token-goat 2.8.1 → 2.8.2

package/README.md

@@ -395,7 +395,7 @@ This writes hook entries into `~/.gemini/settings.json` using Gemini CLI's `Befo
 token-goat install --qwen
 ```
 
-This writes hook entries into `~/.qwen/settings.json`. Unlike Gemini CLI (its own ancestor, with a custom `BeforeTool`/`AfterTool`/`PreCompress` event/matcher scheme), Qwen Code's hooks system diverged and now mirrors Claude Code's own natively — `PreToolUse`/`PostToolUse`/`PreCompact`/`UserPromptSubmit`/`SubagentStop` event names and snake_case stdin JSON — so token-goat wires all five events with no wire-format translation needed. Qwen Code's own tool-name taxonomy is only partially documented, so token-goat uses a catch-all matcher per event rather than an incomplete per-tool list. Image shrinking, session hints, post-edit indexing, compact assist, and bash output compression all work. This bridge was built from QwenLM/qwen-code's published docs, not dogfooded against a live Qwen Code install — if hooks aren't firing, `token-goat doctor` and the settings.json contents are the first things to check. To remove: `token-goat uninstall --qwen`.
+This writes hook entries into `~/.qwen/settings.json`. Unlike Gemini CLI (its own ancestor, with a custom `BeforeTool`/`AfterTool`/`PreCompress` event/matcher scheme), Qwen Code's hooks system diverged and now mirrors Claude Code's own natively — `PreToolUse`/`PostToolUse`/`PreCompact`/`UserPromptSubmit`/`SubagentStop` event names and snake_case stdin JSON — so token-goat wires all five events with no wire-format translation needed. Qwen Code's own tool-name taxonomy is only partially documented, so token-goat uses a catch-all matcher per event rather than an incomplete per-tool list. Image shrinking, session hints, post-edit indexing, compact assist, and bash output compression all work. This bridge was built from QwenLM/qwen-code's published docs, not tested against a live Qwen Code install — if hooks aren't firing, `token-goat doctor` and the settings.json contents are the first things to check. To remove: `token-goat uninstall --qwen`.
 
 ### Kimi Code users
 
@@ -403,7 +403,7 @@ This writes hook entries into `~/.qwen/settings.json`. Unlike Gemini CLI (its ow
 token-goat install --kimi
 ```
 
-This writes `[[hooks]]` entries into `~/.kimi-code/config.toml` (or `$KIMI_CODE_HOME/config.toml`), covering Kimi Code's `PreToolUse`, `PostToolUse`, `PreCompact`, `UserPromptSubmit`, `SubagentStop`, and `SessionStart` events. Kimi Code sends a Claude-Code-shaped snake_case payload on stdin, but it reads a different response: only a top-level `message` and `hookSpecificOutput.permissionDecision` / `permissionDecisionReason`. So the install also writes a small shim at `~/.kimi-code/hooks/token-goat-shim.js` that translates token-goat's answer into that contract, turns a hint into `message`, and writes nothing at all for a no-op. Image shrinking, session hints, post-edit indexing, compact assist, and bash output compression all work. `Notification` and `Stop` are not wired, because token-goat has no handler for them. Input and output rewriting are not wired either: Kimi Code offers no channel to replace a tool's input or its result. This bridge was built from MoonshotAI/kimi-code's own source and docs, not dogfooded against a live Kimi Code install, so if hooks are not firing, `token-goat doctor` and the `config.toml` contents are the first things to check. To remove: `token-goat uninstall --kimi`.
+This writes `[[hooks]]` entries into `~/.kimi-code/config.toml` (or `$KIMI_CODE_HOME/config.toml`), covering Kimi Code's `PreToolUse`, `PostToolUse`, `PreCompact`, `UserPromptSubmit`, `SubagentStop`, and `SessionStart` events. Kimi Code sends a Claude-Code-shaped snake_case payload on stdin, but it reads a different response: only a top-level `message` and `hookSpecificOutput.permissionDecision` / `permissionDecisionReason`. So the install also writes a small shim at `~/.kimi-code/hooks/token-goat-shim.js` that translates token-goat's answer into that contract, turns a hint into `message`, and writes nothing at all for a no-op. Image shrinking, session hints, post-edit indexing, compact assist, and bash output compression all work. `Notification` and `Stop` are not wired, because token-goat has no handler for them. Input and output rewriting are not wired either: Kimi Code offers no channel to replace a tool's input or its result. This bridge was built from MoonshotAI/kimi-code's own source and docs, not tested against a live Kimi Code install, so if hooks are not firing, `token-goat doctor` and the `config.toml` contents are the first things to check. To remove: `token-goat uninstall --kimi`.
 
 ### opencode users
 
@@ -423,7 +423,7 @@ The `--openclaw` flag patches Claude Code and registers a TypeScript bridge plug
 
 What works: **bash output compression**, **re-read denial** and **surgical-read redirects for oversized first reads**, **image shrinking**, and **post-edit indexing** (all via `before_tool_call`/`after_tool_call`). What doesn't: **session hints** — OpenClaw's tool-call hooks have no context-injection channel, only param rewriting — and the **compaction manifest** — OpenClaw's `before_compaction`/`after_compaction` are observation-only, with no return-value mechanism to inject a manifest into the next turn the way pi's compaction hooks do.
 
-This bridge has not been validated against a live OpenClaw instance — it's built from OpenClaw's documented plugin SDK and hook event types, not dogfooded against a real running gateway. If tool calls aren't being intercepted, the built-in tool name list in `openclaw.ts`'s `TOOL_TO_TG` map is the first thing to check. To remove: `token-goat uninstall --openclaw`.
+This bridge has not been validated against a live OpenClaw instance — it's built from OpenClaw's documented plugin SDK and hook event types, not tested against a real running gateway. If tool calls aren't being intercepted, the built-in tool name list in `openclaw.ts`'s `TOOL_TO_TG` map is the first thing to check. To remove: `token-goat uninstall --openclaw`.
 
 ### pi users
 

package/dist/{token-goat-chunk-VBXBLGTO.mjs → token-goat-chunk-2MWF3OGR.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-RMDQFTQD.mjs";
+} from "./token-goat-chunk-LILS6TIU.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
@@ -113,7 +113,7 @@ import {
   searchRecall,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-XEDQH5DA.mjs";
+} from "./token-goat-chunk-5MLXFSRI.mjs";
 import {
   AGENT_SALT_MARKER,
   CONTEXT_AUTOCOMPACT_TOKENS,
@@ -256,7 +256,7 @@ import {
   vscodeDecoderConfigured,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-2G6RAB4G.mjs";
+} from "./token-goat-chunk-AM23GDIS.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -338,11 +338,14 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import {
   __export
 } from "./token-goat-chunk-AEX54RUZ.mjs";
 
+// src/cli.ts
+import { randomBytes } from "node:crypto";
+
 // node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
   /**
@@ -4084,7 +4087,8 @@ var PI_EXTENSION_SCRIPT = `// token-goat bridge extension for pi (pi-coding-agen
 // Bridges pi's extension events to token-goat's subprocess hook protocol.
 // https://github.com/DFKHelper/token-goat
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process"
+import crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -4543,6 +4547,7 @@ var OPENCODE_PLUGIN_SCRIPT = `// token-goat bridge plugin for opencode
 // Bridges opencode's plugin hooks to token-goat's subprocess hook protocol.
 // https://github.com/DFKHelper/token-goat
 import { spawnSync } from "node:child_process"
+import crypto from "node:crypto"
 import fs from "node:fs"
 import os from "node:os"
 import path from "node:path"
@@ -9976,7 +9981,7 @@ function parseNodeBlock(lines, start) {
   }
   return { block: { frames, exception: header }, nextIndex: i };
 }
-var RUST_PANIC_HEADER_RE = /^thread '[^']*' panicked at (.+):(\d+):(\d+):\s*$/;
+var RUST_PANIC_HEADER_RE = /^thread '[^']*' panicked at ([^:\r\n]+):(\d+):(\d+):\s*$/;
 var RUST_BACKTRACE_NOTE_RE = /^note: run with `RUST_BACKTRACE=1`/;
 var RUST_BACKTRACE_NUM_RE = /^\s*\d+:\s+(.+)$/;
 var RUST_BACKTRACE_AT_RE = /^\s+at\s+(.+):(\d+):(\d+)\s*$/;
@@ -10022,7 +10027,7 @@ function parseRustBlock(lines, start) {
   }
   return { block: { frames: [panicFrame], exception }, nextIndex: i };
 }
-var JVM_HEADER_RE = /^(?:Exception in thread "[^"]*" )?(?:Caused by: )?((?:[A-Za-z_$][\w$]*\.)+[A-Za-z_$][\w$]*): (.*)$/;
+var JVM_HEADER_RE = /^(?:Exception in thread "[^"\r\n]*" )?(?:Caused by: )?((?:[A-Za-z_$][\w$]*\.)+[A-Za-z_$][\w$]*): (.*)$/;
 var JVM_FRAME_RE = /^\s+at\s+(\S+)\(([^)]*)\)\s*$/;
 var JVM_MORE_RE = /^\s*\.\.\.\s+\d+\s+more\s*$/;
 function parseJvmFrameLine(line) {
@@ -14038,7 +14043,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-73MF6YWW.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-AL644JUV.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-324QOJYZ.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -14063,7 +14068,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-YUGNM3KL.mjs");
+  const { relay } = await import("./token-goat-chunk-JU7QESB3.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -14958,7 +14963,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-I6TOUPLP.mjs");
+    const bashRunner = await import("./token-goat-chunk-BTZSUIYA.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -15227,7 +15232,7 @@ function atomicWriteBuffer(dest, data) {
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
-  const rnd = Math.random().toString(36).slice(2, 8);
+  const rnd = randomBytes(4).toString("hex");
   const tmp = path27.join(path27.dirname(path27.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
   try {
     fs27.writeFileSync(tmp, data, { mode: 384 });

package/dist/{token-goat-chunk-XEDQH5DA.mjs → token-goat-chunk-5MLXFSRI.mjs}

@@ -8,7 +8,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-chunk-2G6RAB4G.mjs";
+} from "./token-goat-chunk-AM23GDIS.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -18,7 +18,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -404,10 +404,10 @@ var COMMAND_PATTERNS = {
   gitImmutable: /^\s*git\s+show\s+[0-9a-f]{40}\b/i,
   gitDiffScoped: /\s--\s+\S/,
   dirListing: /^\s*(?:ls|eza|exa|dir|Get-ChildItem|gci)\b/i,
-  depList: /^\s*(?:npm\s+(?:-\S+\s+)*(?:ls|list)\b|pip\s+(?:-\S+\s+)*(?:list|freeze)\b|uv\s+pip\s+(?:-\S+\s+)*(?:list|freeze)\b|pnpm\s+(?:-\S+\s+)*(?:list|ls)\b|yarn\s+(?:-\S+\s+)*(?:list)\b|cargo\s+(?:-\S+\s+)*tree\b|bundle\s+(?:-\S+\s+)*(?:list|show)\b|composer\s+(?:-\S+\s+)*show\b)/i,
-  npmInstall: /^\s*npm\s+(?:-\S+\s+)*(?:install|ci)\b/i,
-  npmAudit: /^\s*npm\s+(?:-\S+\s+)*audit\b(?!.*(?:--fix|fix)\b)/i,
-  npmOutdated: /^\s*npm\s+(?:-\S+\s+)*outdated\b/i,
+  depList: /^\s*(?:npm\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:ls|list)\b|pip\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:list|freeze)\b|uv\s+pip\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:list|freeze)\b|pnpm\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:list|ls)\b|yarn\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:list)\b|cargo\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*tree\b|bundle\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:list|show)\b|composer\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*show\b)/i,
+  npmInstall: /^\s*npm\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*(?:install|ci)\b/i,
+  npmAudit: /^\s*npm\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*audit\b(?!.*(?:--fix|fix)\b)/i,
+  npmOutdated: /^\s*npm\s+(?:--?[a-zA-Z0-9_-]+(?:\s+|=)?)*outdated\b/i,
   envProbe: /^\s*(?:node\s+(?:-v|--version)|npm\s+(?:-v|--version)|python3?\s+(?:(?:-V)\b|--?version)|git\s+--version|uv\s+--version|go\s+version|rustc\s+--version|cargo\s+--version|java\s+--version|ruby\s+--version|gem\s+--version|php\s+--version|which\b|where\b)/i,
   npx: /^\s*npx\s+(?:--?yes\s+)?(?!.*\b(?:install|add|remove|uninstall|i|rm|update|upgrade|set|get|publish|link|ci|audit|shrinkwrap|dedupe|prune|rebuild)\b)/i,
   gitPush: /^\s*git\s+push\b/i,

package/dist/{token-goat-chunk-73MF6YWW.mjs → token-goat-chunk-AL644JUV.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-RMDQFTQD.mjs";
+} from "./token-goat-chunk-LILS6TIU.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-2G6RAB4G.mjs";
+} from "./token-goat-chunk-AM23GDIS.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/dist/{token-goat-chunk-2G6RAB4G.mjs → token-goat-chunk-AM23GDIS.mjs}

@@ -91,7 +91,7 @@ import {
   withFileLock,
   writeIfDifferent,
   writeJsonSettings
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -9922,7 +9922,7 @@ function extractMarkdownHeadings(content, limit = MAX_HEADINGS) {
   const lines2 = content.split("\n");
   for (const [i, line] of eachUnfencedLine(lines2)) {
     if (!line) continue;
-    const match = /^(#+)\s+(.+?)(?:\s+#+\s*)?$/.exec(line);
+    const match = /^(#+)\s+([^\r\n]+?)(?:\s+#+)?\s*$/.exec(line);
     if (!match || match.length < 3) continue;
     const hashes = match[1];
     const headingText = match[2];
@@ -10052,7 +10052,7 @@ function handleHtml(filePath, content, contentLengthHint) {
       message: `Large HTML file (${formatBytes(length)}) \u2014 too large to preview (exceeds the in-hook scan cap). Use token-goat section to extract a section by heading, or convert to text: pandoc "${filePath}" -t plain`
     };
   }
-  const title = content.match(/<title[^>]*>([^<]+)<\/title>/i)?.[1]?.trim();
+  const title = content.match(/<title[^>]*>([^<]*)<\/title>/i)?.[1]?.trim();
   const headings = findHtmlHeadingMatches(content).slice(0, 20).map(({ level, heading }) => {
     if (!heading) return "";
     return `${"  ".repeat(level - 1)}h${level}: ${heading}`;

package/dist/{token-goat-chunk-I6TOUPLP.mjs → token-goat-chunk-BTZSUIYA.mjs}

@@ -10,11 +10,11 @@ import {
   selectFilter,
   shlexSplit,
   wrappedShell
-} from "./token-goat-chunk-7JDXDERZ.mjs";
+} from "./token-goat-chunk-TF5NT3H5.mjs";
 import {
   loadConfig,
   recordStat
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/dist/{token-goat-chunk-ELDJRLHZ.mjs → token-goat-chunk-IVCTQPZD.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.8.1";
+    return "2.8.2";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -6657,7 +6657,7 @@ var SECRET_PATTERNS = [
   // identifier characters only, so prose that merely mentions a keyword still never reaches
   // a separator and stays unredacted. api[_-]?key covers the apikey and api-key spellings too.
   // `& ; # , :` play two incompatible roles. They separate one field from the next (a query
-  // string, a cookie header, an inline env list), and they are also perfectly ordinary password
+  // string, a cookie header, an inline env list), and they are also perfectly ordinary credential
   // characters. Rejecting them outright got the first role right and the second badly wrong: the
   // match stopped at the first one and left everything after it in plain text, so
   // `password=corr&horse&battery` redacted four characters and printed the rest, and

package/dist/{token-goat-chunk-YUGNM3KL.mjs → token-goat-chunk-JU7QESB3.mjs}

@@ -4,14 +4,14 @@ import {
   buildEvent,
   relay,
   relayInProcess
-} from "./token-goat-chunk-AOBZUFNJ.mjs";
+} from "./token-goat-chunk-KBVN4ELV.mjs";
 import {
   MAX_STDIN_BYTES,
   readStdinJson
-} from "./token-goat-chunk-XEDQH5DA.mjs";
-import "./token-goat-chunk-2G6RAB4G.mjs";
-import "./token-goat-chunk-7JDXDERZ.mjs";
-import "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-5MLXFSRI.mjs";
+import "./token-goat-chunk-AM23GDIS.mjs";
+import "./token-goat-chunk-TF5NT3H5.mjs";
+import "./token-goat-chunk-IVCTQPZD.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {

package/dist/{token-goat-chunk-AOBZUFNJ.mjs → token-goat-chunk-KBVN4ELV.mjs}

@@ -23,7 +23,7 @@ import {
   summarizeOutputDelta,
   summarizeResidentContext,
   taskListPruneHint
-} from "./token-goat-chunk-XEDQH5DA.mjs";
+} from "./token-goat-chunk-5MLXFSRI.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
@@ -118,7 +118,7 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-2G6RAB4G.mjs";
+} from "./token-goat-chunk-AM23GDIS.mjs";
 import {
   canRunWrappedShell,
   compressOutput,
@@ -129,7 +129,7 @@ import {
   isRewriteWorthwhile,
   resolveMinNetSavingsBytes,
   shlexSplit
-} from "./token-goat-chunk-7JDXDERZ.mjs";
+} from "./token-goat-chunk-TF5NT3H5.mjs";
 import {
   VERSION,
   detectHarness,
@@ -149,7 +149,7 @@ import {
   runGit,
   shortFingerprint,
   toKB
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 
 // src/hooks_grep.ts
 function grepIntInput(toolInput, key) {
@@ -620,7 +620,7 @@ import crypto from "node:crypto";
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-Y2SYNH3S.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-SE6V7LUZ.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {

package/dist/{token-goat-chunk-RMDQFTQD.mjs → token-goat-chunk-LILS6TIU.mjs}

@@ -54,7 +54,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-2G6RAB4G.mjs";
+} from "./token-goat-chunk-AM23GDIS.mjs";
 import {
   Database,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -106,7 +106,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -139,7 +139,7 @@ function getTrackedFiles(cwd = process.cwd()) {
 // src/section_reader.ts
 import { readFileSync } from "node:fs";
 function parseHeadingSpec(spec, headers) {
-  const m = /^(.*?)#(\d+)$/.exec(spec);
+  const m = /^([^#\r\n]+)#(\d+)$/.exec(spec);
   if (m !== null && m[1] !== void 0 && m[2] !== void 0) {
     const specLower = spec.trim().toLowerCase();
     const isLiteralHeading = headers?.some((h) => h.heading.trim().toLowerCase() === specLower) ?? false;
@@ -163,7 +163,7 @@ function normalizeHeadingStrip(s) {
   return n.replace(/\s+/g, " ").trim();
 }
 var MIN_WIDEN_WORD_LEN = 3;
-var MARKDOWN_HEADER_RE = /^(#{1,6})\s+(.+?)(?:\s+#+)?\s*$/;
+var MARKDOWN_HEADER_RE = /^(#{1,6})\s+([^\r\n]+?)(?:\s+#+)?\s*$/;
 var TABLE_HEADER_RE = /^\s*\[+\s*([^\]]+?)\s*\]+\s*(?:[#;].*)?$/;
 var PYTHON_HEADER_RE = /^(\s*)(?:async\s+)?(?:def|class)\s+([A-Za-z_]\w*)/;
 var KEYVALUE_HEADER_RE = /^([A-Za-z_][\w.-]*)\s*(?:=|:(?!\/\/))/;

package/dist/{token-goat-chunk-Y2SYNH3S.mjs → token-goat-chunk-SE6V7LUZ.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-VBXBLGTO.mjs";
-import "./token-goat-chunk-RMDQFTQD.mjs";
-import "./token-goat-chunk-XEDQH5DA.mjs";
-import "./token-goat-chunk-2G6RAB4G.mjs";
-import "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-2MWF3OGR.mjs";
+import "./token-goat-chunk-LILS6TIU.mjs";
+import "./token-goat-chunk-5MLXFSRI.mjs";
+import "./token-goat-chunk-AM23GDIS.mjs";
+import "./token-goat-chunk-IVCTQPZD.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {

package/dist/{token-goat-chunk-7JDXDERZ.mjs → token-goat-chunk-TF5NT3H5.mjs}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   redactSecrets,
   stripAnsiCodes
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 
 // src/tool_filters/helpers.ts
 import * as fs from "node:fs";
@@ -1424,7 +1424,7 @@ function makeLanguageFilter(cfg) {
 var _GH_COPILOT_SPINNER_RE = /^\s*(?:Asking GitHub Copilot|Generating|Thinking|Fetching)\s*\.{0,3}\s*$/i;
 var _GH_COPILOT_BANNER_RE = /^\s*(?:Welcome to GitHub Copilot|Using GitHub Copilot|Authenticated as|GitHub Copilot\s+v\d+)/i;
 var _GH_COPILOT_DISCLAIMER_RE = /^\s*(?:Disclaimer:|This response was|GitHub Copilot|The commands?\s+(?:above|below)|Please review|Always review|Remember to|Note:|Tip:)/i;
-var _AIDER_APPLYING_RE = /^\s*(?:Applying\s+edit(?:s)?(?:\s+to\s+\S+)?|Applied\s+edit\s+to\s+\S+)\s*\.{0,3}\s*$/i;
+var _AIDER_APPLYING_RE = /^\s*(?:Applying\s+edits?(?:\s+to\s+\S+)?|Applied\s+edit\s+to\s+\S+)\s*(?:\.{1,3})?\s*$/i;
 var _AIDER_TOKENS_RE = /^\s*Tokens:\s+\d[\d,]*\s+sent,\s+\d[\d,]*\s+received/i;
 var _AIDER_COST_RE = /^\s*Cost:\s+\$[\d.]+\s+message,\s+\$[\d.]+\s+session/i;
 var _AIDER_REPOMAP_RE = /^\s*(?:Repo-map:|Added\s+\S+\s+to\s+the\s+chat|Removed\s+\S+\s+from\s+the\s+chat|Loading\s+repo\s+map|Updating\s+repo\s+map|Scanning\s+repo\s+contents|Using\s+\d+\s+tokens\s+of\s+repo\s+map)/i;
@@ -4025,7 +4025,7 @@ var _TF_RESOURCE_COMPLETE_RE = /^[a-z0-9_.[\]"-]+: (?:Creation|Destruction|Modif
 var _TF_PLAN_ATTR_DIFF_RE = /^\s+[~+-]\s+\S/;
 var _TF_KNOWN_AFTER_APPLY_RE = /\(known after apply\)/;
 var _TF_INIT_PROVIDER_RE = /^\s*-\s+(?:Finding|Installing|Installed|Downloading|Locking)\s+\S+/i;
-var _TF_SHOW_RESOURCE_HDR_RE = /^# (?:(?:module\.\S+\.)?[a-z][a-z0-9_]+\.[a-zA-Z0-9_.[\]-]+):$/;
+var _TF_SHOW_RESOURCE_HDR_RE = /^# (?:(?:module\.[^.\s]+\.)?[a-z][a-z0-9_]+\.[a-zA-Z0-9_.[\]-]+):$/;
 var _TF_SHOW_KEY_ATTR_RE = /^\s+(?:id|arn|name|region|account_id|bucket|type|instance_type|endpoint|address|hostname|dns_name|tags(?:_all)?)\s*=/;
 var TerraformFilter = class extends ToolFilter {
   name = "terraform";
@@ -9030,7 +9030,7 @@ var LOG_WARN_RE = /\b(WARN(?:ING)?)\b|\[WARN(?:ING)?\]|level=warn/i;
 var LOG_INFO_RE = /\b(INFO)\b|\[INFO\]|level=info/i;
 var LOG_DEBUG_RE = /\b(DEBUG|TRACE|VERBOSE)\b|\[DEBUG\]|\[TRACE\]|level=(?:debug|trace)/i;
 var LOG_ANY_RE = /\b(?:ERROR|FAIL(?:URE|ED)?|CRITICAL|EXCEPTION|FATAL|WARN(?:ING)?|INFO|DEBUG|TRACE|VERBOSE)\b|\[(?:ERROR|CRITICAL|FATAL|WARN(?:ING)?|INFO|DEBUG|TRACE)\]|level=(?:error|critical|fatal|warn|info|debug|trace)/i;
-var TRACE_CONTINUATION_RE = /^\s+(?:at |File "|in |\w+Error:|\w+Exception:)|^\s+\w+[\w.]+\(.*\)$|^\s+\.{3}\s*\d+\s+more|^Caused by:|^During handling of the above exception/;
+var TRACE_CONTINUATION_RE = /^\s+(?:at |File "|in |\w+Error:|\w+Exception:)|^\s+\w+[\w.]+\([^)\r\n]*\)$|^\s+\.{3}\s*\d+\s+more|^Caused by:|^During handling of the above exception/;
 function scoreLogLine(line) {
   if (LOG_LEVEL_RE.test(line)) return 1;
   if (LOG_WARN_RE.test(line)) return 0.5;
@@ -9846,8 +9846,8 @@ function gitPositionalArgs(args) {
   }
   return out;
 }
-var _GIT_CRLF_MODERN_RE = /^warning: in the working copy of '.*', (?:LF will be replaced by CRLF|CRLF will be replaced by LF) the next time Git touches it\.?\r?$/m;
-var _GIT_CRLF_WARNING_RE = /^warning: (?:LF will be replaced by CRLF|CRLF will be replaced by LF) in .*\.?\r?$/;
+var _GIT_CRLF_MODERN_RE = /^warning: in the working copy of '[^']+', (?:LF will be replaced by CRLF|CRLF will be replaced by LF) the next time Git touches it\.?\r?$/m;
+var _GIT_CRLF_WARNING_RE = /^warning: (?:LF will be replaced by CRLF|CRLF will be replaced by LF) in [^\r\n]+\.?\r?$/;
 var _GIT_CRLF_CONTINUATION_RE = /^The file will have its original line endings in your working directory\.?\r?$/;
 function _stripGitCrlfWarnings(text) {
   if (!text.includes("will be replaced by") && !text.includes("original line endings") && !text.includes("next time Git touches it")) {
@@ -11793,7 +11793,7 @@ var KtlintFilter = class _KtlintFilter extends ToolFilter {
   }
 };
 var _SWIFTLINT_VIOLATION_RE = /^(.+\.swift):(\d+)(?::\d+)?: (warning|error|serious): (.+?) \(([a-z_]+)\)\s*$/i;
-var _SWIFTLINT_PROGRESS_RE = /^(Linting Swift files|Loading configuration|Linting '|Done linting!|Resolved \d|warning: .+ is deprecated|Ignoring '.+' in '|\s*$)/i;
+var _SWIFTLINT_PROGRESS_RE = /^(?:Linting Swift files|Loading configuration|Linting '|Done linting!|Resolved \d|warning: [^\r\n]+ is deprecated|Ignoring '[^']+' in '|\s*$)/i;
 var _SWIFTLINT_SUMMARY_RE = /^Done linting!/i;
 var swiftlintFilter = makeLinterFilter({
   name: "swiftlint",
@@ -12043,7 +12043,7 @@ var _CPPCHECK_PROGRESS_RE = /^\d+\/\d+\s+files\s+checked\s+\d+%\s+done/;
 var _CPPCHECK_DIAGNOSTIC_RE = /^\[.+\.(?:c|cpp|cxx|cc|h|hpp|hxx):\d+\]:/;
 var _CPPCHECK_DIAG_NOLINE_RE = /^\[.+\]:\s*\((?:error|warning|style|performance|portability|information)\)/i;
 var _CPPCHECK_CONFIG_RE = /^(?:Checking\s+configuration|Active\s+checkers:|Enabled\s+checkers:|cppcheck:\s+(?:error:|warning:|note:))/i;
-var _CPPCHECK_SUMMARY_RE = /^(?:\d+\s+(?:error|warning|style|performance|portability)s?(?:\s+(?:found|detected))?|No\s+errors\s+found|Done\s+processing|cppcheck:\s+.*(?:done|finished)|\d+\s+unique\s+error)/i;
+var _CPPCHECK_SUMMARY_RE = /^(?:\d+\s+(?:error|warning|style|performance|portability)s?(?:\s+(?:found|detected))?|No\s+errors\s+found|Done\s+processing|cppcheck:\s+[^\r\n]*(?:done|finished)|\d+\s+unique\s+error)/i;
 var CppcheckFilter = class extends ToolFilter {
   name = "cppcheck";
   binaries = /* @__PURE__ */ new Set(["cppcheck"]);
@@ -12215,14 +12215,14 @@ function dedupLines(lines, maxPerKey = 1, keyFn = (l) => l.trim()) {
 }
 var NPM_DEPRECATED_RE = /^npm warn deprecated\b/i;
 var NPM_NOTICE_RE = /^npm notice\b/i;
-var NPM_NOTICE_LOCKFILE_RE = /^npm notice.*lock/i;
+var NPM_NOTICE_LOCKFILE_RE = /^npm notice[^\r\n]*lock/i;
 var NPM_ZERO_VULN_RE = /^found 0 vulnerabilities\b/i;
 var NPM_FUNDING_RE = /^\d+\s+packages? are looking for funding\b/i;
 var NPM_FUND_RUN_RE = /^\s*run `npm fund`/i;
 var NPM_WARN_RE = /^npm warn\b/i;
 var NPM_VERBOSE_RE = /^npm (?:timing|sill|http fetch|http request|http finish|verb)\b/i;
 var NPM_REIFY_RE = /^[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏]\s/;
-var YARN_PEER_DEP_RE = /^warning ".+ > .+" has (?:unmet|incorrect) peer dependency/i;
+var YARN_PEER_DEP_RE = /^warning "[^"\r\n]+ > [^"\r\n]+" has (?:unmet|incorrect) peer dependency/i;
 var YARN_PHASE_RE = /^\[\d+\/\d+\]/;
 var YARN_FETCH_PHASE_RE = /^\[2\/4\]/;
 var YARN_INFO_RE = /^info\b/i;
@@ -12233,7 +12233,7 @@ var YARN_BERRY_DONE_RE = /^➤\s+YN0000:\s+·\s+Done/;
 var YARN_BERRY_PREFIX_RE = /^➤\s+YN\d{4}:/;
 var PNPM_PLUS_BAR_RE = /^\++\s*$/;
 var PNPM_PROGRESS_RE = /^Progress:/i;
-var PNPM_RESOLVER_PROGRESS_RE = /^\s*(?:Resolving|Downloading|Fetching)[:\s].*\d+\/\d+|\s+\d+\s+packages?\s+(?:fetched|resolved|downloaded|linked)/;
+var PNPM_RESOLVER_PROGRESS_RE = /^\s*(?:Resolving|Downloading|Fetching)[:\s][^\r\n]*\d+\/\d+|\s+\d+\s+packages?\s+(?:fetched|resolved|downloaded|linked)/;
 var PNPM_SUMMARY_RE = /^(?:Packages:|Already up to date|Progress:|WARN|ERR!|added|removed|changed)/i;
 var PNPM_LOCKFILE_RE = /^\s*(?:Lockfile|Saved|node_modules|symlink)/i;
 var PIP_VERBOSE_DEBUG_RE = /^(?:DEBUG|VERBOSE|TRACE)\b/;
@@ -12266,13 +12266,13 @@ var BUNDLER_USING_RE = /^Using\s+\S+\s+[\d.]+/;
 var BUNDLER_FETCH_INSTALL_RE = /^(?:Fetching|Installing)\s+\S+\s+[\d.]+/;
 var COMPOSER_INSTALL_RE = /^\s+- Installing \S+ \(/;
 var COMPOSER_DOWNLOADING_RE = /^\s+- Downloading \S+ \(/;
-var COMPOSER_DOWNLOAD_PROGRESS_RE = /^\s+- (?:Installing|Downloading) .+\(\d+%\)/;
+var COMPOSER_DOWNLOAD_PROGRESS_RE = /^\s+- (?:Installing|Downloading) [^\r\n]+\(\d+%\)/;
 var COMPOSER_FUNDING_RE = /^\d+ packages? you are using are looking for funding/;
 var COMPOSER_WARNING_RE = /^\s*(?:Warning|Deprecation|deprecated|constraint):/i;
 var NUGET_INSTALLING_RE = /^\s*Installing\s+\S+\s+\d+\.\d+/i;
 var NUGET_RESTORING_RE = /^\s*Restoring packages for\b/i;
 var NUGET_OK_HTTPS_RE = /^\s*OK\s+https?:\/\//i;
-var NUGET_ALREADY_INSTALLED_RE = /^\s*Package\s+\S+.*\bis already installed/i;
+var NUGET_ALREADY_INSTALLED_RE = /^\s*Package\s+\S+[^\r\n]*\bis already installed/i;
 var NUGET_SUCCESS_INSTALL_RE = /^\s*Successfully installed\s+/i;
 var PUB_KEEP_RE2 = /^(?:Resolving dependencies|Changed \d+|No dependencies changed|Got dependencies|Downloading packages|Building package executable)/;
 var PUB_PKG_LINE_RE2 = /^[+>!]\s+\S+\s+\S+/;
@@ -13278,7 +13278,7 @@ var PREAMBLE_RE = /^collecting\s/;
 var HEADER_RE = /^=+\s*(?:test session starts|FAILURES|ERRORS|short test summary info|warnings summary|slowest \d+ durations|\d+ failed|\d+ passed|\d+ error)\b/;
 var COV_TOTAL_RE = /^TOTAL\s+\d/;
 var WARN_DOCS_RE = /^\s*--\s+Docs:\s+https?:\/\//;
-var WARN_MSG_RE = /^\s+\S.*:\d+:\s+\S.*Warning\b/;
+var WARN_MSG_RE = /^\s+\S[^:\r\n]*:\d+:\s+\S[^\r\n]*Warning\b/;
 var WARN_NODEID_RE = /^\S+::\S+/;
 var SLOW_DURATION_RE = /^\d+\.\d+s\s+(?:call|setup|teardown)\s+\S/;
 var FAIL_LINE_RE = /^(FAILED|ERROR|PASSED|SKIPPED|XFAIL|XPASS)\s+\S/;

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-AOBZUFNJ.mjs";
-import "./token-goat-chunk-XEDQH5DA.mjs";
-import "./token-goat-chunk-2G6RAB4G.mjs";
-import "./token-goat-chunk-7JDXDERZ.mjs";
-import "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-KBVN4ELV.mjs";
+import "./token-goat-chunk-5MLXFSRI.mjs";
+import "./token-goat-chunk-AM23GDIS.mjs";
+import "./token-goat-chunk-TF5NT3H5.mjs";
+import "./token-goat-chunk-IVCTQPZD.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-VBXBLGTO.mjs";
-import "./token-goat-chunk-RMDQFTQD.mjs";
-import "./token-goat-chunk-XEDQH5DA.mjs";
-import "./token-goat-chunk-2G6RAB4G.mjs";
+} from "./token-goat-chunk-2MWF3OGR.mjs";
+import "./token-goat-chunk-LILS6TIU.mjs";
+import "./token-goat-chunk-5MLXFSRI.mjs";
+import "./token-goat-chunk-AM23GDIS.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-ELDJRLHZ.mjs";
+} from "./token-goat-chunk-IVCTQPZD.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",