(conn, "ALTER TABLE symbols ADD COLUMN parent TEXT NOT NULL DEFAULT ''"),
@@ -4730,13 +4746,32 @@ function runMigrations(conn, fromVersion, toVersion) {
     MIGRATIONS[v]?.(conn);
   }
 }
-function initConnection(conn) {
-  const walMode = conn.pragma("journal_mode = WAL", { simple: true });
-  if (String(walMode).toLowerCase() !== "wal") {
-    throw new Error(`db: failed to enable WAL mode (got: ${walMode})`);
+var WAL_SWITCH_DEADLINE_MS = 15e3;
+function enableWalWithRetry(conn, budgetMs = WAL_SWITCH_DEADLINE_MS) {
+  const deadline = Date.now() + budgetMs;
+  let lastError;
+  for (; ; ) {
+    try {
+      const mode = conn.pragma("journal_mode = WAL", { simple: true });
+      if (String(mode).toLowerCase() === "wal") return;
+      lastError = new Error(`got: ${String(mode)}`);
+    } catch (e) {
+      lastError = e;
+    }
+    try {
+      if (String(conn.pragma("journal_mode", { simple: true })).toLowerCase() === "wal") return;
+    } catch {
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`db: failed to enable WAL mode (${lastError instanceof Error ? lastError.message : String(lastError)})`);
+    }
+    sleepSync(25);
   }
-  conn.pragma("synchronous = NORMAL");
+}
+function initConnection(conn) {
   conn.pragma("busy_timeout = 15000");
+  enableWalWithRetry(conn);
+  conn.pragma("synchronous = NORMAL");
   conn.function(
     "TG_LOWER",
     { deterministic: true },
@@ -6093,7 +6128,14 @@ var SECRET_PATTERNS = [
   // realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical
   // anchor here -- each of the three dot-separated segments requires a minimum length to avoid
   // matching a short, coincidentally dotted token.
-  ["jwt", /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g],
+  //
+  // The trailing `={0,2}` on each segment is what makes a padded token match. Base64url as the JWT
+  // spec defines it drops the `=` padding, but producers that reach for a plain base64 encoder
+  // emit it anyway, and a `=` in the header or payload segment used to defeat the match outright:
+  // not a partial redaction, but none at all, so the entire token was printed. `=` cannot appear
+  // anywhere except the end of a segment, since it is not one of the characters the segment body
+  // allows, so accepting it here cannot widen the match onto anything else.
+  ["jwt", /eyJ[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}/g],
   ["npm_token", /npm_[A-Za-z0-9]{36}/g],
   // rk_live_ (restricted keys) share the sk_live_/sk_test_ secret-key shape and risk level, so
   // one pattern covers all three rather than adding a near-duplicate entry.
@@ -6284,6 +6326,7 @@ export {
   countNoun,
   excludeTestsHiddenNote,
   countContentLines,
+  pushAll,
   escapeRegExp,
   windowsCmdQuoteArg,
   redactUrlQuery,
@@ -6324,6 +6367,7 @@ export {
   lastProjectConfigLockedKeys,
   getProjectConfigInfo,
   resolveConfigKeyLayer,
+  readConfigSource,
   isAutoTriggerMultiplierExplicit,
   loadConfig,
   invalidateConfigCache,

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-hook-chunk-4POU6OHK.mjs";
-import "./token-goat-hook-chunk-NIPXIAPA.mjs";
-import "./token-goat-hook-chunk-CRBMPT74.mjs";
-import "./token-goat-hook-chunk-XM4W3WCO.mjs";
-import "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
+} from "./token-goat-hook-chunk-BDR6C6IE.mjs";
+import "./token-goat-hook-chunk-3ZDBWJDF.mjs";
+import "./token-goat-hook-chunk-5UH54CW6.mjs";
+import "./token-goat-hook-chunk-A77A26A7.mjs";
+import "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";
 export {

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-HW4VUKJ5.mjs";
-import "./token-goat-chunk-D5IZEGN2.mjs";
-import "./token-goat-chunk-SIHYQCTM.mjs";
-import "./token-goat-chunk-I2KCEGIP.mjs";
+} from "./token-goat-chunk-KYFJC37X.mjs";
+import "./token-goat-chunk-IYTVE6KN.mjs";
+import "./token-goat-chunk-VYMGEVZS.mjs";
+import "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.6.35",
+  "version": "2.6.36",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",
@@ -51,7 +51,8 @@
     "dist/",
     "README.md",
     "SECURITY.md",
-    "LICENSE"
+    "LICENSE",
+    "scripts/install-git-hooks.mjs"
   ],
   "license": "PolyForm-Noncommercial-1.0.0",
   "engines": {
@@ -59,26 +60,26 @@
   },
   "dependencies": {
     "better-sqlite3": "^12.11.1",
-    "commander": "^15.0.0",
-    "csv-parse": "^7.0.2",
-    "js-yaml": "^5.2.1",
-    "jsonc-parser": "^3.3.1",
-    "smol-toml": "^1.8.0",
-    "zod": "^4.4.3"
+    "jsonc-parser": "^3.3.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^26.2.0",
+    "commander": "^15.0.0",
+    "csv-parse": "^7.0.2",
     "esbuild": "^0.28.2",
     "eslint": "^10.8.1",
     "exceljs": "^4.4.0",
     "html-to-text": "^10.0.1",
+    "js-yaml": "^5.2.1",
     "lefthook": "^2.1.10",
+    "smol-toml": "^1.8.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.67.0",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "zod": "^4.4.3"
   },
   "optionalDependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",

package/scripts/install-git-hooks.mjs

@@ -0,0 +1,55 @@
+/**
+ * `prepare` hook: wire up lefthook's git hooks for a development checkout.
+ *
+ * Runs `lefthook install` when lefthook is actually present, and skips quietly when it isn't.
+ *
+ * The skip matters because npm runs `prepare` for more than the dev-checkout case it was added
+ * for. `npm install -g .` runs it in a context without this project's node_modules/.bin on PATH,
+ * so a bare `lefthook install` dies with "'lefthook' is not recognized" and fails the global
+ * install that CLAUDE.md prescribes as the dogfood step for every CLI/hook change. Installing
+ * token-goat as a dependency has the same shape: no devDependencies, and no git repo to hook.
+ *
+ * Skipping is deliberately conditioned on lefthook being *absent*, not on the command failing.
+ * A developer whose `lefthook install` genuinely breaks still gets a hard error, because these
+ * hooks were decorative once already -- configured in lefthook.yml but never installed, so every
+ * guard in it silently did nothing -- and swallowing failures here is how that recurs.
+ */
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+import fs from 'node:fs'
+
+/**
+ * Absolute path to the lefthook CLI shim, or null when lefthook isn't installed here.
+ *
+ * Looks for npm's own `.bin` shim rather than resolving the package, because the shim is what
+ * npm creates for a devDependency and it is the exact thing missing in the contexts we skip.
+ * `.cmd` first: on Windows the extensionless file is a shell script Node can't spawn directly.
+ */
+function findLefthookBin(startDir) {
+  const binDir = path.join(startDir, 'node_modules', '.bin')
+  for (const name of ['lefthook.cmd', 'lefthook']) {
+    const candidate = path.join(binDir, name)
+    if (fs.existsSync(candidate)) return candidate
+  }
+  return null
+}
+
+const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const bin = findLefthookBin(projectRoot)
+
+if (bin === null) {
+  // Not a dev checkout with lefthook installed: a global install, a published-package install, or
+  // a pack/prepare temp dir. Nothing to wire up and nothing wrong -- exit 0 so the install works.
+  process.exit(0)
+}
+
+// npm's Windows shim is a .cmd batch file, which Node refuses to spawn without a shell. Quote the
+// path in that case, since `shell: true` re-parses the command string and the path can contain
+// spaces (a checkout under "C:\Program Files", a user profile with a space in the name).
+const needsShell = /\.(cmd|bat)$/i.test(bin)
+const result = spawnSync(needsShell ? `"${bin}"` : bin, ['install'], {
+  stdio: 'inherit',
+  shell: needsShell,
+})
+process.exit(result.status ?? 1)