token-goat 2.8.2 → 2.8.3

package/README.md

@@ -72,7 +72,7 @@ The fastest way to reduce AI token costs is fixing these five, not writing short
 | Agent re-reads a file edited mid-session | Unified diff injected as a hint — full Read avoided when the diff covers the change. Docs and source/style/data files (`.md`/`.ts`/`.css`/`.json`/…) by default; set `serve_diff_on_reread = false` to disable source diffs |
 | Compaction forgets which files were edited | Structured session manifest injected before compact |
 | Same files re-read from scratch after `/compact` | Recovery hint at SessionStart lists cached snapshot + bash + WebFetch IDs |
-| Loaded skill body summarised away by compaction | `### Active Skills` manifest section + `**Skills**:` recovery block list every loaded skill; full body recoverable via `token-goat skill-body <name>` without re-invoking |
+| Loaded skill body summarized away by compaction | `### Active Skills` manifest section + `**Skills**:` recovery block list every loaded skill; full body recoverable via `token-goat skill-body <name>` without re-invoking |
 | Large skill bodies re-injected each turn (6 active skills = 65k+ tokens) | `<!-- COMPACT_END -->` marker: everything above the marker is the compact form; token-goat detects it on load, caches the compact slice, and injects only that — typically ~400 tokens vs. 10k+ |
 | Model reads a skill SKILL.md file directly mid-session (burning the full 10k–65k tokens again) | Pre-Read hook intercepts `*/.claude/skills/<name>/SKILL.md` paths; if the skill is already cached this session it emits a `token-goat skill-body <name>` hint instead |
 | Same large skill invoked twice in a session | PreToolUse hook blocks the reload; serves cached compact (~400 tokens) via `additionalContext` instead of the full 40–65k body. Allows the reload if compaction fired since the last load |
@@ -666,7 +666,7 @@ Missed lookups recover surgically: `read` and `section` print a "Did you mean…
 
 ### Skill efficiency — the `<!-- COMPACT_END -->` marker
 
-When Claude Code invokes a skill, it re-injects the full skill body on every subsequent turn. A large skill file (e.g. a 10k-token `/improve` or `/ralph`) can cost 40–65k tokens per session across 6 active skills. The `<!-- COMPACT_END -->` marker solves this: place it in any skill file to split it into a compact form (above the marker, ~400 tokens) and a reference section (below). Token-goat detects the marker the first time the skill fires, caches only the compact slice, and injects that from then on — labelled `--- compact form (N tokens) ---` so the model knows to request the full body only when it needs the detail.
+When Claude Code invokes a skill, it re-injects the full skill body on every subsequent turn. A large skill file (e.g. a 10k-token `/improve` or `/ralph`) can cost 40–65k tokens per session across 6 active skills. The `<!-- COMPACT_END -->` marker solves this: place it in any skill file to split it into a compact form (above the marker, ~400 tokens) and a reference section (below). Token-goat detects the marker the first time the skill fires, caches only the compact slice, and injects that from then on — labeled `--- compact form (N tokens) ---` so the model knows to request the full body only when it needs the detail.
 
 To add the marker to a skill, open the file and insert `<!-- COMPACT_END -->` on its own line where the "quick reference ends and the detail begins" — typically after the quick-start table and before step-by-step instructions. The full reference section is still reachable via `token-goat skill-section "<name>::<heading>"` or `token-goat skill-body <name>` when needed.
 
@@ -756,7 +756,7 @@ $ token-goat waste --copilot
   Copilot counted 11,548 tok of tool definitions in total, so this is roughly 18.5% of it.
 ```
 
-The fixed overhead is the largest number in a Copilot session and no hook can reach it: Copilot assembles the system prompt and the tool definitions natively, with nothing between assembly and send. Only configuration moves it. The per-server breakdown exists to make that configuration decision possible, since one aggregate says the tool definitions are expensive without saying which tools. It is read from Copilot's own MCP tool cache, counts only the fields a model is actually sent, and is labelled an estimate throughout: it comes from byte length rather than Copilot's tokeniser, and it deliberately does not add up to Copilot's total, because Copilot's own built-in tools are not cached there.
+The fixed overhead is the largest number in a Copilot session and no hook can reach it: Copilot assembles the system prompt and the tool definitions natively, with nothing between assembly and send. Only configuration moves it. The per-server breakdown exists to make that configuration decision possible, since one aggregate says the tool definitions are expensive without saying which tools. It is read from Copilot's own MCP tool cache, counts only the fields a model is actually sent, and is labeled an estimate throughout: it comes from byte length rather than Copilot's tokeniser, and it deliberately does not add up to Copilot's total, because Copilot's own built-in tools are not cached there.
 
 The "Assistant output" section is separate from the tool-call ledger above it: `generatedTokens` is what was actually paid, once, to produce the assistant's own text turns. `resendCeilingTokens` is a cache-unaware upper bound on how much re-sending those turns as conversation history on every later request could cost — not real spend, since Claude Code's prompt caching bills a repeated conversation prefix at cache-read rates, a fraction of full input price. Treat it as a ceiling on how bad unbounded verbosity could get, not as a dollar figure.
 
@@ -778,7 +778,7 @@ $ token-goat recall "eslint warnings"
 
 Results are ranked by relevance (BM25 via SQLite FTS5, falling back to a plain substring scan if FTS5 is unavailable), newest indexed entries win ties. `--type bash|web|mcp` narrows to one cache type; `--limit <n>` caps the result count (default 10); `--json` emits `{ id, cacheType, label, snippet, storedAt }[]` instead. The index is built incrementally as entries are cached — there is no separate rebuild step.
 
-Run `token-goat recall` with **no query** to browse instead of search: every cached entry across all three types, newest first, in the same format and honouring the same `--type`/`--limit`/`--json` flags. This is the case where the index matters most — the ids have scrolled out of context and you have no term to search for, so the alternative is running `bash-history`, `web-history`, and `mcp-history` in turn.
+Run `token-goat recall` with **no query** to browse instead of search: every cached entry across all three types, newest first, in the same format and honoring the same `--type`/`--limit`/`--json` flags. This is the case where the index matters most — the ids have scrolled out of context and you have no term to search for, so the alternative is running `bash-history`, `web-history`, and `mcp-history` in turn.
 
 ### Hint efficacy tracking
 
@@ -1066,7 +1066,13 @@ A working install returns `["PreToolUse", "PostToolUse", "PreCompact"]`. Any mis
 
 ## Image support
 
-Token-goat shrinks large images before they reach the model, cutting vision token costs by 60–90%. The pipeline uses [`sharp`](https://sharp.pixelplumbing.com/), a Node.js image processing library that ships prebuilt native binaries for Windows, macOS, Linux, and Alpine.
+Vision models bill by pixel dimensions, not file size. Anthropic charges one token per 28×28-pixel patch of a Claude image (`⌈width/28⌉ × ⌈height/28⌉` visual tokens, per the [Claude vision docs](https://platform.claude.com/docs/en/build-with-claude/vision#evaluate-image-size)), OpenAI's GPT-5.6 models tile in 32×32-pixel patches with a 1.2x multiplier on top, and Gemini charges a flat 258 tokens under 384×384 pixels and roughly 258 tokens per 768×768 tile above that. A heavily compressed screenshot can still decode to a large pixel count, so a small file on disk is no guarantee of a cheap read.
+
+Token-goat shrinks an image before it reaches the model whenever either of two independent checks trips: the file is at or above 512 KB, or its longest edge exceeds 1568 pixels (`src/image_shrink.ts`). The byte check is a cheap pre-filter that skips decoding most images outright. The dimension check exists because the byte check alone misses a case: a flat-color screenshot can compress to a few hundred kilobytes on disk and still decode to a resolution well past 1568 pixels on its long edge, and vision models bill on that decoded resolution, not the compressed file. Either trigger routes the image through the same pipeline: downscale to a 1568px long edge and re-encode as WebP. The pipeline uses [`sharp`](https://sharp.pixelplumbing.com/), a Node.js image processing library that ships prebuilt native binaries for Windows, macOS, Linux, and Alpine.
+
+How much this saves depends on the model, because Claude downscales an oversized image itself before billing and caps the cost rather than charging for every pixel it was sent. By the [published per-tier table](https://platform.claude.com/docs/en/build-with-claude/vision#evaluate-image-size), a 3840x2160 screenshot bills at 4784 visual tokens on Claude 4.7 and later, and 1560 on earlier models. Resizing it to a 1568px long edge first costs 1792 tokens: a 63% cut against the newer models, and nothing against the older ones, whose own cap is already tighter than what this pipeline produces. Other vendors cap differently, so treat 63% as the measured Claude figure rather than a universal rate.
+
+Two cases are not about cost at all. Screenshots returned to the computer-use and browser-use toolsets are rejected outright when they exceed the model's limits, rather than downscaled, so resizing before the call is what lets it succeed. A request carrying more than 20 images also applies a stricter per-image dimension limit to every image in it, which a 1568px long edge already satisfies.
 
 On most platforms, `npm install -g token-goat` installs sharp without additional steps. npm pulls a prebuilt binary keyed to your Node.js major version and OS — no C++ compiler, libvips, or system codec libraries required.
 
@@ -1278,7 +1284,7 @@ A third case needs no fence, because the danger is the line break rather than th
 
 The MCP tools (`symbol` when given a `file` filter, `read`, `section`, `skeleton`, `outline`, `refs`, `brief`, `grep`, `imports`, `exports`) are confined to the project root, resolving symlinks before the check. Set `mcp.confine_reads_to_project_root = false` (env `TOKEN_GOAT_MCP_CONFINE_READS`) in your global config if you genuinely need cross-root reads from an MCP client; a per-project file cannot set it. The CLI is deliberately unconfined and unchanged. This is defense in depth for one sink, not a sandbox: an agent that can call these tools can usually call its own read tool too.
 
-Note what that flag does and does not cover. It stops a caller traversing *out of* the root it is given; it does not constrain *which* root the caller supplies. Every MCP tool takes an optional `projectRoot`, and it exists for a reason — the server's cwd is often not the workspace root for MCP clients — but tool arguments are model-generated, so that choice is untrusted input like any other. If your deployment treats MCP as the only path to the filesystem, set `mcp.allowed_roots` (env `TOKEN_GOAT_MCP_ALLOWED_ROOTS`, delimiter-separated like `PATH`) to the roots that may legitimately be named; a resolved root outside every entry is then refused. It is empty by default, which keeps the multi-root behaviour above unchanged.
+Note what that flag does and does not cover. It stops a caller traversing *out of* the root it is given; it does not constrain *which* root the caller supplies. Every MCP tool takes an optional `projectRoot`, and it exists for a reason — the server's cwd is often not the workspace root for MCP clients — but tool arguments are model-generated, so that choice is untrusted input like any other. If your deployment treats MCP as the only path to the filesystem, set `mcp.allowed_roots` (env `TOKEN_GOAT_MCP_ALLOWED_ROOTS`, delimiter-separated like `PATH`) to the roots that may legitimately be named; a resolved root outside every entry is then refused. It is empty by default, which keeps the multi-root behavior above unchanged.
 
 **Restricting what token-goat may fetch.** `webfetch.allow` and `webfetch.deny` (env `TOKEN_GOAT_WEBFETCH_ALLOW` / `TOKEN_GOAT_WEBFETCH_DENY`, comma-separated) are wildcard URL patterns that decide which addresses may be reached. Deny is checked first and wins; a non-empty allow list refuses anything it does not name. Patterns are matched against the address as it will actually be sent, not only as you typed it, so a trailing dot on the host, `..` path segments, a default port written out, and percent-encoded path characters cannot be used to step around a rule. Writing a default port in a pattern (`https://example.com:443/*`) and omitting it are equivalent. Both are empty by default, which permits everything, exactly as before. They apply to the WebFetch call your AI makes, to the fetches token-goat performs itself (`fetch-image`, `gdrive-sections`), and to the headless browser behind `screenshot` (whose page sub-resources are checked too), including every redirect hop, so an allowed site cannot redirect the request on to a denied one.
 

package/dist/{token-goat-chunk-2MWF3OGR.mjs → token-goat-chunk-222VPFP2.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-LILS6TIU.mjs";
+} from "./token-goat-chunk-TX4JFJTD.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
@@ -113,7 +113,7 @@ import {
   searchRecall,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-5MLXFSRI.mjs";
+} from "./token-goat-chunk-4HIMCBYK.mjs";
 import {
   AGENT_SALT_MARKER,
   CONTEXT_AUTOCOMPACT_TOKENS,
@@ -123,6 +123,7 @@ import {
   SESSIONS_SUBDIR,
   SKILLS_OUTPUT_SUBDIR,
   SKIP_DIRS,
+  UNTRUSTED_FILE_TAG,
   UNTRUSTED_TOOL_TAG,
   UNTRUSTED_WEB_TAG,
   WORKER_HEARTBEAT_STALE_MS,
@@ -256,7 +257,7 @@ import {
   vscodeDecoderConfigured,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-AM23GDIS.mjs";
+} from "./token-goat-chunk-PWVXXPCC.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -338,7 +339,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-IVCTQPZD.mjs";
+} from "./token-goat-chunk-6ODZ6PZK.mjs";
 import {
   __export
 } from "./token-goat-chunk-AEX54RUZ.mjs";
@@ -3760,7 +3761,7 @@ function attemptedCommandName(argv) {
 // src/cli.ts
 import * as fs27 from "fs";
 import * as path27 from "path";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 
 // src/walk_index.ts
 import * as fs2 from "node:fs";
@@ -13504,20 +13505,55 @@ function formatSessionSlice(turns) {
 
 // src/cli_mcp_audit.ts
 import * as fs26 from "node:fs";
+import * as os12 from "node:os";
 import * as path26 from "node:path";
-function readMcpConfig(projectRoot) {
-  const configPath2 = path26.join(projectRoot, ".mcp.json");
+function readMcpJsonFile(configPath2) {
   try {
-    if (!fs26.existsSync(configPath2)) {
-      return null;
-    }
+    if (!fs26.existsSync(configPath2)) return null;
     const content = fs26.readFileSync(configPath2, "utf-8");
     const parsed = JSON.parse(content);
-    return parsed.mcpServers || parsed;
+    const servers = parsed && typeof parsed === "object" ? parsed.mcpServers ?? parsed : null;
+    return servers && typeof servers === "object" ? servers : null;
+  } catch {
+    return null;
+  }
+}
+function driveLetterCaseVariants(p) {
+  const m = /^([a-zA-Z]:)(.*)$/s.exec(p);
+  if (m === null) return [p];
+  const [, drive, rest] = m;
+  return [`${drive.toLowerCase()}${rest}`, `${drive.toUpperCase()}${rest}`];
+}
+function readClaudeJsonConfig(claudeJsonPath, projectRoot) {
+  try {
+    if (!fs26.existsSync(claudeJsonPath)) return null;
+    const parsed = JSON.parse(fs26.readFileSync(claudeJsonPath, "utf-8"));
+    const projects = parsed && typeof parsed === "object" ? parsed.projects : null;
+    if (!projects || typeof projects !== "object") return null;
+    const slashForms = [projectRoot, projectRoot.replace(/\\/g, "/"), projectRoot.replace(/\//g, "\\")];
+    const candidates = [...new Set(slashForms.flatMap(driveLetterCaseVariants))];
+    for (const key of candidates) {
+      const entry = projects[key];
+      if (entry && typeof entry === "object") {
+        const servers = entry["mcpServers"];
+        if (servers && typeof servers === "object") return servers;
+      }
+    }
+    return null;
   } catch {
     return null;
   }
 }
+function discoverMcpConfig(projectRoot, home) {
+  const mcpJsonPath = path26.join(projectRoot, ".mcp.json");
+  const claudeJsonPath = path26.join(home, ".claude.json");
+  const sourcesChecked = [mcpJsonPath, claudeJsonPath];
+  const fromMcpJson = readMcpJsonFile(mcpJsonPath);
+  if (fromMcpJson !== null) return { servers: fromMcpJson, sourcePath: mcpJsonPath, sourcesChecked };
+  const fromClaudeJson = readClaudeJsonConfig(claudeJsonPath, projectRoot);
+  if (fromClaudeJson !== null) return { servers: fromClaudeJson, sourcePath: claudeJsonPath, sourcesChecked };
+  return { servers: null, sourcePath: null, sourcesChecked };
+}
 function analyzeMcpCache() {
   const serverMetrics = /* @__PURE__ */ new Map();
   const blobs = listBlobs(BASH_OUTPUT_SUBDIR).filter((b) => b.id.startsWith("mcp_"));
@@ -13539,8 +13575,9 @@ function analyzeMcpCache() {
   }
   return serverMetrics;
 }
-function buildMcpAuditReport(projectRoot) {
-  const config = readMcpConfig(projectRoot);
+function buildMcpAuditReport(projectRoot, home = os12.homedir()) {
+  const discovery = discoverMcpConfig(projectRoot, home);
+  const config = discovery.servers;
   const cacheMetrics = analyzeMcpCache();
   const servers = [];
   let totalCost = 0;
@@ -13574,7 +13611,10 @@ function buildMcpAuditReport(projectRoot) {
   servers.sort((a, b) => b.totalTokens - a.totalTokens);
   return {
     projectRoot,
-    configFound: config !== null,
+    configFound: discovery.sourcePath !== null,
+    configSourcePath: discovery.sourcePath,
+    configSourcesChecked: discovery.sourcesChecked,
+    costKnown: discovery.sourcePath !== null || cacheMetrics.size > 0,
     servers,
     totalCost
   };
@@ -13586,11 +13626,12 @@ function printReport3(report) {
   w("\n# token-goat mcp-audit\n");
   w(`Project: ${report.projectRoot}
 `);
-  w(`Config found: ${report.configFound ? "yes" : "no"}
+  w(report.configSourcePath !== null ? `Config found: yes (${report.configSourcePath})
+` : `Config found: no (checked: ${report.configSourcesChecked.join(", ")})
 `);
   w("\n## MCP servers\n");
   if (report.servers.length === 0) {
-    w("  none\n");
+    w(report.costKnown ? "  none\n" : "  none discovered from a readable config source\n");
   } else {
     w("| Server | Per-Call (tok) | Calls | Total (tok) |\n");
     w("|--------|---|---|---|\n");
@@ -13599,9 +13640,10 @@ function printReport3(report) {
 `);
     }
   }
-  w(`
+  w(report.costKnown ? `
 Total cost: ${report.totalCost} tok
-`);
+` : "\nTotal cost: unknown -- no readable MCP config was found and no MCP calls have been recorded in this session's cache yet\n");
+  w("\nNote: plugin-provided MCP servers have no on-disk config token-goat can read, so a live session may have MCP servers this audit cannot see or price.\n");
 }
 async function runMcpAuditCommand(opts = {}) {
   const projectRoot = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
@@ -13620,6 +13662,20 @@ var RECALL_COMMAND = {
   web: "web-output",
   mcp: "mcp-output"
 };
+function fenceTagForCacheType(cacheType) {
+  return cacheType === "web" ? UNTRUSTED_WEB_TAG : UNTRUSTED_TOOL_TAG;
+}
+function fenceSnippetIfMatched(hit) {
+  let matches2 = [];
+  try {
+    if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(hit.snippet);
+  } catch {
+    matches2 = [];
+  }
+  if (matches2.length === 0) return hit.snippet;
+  recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
+  return fenceUntrustedContent(hit.snippet, matches2, fenceTagForCacheType(hit.cacheType));
+}
 function printHits(query, hits) {
   const w = (text) => {
     process.stdout.write(text);
@@ -13635,7 +13691,7 @@ function printHits(query, hits) {
 `);
     w(`  ${label}
 `);
-    w(`  ${hit.snippet}
+    w(`  ${fenceSnippetIfMatched(hit)}
 
 `);
   }
@@ -13648,7 +13704,8 @@ function runRecallCommand(query, opts = {}) {
   };
   const hits = browse ? listRecentRecall(scope) : searchRecall(query, scope);
   if (opts.json === true) {
-    process.stdout.write(`${JSON.stringify(hits)}
+    const fenced = hits.map((hit) => ({ ...hit, snippet: fenceSnippetIfMatched(hit) }));
+    process.stdout.write(`${JSON.stringify(fenced)}
 `);
     return;
   }
@@ -13679,11 +13736,12 @@ function printSummary(rows) {
 }
 function printTotals(totals) {
   const spent = totals.spentBytes === null ? "n/a" : String(totals.spentBytes);
-  const net = totals.netBytes === null ? "n/a" : String(totals.netBytes);
   const legacyNote = totals.legacyEmissions > 0 ? ` (excludes ${totals.legacyEmissions} legacy emission(s) recorded before spend tracking)` : "";
-  process.stdout.write(`
-TOTAL   saved=${totals.savedBytes}   spent=${spent}   net=${net}${legacyNote}
-`);
+  process.stdout.write(
+    `
+TOTAL   saved=${totals.savedBytes} (all-time, every hint kind)   spent=${spent} (hint_emissions ledger only)${legacyNote}
+`
+  );
 }
 function runHintStatsCommand(opts = {}) {
   if (opts.reset === true) {
@@ -14043,7 +14101,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-AL644JUV.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-C5IL6MJH.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-324QOJYZ.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -14068,7 +14126,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-JU7QESB3.mjs");
+  const { relay } = await import("./token-goat-chunk-DP3NNGGV.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -14181,7 +14239,7 @@ async function cmdInstall(opts) {
     );
   }
   try {
-    const skillDir = path27.join(homedir11(), ".claude", "skills");
+    const skillDir = path27.join(homedir12(), ".claude", "skills");
     if (fs27.existsSync(skillDir)) {
       const entries = fs27.readdirSync(skillDir, { withFileTypes: true });
       const skillNames = [];
@@ -14522,6 +14580,17 @@ function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag =
   }
   return emit2(result.join("\n"));
 }
+function fenceFileTextIfMatched(text) {
+  let matches2 = [];
+  try {
+    if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(text);
+  } catch {
+    matches2 = [];
+  }
+  if (matches2.length === 0) return text;
+  recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
+  return fenceUntrustedContent(text, matches2, UNTRUSTED_FILE_TAG);
+}
 function fileSizeOrZero(filePath) {
   try {
     return fs27.statSync(filePath).size;
@@ -14585,7 +14654,7 @@ function cmdMcpOutput(id, opts) {
 }
 async function cmdPdfExtract(file, opts) {
   const text = await runPdfExtractText(file, opts.pages, opts.layout === true);
-  const printed = _applyFiltersAndPrint(text, opts);
+  const printed = _applyFiltersAndPrint(text, opts, true, UNTRUSTED_FILE_TAG);
   const fullSourceBytes = fileSizeOrZero(file);
   const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(printed, "utf8"));
   recordStat("pdf_extract", bytesSaved, Math.round(bytesSaved / 4));
@@ -14598,19 +14667,20 @@ async function cmdPdfLocate(file, pattern, opts) {
   if (opts.context !== void 0) locateOpts.context = requirePositiveInt("--context", opts.context);
   if (opts.pages !== void 0) locateOpts.pages = opts.pages;
   const matches2 = await runPdfLocate(file, pattern, locateOpts);
-  const pages = matches2.map((m) => m.page);
+  const fencedMatches = matches2.map((m) => ({ ...m, snippet: fenceFileTextIfMatched(m.snippet) }));
+  const pages = fencedMatches.map((m) => m.page);
   let printed;
   if (opts.json === true) {
-    printed = JSON.stringify({ file, pattern, matchCount: matches2.length, pages, matches: matches2 }, null, 2);
+    printed = JSON.stringify({ file, pattern, matchCount: fencedMatches.length, pages, matches: fencedMatches }, null, 2);
     out(printed);
-  } else if (matches2.length === 0) {
+  } else if (fencedMatches.length === 0) {
     printed = "(no matches)";
     out(printed);
   } else {
-    const lines = matches2.map((m) => `p${m.page}: ${m.snippet}`);
+    const lines = fencedMatches.map((m) => `p${m.page}: ${m.snippet}`);
     printed = `${lines.join("\n")}
 
-${countNoun(matches2.length, "match", "matches")} across ${countNoun(pages.length, "page")}`;
+${countNoun(fencedMatches.length, "match", "matches")} across ${countNoun(pages.length, "page")}`;
     out(printed);
   }
   const fullSourceBytes = fileSizeOrZero(file);
@@ -14627,7 +14697,8 @@ async function cmdPdfOutline(file, opts) {
     }
     return;
   }
-  const text = opts.json === true ? JSON.stringify(entries, null, 2) : entries.map((e) => `${"  ".repeat(e.level)}${e.title}${e.page !== null ? `  (p.${e.page})` : ""}`).join("\n");
+  const fencedEntries = entries.map((e) => ({ ...e, title: fenceFileTextIfMatched(e.title) }));
+  const text = opts.json === true ? JSON.stringify(fencedEntries, null, 2) : fencedEntries.map((e) => `${"  ".repeat(e.level)}${e.title}${e.page !== null ? `  (p.${e.page})` : ""}`).join("\n");
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
   const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
@@ -14679,12 +14750,16 @@ async function cmdImageText(file, opts = {}) {
   }
   let text;
   if (opts.json === true) {
-    text = JSON.stringify(result, null, 2);
+    text = JSON.stringify(
+      result.text === null ? result : { ...result, text: fenceFileTextIfMatched(result.text) },
+      null,
+      2
+    );
   } else {
     const lines = [`Confidence: ${Math.round(result.confidence)}%`, `Characters: ${result.chars}`];
     text = result.textHeavy && result.text !== null ? `${lines.join("\n")}
 
-${result.text}` : `${lines.join("\n")}
+${fenceFileTextIfMatched(result.text)}` : `${lines.join("\n")}
 (below usefulness threshold; text likely noise, not shown)`;
   }
   out(text);
@@ -14747,19 +14822,20 @@ function recordXlsxStat(kind, file, emitted) {
 }
 async function cmdXlsxSheets(file, opts = {}) {
   const sheets = await listSheets(file);
-  const text = opts.json === true ? JSON.stringify(sheets.map((s) => ({ name: s.name, ref: s.ref, rows: s.rows, cols: s.cols })), null, 2) : sheets.map((s) => `${s.name}  ${s.ref}  (${s.rows} rows x ${s.cols} cols)`).join("\n");
+  const fencedSheets = sheets.map((s) => ({ ...s, name: fenceFileTextIfMatched(s.name) }));
+  const text = opts.json === true ? JSON.stringify(fencedSheets.map((s) => ({ name: s.name, ref: s.ref, rows: s.rows, cols: s.cols })), null, 2) : fencedSheets.map((s) => `${s.name}  ${s.ref}  (${s.rows} rows x ${s.cols} cols)`).join("\n");
   out(text);
   recordXlsxStat("xlsx_sheets", file, text);
 }
 async function cmdXlsxHead(file, opts) {
   const rows = opts.rows !== void 0 ? requireNonNegativeInt("--rows", opts.rows) : 20;
-  const text = await headSheet(file, opts.sheet, rows);
+  const text = fenceFileTextIfMatched(await headSheet(file, opts.sheet, rows));
   out(text);
   recordXlsxStat("xlsx_head", file, text);
 }
 async function cmdXlsxRange(file, opts) {
   const result = await rangeSheet(file, opts.sheet, opts.range, opts.formulas === true);
-  const text = formatXlsxRange(result);
+  const text = fenceFileTextIfMatched(formatXlsxRange(result));
   out(text);
   recordXlsxStat("xlsx_range", file, text);
 }
@@ -14771,7 +14847,7 @@ async function cmdXlsxQuery(file, opts) {
     ...wheres !== void 0 ? { wheres } : {},
     ...opts.head !== void 0 ? { head: requireNonNegativeInt("--head", opts.head) } : {}
   });
-  const text = formatCsvTable(result);
+  const text = fenceFileTextIfMatched(formatCsvTable(result));
   out(text);
   recordXlsxStat("xlsx_query", file, text);
 }
@@ -14782,20 +14858,21 @@ function recordDocStat(kind, file, emitted) {
 }
 async function cmdPptxOutline(file, opts) {
   const slides = await pptxOutline(file);
-  const text = opts.json === true ? JSON.stringify(slides, null, 2) : slides.map((s) => `${s.slide}. ${s.title || "(untitled)"}  [${s.bodyChars} body chars${s.hasNotes ? ", has notes" : ""}]`).join("\n");
+  const fencedSlides = slides.map((s) => ({ ...s, title: fenceFileTextIfMatched(s.title) }));
+  const text = opts.json === true ? JSON.stringify(fencedSlides, null, 2) : fencedSlides.map((s) => `${s.slide}. ${s.title || "(untitled)"}  [${s.bodyChars} body chars${s.hasNotes ? ", has notes" : ""}]`).join("\n");
   out(text);
   recordDocStat("pptx_outline", file, text);
 }
 async function cmdPptxSlide(file, opts) {
   const n = requireNonNegativeInt("--slide", opts.slide);
-  const text = await pptxSlideText(file, n, opts.notes === true);
+  const text = fenceFileTextIfMatched(await pptxSlideText(file, n, opts.notes === true));
   out(text);
   recordDocStat("pptx_slide", file, text);
 }
 async function cmdPptxNotes(file, opts) {
   const n = opts.slide !== void 0 ? requireNonNegativeInt("--slide", opts.slide) : void 0;
   const text = await pptxNotesText(file, n);
-  const printed = text.length > 0 ? text : "no speaker notes found";
+  const printed = text.length > 0 ? fenceFileTextIfMatched(text) : "no speaker notes found";
   out(printed);
   recordDocStat("pptx_notes", file, printed);
 }
@@ -14805,7 +14882,7 @@ async function cmdPptxText(file, opts) {
     out("no matches");
     return;
   }
-  const text = matches2.map((m) => `Slide ${m.slide}: ...${m.snippet}...`).join("\n");
+  const text = fenceFileTextIfMatched(matches2.map((m) => `Slide ${m.slide}: ...${m.snippet}...`).join("\n"));
   out(text);
   recordDocStat("pptx_text", file, text);
 }
@@ -14819,13 +14896,14 @@ async function cmdDocxOutline(file, opts) {
     }
     return;
   }
-  const text = opts.json === true ? JSON.stringify(headings, null, 2) : headings.map((h) => `${"  ".repeat(h.level - 1)}${h.text}`).join("\n");
+  const fencedHeadings = headings.map((h) => ({ ...h, text: fenceFileTextIfMatched(h.text) }));
+  const text = opts.json === true ? JSON.stringify(fencedHeadings, null, 2) : fencedHeadings.map((h) => `${"  ".repeat(h.level - 1)}${h.text}`).join("\n");
   out(text);
   recordDocStat("docx_outline", file, text);
 }
 async function cmdDocxText(file, opts) {
   const text = await docxText(file);
-  const printed = _applyFiltersAndPrint(text, opts);
+  const printed = _applyFiltersAndPrint(text, opts, true, UNTRUSTED_FILE_TAG);
   recordDocStat("docx_text", file, printed);
 }
 function cmdTranscriptOutline(file, opts) {
@@ -14963,7 +15041,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-BTZSUIYA.mjs");
+    const bashRunner = await import("./token-goat-chunk-VAGPOZHO.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -15868,8 +15946,19 @@ ${content}`;
     const sections = await getDocSections(fileId, { fresh: false });
     emitted = formatSections(sections);
   }
-  out(emitted);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(emitted, "utf8"));
+  let toEmit = emitted;
+  try {
+    if (loadConfig().injection.enabled) {
+      const matches2 = scanForInjectionPatterns(emitted);
+      if (matches2.length > 0) {
+        recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
+        toEmit = fenceUntrustedContent(emitted, matches2, UNTRUSTED_WEB_TAG);
+      }
+    }
+  } catch {
+  }
+  out(toEmit);
+  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(toEmit, "utf8"));
   recordStat("gdrive_sections", bytesSaved, Math.round(bytesSaved / 4));
 }
 function expandGlobs(root, patterns, globFnOverride) {

package/dist/{token-goat-chunk-5MLXFSRI.mjs → token-goat-chunk-4HIMCBYK.mjs}

@@ -8,7 +8,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-chunk-AM23GDIS.mjs";
+} from "./token-goat-chunk-PWVXXPCC.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -18,7 +18,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-chunk-IVCTQPZD.mjs";
+} from "./token-goat-chunk-6ODZ6PZK.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";

package/dist/{token-goat-chunk-SE6V7LUZ.mjs → token-goat-chunk-4OM2Q2SX.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-2MWF3OGR.mjs";
-import "./token-goat-chunk-LILS6TIU.mjs";
-import "./token-goat-chunk-5MLXFSRI.mjs";
-import "./token-goat-chunk-AM23GDIS.mjs";
-import "./token-goat-chunk-IVCTQPZD.mjs";
+} from "./token-goat-chunk-222VPFP2.mjs";
+import "./token-goat-chunk-TX4JFJTD.mjs";
+import "./token-goat-chunk-4HIMCBYK.mjs";
+import "./token-goat-chunk-PWVXXPCC.mjs";
+import "./token-goat-chunk-6ODZ6PZK.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {