token-goat 2.6.35 → 2.8.0

package/dist/{token-goat-chunk-K7W3P2TJ.mjs → token-goat-chunk-44Y77VHR.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.35";
+    return "2.8.0";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -418,14 +418,14 @@ function ensureDirSync(dir) {
 }
 function withRetryOnLock(fn) {
   let lastErr;
-  for (let attempt = 1; attempt <= 5; attempt++) {
+  for (let attempt2 = 1; attempt2 <= 5; attempt2++) {
     try {
       fn();
       return;
     } catch (err) {
       lastErr = err;
-      if (!isRetryable(err) || attempt === 5) throw err;
-      sleepSync(50 * attempt);
+      if (!isRetryable(err) || attempt2 === 5) throw err;
+      sleepSync(50 * attempt2);
     }
   }
   throw lastErr;
@@ -559,7 +559,7 @@ function withFileLock(lockPath, fn, opts = {}) {
   const staleMs = opts.staleMs ?? LOCK_STALE_MS;
   const token = `${process.pid}:${process.hrtime.bigint().toString()}`;
   const deadline = Date.now() + waitMs;
-  let attempt = 0;
+  let attempt2 = 0;
   for (; ; ) {
     try {
       writeFileSync(lockPath, token, { flag: "wx" });
@@ -582,7 +582,7 @@ function withFileLock(lockPath, fn, opts = {}) {
       continue;
     }
     if (Date.now() >= deadline) return void 0;
-    sleepSync(Math.min(20 * ++attempt, 200));
+    sleepSync(Math.min(20 * ++attempt2, 200));
   }
   const heartbeat = startHeartbeat(lockPath, token, staleMs);
   try {
@@ -770,6 +770,9 @@ function countContentLines(content) {
   const n = content.split("\n").length;
   return content.endsWith("\n") ? n - 1 : n;
 }
+function pushAll(target, items) {
+  for (const item of items) target.push(item);
+}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2449,7 +2452,6 @@ var ENV_KEYS2 = [
   "TOKEN_GOAT_OVERFLOW_MAX_TOKENS",
   "TOKEN_GOAT_HINT_JSON_SIDECAR",
   "TOKEN_GOAT_LARGE_READ_BYTES",
-  "TOKEN_GOAT_CURATOR",
   "TOKEN_GOAT_HINT_BUDGET",
   "TOKEN_GOAT_HOOK_WATCHDOG_MS",
   "TOKEN_GOAT_WEB_COMPRESS",
@@ -2510,8 +2512,19 @@ var _lastProjectConfigParseError = null;
 function getLastProjectConfigParseError() {
   return _lastProjectConfigParseError;
 }
-var PROJECT_LOCKED_SECTIONS = ["injection", "webfetch", "gdrive", "mcp", "network"];
-var PROJECT_LOCKED_KEYS = ["indexing.cross_project_symbols", "worker.blocked_roots"];
+var PROJECT_LOCKED_SECTIONS = [
+  "injection",
+  "webfetch",
+  "gdrive",
+  "mcp",
+  "network",
+  "screenshot"
+];
+var PROJECT_LOCKED_KEYS = [
+  "image_shrink.max_image_pixels",
+  "indexing.cross_project_symbols",
+  "worker.blocked_roots"
+];
 var _lastProjectConfigLockedKeys = [];
 function stripLockedProjectKeys(projectRaw) {
   const cleaned = {};
@@ -2642,10 +2655,12 @@ function resolveConfigKeyLayer(key, effectiveValue, cfg, projectInfo) {
   if (rawValueEquals(rawValue, effectiveValue)) return { layer: "project", path: projectInfo.path };
   return { layer: "project-invalid", path: projectInfo.path, rawValue, effectiveValue, reason: rejectionReason(key, rawValue, effectiveValue, cfg) };
 }
+function readConfigSource(p) {
+  return decodeSource(fs5.readFileSync(p));
+}
 function readConfigToml(p) {
   try {
-    const text = fs5.readFileSync(p, "utf8");
-    return { raw: parse(text), parseError: null };
+    return { raw: parse(readConfigSource(p)), parseError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { raw: {}, parseError: null };
@@ -2654,7 +2669,7 @@ function readConfigToml(p) {
 }
 function readConfigText(p) {
   try {
-    return { text: fs5.readFileSync(p, "utf8"), readError: null };
+    return { text: readConfigSource(p), readError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { text: null, readError: null };
@@ -2696,11 +2711,11 @@ function isAutoTriggerMultiplierExplicit() {
     return ca_raw["auto_trigger_multiplier"] !== void 0;
   };
   try {
-    if (setsMultiplier(fs5.readFileSync(configPath(), "utf8"))) return true;
+    if (setsMultiplier(readConfigSource(configPath()))) return true;
   } catch {
   }
   try {
-    return setsMultiplier(fs5.readFileSync(projectConfigPath(resolveConfigProjectRoot()), "utf8"));
+    return setsMultiplier(readConfigSource(projectConfigPath(resolveConfigProjectRoot())));
   } catch {
     return false;
   }
@@ -3685,17 +3700,21 @@ function isInsideStringLiteral(line, index, from = 0) {
   }
   return openQuote !== null;
 }
+function nextBlockCommentOpen(line, from) {
+  const lineCommentIdx = lineCommentStartIndex(line, ["//"], from);
+  let open = line.indexOf("/*", from);
+  while (open !== -1 && (isInsideStringLiteral(line, open, from) || lineCommentIdx !== -1 && open >= lineCommentIdx)) {
+    open = line.indexOf("/*", open + 1);
+  }
+  return open;
+}
 function stripBlockCommentSpan(line, inComment) {
   let code = "";
   let j = 0;
   let comment = inComment;
   while (j < line.length) {
     if (!comment) {
-      const lineCommentIdx = lineCommentStartIndex(line, ["//"], j);
-      let open = line.indexOf("/*", j);
-      while (open !== -1 && (isInsideStringLiteral(line, open, j) || lineCommentIdx !== -1 && open >= lineCommentIdx)) {
-        open = line.indexOf("/*", open + 1);
-      }
+      const open = nextBlockCommentOpen(line, j);
       if (open === -1) {
         code += line.slice(j);
         break;
@@ -3729,11 +3748,7 @@ function stripNestedBlockCommentSpan(line, depth) {
   let d = depth;
   while (j < line.length) {
     if (d === 0) {
-      const lineCommentIdx = lineCommentStartIndex(line, ["//"], j);
-      let open = line.indexOf("/*", j);
-      while (open !== -1 && (isInsideStringLiteral(line, open, j) || lineCommentIdx !== -1 && open >= lineCommentIdx)) {
-        open = line.indexOf("/*", open + 1);
-      }
+      const open = nextBlockCommentOpen(line, j);
       if (open === -1) {
         code += line.slice(j);
         break;
@@ -4179,6 +4194,7 @@ function propagateEndLinesToSymbols(symbols, sections) {
 }
 function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix, opts) {
   const block = opts?.blockComment;
+  const backtick = opts?.backtickQuote === true;
   let depth = 0;
   let quote = null;
   for (let i = openBraceIndex; i < content.length; i++) {
@@ -4200,7 +4216,7 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       while (i < content.length && content[i] !== "\n") i++;
       continue;
     }
-    if (ch === '"' || ch === "'") {
+    if (ch === '"' || ch === "'" || backtick && ch === "`") {
       quote = ch;
       continue;
     }
@@ -4438,11 +4454,328 @@ function redactIfDotenv(filePath, text) {
 }
 
 // src/db.ts
+import * as fs7 from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import * as path7 from "node:path";
+
+// src/sqlite_driver.ts
 import * as fs6 from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import * as path7 from "node:path";
-import Database from "better-sqlite3";
 var _require = createRequire2(import.meta.url);
+function suppressSqliteExperimentalWarning() {
+  const original = process.emit;
+  let armed = true;
+  const restore = () => {
+    if (!armed) return;
+    armed = false;
+    process.emit = original;
+  };
+  process.emit = function patched(name, ...rest) {
+    const data = rest[0];
+    if (armed && name === "warning" && data instanceof Error && data.name === "ExperimentalWarning" && /sqlite/i.test(data.message)) {
+      restore();
+      return false;
+    }
+    return original.call(this, name, ...rest);
+  };
+  setImmediate(restore);
+  return restore;
+}
+var restoreWarnings = suppressSqliteExperimentalWarning();
+var nodeSqlite;
+try {
+  nodeSqlite = _require("node:sqlite");
+} catch (e) {
+  restoreWarnings();
+  throw e;
+}
+var { DatabaseSync } = nodeSqlite;
+var SQLITE_PRIMARY_CODES = [
+  "SQLITE_OK",
+  "SQLITE_ERROR",
+  "SQLITE_INTERNAL",
+  "SQLITE_PERM",
+  "SQLITE_ABORT",
+  "SQLITE_BUSY",
+  "SQLITE_LOCKED",
+  "SQLITE_NOMEM",
+  "SQLITE_READONLY",
+  "SQLITE_INTERRUPT",
+  "SQLITE_IOERR",
+  "SQLITE_CORRUPT",
+  "SQLITE_NOTFOUND",
+  "SQLITE_FULL",
+  "SQLITE_CANTOPEN",
+  "SQLITE_PROTOCOL",
+  "SQLITE_EMPTY",
+  "SQLITE_SCHEMA",
+  "SQLITE_TOOBIG",
+  "SQLITE_CONSTRAINT",
+  "SQLITE_MISMATCH",
+  "SQLITE_MISUSE",
+  "SQLITE_NOLFS",
+  "SQLITE_AUTH",
+  "SQLITE_FORMAT",
+  "SQLITE_RANGE",
+  "SQLITE_NOTADB",
+  "SQLITE_NOTICE",
+  "SQLITE_WARNING"
+];
+var SQLITE_EXTENDED_SUFFIXES = {
+  SQLITE_OK: ["LOAD_PERMANENTLY", "SYMLINK"],
+  SQLITE_ERROR: ["MISSING_COLLSEQ", "RETRY", "SNAPSHOT"],
+  SQLITE_ABORT: [null, "ROLLBACK"],
+  SQLITE_BUSY: ["RECOVERY", "SNAPSHOT", "TIMEOUT"],
+  SQLITE_LOCKED: ["SHAREDCACHE", "VTAB"],
+  SQLITE_READONLY: ["RECOVERY", "CANTLOCK", "ROLLBACK", "DBMOVED", "CANTINIT", "DIRECTORY"],
+  SQLITE_IOERR: [
+    "READ",
+    "SHORT_READ",
+    "WRITE",
+    "FSYNC",
+    "DIR_FSYNC",
+    "TRUNCATE",
+    "FSTAT",
+    "UNLOCK",
+    "RDLOCK",
+    "DELETE",
+    "BLOCKED",
+    "NOMEM",
+    "ACCESS",
+    "CHECKRESERVEDLOCK",
+    "LOCK",
+    "CLOSE",
+    "DIR_CLOSE",
+    "SHMOPEN",
+    "SHMSIZE",
+    "SHMLOCK",
+    "SHMMAP",
+    "SEEK",
+    "DELETE_NOENT",
+    "MMAP",
+    "GETTEMPPATH",
+    "CONVPATH",
+    "VNODE",
+    "AUTH",
+    "BEGIN_ATOMIC",
+    "COMMIT_ATOMIC",
+    "ROLLBACK_ATOMIC",
+    "DATA",
+    "CORRUPTFS",
+    "IN_PAGE"
+  ],
+  SQLITE_CORRUPT: ["VTAB", "SEQUENCE", "INDEX"],
+  SQLITE_CANTOPEN: ["NOTEMPDIR", "ISDIR", "FULLPATH", "CONVPATH", "DIRTYWAL", "SYMLINK"],
+  SQLITE_CONSTRAINT: [
+    "CHECK",
+    "COMMITHOOK",
+    "FOREIGNKEY",
+    "FUNCTION",
+    "NOTNULL",
+    "PRIMARYKEY",
+    "TRIGGER",
+    "UNIQUE",
+    "VTAB",
+    "ROWID",
+    "PINNED",
+    "DATATYPE"
+  ],
+  SQLITE_AUTH: ["USER"],
+  SQLITE_NOTICE: ["RECOVER_WAL", "RECOVER_ROLLBACK", "RBU"],
+  SQLITE_WARNING: ["AUTOINDEX"]
+};
+function sqliteResultCodeName(errcode) {
+  if (!Number.isInteger(errcode) || errcode < 0) return "ERR_SQLITE_ERROR";
+  if (errcode === 100) return "SQLITE_ROW";
+  if (errcode === 101) return "SQLITE_DONE";
+  const primary = SQLITE_PRIMARY_CODES[errcode & 255];
+  if (primary === void 0) return "ERR_SQLITE_ERROR";
+  const subcode = errcode >> 8;
+  if (subcode === 0) return primary;
+  const suffix = SQLITE_EXTENDED_SUFFIXES[primary]?.[subcode - 1];
+  return suffix === void 0 || suffix === null ? primary : `${primary}_${suffix}`;
+}
+function attempt(fn) {
+  try {
+    return fn();
+  } catch (e) {
+    const err = e;
+    if (err.code === "ERR_SQLITE_ERROR" && typeof err.errcode === "number") {
+      err.code = sqliteResultCodeName(err.errcode);
+    }
+    throw e;
+  }
+}
+var Statement = class {
+  #stmt;
+  #pluck = false;
+  constructor(stmt) {
+    this.#stmt = stmt;
+  }
+  get source() {
+    return this.#stmt.sourceSQL;
+  }
+  /**
+   * better-sqlite3's `reader` flag: does this statement return rows?
+   *
+   * `node:sqlite` has no equivalent, so it is derived from the prepared statement's own column
+   * count -- SQLite gives a row-producing statement its result columns at prepare time and gives a
+   * non-producing one none. That is a derivation, and this is the third defence-in-depth layer in
+   * `sqlite_query.ts`'s read-only guard, so it is not taken on faith: the driver tests run both
+   * libraries side by side over SELECT, a CTE, VALUES, EXPLAIN, an empty-result SELECT, INSERT,
+   * UPDATE, DELETE, CREATE, a reading PRAGMA and an assigning PRAGMA, and require every verdict to
+   * agree. If a future SQLite statement form ever breaks the equivalence, that test fails rather
+   * than the guard quietly weakening.
+   */
+  get reader() {
+    return attempt(() => this.#stmt.columns()).length > 0;
+  }
+  // A plucked row is "the first column", which for an object row means the first *inserted* key. V8 preserves insertion order for string keys, and node:sqlite builds the row by walking the result columns left to right, so Object.values()[0] is the leftmost column -- not the column named in the SQL text, the same rule better-sqlite3 applies.
+  #shape(row) {
+    if (!this.#pluck || row === void 0 || row === null) return row;
+    const values = Object.values(row);
+    return values.length === 0 ? void 0 : values[0];
+  }
+  get(...params) {
+    return this.#shape(attempt(() => this.#stmt.get(...params)));
+  }
+  all(...params) {
+    const rows = attempt(() => this.#stmt.all(...params));
+    return this.#pluck ? rows.map((r) => this.#shape(r)) : rows;
+  }
+  run(...params) {
+    return attempt(() => this.#stmt.run(...params));
+  }
+  // Wrapped rather than returned directly so pluck applies lazily, one row at a time: the whole point of iterate() here is that sqlite_query.ts caps the row count without buffering the rest, and mapping the iterator through .all() first would defeat that.
+  *iterate(...params) {
+    const rows = attempt(() => this.#stmt.iterate(...params))[Symbol.iterator]();
+    for (; ; ) {
+      const next = attempt(() => rows.next());
+      if (next.done === true) return;
+      yield this.#shape(next.value);
+    }
+  }
+  pluck(toggle = true) {
+    this.#pluck = toggle;
+    return this;
+  }
+  safeIntegers(toggle = true) {
+    this.#stmt.setReadBigInts(toggle);
+    return this;
+  }
+  columns() {
+    return attempt(() => this.#stmt.columns());
+  }
+};
+var Database = class {
+  #db;
+  #path;
+  #readonly;
+  #savepoints = 0;
+  constructor(dbPath, options = {}) {
+    const wantsExisting = options.readonly === true || options.fileMustExist === true;
+    if (wantsExisting && dbPath !== ":memory:" && !fs6.existsSync(dbPath)) {
+      throw new Error("unable to open database file");
+    }
+    this.#db = attempt(() => new DatabaseSync(dbPath, {
+      readOnly: options.readonly === true,
+      // sqlite-vec is loaded through db.loadExtension by initConnection, which node:sqlite refuses unless the connection opted in at construction. Harmless when no extension is ever loaded.
+      allowExtension: true,
+      // better-sqlite3 opens every connection with busy_timeout at 5000ms; node:sqlite opens at 0, so a connection that named no timeout would silently go from five seconds of patience to none. db.ts overrides this to 15000 in initConnection, but sqlite_query.ts opens a user's arbitrary database readonly and takes whatever the default is -- which would have turned ordinary contention with another writer into an immediate "database is locked".
+      timeout: options.timeout ?? 5e3
+    }));
+    this.#path = dbPath;
+    this.#readonly = options.readonly === true;
+  }
+  get open() {
+    return this.#db.isOpen;
+  }
+  get inTransaction() {
+    return this.#db.isTransaction;
+  }
+  get readonly() {
+    return this.#readonly;
+  }
+  get name() {
+    return this.#path;
+  }
+  prepare(sql) {
+    return new Statement(attempt(() => this.#db.prepare(sql)));
+  }
+  exec(sql) {
+    attempt(() => this.#db.exec(sql));
+  }
+  pragma(source, options = {}) {
+    const rows = attempt(() => this.#db.prepare(`PRAGMA ${source}`).all());
+    if (options.simple !== true) return rows;
+    const first = rows[0];
+    if (first === void 0) return void 0;
+    const values = Object.values(first);
+    return values.length === 0 ? void 0 : values[0];
+  }
+  function(name, options, fn) {
+    attempt(() => this.#db.function(name, options, fn));
+  }
+  loadExtension(extensionPath) {
+    attempt(() => this.#db.loadExtension(extensionPath));
+  }
+  close() {
+    attempt(() => this.#db.close());
+  }
+  /**
+   * Wrap `fn` so it runs inside a transaction, committing on return and rolling back on throw.
+   *
+   * Nesting uses SAVEPOINT, which is what makes it safe for a transactional helper to call another
+   * one: an inner `BEGIN` would throw ("cannot start a transaction within a transaction"), an inner
+   * SAVEPOINT composes. Whether we are nested is read from SQLite via `isTransaction` rather than
+   * tracked in a counter here, so a transaction some other code path opened still nests correctly.
+   *
+   * The rollback is best-effort and never replaces the caller's error: if the ROLLBACK itself fails
+   * -- the connection died, the transaction was already unwound -- the original failure is still
+   * what propagates, because that is the one that explains what went wrong.
+   */
+  transaction(fn) {
+    const build = (beginSql) => (...args) => {
+      if (this.#db.isTransaction) {
+        const name = `tg_sp_${this.#savepoints++}`;
+        attempt(() => this.#db.exec(`SAVEPOINT ${name}`));
+        try {
+          const result = fn(...args);
+          attempt(() => this.#db.exec(`RELEASE ${name}`));
+          return result;
+        } catch (e) {
+          try {
+            attempt(() => this.#db.exec(`ROLLBACK TO ${name}`));
+            attempt(() => this.#db.exec(`RELEASE ${name}`));
+          } catch {
+          }
+          throw e;
+        }
+      }
+      attempt(() => this.#db.exec(beginSql));
+      try {
+        const result = fn(...args);
+        attempt(() => this.#db.exec("COMMIT"));
+        return result;
+      } catch (e) {
+        try {
+          attempt(() => this.#db.exec("ROLLBACK"));
+        } catch {
+        }
+        throw e;
+      }
+    };
+    const wrapped = build("BEGIN");
+    wrapped.default = wrapped;
+    wrapped.deferred = build("BEGIN");
+    wrapped.immediate = build("BEGIN IMMEDIATE");
+    wrapped.exclusive = build("BEGIN EXCLUSIVE");
+    return wrapped;
+  }
+};
+
+// src/db.ts
+var _require2 = createRequire3(import.meta.url);
 var _connections = /* @__PURE__ */ new Map();
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS files (
@@ -4642,6 +4975,26 @@ CREATE TABLE IF NOT EXISTS skill_version_snapshots (
   loaded_commands_json TEXT NOT NULL,
   notified_at REAL
 );
+
+-- Which embedding stack produced the vectors currently in chunk_vectors -- the model, its
+-- pinned revision, and the inference runtime (see embeddingProvenance in embeddings.ts). The
+-- vector table itself is vec0(rowid, embedding) and has nowhere to record this, so without
+-- this row a database that was embedded by one stack and then added to by another holds two
+-- incomparable sets of vectors under one index, with nothing able to tell them apart. That is
+-- not hypothetical: global.db is machine-wide across every project on the machine (see
+-- constants.ts), so upgrading the runtime, or changing the model or its pinned revision, mixes
+-- old and new vectors for as long as the old files go untouched. Measured drift between two
+-- runtime versions of the same quantized model is 0.9925-0.9978 cosine on the final vector --
+-- small, but enough to reorder near-ties, and invisible to every existing check.
+--
+-- Single-row by construction (the CHECK pins the key), because there is exactly one vector
+-- table per database. An EMPTY table on a database that already holds chunks means the vectors
+-- predate this stamp and their provenance is unknowable -- see ensureEmbeddingProvenance, which
+-- treats that exactly like a mismatch. That is what makes this work without a migration step.
+CREATE TABLE IF NOT EXISTS embedding_provenance (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  provenance TEXT NOT NULL
+);
 `;
 var FTS_SQL = `
 CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(
@@ -4692,7 +5045,7 @@ CREATE TRIGGER IF NOT EXISTS cache_recall_au AFTER UPDATE ON cache_recall BEGIN
   VALUES (new.row_id, new.label, new.content);
 END;
 `;
-var SCHEMA_VERSION = 11;
+var SCHEMA_VERSION = 12;
 function alterTableIdempotent(conn, sql) {
   try {
     conn.exec(sql);
@@ -4723,7 +5076,7 @@ function purgeDotenvEmbeddings(conn) {
 var MIGRATIONS = {
   // v1 -> v2: adds files.embed_sha, tracked separately from files.sha so embedding freshness can be gated independently of parse freshness (see makeIndexer in worker.ts). A pre-existing v1 database's `files` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, so a genuine ALTER TABLE failure is never silently lost.
   1: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN embed_sha TEXT"),
-  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / resetTransientRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant resetTransientRetryCount -- called from appendDirtyPath (hooks_index.ts) in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
+  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / clearRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant the retry-count reset -- run at the time in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
   2: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN retry_count INTEGER NOT NULL DEFAULT 0"),
   // v8 -> v9: adds symbols.parent (see SCHEMA_VERSION comment above for why). A pre-existing v8 database's `symbols` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 above.
   8: (conn) => alterTableIdempotent(conn, "ALTER TABLE symbols ADD COLUMN parent TEXT NOT NULL DEFAULT ''"),
@@ -4743,13 +5096,32 @@ function runMigrations(conn, fromVersion, toVersion) {
     MIGRATIONS[v]?.(conn);
   }
 }
-function initConnection(conn) {
-  const walMode = conn.pragma("journal_mode = WAL", { simple: true });
-  if (String(walMode).toLowerCase() !== "wal") {
-    throw new Error(`db: failed to enable WAL mode (got: ${walMode})`);
+var WAL_SWITCH_DEADLINE_MS = 15e3;
+function enableWalWithRetry(conn, budgetMs = WAL_SWITCH_DEADLINE_MS) {
+  const deadline = Date.now() + budgetMs;
+  let lastError;
+  for (; ; ) {
+    try {
+      const mode = conn.pragma("journal_mode = WAL", { simple: true });
+      if (String(mode).toLowerCase() === "wal") return;
+      lastError = new Error(`got: ${String(mode)}`);
+    } catch (e) {
+      lastError = e;
+    }
+    try {
+      if (String(conn.pragma("journal_mode", { simple: true })).toLowerCase() === "wal") return;
+    } catch {
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`db: failed to enable WAL mode (${lastError instanceof Error ? lastError.message : String(lastError)})`);
+    }
+    sleepSync(25);
   }
-  conn.pragma("synchronous = NORMAL");
+}
+function initConnection(conn) {
   conn.pragma("busy_timeout = 15000");
+  enableWalWithRetry(conn);
+  conn.pragma("synchronous = NORMAL");
   conn.function(
     "TG_LOWER",
     { deterministic: true },
@@ -4767,7 +5139,7 @@ function initConnection(conn) {
   } catch {
   }
   try {
-    const sqliteVec = _require("sqlite-vec");
+    const sqliteVec = _require2("sqlite-vec");
     sqliteVec.load(conn);
     conn.exec(
       `CREATE VIRTUAL TABLE IF NOT EXISTS chunk_vectors USING vec0(
@@ -4798,7 +5170,7 @@ function getDb(dbPath) {
   try {
     ensureDirSync(dir);
   } catch (e) {
-    if (e.code !== "EEXIST" || !fs6.existsSync(dir)) throw e;
+    if (e.code !== "EEXIST" || !fs7.existsSync(dir)) throw e;
   }
   const conn = new Database(resolved);
   try {
@@ -5493,7 +5865,8 @@ function _renderInsightsSection(stats) {
   function dim(s) {
     return `${fg(...C.TEXT_MUTED)}${s}${RESET}`;
   }
-  const topKind = stats.by_kind.reduce((max, k) => k.bytes > (max?.bytes || -Infinity) ? k : max, stats.by_kind[0]);
+  const savingKinds = stats.by_kind.filter((k) => k.bytes > 0);
+  const topKind = savingKinds.reduce((max, k) => k.bytes > (max?.bytes || -Infinity) ? k : max, savingKinds[0]);
   if (topKind) {
     const share = stats.totals.bytes > 0 ? topKind.bytes / stats.totals.bytes : 0;
     lines.push(
@@ -5506,7 +5879,7 @@ function _renderInsightsSection(stats) {
       `${_M}${bullet} ${dim(_STATS_MESSAGES.insights.mostActive)}${fg(...C.TEXT_PRIMARY)}${topDay.date}${RESET}${dim(" \u2014 ")}${topDay.events.toLocaleString()} events, ${_fmtBytes(topDay.bytes)}${dim(" saved")}`
     );
   }
-  const tokenKinds = stats.by_kind.filter((k) => !k.bytes_mode_only);
+  const tokenKinds = stats.by_kind.filter((k) => !k.bytes_mode_only && k.tokens > 0);
   const topToken = tokenKinds.reduce((max, k) => k.tokens > (max?.tokens || -Infinity) ? k : max, tokenKinds[0]);
   if (topToken) {
     lines.push(
@@ -5657,6 +6030,8 @@ var KIND_TO_SOURCE = {
   // Cold first load of an oversized skill where preSkillHandler inlined the compact slice in its reply instead of pointing at `skill-body --compact`. Unlike its skill_oversized_first_load sibling (event-only, 0 bytes -- the pointer deny saves nothing by itself, the follow-up command does) this one records real savings: the full body never landed, the slice did, so bytesSaved is body minus slice.
   skill_compact_inlined: SOURCE_SKILL,
   secret_redacted: SOURCE_OTHER,
+  // Measurement of what a compaction produced (hooks_compact.ts postCompactHandler): summary size and how many manifest paths survived into it. SOURCE_OTHER and always recorded at (0, 0) -- the summary was written whether or not token-goat was watching, so there is no counterfactual in which those bytes were saved. Filing it anywhere with a savings total would credit token-goat for the whole summary, which is the accounting mistake this registry exists to prevent.
+  compact_summary: SOURCE_OTHER,
   // Envelope compaction of an oversized subagent report (hooks_agent_spawn.ts). SOURCE_CONTENT, not SOURCE_HINT: the handler's sibling session_hint entry is advisory (it only appends a recall pointer and genuinely saves nothing), whereas this kind records a real rewrite with real bytes removed, so filing it under the advisory bucket would understate the compaction and repeat the zero-savings desync this registry keeps getting bitten by.
   agent_report_compact: SOURCE_CONTENT,
   // Decline counterpart to agent_report_compact: the fence-collapse net-benefit gate ran and found at least one over-long fence, but declined to rewrite because net savings did not clear the notice cost. Always recorded at (0, 0) -- see the recordStat call site -- so it never contributes to any savings total; it exists purely to make gate hit-rate and near-misses visible instead of the decline being invisible.
@@ -6106,7 +6481,14 @@ var SECRET_PATTERNS = [
   // realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical
   // anchor here -- each of the three dot-separated segments requires a minimum length to avoid
   // matching a short, coincidentally dotted token.
-  ["jwt", /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g],
+  //
+  // The trailing `={0,2}` on each segment is what makes a padded token match. Base64url as the JWT
+  // spec defines it drops the `=` padding, but producers that reach for a plain base64 encoder
+  // emit it anyway, and a `=` in the header or payload segment used to defeat the match outright:
+  // not a partial redaction, but none at all, so the entire token was printed. `=` cannot appear
+  // anywhere except the end of a segment, since it is not one of the characters the segment body
+  // allows, so accepting it here cannot widen the match onto anything else.
+  ["jwt", /eyJ[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}/g],
   ["npm_token", /npm_[A-Za-z0-9]{36}/g],
   // rk_live_ (restricted keys) share the sk_live_/sk_test_ secret-key shape and risk level, so
   // one pattern covers all three rather than adding a near-duplicate entry.
@@ -6251,6 +6633,7 @@ function stripAnsiCodes(text) {
 export {
   VERSION,
   dataDir,
+  ensureDataDirPrivate,
   globalDbPath,
   configPath,
   ENV_KEYS,
@@ -6301,6 +6684,7 @@ export {
   countNoun,
   excludeTestsHiddenNote,
   countContentLines,
+  pushAll,
   escapeRegExp,
   windowsCmdQuoteArg,
   redactUrlQuery,
@@ -6338,12 +6722,14 @@ export {
   lastProjectConfigLockedKeys,
   getProjectConfigInfo,
   resolveConfigKeyLayer,
+  readConfigSource,
   isAutoTriggerMultiplierExplicit,
   loadConfig,
   invalidateConfigCache,
   loadPersistedConfig,
   CONFIG_KEY_ENV_OVERRIDES,
   saveConfig,
+  Database,
   precedingDocComment,
   buildLineIndex,
   offsetToLine,