token-goat 2.8.4 → 2.8.6

package/dist/{token-goat-chunk-U4UI5F3S.mjs → token-goat-chunk-U7M2LTGP.mjs}

@@ -86,11 +86,12 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-RE7S7H26.mjs";
+} from "./token-goat-chunk-XAWIELXH.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GEMINI_TOOL_NAME_MAP,
   HOOK_EVENTS,
+  RECALL_DEFAULT_LIMIT,
   WEB_OUTPUT_SUBDIR,
   accumulateResidentLine,
   buildCommandManifest,
@@ -113,7 +114,7 @@ import {
   searchRecall,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-IZRXU64B.mjs";
+} from "./token-goat-chunk-TELKICYU.mjs";
 import {
   AGENT_SALT_MARKER,
   CONTEXT_AUTOCOMPACT_TOKENS,
@@ -131,6 +132,7 @@ import {
   WORKER_HEARTBEAT_STALE_MS,
   WorkerAlreadyRunningError,
   anchoredMarkerPattern,
+  applyIndexingPriority,
   auditClaudeMd,
   buildExtractiveCompact,
   buildLineDiff,
@@ -160,6 +162,7 @@ import {
   extractChecklistSection,
   extractCompactFromMarker,
   extractNamedSection,
+  fenceUntrusted,
   fenceUntrustedContent,
   fenceUntrustedOcrText,
   findClaudeMdFiles,
@@ -177,6 +180,7 @@ import {
   formatXlsxRange,
   getContextPressure,
   getDirtyPathsFor,
+  getEmbeddingCoverage,
   getFileEntry,
   getHintStatsSummary,
   getHintStatsTotals,
@@ -190,6 +194,7 @@ import {
   indexFileEmbeddings,
   indexFileSync,
   indexedPathSpellingIsStale,
+  injectionFencingEnabled,
   installClaudeMd,
   installCodex,
   installCopilotCli,
@@ -239,7 +244,7 @@ import {
   resetHintStats,
   runContextStats,
   runDetachedWorkerDaemon,
-  scanForInjectionPatterns,
+  scanAndRecord,
   shrinkImage,
   skillOutputsDir,
   startDetachedWorker,
@@ -260,7 +265,7 @@ import {
   vscodeDecoderConfigured,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-4OTIB7SB.mjs";
+} from "./token-goat-chunk-DK4VLLYB.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -343,7 +348,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-E76UNTVK.mjs";
+} from "./token-goat-chunk-2JZ66BBE.mjs";
 import {
   __export
 } from "./token-goat-chunk-AEX54RUZ.mjs";
@@ -6027,6 +6032,42 @@ function checkSymbolCount(dbPath, rootDir) {
     };
   }
 }
+var EMBED_COVERAGE_WARN_FRACTION = 0.25;
+function checkEmbeddingCoverage(dbPath, rootDir) {
+  if (!fs12.existsSync(dbPath)) {
+    return { name: "Embedding coverage", status: "ok", message: "no database yet" };
+  }
+  const cfg = loadConfig();
+  if (!cfg.indexing.embeddings_enabled) {
+    return { name: "Embedding coverage", status: "ok", message: "disabled (indexing.embeddings_enabled = false)" };
+  }
+  try {
+    const { indexedFiles, embeddedFiles } = getEmbeddingCoverage(dbPath, rootDir);
+    if (indexedFiles === 0) {
+      return { name: "Embedding coverage", status: "ok", message: "no indexed files yet" };
+    }
+    const pct2 = Math.round(embeddedFiles / indexedFiles * 100);
+    const sizeKb = cfg.indexing.large_file_symbol_only_kb;
+    if (embeddedFiles / indexedFiles < EMBED_COVERAGE_WARN_FRACTION) {
+      return {
+        name: "Embedding coverage",
+        status: "warn",
+        message: `only ${embeddedFiles} of ${indexedFiles} indexed file(s) (${pct2}%) have embeddings \u2014 'semantic' searches those files only, and reports finding nothing in the same words it uses after searching everything. Files over indexing.large_file_symbol_only_kb (currently ${sizeKb} KB) are indexed for symbols only and are the usual reason; raise it with 'token-goat config set indexing.large_file_symbol_only_kb <KB>' and re-embed with 'token-goat index --force' to widen coverage. Exact symbol lookups are unaffected`
+      };
+    }
+    return {
+      name: "Embedding coverage",
+      status: "ok",
+      message: `${embeddedFiles} of ${indexedFiles} indexed file(s) (${pct2}%) have embeddings`
+    };
+  } catch (err2) {
+    return {
+      name: "Embedding coverage",
+      status: "warn",
+      message: `could not query embedding coverage: ${extractErrorMessage(err2)}`
+    };
+  }
+}
 var DIRTY_QUEUE_BACKLOG_WARN_THRESHOLD = 500;
 function checkDirtyQueueHealth(dataDir2) {
   let pendingCount = 0;
@@ -6395,6 +6436,7 @@ function runDoctor(dataDir2, configPath2, rootDir, processes) {
   const actualConfigPath = configPath2 || configPath();
   results.push(checkConfigValid(actualConfigPath));
   results.push(checkEmbeddings(loadConfig(rootDir)));
+  results.push(checkEmbeddingCoverage(path11.join(actualDataDir, "global.db"), rootDir));
   for (const result of checkSecurityPosture(loadConfig(rootDir), actualDataDir)) results.push(result);
   results.push(checkDiskSpace(actualDataDir));
   const copilotResult = checkCopilotCli(copilotCliConfigPath(), copilotCliScriptPath());
@@ -10366,14 +10408,23 @@ function applyFiltersAndFold(lines, noNormalize, foldRepeats) {
 }
 function cmdLogfold(src, opts) {
   const text = readInput(src);
-  let lines = splitLines(text);
+  const rawLines = splitLines(text);
+  const allLines = rawLines.length > 1 && rawLines[rawLines.length - 1] === "" ? rawLines.slice(0, -1) : rawLines;
+  let lines = allLines;
   if (opts.tail !== void 0) {
     const n = requireNonNegativeStrictInt("--tail", opts.tail);
     lines = lines.slice(Math.max(0, lines.length - n));
   }
+  const inputLines = allLines.length;
+  const shownLines = lines.length;
+  const truncated = shownLines < inputLines;
   const folded = applyFiltersAndFold(lines, opts.noNormalize === true, opts.foldRepeats === true);
+  if (truncated) {
+    process.stderr.write(`Showing last ${shownLines} of ${inputLines} lines (raise --tail to see more).
+`);
+  }
   if (opts.json === true) {
-    process.stdout.write(JSON.stringify({ lines: folded }, null, 2) + "\n");
+    process.stdout.write(JSON.stringify({ lines: folded, truncated, inputLines, shownLines }, null, 2) + "\n");
     return;
   }
   for (const item of folded) {
@@ -10859,9 +10910,11 @@ function cmdHot(opts) {
     }
   }
   entries.sort((a, b) => b.readCount - a.readCount);
+  const eligibleCount = entries.length;
   entries = entries.slice(0, limit);
+  const truncated = entries.length < eligibleCount;
   if (opts.json === true) {
-    process.stdout.write(JSON.stringify({ entries }, null, 2) + "\n");
+    process.stdout.write(JSON.stringify({ entries, truncated, totalCount: eligibleCount }, null, 2) + "\n");
     return;
   }
   if (entries.length === 0) {
@@ -10877,6 +10930,10 @@ function cmdHot(opts) {
   const hotDisplayRoot = getDisplayRoot();
   for (const e of entries) {
     process.stdout.write(`${e.readCount}	${toDisplayPath(hotDisplayRoot, e.path)}
+`);
+  }
+  if (truncated) {
+    process.stdout.write(`...and ${eligibleCount - entries.length} more (raise --limit to see them).
 `);
   }
 }
@@ -11330,6 +11387,13 @@ async function buildResumePacket(sessionId) {
 function emitErr(text) {
   process.stderr.write(ensureNewline(text));
 }
+function capAndNote(rows, limit) {
+  const shown = rows.slice(0, limit);
+  if (shown.length < rows.length) {
+    emitErr(`Showing ${shown.length} of ${rows.length} entries (raise --limit to see the rest).`);
+  }
+  return shown;
+}
 function parseLimitOpt(cmdName, limitStr, dflt = 30) {
   if (limitStr === void 0) return dflt;
   let n;
@@ -11369,7 +11433,7 @@ function getNewestSessionFiles() {
 function cmdBashHistory(opts) {
   const limit = parseLimitOpt("bash-history", opts.limit);
   const blobs = listBlobs(BASH_OUTPUT_SUBDIR);
-  const items = blobs.map(({ id, mtime, value }) => {
+  const allItems = blobs.map(({ id, mtime, value }) => {
     if (typeof value !== "object" || value === null) return null;
     const v = value;
     return {
@@ -11379,7 +11443,8 @@ function cmdBashHistory(opts) {
       exitCode: typeof v["exitCode"] === "number" ? v["exitCode"] : -1,
       sizeBytes: typeof v["sizeBytes"] === "number" ? v["sizeBytes"] : 0
     };
-  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt);
+  const items = capAndNote(allItems, limit);
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -11400,7 +11465,7 @@ function cmdBashHistory(opts) {
 function cmdWebHistory(opts) {
   const limit = parseLimitOpt("web-history", opts.limit);
   const blobs = listBlobs(WEB_OUTPUT_SUBDIR);
-  const items = blobs.map(({ id, mtime, value }) => {
+  const allItems = blobs.map(({ id, mtime, value }) => {
     if (typeof value !== "object" || value === null) return null;
     const v = value;
     return {
@@ -11409,7 +11474,8 @@ function cmdWebHistory(opts) {
       bytes: typeof v["content"] === "string" ? Buffer.byteLength(v["content"], "utf8") : 0,
       storedAt: mtime
     };
-  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt);
+  const items = capAndNote(allItems, limit);
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -11428,7 +11494,7 @@ function cmdWebHistory(opts) {
 function cmdMcpHistory(opts) {
   const limit = parseLimitOpt("mcp-history", opts.limit);
   const blobs = listBlobs(BASH_OUTPUT_SUBDIR).filter((b) => b.id.startsWith("mcp_"));
-  const items = blobs.map(({ id, mtime, value }) => {
+  const allItems = blobs.map(({ id, mtime, value }) => {
     if (typeof value !== "object" || value === null) return null;
     const v = value;
     const command = typeof v["command"] === "string" ? v["command"] : "";
@@ -11439,7 +11505,8 @@ function cmdMcpHistory(opts) {
       storedAt: typeof v["storedAt"] === "number" ? v["storedAt"] : mtime,
       sizeBytes: typeof v["sizeBytes"] === "number" ? v["sizeBytes"] : 0
     };
-  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt);
+  const items = capAndNote(allItems, limit);
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -12442,7 +12509,12 @@ function cmdHistory(opts) {
       summary: typeof v["url"] === "string" ? v["url"] : ""
     };
   }).filter((x) => x !== null);
-  const items = [...bashItems, ...webItems].sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  const allItems = [...bashItems, ...webItems].sort((a, b) => b.storedAt - a.storedAt);
+  const items = allItems.slice(0, limit);
+  if (items.length < allItems.length) {
+    process.stderr.write(`Showing ${items.length} of ${allItems.length} entries (raise --limit to see the rest).
+`);
+  }
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -12611,7 +12683,9 @@ async function buildBootstrapAudit(opts = {}) {
   const seenFiles = /* @__PURE__ */ new Set();
   const agents = await scanMetadataRoot(path20.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
   const skills = await scanMetadataRoot(path20.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
-  const largest = [...agents, ...skills].sort((a, b) => b.metadata_bytes - a.metadata_bytes || a.path.localeCompare(b.path)).slice(0, top);
+  const rankedEntries = [...agents, ...skills].sort((a, b) => b.metadata_bytes - a.metadata_bytes || a.path.localeCompare(b.path));
+  const largestTotal = rankedEntries.length;
+  const largest = rankedEntries.slice(0, top);
   const metadataBytes = [...agents, ...skills].reduce((sum, entry) => sum + entry.metadata_bytes, 0);
   const totalTokens = context.total_tokens + Math.floor(metadataBytes / 4);
   const warnTokens = parseBudget("--warn-tokens", opts.warnTokens);
@@ -12635,6 +12709,8 @@ async function buildBootstrapAudit(opts = {}) {
     total_estimated_tokens: totalTokens,
     counts: { agents: agents.length, skills: skills.length, metadata_files: agents.length + skills.length },
     largest,
+    largestTotal,
+    largestTruncated: largest.length < largestTotal,
     diagnostics,
     budgets: { warn_tokens: warnTokens, fail_tokens: failTokens, warn_bytes: warnBytes, fail_bytes: failBytes, warnings, failures }
   };
@@ -12658,6 +12734,8 @@ async function runBootstrapAudit(opts = {}) {
 `);
     process.stdout.write("Largest metadata entries:\n");
     for (const entry of result.largest) process.stdout.write(`  ${entry.metadata_bytes.toString().padStart(7)} bytes  ${entry.path}
+`);
+    if (result.largestTruncated) process.stdout.write(`  ...and ${result.largestTotal - result.largest.length} more (raise --top to see them).
 `);
     for (const diagnostic of result.diagnostics) process.stderr.write(`token-goat: bootstrap-audit: skipped ${diagnostic.path} (${diagnostic.reason})
 `);
@@ -14387,15 +14465,14 @@ var RECALL_COMMAND = {
 function fenceTagForCacheType(cacheType) {
   return cacheType === "web" ? UNTRUSTED_WEB_TAG : UNTRUSTED_TOOL_TAG;
 }
+function fenceRecallListing(text, hits) {
+  const tags = new Set(hits.map((hit) => fenceTagForCacheType(hit.cacheType)));
+  const tag = tags.size === 1 ? [...tags][0] ?? UNTRUSTED_TOOL_TAG : UNTRUSTED_TOOL_TAG;
+  return fenceUntrusted(text, tag);
+}
 function fenceSnippetIfMatched(hit) {
-  let matches2 = [];
-  try {
-    if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(hit.snippet);
-  } catch {
-    matches2 = [];
-  }
+  const matches2 = scanAndRecord(hit.snippet);
   if (matches2.length === 0) return hit.snippet;
-  recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
   return fenceUntrustedContent(hit.snippet, matches2, fenceTagForCacheType(hit.cacheType));
 }
 function printHits(query, hits) {
@@ -14407,16 +14484,15 @@ function printHits(query, hits) {
 `);
     return;
   }
-  for (const hit of hits) {
+  const body = hits.map((hit) => {
     const label = hit.label.length > 80 ? hit.label.slice(0, 77) + "..." : hit.label;
-    w(`[${pad(hit.cacheType, 4)}] ${hit.id}  (token-goat ${RECALL_COMMAND[hit.cacheType]} ${hit.id})
-`);
-    w(`  ${label}
-`);
-    w(`  ${fenceSnippetIfMatched(hit)}
-
+    return `[${pad(hit.cacheType, 4)}] ${hit.id}  (token-goat ${RECALL_COMMAND[hit.cacheType]} ${hit.id})
+  ${label}
+  ${hit.snippet}
+`;
+  }).join("\n");
+  w(`${fenceRecallListing(body, hits)}
 `);
-  }
 }
 function runRecallCommand(query, opts = {}) {
   const browse = query === void 0 || query.trim() === "";
@@ -14424,7 +14500,13 @@ function runRecallCommand(query, opts = {}) {
     ...opts.type !== void 0 ? { type: opts.type } : {},
     ...opts.limit !== void 0 ? { limit: opts.limit } : {}
   };
-  const hits = browse ? listRecentRecall(scope) : searchRecall(query, scope);
+  const effectiveLimit = opts.limit ?? RECALL_DEFAULT_LIMIT;
+  const fetched = browse ? listRecentRecall({ ...scope, limit: effectiveLimit + 1 }) : searchRecall(query, { ...scope, limit: effectiveLimit + 1 });
+  const hits = fetched.slice(0, effectiveLimit);
+  if (fetched.length > hits.length) {
+    process.stderr.write(`Showing ${hits.length} entries; more are available (raise --limit to see them).
+`);
+  }
   if (opts.json === true) {
     const fenced = hits.map((hit) => ({ ...hit, snippet: fenceSnippetIfMatched(hit) }));
     process.stdout.write(`${JSON.stringify(fenced)}
@@ -14681,6 +14763,7 @@ async function cmdSemantic(query, opts) {
   process.exitCode = code;
 }
 async function cmdIndex(pathArg, opts = {}) {
+  applyIndexingPriority();
   const root = pathArg ?? process.cwd();
   const dbPath = opts.dbPath ?? globalDbPath();
   const force = opts.force === true;
@@ -14823,7 +14906,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-LZOAPGWR.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-ZIPBLIUZ.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-324QOJYZ.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -14848,7 +14931,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-L6YP6FKQ.mjs");
+  const { relay } = await import("./token-goat-chunk-LJEETTER.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -15244,24 +15327,13 @@ function cmdHintStats(opts = {}) {
     ...opts.markIneffective !== void 0 && isHintCategory(opts.markIneffective) ? { markIneffective: opts.markIneffective } : {}
   });
 }
-function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag = UNTRUSTED_WEB_TAG) {
+function _applyFiltersAndPrint(content, opts, fenceByProvenance = false, fenceTag = UNTRUSTED_WEB_TAG) {
   const emit2 = (text) => {
-    if (!fenceUntrusted || text === "") {
-      out(text);
-      return text;
-    }
-    let matches2 = [];
-    try {
-      if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(text);
-    } catch {
-      matches2 = [];
-    }
-    if (matches2.length === 0) {
+    if (!fenceByProvenance || text === "") {
       out(text);
       return text;
     }
-    recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
-    const fenced = fenceUntrustedContent(text, matches2, fenceTag);
+    const fenced = fenceUntrusted(text, fenceTag);
     out(fenced);
     return fenced;
   };
@@ -15299,6 +15371,11 @@ function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag =
   const headN = opts.head !== void 0 ? requireNonNegativeInt("--head", opts.head) : 30;
   const tailN = opts.tail !== void 0 ? requireNonNegativeInt("--tail", opts.tail) : 80;
   const applyElision = (lines2, headN2, tailN2) => lines2.length > headN2 + tailN2 + 1 ? [...lines2.slice(0, headN2), "...(elided)...", ...lines2.slice(lines2.length - tailN2)] : lines2;
+  const noteLineCap = (which, flag, shown, total) => {
+    if (shown >= total) return;
+    process.stderr.write(`Showing ${which} ${shown} of ${total} lines (raise --${flag}, or --full for the whole body).
+`);
+  };
   let result = lines;
   if (opts.head === void 0 && opts.tail === void 0) {
     result = applyElision(lines, headN, tailN);
@@ -15306,20 +15383,19 @@ function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag =
     result = applyElision(lines, headN, tailN);
   } else if (opts.head !== void 0) {
     result = lines.slice(0, headN);
+    noteLineCap("first", "head", result.length, lines.length);
   } else if (opts.tail !== void 0) {
     result = lines.slice(Math.max(0, lines.length - tailN));
+    noteLineCap("last", "tail", result.length, lines.length);
   }
   return emit2(result.join("\n"));
 }
-function fenceFileTextIfMatched(text) {
-  let matches2 = [];
-  try {
-    if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(text);
-  } catch {
-    matches2 = [];
-  }
+function fenceFileText(text) {
+  return fenceUntrusted(text, UNTRUSTED_FILE_TAG);
+}
+function fenceFileFieldIfMatched(text) {
+  const matches2 = scanAndRecord(text);
   if (matches2.length === 0) return text;
-  recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
   return fenceUntrustedContent(text, matches2, UNTRUSTED_FILE_TAG);
 }
 function fileSizeOrZero(filePath) {
@@ -15398,20 +15474,22 @@ async function cmdPdfLocate(file, pattern, opts) {
   if (opts.context !== void 0) locateOpts.context = requirePositiveInt("--context", opts.context);
   if (opts.pages !== void 0) locateOpts.pages = opts.pages;
   const matches2 = await runPdfLocate(file, pattern, locateOpts);
-  const fencedMatches = matches2.map((m) => ({ ...m, snippet: fenceFileTextIfMatched(m.snippet) }));
-  const pages = fencedMatches.map((m) => m.page);
+  const pages = matches2.map((m) => m.page);
   let printed;
   if (opts.json === true) {
+    const fencedMatches = matches2.map((m) => ({ ...m, snippet: fenceFileFieldIfMatched(m.snippet) }));
     printed = JSON.stringify({ file, pattern, matchCount: fencedMatches.length, pages, matches: fencedMatches }, null, 2);
     out(printed);
-  } else if (fencedMatches.length === 0) {
+  } else if (matches2.length === 0) {
     printed = "(no matches)";
     out(printed);
   } else {
-    const lines = fencedMatches.map((m) => `p${m.page}: ${m.snippet}`);
-    printed = `${lines.join("\n")}
+    const lines = matches2.map((m) => `p${m.page}: ${m.snippet}`);
+    printed = fenceFileText(
+      `${lines.join("\n")}
 
-${countNoun(fencedMatches.length, "match", "matches")} across ${countNoun(pages.length, "page")}`;
+${countNoun(matches2.length, "match", "matches")} across ${countNoun(pages.length, "page")}`
+    );
     out(printed);
   }
   const fullSourceBytes = fileSizeOrZero(file);
@@ -15428,8 +15506,7 @@ async function cmdPdfOutline(file, opts) {
     }
     return;
   }
-  const fencedEntries = entries.map((e) => ({ ...e, title: fenceFileTextIfMatched(e.title) }));
-  const text = opts.json === true ? JSON.stringify(fencedEntries, null, 2) : fencedEntries.map((e) => `${"  ".repeat(e.level)}${e.title}${e.page !== null ? `  (p.${e.page})` : ""}`).join("\n");
+  const text = opts.json === true ? JSON.stringify(entries.map((e) => ({ ...e, title: fenceFileFieldIfMatched(e.title) })), null, 2) : fenceFileText(entries.map((e) => `${"  ".repeat(e.level)}${e.title}${e.page !== null ? `  (p.${e.page})` : ""}`).join("\n"));
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
   const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
@@ -15472,13 +15549,8 @@ ${msg}`;
   recordStat("image_meta", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 function fenceOcrText(text) {
-  try {
-    if (loadConfig().injection.enabled) {
-      const matches2 = scanForInjectionPatterns(text);
-      if (matches2.length > 0) recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
-    }
-  } catch {
-  }
+  if (!injectionFencingEnabled()) return text;
+  scanAndRecord(text);
   return fenceUntrustedOcrText(text);
 }
 async function cmdImageText(file, opts = {}) {
@@ -15563,20 +15635,19 @@ function recordXlsxStat(kind, file, emitted) {
 }
 async function cmdXlsxSheets(file, opts = {}) {
   const sheets = await listSheets(file);
-  const fencedSheets = sheets.map((s) => ({ ...s, name: fenceFileTextIfMatched(s.name) }));
-  const text = opts.json === true ? JSON.stringify(fencedSheets.map((s) => ({ name: s.name, ref: s.ref, rows: s.rows, cols: s.cols })), null, 2) : fencedSheets.map((s) => `${s.name}  ${s.ref}  (${s.rows} rows x ${s.cols} cols)`).join("\n");
+  const text = opts.json === true ? JSON.stringify(sheets.map((s) => ({ name: fenceFileFieldIfMatched(s.name), ref: s.ref, rows: s.rows, cols: s.cols })), null, 2) : fenceFileText(sheets.map((s) => `${s.name}  ${s.ref}  (${s.rows} rows x ${s.cols} cols)`).join("\n"));
   out(text);
   recordXlsxStat("xlsx_sheets", file, text);
 }
 async function cmdXlsxHead(file, opts) {
   const rows = opts.rows !== void 0 ? requireNonNegativeInt("--rows", opts.rows) : 20;
-  const text = fenceFileTextIfMatched(await headSheet(file, opts.sheet, rows));
+  const text = fenceFileText(await headSheet(file, opts.sheet, rows));
   out(text);
   recordXlsxStat("xlsx_head", file, text);
 }
 async function cmdXlsxRange(file, opts) {
   const result = await rangeSheet(file, opts.sheet, opts.range, opts.formulas === true);
-  const text = fenceFileTextIfMatched(formatXlsxRange(result));
+  const text = fenceFileText(formatXlsxRange(result));
   out(text);
   recordXlsxStat("xlsx_range", file, text);
 }
@@ -15588,7 +15659,7 @@ async function cmdXlsxQuery(file, opts) {
     ...wheres !== void 0 ? { wheres } : {},
     ...opts.head !== void 0 ? { head: requireNonNegativeInt("--head", opts.head) } : {}
   });
-  const text = fenceFileTextIfMatched(formatCsvTable(result, (opts.where ?? []).map((w) => `--where ${w}`)));
+  const text = fenceFileText(formatCsvTable(result, (opts.where ?? []).map((w) => `--where ${w}`)));
   out(text);
   recordXlsxStat("xlsx_query", file, text);
 }
@@ -15599,21 +15670,22 @@ function recordDocStat(kind, file, emitted) {
 }
 async function cmdPptxOutline(file, opts) {
   const slides = await pptxOutline(file);
-  const fencedSlides = slides.map((s) => ({ ...s, title: fenceFileTextIfMatched(s.title) }));
-  const text = opts.json === true ? JSON.stringify(fencedSlides, null, 2) : fencedSlides.map((s) => `${s.slide}. ${s.title || "(untitled)"}  [${s.bodyChars} body chars${s.hasNotes ? ", has notes" : ""}]`).join("\n");
+  const text = opts.json === true ? JSON.stringify(slides.map((s) => ({ ...s, title: fenceFileFieldIfMatched(s.title) })), null, 2) : fenceFileText(
+    slides.map((s) => `${s.slide}. ${s.title || "(untitled)"}  [${s.bodyChars} body chars${s.hasNotes ? ", has notes" : ""}]`).join("\n")
+  );
   out(text);
   recordDocStat("pptx_outline", file, text);
 }
 async function cmdPptxSlide(file, opts) {
   const n = requireNonNegativeInt("--slide", opts.slide);
-  const text = fenceFileTextIfMatched(await pptxSlideText(file, n, opts.notes === true));
+  const text = fenceFileText(await pptxSlideText(file, n, opts.notes === true));
   out(text);
   recordDocStat("pptx_slide", file, text);
 }
 async function cmdPptxNotes(file, opts) {
   const n = opts.slide !== void 0 ? requireNonNegativeInt("--slide", opts.slide) : void 0;
   const text = await pptxNotesText(file, n);
-  const printed = text.length > 0 ? fenceFileTextIfMatched(text) : "no speaker notes found";
+  const printed = text.length > 0 ? fenceFileText(text) : "no speaker notes found";
   out(printed);
   recordDocStat("pptx_notes", file, printed);
 }
@@ -15623,7 +15695,7 @@ async function cmdPptxText(file, opts) {
     out("no matches");
     return;
   }
-  const text = fenceFileTextIfMatched(matches2.map((m) => `Slide ${m.slide}: ...${m.snippet}...`).join("\n"));
+  const text = fenceFileText(matches2.map((m) => `Slide ${m.slide}: ...${m.snippet}...`).join("\n"));
   out(text);
   recordDocStat("pptx_text", file, text);
 }
@@ -15637,8 +15709,7 @@ async function cmdDocxOutline(file, opts) {
     }
     return;
   }
-  const fencedHeadings = headings.map((h) => ({ ...h, text: fenceFileTextIfMatched(h.text) }));
-  const text = opts.json === true ? JSON.stringify(fencedHeadings, null, 2) : fencedHeadings.map((h) => `${"  ".repeat(h.level - 1)}${h.text}`).join("\n");
+  const text = opts.json === true ? JSON.stringify(headings.map((h) => ({ ...h, text: fenceFileFieldIfMatched(h.text) })), null, 2) : fenceFileText(headings.map((h) => `${"  ".repeat(h.level - 1)}${h.text}`).join("\n"));
   out(text);
   recordDocStat("docx_outline", file, text);
 }
@@ -15782,7 +15853,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-NZFTWBGV.mjs");
+    const bashRunner = await import("./token-goat-chunk-L2XHDICZ.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -16710,17 +16781,7 @@ ${content}`;
     const sections = await getDocSections(fileId, { fresh: false });
     emitted = formatSections(sections);
   }
-  let toEmit = emitted;
-  try {
-    if (loadConfig().injection.enabled) {
-      const matches2 = scanForInjectionPatterns(emitted);
-      if (matches2.length > 0) {
-        recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
-        toEmit = fenceUntrustedContent(emitted, matches2, UNTRUSTED_WEB_TAG);
-      }
-    }
-  } catch {
-  }
+  const toEmit = fenceUntrusted(emitted, UNTRUSTED_WEB_TAG);
   out(toEmit);
   const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(toEmit, "utf8"));
   recordStat("gdrive_sections", bytesSaved, savedTokensFromBytes(bytesSaved));
@@ -16803,9 +16864,11 @@ function cmdTokens(patterns, opts) {
   const result = estimateBudget(root, expandGlobs(root, patterns ?? []));
   let entries = [...result.entries];
   if (opts.asc === true) entries.reverse();
+  const eligibleCount = entries.length;
   if (opts.top !== void 0) entries = entries.slice(0, requireNonNegativeInt("--top", opts.top));
+  const truncated = entries.length < eligibleCount;
   if (opts.json === true) {
-    out(JSON.stringify({ entries, total_tokens: result.total_tokens, total_lines: result.total_lines }, null, 2));
+    out(JSON.stringify({ entries, truncated, totalCount: eligibleCount, total_tokens: result.total_tokens, total_lines: result.total_lines }, null, 2));
     return;
   }
   if (opts.tree === true) {
@@ -16839,6 +16902,9 @@ function cmdTokens(patterns, opts) {
   for (const e of entries) {
     lines.push(`${e.rel_path.padEnd(colW)}  ${String(e.tokens).padStart(8)}  ${String(e.lines).padStart(6)}`);
   }
+  if (truncated) {
+    lines.push(`...and ${eligibleCount - entries.length} more (raise --top to see them).`);
+  }
   out(lines.join("\n"));
 }
 function cmdBudget(patterns, opts) {