token-goat 2.8.3 → 2.8.4

package/dist/{token-goat-chunk-6ODZ6PZK.mjs → token-goat-chunk-E76UNTVK.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.8.3";
+    return "2.8.4";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -263,6 +263,16 @@ function lowercaseDriveLetter(s) {
 }
 var EXTENDED_UNC_PREFIX_RE = /^\\\\\?\\UNC\\/i;
 var EXTENDED_PREFIX_RE = /^\\\\\?\\/;
+function shellMountToWindowsPath(p) {
+  const s = p.includes("\\") ? p.replace(/\\/g, "/") : p;
+  const m = WSL_PATH_RE.exec(s);
+  if (m) return `${m[1].toLowerCase()}:/${m[2].replace(/^\/+/, "")}`;
+  if (process.platform === "win32") {
+    const g = MSYS_PATH_RE.exec(s);
+    if (g) return `${g[1].toLowerCase()}:${g[2] ?? "/"}`;
+  }
+  return s;
+}
 function normalizePath(p) {
   let s = p;
   if (EXTENDED_UNC_PREFIX_RE.test(s)) {
@@ -270,20 +280,7 @@ function normalizePath(p) {
   } else if (EXTENDED_PREFIX_RE.test(s)) {
     s = s.slice(4);
   }
-  if (s.includes("\\")) {
-    s = s.replace(/\\/g, "/");
-  }
-  const m = WSL_PATH_RE.exec(s);
-  if (m) {
-    const driveLetter = m[1].toLowerCase();
-    const rest = m[2];
-    const restStripped = rest.replace(/^\/+/, "");
-    s = `${driveLetter}:/${restStripped}`;
-  }
-  if (process.platform === "win32") {
-    const g = MSYS_PATH_RE.exec(s);
-    if (g) s = `${g[1].toLowerCase()}:${g[2] ?? "/"}`;
-  }
+  s = shellMountToWindowsPath(s);
   s = expandShortPath(s);
   s = lowercaseDriveLetter(s);
   s = normalizeDarwinSystemAlias(s);
@@ -297,8 +294,10 @@ function normalizeDarwinSystemAlias(p) {
 }
 function resolveIndexPath(file, base = process.cwd()) {
   const isWindowsAbsolute = (s) => /^[a-zA-Z]:[/\\]/.test(s);
-  const resolve5 = isWindowsAbsolute(file) || isWindowsAbsolute(base) ? path2.win32.resolve : path2.resolve;
-  return normalizePath(resolve5(base, file));
+  const f = shellMountToWindowsPath(file);
+  const b = shellMountToWindowsPath(base);
+  const resolve5 = isWindowsAbsolute(f) || isWindowsAbsolute(b) ? path2.win32.resolve : path2.resolve;
+  return normalizePath(resolve5(b, f));
 }
 function toDisplayPath(root, target) {
   if (root === void 0) return target;
@@ -759,6 +758,14 @@ function grepFilteredToEmptyNotice(preFilterCount, grep, nounSingular, nounPlura
   const pronoun = preFilterCount === 1 ? "it" : "them";
   return `  (all ${preFilterCount} ${noun} ${verb} filtered out by --grep ${grep} -- widen or drop the filter to see ${pronoun})`;
 }
+function filtersFilteredToEmptyNotice(preFilterCount, activeFilters, nounSingular, nounPlural, reassurance) {
+  const noun = preFilterCount === 1 ? nounSingular : nounPlural;
+  const cause = activeFilters.length === 0 ? "the active filter" : activeFilters.join(" + ");
+  const knob = activeFilters.length > 1 ? "filters" : "filter";
+  const verb = preFilterCount === 1 ? "was" : "were";
+  const tail = reassurance === void 0 ? "" : `; ${reassurance}`;
+  return `  (all ${preFilterCount} ${noun} ${verb} filtered out by ${cause}${tail} -- widen or drop the ${knob} to see them)`;
+}
 function countNoun(count, singular, plural = `${singular}s`) {
   return `${count} ${count === 1 ? singular : plural}`;
 }
@@ -2161,7 +2168,15 @@ var CONFIG_DEFAULTS = {
     // 85+, while a photo with an incidental sign or logo in frame scores much lower and
     // noisier -- padding the threshold below the terminal/code norm still comfortably
     // excludes photographic false positives without needing a second heuristic.
-    ocr_min_confidence: 65
+    ocr_min_confidence: 65,
+    // Which resolution tier the model being shown the image is on, which decides what its pixels
+    // cost. 'standard' (1568px long edge, 1568 visual tokens) is every model before Claude 4.7;
+    // 'high' (2576px, 4784 tokens) is 4.7 and later, and bills the same large image up to roughly
+    // three times higher. Only the saving *reported* by `token-goat stats` depends on this -- no
+    // image is encoded differently -- and 'standard' is the default because it is the floor: it
+    // caps the counterfactual at the smaller of the two bills and so can never credit a saving
+    // that was not there. Set it to 'high' on a Claude 4.7+ model to see the larger real figure.
+    vision_tier: "standard"
   },
   screenshot: {
     chrome_path: "",
@@ -2321,6 +2336,9 @@ function validatedFloat(raw, def, min, max) {
   if (!Number.isFinite(n)) return def;
   return Math.max(min, Math.min(max, n));
 }
+function validatedVisionTier(raw, def) {
+  return raw === "standard" || raw === "high" ? raw : def;
+}
 function validatedStr(raw, def) {
   return typeof raw === "string" ? raw : def;
 }
@@ -2684,6 +2702,8 @@ function mergeRawConfig(base, override) {
       const baseSection = baseVal !== null && typeof baseVal === "object" && !Array.isArray(baseVal) ? baseVal : {};
       merged[key] = { ...baseSection, ...overrideVal };
     } else {
+      const baseVal = base[key];
+      if (baseVal !== null && typeof baseVal === "object" && !Array.isArray(baseVal)) continue;
       merged[key] = overrideVal;
     }
   }
@@ -2877,8 +2897,10 @@ function _buildConfig(raw, projectRaw = {}) {
   is_cfg.screenshot_redirect = validatedBool(is_raw["screenshot_redirect"], is_cfg.screenshot_redirect);
   is_cfg.ocr_enabled = validatedBool(is_raw["ocr_enabled"], is_cfg.ocr_enabled);
   is_cfg.ocr_min_confidence = validatedInt(is_raw["ocr_min_confidence"], is_cfg.ocr_min_confidence, ...boundsOf("image_shrink.ocr_min_confidence"));
+  is_cfg.vision_tier = validatedVisionTier(is_raw["vision_tier"], is_cfg.vision_tier);
   is_cfg.max_image_pixels = envInt("TOKEN_GOAT_MAX_IMAGE_PIXELS", is_cfg.max_image_pixels, ...boundsOf("image_shrink.max_image_pixels"));
   is_cfg.ocr_enabled = envBool("TOKEN_GOAT_OCR_ENABLED", is_cfg.ocr_enabled);
+  is_cfg.vision_tier = validatedVisionTier(process.env["TOKEN_GOAT_VISION_TIER"], is_cfg.vision_tier);
   const sc_raw = section(raw, "screenshot");
   const sc_cfg = getDefaultConfig("screenshot");
   sc_cfg.chrome_path = validatedStr(sc_raw["chrome_path"], sc_cfg.chrome_path);
@@ -3077,6 +3099,7 @@ var CONFIG_KEY_ENV_OVERRIDES = {
   "skill_preservation.orphan_sweep_enabled": ["TOKEN_GOAT_ORPHAN_SWEEP"],
   "image_shrink.max_image_pixels": ["TOKEN_GOAT_MAX_IMAGE_PIXELS"],
   "image_shrink.ocr_enabled": ["TOKEN_GOAT_OCR_ENABLED"],
+  "image_shrink.vision_tier": ["TOKEN_GOAT_VISION_TIER"],
   "screenshot.block_private_targets": ["TOKEN_GOAT_SCREENSHOT_BLOCK_PRIVATE_TARGETS"],
   "repomap.compact_file_threshold": ["TOKEN_GOAT_REPOMAP_COMPACT_THRESHOLD"],
   "repomap.exclude_tests": ["TOKEN_GOAT_REPOMAP_EXCLUDE_TESTS"],
@@ -3199,7 +3222,8 @@ function saveConfig(config) {
       max_image_pixels: is_cfg.max_image_pixels,
       screenshot_redirect: is_cfg.screenshot_redirect,
       ocr_enabled: is_cfg.ocr_enabled,
-      ocr_min_confidence: is_cfg.ocr_min_confidence
+      ocr_min_confidence: is_cfg.ocr_min_confidence,
+      vision_tier: is_cfg.vision_tier
     },
     screenshot: {
       chrome_path: config.screenshot.chrome_path,
@@ -4175,9 +4199,11 @@ function makeSymbolEmitter(symbols, sections, seen, filePath, maxSymbols = 500,
 }
 function assignFlatEndLines(sections, totalLines) {
   for (let i = 0; i < sections.length; i++) {
-    const next = sections[i + 1];
     const s = sections[i];
     if (s === void 0) continue;
+    let j = i + 1;
+    while (j < sections.length && (sections[j]?.line ?? 0) <= s.line) j++;
+    const next = sections[j];
     const end = next !== void 0 ? next.line - 1 : totalLines;
     s.endLine = end < s.line ? s.line : end;
   }
@@ -4472,6 +4498,7 @@ function findBlockOpenBrace(content, lineIndex, startLine, lastSearchLine, lineC
     else if (ch === ")" || ch === "]") {
       if (parenDepth > 0) parenDepth--;
     } else if (ch === ";") return null;
+    else if (ch === "}" && parenDepth === 0) return null;
     else if (ch === "{") return i;
   }
   return null;
@@ -4567,8 +4594,9 @@ function extractEnv(content, filePath) {
       if (_lineClosesQuote(line, openQuote)) openQuote = null;
       continue;
     }
-    if (!line || line[0] === "#" || line[0] === ";" || line[0] === " " || line[0] === "	") continue;
-    const m = ENV_KEY_RE.exec(line);
+    const trimmed = line.replace(/^[ \t]+/, "");
+    if (!trimmed || trimmed[0] === "#" || trimmed[0] === ";") continue;
+    const m = ENV_KEY_RE.exec(trimmed);
     if (m === null) continue;
     const name = m[1]?.trim() ?? "";
     if (!name || name.length > MAX_HEADING_LEN) continue;
@@ -4576,7 +4604,7 @@ function extractEnv(content, filePath) {
     if (seen.has(key)) continue;
     seen.add(key);
     symbols.push(makeLineSymbol(filePath, name, "env_key", i + 1));
-    openQuote = _detectOpenQuote(line.slice(m[0].length));
+    openQuote = _detectOpenQuote(trimmed.slice(m[0].length));
   }
   return symbols;
 }
@@ -4955,7 +4983,8 @@ CREATE TABLE IF NOT EXISTS files (
   language TEXT,
   indexed_at REAL,
   embed_sha TEXT,
-  retry_count INTEGER NOT NULL DEFAULT 0
+  retry_count INTEGER NOT NULL DEFAULT 0,
+  parser_sha TEXT
 );
 -- Expression index on TG_LOWER(path) -- see pathEqClause (sql_path.ts) and TG_LOWER's
 -- registration above. TG_LOWER is registered { deterministic: true }, which is required for
@@ -5215,7 +5244,7 @@ CREATE TRIGGER IF NOT EXISTS cache_recall_au AFTER UPDATE ON cache_recall BEGIN
   VALUES (new.row_id, new.label, new.content);
 END;
 `;
-var SCHEMA_VERSION = 12;
+var SCHEMA_VERSION = 13;
 function alterTableIdempotent(conn, sql) {
   try {
     conn.exec(sql);
@@ -5259,7 +5288,9 @@ var MIGRATIONS = {
   // .env would have kept serving its pre-fix chunks indefinitely. Deleting the rows here both
   // removes the stored secrets and, by clearing embed_sha, makes the next drain re-embed the file
   // through the redacting path.
-  10: purgeDotenvEmbeddings
+  10: purgeDotenvEmbeddings,
+  // v12 -> v13: adds files.parser_sha, the digest of the extraction logic that produced this file's rows, tracked separately from files.sha for the same reason embed_sha is -- content freshness and parse freshness are different questions, and the content sha alone could only ever answer the first. A pre-existing v12 database's `files` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has it from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 / v8 -> v9 / v9 -> v10 above. Deliberately left NULL for every existing row rather than backfilled with the current fingerprint: NULL is the truthful answer (nobody recorded which parser wrote those rows), and it is also the answer that makes the freshness gates reparse them once, which is exactly what a database indexed by an older parser needs.
+  12: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN parser_sha TEXT")
 };
 function runMigrations(conn, fromVersion, toVersion) {
   for (let v = fromVersion; v < toVersion; v++) {
@@ -5745,7 +5776,51 @@ var _KIND_GROUPS = [
       "exports",
       "imports",
       "changed_lookup",
-      "dep_docs"
+      "dep_docs",
+      // Every other SOURCE_READ kind in stats.ts's KIND_TO_SOURCE: the surgical-read commands over documents, structured data and session/PR state. They were registered and produced but grouped nowhere, so `stats --full` printed the whole family under 'Other', away from the read-savings siblings they are measured against. image_meta/image_text sit here rather than under 'Images' because stats.ts files them as SOURCE_READ: they save read bytes, they do not shrink an image.
+      "brief_view",
+      "conflicts",
+      "coverage_report_gaps",
+      "csv_query",
+      "csv_profile",
+      "compact_doc",
+      "docx_outline",
+      "docx_text",
+      "gdrive_sections",
+      "image_meta",
+      "image_text",
+      "json_query",
+      "json_outline",
+      "note_read",
+      "note_list",
+      "openapi_op",
+      "openapi_outline",
+      "pdf_extract",
+      "pdf_locate",
+      "pdf_outline",
+      "pdf_meta",
+      "pptx_outline",
+      "pptx_slide",
+      "pptx_notes",
+      "pptx_text",
+      "pr_slice",
+      "session_outline",
+      "session_slice",
+      "sqlite_query",
+      "sqlite_schema",
+      "transcript",
+      "transcript_outline",
+      "video_chapters",
+      "xlsx_sheets",
+      "xlsx_head",
+      "xlsx_range",
+      "xlsx_query",
+      "xml_query",
+      "xml_outline",
+      "yaml_query",
+      "yaml_outline",
+      "zip_list",
+      "zip_read"
     ])
   },
   { label: "Lookups", members: /* @__PURE__ */ new Set(["symbol_lookup", "semantic_search", "map_lookup"]) },
@@ -5767,74 +5842,72 @@ var _KIND_GROUPS = [
       "session_hint_overhead",
       "session_hint_suppressed",
       "read_count_deny",
-      "read_dedup_hint",
       "grep_dedup_hint",
       "glob_dedup_hint",
       "diff_hint",
       "predictive_prefetch_hit",
-      "read_partial_overlap_hint",
       "structured_file_hint",
       "write_rewrite_hint",
       "websearch_dedup_hint",
       "large_file_hint_followed",
-      "large_file_hint_ignored"
-    ])
-  },
-  {
-    label: "Bash",
-    members: /* @__PURE__ */ new Set([
-      "bash_dedup_hint",
-      "bash_output_cached",
-      "bash_output_recall",
-      "bash_output_recall_miss",
-      "bash_dedup_stale",
-      "bash_range_read_hint",
-      "bash_streak_hint",
-      "bash_poll_hint",
-      "env_probe_cache_hit",
-      "git_diff_scope_hint",
-      "dep_list_cache_hit",
-      "bash_read_equiv_already_read",
-      "bash_grep_result_cache_hit",
-      "git_diff_context_trimmed"
+      "large_file_hint_ignored",
+      "evidence_cache_hit"
     ])
   },
+  // Empty for the same reason as MCP below: every live Bash kind arrives through _kindGroupLabel's `bash_compress:` prefix branch, not through a literal name. The fifteen literal names this set used to carry (bash_output_cached, bash_dedup_hint, env_probe_cache_hit and the rest) came over with the Python port and were never recorded or registered anywhere in this tree, so they grouped rows that could not exist.
+  { label: "Bash", members: /* @__PURE__ */ new Set() },
   {
     label: "Web",
     members: /* @__PURE__ */ new Set([
-      "web_dedup_hint",
-      "web_output_cached",
-      "web_output_recall",
-      "web_output_recall_miss",
-      "web_dedup_stale",
       "web_fetch",
       "injection_detected"
     ])
   },
+  // Membership comes from _kindGroupLabel's `mcp:` prefix branch, not from this set, which is why
+  // it is empty. The entry still has to exist: _renderByKindSection iterates _KIND_GROUPS' labels
+  // (plus 'Other') to decide what to print, so a label _kindGroupLabel returns but that is missing
+  // here does not fall back to 'Other' -- its rows disappear from the table entirely.
+  { label: "MCP", members: /* @__PURE__ */ new Set() },
   {
     label: "Compact / Skills",
     members: /* @__PURE__ */ new Set([
-      "compact_manifest",
-      "compact_assist",
-      "compact_recovery",
-      "skill_body_recall",
-      "skill_compact_served",
-      "skill_cached",
       "skill_load",
       "skill_oversized_first_load",
-      "skill_compact_inlined",
-      "resume_packet",
-      "decision_log"
+      "skill_compact_inlined"
+    ])
+  },
+  // SOURCE_CONTENT: real rewrites of tool output that remove real bytes (agent report compaction, Grep fold, browser tab dedup, bash/content compression and the handoff pair). The by-source table has shown a 'content' row since the source was added, but the by-kind table had no member set for it, so every one of these kinds printed under 'Other'. The taskoutput: prefix branch in _kindGroupLabel routes here too.
+  {
+    label: "Content",
+    members: /* @__PURE__ */ new Set([
+      "content_compress",
+      "content_retrieve",
+      "agent_report_compact",
+      "agent_report_compact_declined",
+      "browser_tab_dedup",
+      "grep:fold",
+      "handoff_create",
+      "handoff_resolve",
+      "plan_echo_collapse"
     ])
   }
 ];
 function _kindGroupLabel(kind) {
-  if (kind.startsWith("bash_compress:")) {
+  if (kind.startsWith("bash_compress:") || kind.startsWith("bashoutput:")) {
     return "Bash";
   }
-  if (kind.startsWith("webfetch:")) {
+  if (kind.startsWith("webfetch:") || kind.startsWith("gdrive:")) {
     return "Web";
   }
+  if (kind.startsWith("mcp:")) {
+    return "MCP";
+  }
+  if (kind.startsWith("skill_body:") || kind.startsWith("skill_compact:")) {
+    return "Compact / Skills";
+  }
+  if (kind.startsWith("taskoutput:")) {
+    return "Content";
+  }
   for (const group of _KIND_GROUPS) {
     if (group.members.has(kind)) {
       return group.label;
@@ -6138,6 +6211,10 @@ var SOURCE_SKILL = "skill";
 var SOURCE_CONTENT = "content";
 var SOURCE_OTHER = "other";
 var _BYTES_MODE_ONLY_KINDS = /* @__PURE__ */ new Set(["webfetch_image", "gdrive_image"]);
+var COUNT_ONLY_KINDS = /* @__PURE__ */ new Set(["secret_redacted"]);
+function savedTokensFromBytes(bytes) {
+  return Math.round(Math.max(0, bytes) / 4);
+}
 var KIND_TO_SOURCE = {
   image_shrink: SOURCE_IMAGE,
   image_shrink_cache_hit: SOURCE_IMAGE,
@@ -6238,6 +6315,10 @@ var KIND_TO_SOURCE = {
   // Decline counterpart to agent_report_compact: the fence-collapse net-benefit gate ran and found at least one over-long fence, but declined to rewrite because net savings did not clear the notice cost. Always recorded at (0, 0) -- see the recordStat call site -- so it never contributes to any savings total; it exists purely to make gate hit-rate and near-misses visible instead of the decline being invisible.
   agent_report_compact_declined: SOURCE_CONTENT,
   content_compress: SOURCE_CONTENT,
+  // Verbatim-repeat collapse of a browser tool's "Tab Context:" text block (hooks_browser_image.ts postBrowserImageHandler). SOURCE_CONTENT for the same reason as agent_report_compact above: it is a real rewrite with real bytes removed, not an advisory nudge. Deliberately not SOURCE_IMAGE -- it shares a handler with image_shrink but collapses text, and folding text bytes into the image ledger is the two-units-under-one-label mistake this file's image_shrink entry was just fixed for.
+  browser_tab_dedup: SOURCE_CONTENT,
+  // Collapse of the plan echo in an approved ExitPlanMode result (hooks_exitplanmode.ts). SOURCE_CONTENT for the same reason as agent_report_compact: real bytes removed from a tool result, not an advisory nudge. The handler shipped for releases emitting this rewrite and recording nothing at all, so the mechanism was invisible in `stats` and its net benefit could not be checked against the gate that admits it.
+  plan_echo_collapse: SOURCE_CONTENT,
   // Lossless re-layout of Grep content-mode output (hooks_grep.ts foldGrepContentHandler). SOURCE_CONTENT, not SOURCE_HINT, for the same reason as agent_report_compact above: its sibling grep_dedup_hint is advisory and saves nothing directly, whereas this is a real rewrite with real bytes removed. Filing it under the advisory bucket would silently add non-hint savings to hint_stats.ts's savedBytes (which reads by_source[SOURCE_HINT] wholesale) and overstate the hint ledger's net benefit.
   "grep:fold": SOURCE_CONTENT,
   content_retrieve: SOURCE_CONTENT,
@@ -6366,7 +6447,8 @@ CREATE TABLE IF NOT EXISTS stats (
   tokens_saved INTEGER NOT NULL DEFAULT 0,
   bytes_saved INTEGER NOT NULL DEFAULT 0,
   detail TEXT,
-  harness TEXT
+  harness TEXT,
+  traceparent TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_stats_ts ON stats(ts);
 CREATE INDEX IF NOT EXISTS idx_stats_kind ON stats(kind);
@@ -6389,6 +6471,11 @@ function migrateGlobalSchema(db) {
   } catch (err) {
     if (!(err instanceof Error) || !/duplicate column/i.test(err.message)) throw err;
   }
+  try {
+    db.exec("ALTER TABLE stats ADD COLUMN traceparent TEXT");
+  } catch (err) {
+    if (!(err instanceof Error) || !/duplicate column/i.test(err.message)) throw err;
+  }
 }
 var _harnessColumnByDb = /* @__PURE__ */ new WeakMap();
 function statsHasHarnessColumn(db) {
@@ -6405,6 +6492,21 @@ function statsHasHarnessColumn(db) {
   _harnessColumnByDb.set(db, present);
   return present;
 }
+var _traceparentColumnByDb = /* @__PURE__ */ new WeakMap();
+function statsHasTraceparentColumn(db) {
+  const cached = _traceparentColumnByDb.get(db);
+  if (cached !== void 0) return cached;
+  let present;
+  try {
+    present = db.prepare("PRAGMA table_info(stats)").all().some(
+      (c) => c.name === "traceparent"
+    );
+  } catch {
+    present = false;
+  }
+  _traceparentColumnByDb.set(db, present);
+  return present;
+}
 function getGlobalDb(homeDir) {
   const basePath = homeDir ? dataDirForHome(homeDir) : dataDir();
   const dbPath = path8.join(basePath, "global.db");
@@ -6423,11 +6525,18 @@ function noStatsMessage(windowDays, homeDir) {
   if (total === 0) return "No stats recorded yet.";
   return `No stats in the last ${countNoun(windowDays, "day")} (${total} recorded outside this window; use --window-days 0 for all time).`;
 }
-function recordStat(kind, bytesSaved = 0, tokensSaved = 0, _testDb, detail) {
+function recordStat(kind, bytesSaved = 0, tokensSaved = 0, _testDb, detail, traceparent) {
   try {
     const db = _testDb ?? getGlobalDb();
     const ts = Math.floor(Date.now() / 1e3);
-    if (statsHasHarnessColumn(db)) {
+    const tp = traceparent ?? process.env["TRACEPARENT"] ?? process.env["traceparent"] ?? null;
+    const hasHarness = statsHasHarnessColumn(db);
+    const hasTraceparent = statsHasTraceparentColumn(db);
+    if (hasHarness && hasTraceparent) {
+      db.prepare(
+        "INSERT INTO stats (ts, kind, bytes_saved, tokens_saved, detail, harness, traceparent) VALUES (?, ?, ?, ?, ?, ?, ?)"
+      ).run(ts, kind, bytesSaved, tokensSaved, detail ?? null, getHarnessName(), tp);
+    } else if (hasHarness) {
       db.prepare(
         "INSERT INTO stats (ts, kind, bytes_saved, tokens_saved, detail, harness) VALUES (?, ?, ?, ?, ?, ?)"
       ).run(ts, kind, bytesSaved, tokensSaved, detail ?? null, getHarnessName());
@@ -6482,10 +6591,14 @@ function summarize(windowDays = 30, testDb, homeDir) {
   const stmt = db.prepare(query);
   const rows = sinceTs !== null ? stmt.all(sinceTs) : stmt.all();
   const tsToDateCache = {};
+  const counts = {};
   for (const row of rows) {
     const bytesSaved = row.bytes_saved ?? 0;
-    const tokensSaved = row.tokens_saved ?? 0;
+    const recorded = row.tokens_saved ?? 0;
     const kind = row.kind;
+    const isCount = COUNT_ONLY_KINDS.has(kind);
+    if (isCount) counts[kind] = (counts[kind] ?? 0) + recorded;
+    const tokensSaved = isCount ? 0 : recorded;
     const tsRaw = row.ts;
     if (tsRaw === void 0) continue;
     const ts = tsRaw;
@@ -6544,6 +6657,7 @@ function summarize(windowDays = 30, testDb, homeDir) {
     by_project: byProjectList,
     by_source: bySourceDict,
     by_harness: byHarness,
+    counts,
     by_command: Object.entries(byCommandDict).map(([command, bucket]) => ({ ...bucket, command })).filter((r) => r.events > 0),
     window_days: windowDays
   };
@@ -6554,6 +6668,10 @@ function _totalsLines(summary) {
     `Total events:   ${summary.total_events}`,
     `Bytes saved:    ${fmtBytes(summary.total_bytes_saved)}`,
     `Tokens saved:   ${summary.total_tokens_saved}`,
+    // Printed on its own line, below the token total and never inside it, because it counts
+    // placeholders rather than tokens. Omitted entirely when nothing was redacted, so the line is
+    // information rather than a permanent zero. See COUNT_ONLY_KINDS.
+    ...summary.counts["secret_redacted"] ? [`Secrets hidden: ${summary.counts["secret_redacted"]} (a count, not tokens)`] : [],
     `Window:         ${summary.window_days} days`
   ];
 }
@@ -6872,6 +6990,7 @@ export {
   toKB,
   compileGrepMatcher,
   grepFilteredToEmptyNotice,
+  filtersFilteredToEmptyNotice,
   countNoun,
   excludeTestsHiddenNote,
   countContentLines,
@@ -6959,6 +7078,7 @@ export {
   fg,
   C,
   SOURCE_HINT,
+  savedTokensFromBytes,
   formatLocalTimestamp,
   recordStat,
   recordUnmappedTool,

package/dist/{token-goat-chunk-4OM2Q2SX.mjs → token-goat-chunk-HNODKNWO.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-222VPFP2.mjs";
-import "./token-goat-chunk-TX4JFJTD.mjs";
-import "./token-goat-chunk-4HIMCBYK.mjs";
-import "./token-goat-chunk-PWVXXPCC.mjs";
-import "./token-goat-chunk-6ODZ6PZK.mjs";
+} from "./token-goat-chunk-U4UI5F3S.mjs";
+import "./token-goat-chunk-RE7S7H26.mjs";
+import "./token-goat-chunk-IZRXU64B.mjs";
+import "./token-goat-chunk-4OTIB7SB.mjs";
+import "./token-goat-chunk-E76UNTVK.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {

package/dist/{token-goat-chunk-4HIMCBYK.mjs → token-goat-chunk-IZRXU64B.mjs}

@@ -8,7 +8,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-chunk-PWVXXPCC.mjs";
+} from "./token-goat-chunk-4OTIB7SB.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -18,7 +18,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-chunk-6ODZ6PZK.mjs";
+} from "./token-goat-chunk-E76UNTVK.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -151,8 +151,22 @@ var GROK_TOOL_NAME_MAP = {
   write: "Write",
   search_replace: "Edit",
   run_terminal_command: "Bash",
+  // The grok 0.2.93 binary registers its shell tool as `tool.run_terminal_cmd` (tracing-id table in ~/.grok/bin/agent.exe) and its newer embedded hooks doc's PreToolUse example sends `"toolName": "run_terminal_cmd"`, while the older embedded doc revision and a 2026-07-09 live capture on the same version both show `run_terminal_command`. Which spelling arrives is profile/version dependent, so BOTH are mapped: an unmatched extra entry is a harmless no-op, a missing one silently kills every Bash hook (compression, wrap, hints) on that profile.
+  run_terminal_cmd: "Bash",
   grep: "Grep",
-  list_dir: "Glob"
+  list_dir: "Glob",
+  // `glob` is a distinct registered grok tool (tool.glob in the 0.2.93 binary's tracing-id table), separate from list_dir; unmapped it arrived as lowercase 'glob' and matched no handler.
+  glob: "Glob",
+  // web_fetch/web_search were entirely absent from this map, so grok's URL fetches bypassed token-goat's WebFetch pipeline (URL-policy deny included) and its searches bypassed the WebSearch dedup/compression. Verified against the 0.2.93 binary: tool.web_fetch / tool.web_search registered ids, grok_build WebFetchInput's field described as "The URL to fetch content from" (i.e. `url`), grok_build WebSearchInput's fields query/citations/allowed_domains -- all matching the keys hooks_fetch.ts / hooks_websearch.ts already read, so a name map alone revives both.
+  web_fetch: "WebFetch",
+  web_search: "WebSearch",
+  // The Hashline prompt profile registers hashline_read/hashline_edit/hashline_grep (tool.hashline_* in the binary; grok's own hook alias table pairs them with Read/Edit/Grep). Their input key shapes were not individually verified: if one differs, the mapped handler degrades to the same no-op as an unmapped name, never a wrong rewrite. The *_concise twins are the GrokBuildConcise profile's registrations of the same three core tools.
+  hashline_read: "Read",
+  hashline_edit: "Edit",
+  hashline_grep: "Grep",
+  read_file_concise: "Read",
+  search_replace_concise: "Edit",
+  run_terminal_cmd_concise: "Bash"
 };
 var GROK_INPUT_KEY_MAP = {
   Read: { target_file: "file_path" }
@@ -162,10 +176,28 @@ var KIMI_TOOL_NAME_MAP = {
   ReadMediaFile: "Read"
 };
 var KIMI_INPUT_KEY_MAP = {
-  Read: { path: "file_path" },
+  // line_offset/n_lines are Kimi's Read paging arguments (ReadInputSchema in MoonshotAI/kimi-code packages/agent-core-v2/src/agent/tools/os/read/read.ts: `path`, `line_offset` "the line number to start reading from", `n_lines` "the number of lines to read"). Unmapped, every ranged Kimi read looked unbounded to hooks_read.ts's estimateRequestedSlice and was gated on the whole file's size -- a small slice of a big file could draw the large-file deny meant for full reads. line_offset's 1-indexed positive form matches Read's own offset semantics exactly; its negative tail-read form has no token-goat equivalent and is clamped to 1 by estimateRequestedSlice's `offset >= 1` guard, degrading to a window of the right SIZE (which is all the gate consumes). ReadMediaFile shares this map via its Read rename and carries only `path`, so the extra entries never touch it.
+  Read: { path: "file_path", line_offset: "offset", n_lines: "limit" },
   Write: { path: "file_path" },
   Edit: { path: "file_path" }
 };
+var QWEN_TOOL_NAME_MAP = {
+  read_file: "Read",
+  write_file: "Write",
+  edit: "Edit",
+  replace: "Edit",
+  notebook_edit: "NotebookEdit",
+  run_shell_command: "Bash",
+  grep_search: "Grep",
+  search_file_content: "Grep",
+  glob: "Glob",
+  web_fetch: "WebFetch",
+  web_search: "WebSearch",
+  list_directory: "Read"
+};
+var QWEN_INPUT_KEY_MAP = {
+  Read: { path: "file_path" }
+};
 function remapInputKeys(input, keyMap) {
   const newInput = {};
   for (const [k, v] of Object.entries(input)) {
@@ -209,6 +241,14 @@ function grokToCanonicalWire(obj) {
   }
   return wire;
 }
+function aliasLlmContentToOutput(result) {
+  const toolResponse = result["tool_response"];
+  if (toolResponse === null || typeof toolResponse !== "object" || Array.isArray(toolResponse)) return;
+  const responseRecord = toolResponse;
+  if (typeof responseRecord["llmContent"] === "string" && responseRecord["output"] === void 0) {
+    result["tool_response"] = { ...responseRecord, output: responseRecord["llmContent"] };
+  }
+}
 function normalizePayload(payload, harness = "claude") {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
     _LOG.warn("normalizePayload: payload is not a dict; received %s", typeof payload);
@@ -246,12 +286,19 @@ function normalizePayload(payload, harness = "claude") {
     result2["_tg_harness"] = harness;
     return result2;
   }
+  if (harness === "qwen") {
+    const result2 = remapToolName(obj, toolName, QWEN_TOOL_NAME_MAP, QWEN_INPUT_KEY_MAP);
+    aliasLlmContentToOutput(result2);
+    result2["_tg_harness"] = harness;
+    return result2;
+  }
   if (harness === "gemini") {
     const result2 = remapToolName(obj, toolName, GEMINI_TOOL_NAME_MAP, GEMINI_INPUT_KEY_MAP);
     if ("functionCallId" in result2 && !("toolUseId" in result2)) {
       result2["toolUseId"] = result2["functionCallId"];
       delete result2["functionCallId"];
     }
+    aliasLlmContentToOutput(result2);
     result2["_tg_harness"] = harness;
     return result2;
   }

package/dist/{token-goat-chunk-DP3NNGGV.mjs → token-goat-chunk-L6YP6FKQ.mjs}

@@ -4,14 +4,14 @@ import {
   buildEvent,
   relay,
   relayInProcess
-} from "./token-goat-chunk-NKNCHJ4H.mjs";
+} from "./token-goat-chunk-ZQ3PUOP3.mjs";
 import {
   MAX_STDIN_BYTES,
   readStdinJson
-} from "./token-goat-chunk-4HIMCBYK.mjs";
-import "./token-goat-chunk-PWVXXPCC.mjs";
-import "./token-goat-chunk-EFF2XCLB.mjs";
-import "./token-goat-chunk-6ODZ6PZK.mjs";
+} from "./token-goat-chunk-IZRXU64B.mjs";
+import "./token-goat-chunk-4OTIB7SB.mjs";
+import "./token-goat-chunk-CZALRRGN.mjs";
+import "./token-goat-chunk-E76UNTVK.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 export {