token-goat 2.8.4 → 2.9.1

package/dist/{token-goat-chunk-U4UI5F3S.mjs → token-goat-chunk-SQSB5P5P.mjs}

@@ -5,6 +5,7 @@ import {
   AMBIGUOUS_HEADING_LIMIT,
   CONTENT_MAX_INPUT_CHARS,
   WHOLE_FILE_NOTE_SYMBOL,
+  buildImportGraph,
   compressText,
   computeFileFingerprint,
   createHandoff,
@@ -15,7 +16,6 @@ import {
   extractTranscriptText,
   filterSimilarHeadings,
   findSpecSeparator,
-  getTrackedFiles,
   healStaleIndex,
   isAvailable as isAvailable2,
   listSections,
@@ -86,42 +86,38 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-RE7S7H26.mjs";
+} from "./token-goat-chunk-SXSWQMNP.mjs";
 import {
-  BASH_OUTPUT_SUBDIR,
+  DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
   HOOK_EVENTS,
   WEB_OUTPUT_SUBDIR,
   accumulateResidentLine,
   buildCommandManifest,
   checkSymbolBodySize,
-  commandHash,
   createResidentContextStats,
   filterCommandManifest,
   formatBytes,
   formatCommandManifest,
   formatTokenEstimate,
-  getBashOutput,
   getWebOutput,
   getWebOutputByUrlFromDisk,
   getWebOutputRaw,
-  isRecallCacheType,
-  listRecentRecall,
-  normalizeCommandForCacheKey,
   readCopilotMcpTools,
   readStdinJson,
-  searchRecall,
+  runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-IZRXU64B.mjs";
+} from "./token-goat-chunk-MR7MNSDR.mjs";
 import {
   AGENT_SALT_MARKER,
+  BASH_OUTPUT_SUBDIR,
   CONTEXT_AUTOCOMPACT_TOKENS,
   DEFAULT_MAX_AGE_MS,
   DEFAULT_MAX_COUNT,
-  MATERIALIZE_SHRUNK_IMAGE_JS,
   MAX_FILES_SCANNED,
   PARSER_FINGERPRINT,
+  RECALL_DEFAULT_LIMIT,
   SESSIONS_SUBDIR,
   SKILLS_OUTPUT_SUBDIR,
   SKIP_DIRS,
@@ -130,7 +126,7 @@ import {
   UNTRUSTED_WEB_TAG,
   WORKER_HEARTBEAT_STALE_MS,
   WorkerAlreadyRunningError,
-  anchoredMarkerPattern,
+  applyIndexingPriority,
   auditClaudeMd,
   buildExtractiveCompact,
   buildLineDiff,
@@ -138,14 +134,11 @@ import {
   buildProjectMap,
   buildStats,
   capJsonRows,
+  commandHash,
   compactDoc,
   compactPathFor,
   confirmAndApply,
   contentHash,
-  copilotCliConfigPath,
-  copilotCliMcpToolsDir,
-  copilotCliScriptPath,
-  copilotCliUserRoot,
   detectWalkMode,
   dirtyQueuePathFor,
   docxOutline,
@@ -160,6 +153,7 @@ import {
   extractChecklistSection,
   extractCompactFromMarker,
   extractNamedSection,
+  fenceUntrusted,
   fenceUntrustedContent,
   fenceUntrustedOcrText,
   findClaudeMdFiles,
@@ -168,15 +162,16 @@ import {
   findMemSuggestionCandidates,
   findMemoryMd,
   findOrphanedChunkPaths,
-  findStrayClaudeMdBlocks,
   findSystemTempFiles,
   formatAge,
   formatCsvTable,
   formatMemSuggestions,
   formatProjectMap,
   formatXlsxRange,
+  getBashOutput,
   getContextPressure,
   getDirtyPathsFor,
+  getEmbeddingCoverage,
   getFileEntry,
   getHintStatsSummary,
   getHintStatsTotals,
@@ -184,34 +179,24 @@ import {
   getSessionFiles,
   getSessionId,
   getSkillFilePath,
-  groupHasTokenGoat,
+  getTrackedFiles,
   headSheet,
   incrementSkillHit,
   indexFileEmbeddings,
   indexFileSync,
   indexedPathSpellingIsStale,
-  installClaudeMd,
-  installCodex,
-  installCopilotCli,
-  installGrok,
-  installHooks,
-  installKimi,
-  installSkill,
-  installVscode,
+  injectionFencingEnabled,
   isAvailable,
-  isCodexInstalled,
   isCompactFresh,
-  isCopilotCliInstalled,
   isEmbedFresh,
   isEmbeddableDocument,
-  isGrokInstalled,
   isHintCategory,
-  isInstalled,
-  isKimiInstalled,
   isParseSkipEligible,
+  isRecallCacheType,
   isWorkerRunning,
   listBlobs,
   listOutputs,
+  listRecentRecall,
   listSheets,
   listSkills,
   loadBlob,
@@ -219,7 +204,7 @@ import {
   mapLookupBytesSaved,
   markCategoryEffective,
   markCategoryIneffective,
-  otherScopeHasManagedServer,
+  normalizeCommandForCacheKey,
   parseWhereSpecs,
   pptxNotesText,
   pptxOutline,
@@ -239,7 +224,8 @@ import {
   resetHintStats,
   runContextStats,
   runDetachedWorkerDaemon,
-  scanForInjectionPatterns,
+  scanAndRecord,
+  searchRecall,
   shrinkImage,
   skillOutputsDir,
   startDetachedWorker,
@@ -248,33 +234,32 @@ import {
   storeOutput,
   tokenGoatHome,
   trimToBudget,
-  uninstallClaudeMd,
-  uninstallCodex,
-  uninstallCopilotCli,
-  uninstallGrok,
-  uninstallHooks,
-  uninstallKimi,
-  uninstallSkill,
-  uninstallVscode,
   urlPolicyDenialReason,
-  vscodeDecoderConfigured,
+  visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-4OTIB7SB.mjs";
+} from "./token-goat-chunk-FDXINYK4.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
   ENV_KEYS,
   FILTERS,
   LOCK_WAIT_MS_HARDENED,
+  MATERIALIZE_SHRUNK_IMAGE_JS,
   RESET,
   VERSION,
   _useRichStats,
+  anchoredMarkerPattern,
   atomicWriteBytes,
   atomicWriteText,
   canonicalize,
+  cappedSourceBytesSaved,
   colorStdout,
   configPath,
+  copilotCliConfigPath,
+  copilotCliMcpToolsDir,
+  copilotCliScriptPath,
+  copilotCliUserRoot,
   countNoun,
   dataDir,
   decodeSource,
@@ -289,6 +274,7 @@ import {
   fg,
   fileIsAbsent,
   findProject,
+  findStrayClaudeMdBlocks,
   fingerprintContent,
   fingerprintFile,
   foldPath,
@@ -299,9 +285,24 @@ import {
   getLastProjectConfigParseError,
   getProjectConfigInfo,
   globalDbPath,
+  groupHasTokenGoat,
+  installClaudeMd,
+  installCodex,
+  installCopilotCli,
+  installGrok,
+  installHooks,
+  installKimi,
   installSingleFilePlugin,
+  installSkill,
+  installVscode,
   invalidateConfigCache,
+  isCodexInstalled,
+  isCopilotCliInstalled,
   isDotenvPath,
+  isGrokInstalled,
+  isInstalled,
+  isKimiInstalled,
+  isTestFile,
   isUnderBlockedRoot,
   isWindows,
   lastProjectConfigLockedKeys,
@@ -309,6 +310,7 @@ import {
   loadPersistedConfig,
   normalizeDarwinSystemAlias,
   normalizePath,
+  otherScopeHasManagedServer,
   pad,
   parse,
   pushAll,
@@ -336,14 +338,23 @@ import {
   summarize,
   toDisplayPath,
   toKB,
+  uninstallClaudeMd,
+  uninstallCodex,
+  uninstallCopilotCli,
+  uninstallGrok,
+  uninstallHooks,
+  uninstallKimi,
   uninstallSingleFilePlugin,
+  uninstallSkill,
+  uninstallVscode,
   validateEnumField,
   validateNumericField,
+  vscodeDecoderConfigured,
   withExtension,
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-E76UNTVK.mjs";
+} from "./token-goat-chunk-4ZDRTNGV.mjs";
 import {
   __export
 } from "./token-goat-chunk-AEX54RUZ.mjs";
@@ -3462,9 +3473,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path29) {
-    if (path29 === void 0) return this._executableDir;
-    this._executableDir = path29;
+  executableDir(path30) {
+    if (path30 === void 0) return this._executableDir;
+    this._executableDir = path30;
     return this;
   }
   /**
@@ -3764,7 +3775,7 @@ function attemptedCommandName(argv) {
 
 // src/cli.ts
 import * as fs28 from "fs";
-import * as path28 from "path";
+import * as path29 from "path";
 import { homedir as homedir13 } from "os";
 
 // src/walk_index.ts
@@ -5652,9 +5663,110 @@ function formatCues(cues) {
   return cues.map((cue) => `[${formatTimestamp(cue.startSeconds)}]${cue.speaker !== null ? ` ${cue.speaker}:` : ""} ${cue.text}`).join("\n");
 }
 
+// src/affected.ts
+import * as path9 from "node:path";
+var DEFAULT_AFFECTED_DEPTH = 5;
+function emit(text) {
+  const payload = colorStdout() ? text : stripAnsi(text);
+  process.stdout.write(ensureNewline(payload));
+}
+function emitErr(text) {
+  process.stderr.write(ensureNewline(text));
+}
+function computeAffected(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const depth = opts.depth ?? DEFAULT_AFFECTED_DEPTH;
+  const { files, importedBy } = buildImportGraph(cwd);
+  const trackedByFolded = /* @__PURE__ */ new Map();
+  for (const f of files) trackedByFolded.set(foldPath(normalizePath(f)), f);
+  const unknownSeeds = [];
+  let frontier = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of opts.files) {
+    const abs = normalizePath(path9.resolve(cwd, raw));
+    const tracked = trackedByFolded.get(foldPath(abs));
+    if (tracked === void 0) {
+      unknownSeeds.push(raw);
+      continue;
+    }
+    if (seen.has(tracked)) continue;
+    seen.add(tracked);
+    frontier.push(tracked);
+  }
+  let hops = 0;
+  while (frontier.length > 0 && hops < depth) {
+    const next = [];
+    for (const file of frontier) {
+      for (const importer of importedBy.get(file) ?? []) {
+        if (seen.has(importer)) continue;
+        seen.add(importer);
+        next.push(importer);
+      }
+    }
+    frontier = next;
+    hops++;
+  }
+  const depthLimited = frontier.length > 0;
+  const matcher = opts.filter === void 0 ? null : new RegExp(opts.filter);
+  const isAffectedTest = (f) => matcher === null ? isTestFile(f) : matcher.test(f);
+  const root = getDisplayRoot(cwd);
+  const testFiles = [...seen].filter(isAffectedTest).map((f) => toDisplayPath(root, f)).sort();
+  return {
+    testFiles,
+    reachedCount: seen.size,
+    unknownSeeds,
+    depthLimited,
+    unexploredAtFrontier: frontier.length,
+    depth
+  };
+}
+function runAffected(opts) {
+  if (opts.depth !== void 0 && opts.depth <= 0) {
+    emitErr(`--depth must be a positive number, got: ${opts.depth}`);
+    return 1;
+  }
+  if (opts.files.length === 0) {
+    emitErr("No changed files given. Pass paths as arguments, or pipe them in with --stdin.");
+    return 1;
+  }
+  if (opts.filter !== void 0) {
+    try {
+      new RegExp(opts.filter);
+    } catch (err2) {
+      emitErr(`--filter is not a valid regular expression: ${err2 instanceof Error ? err2.message : String(err2)}`);
+      return 1;
+    }
+  }
+  const result = computeAffected(opts);
+  if (opts.json === true) {
+    emit(JSON.stringify(result, null, 2));
+    return 0;
+  }
+  if (opts.quiet === true) {
+    for (const f of result.testFiles) emit(f);
+  } else if (result.testFiles.length === 0) {
+    const traced = opts.files.length - result.unknownSeeds.length;
+    if (traced === 0) {
+      emit(`Nothing could be traced: ${result.unknownSeeds.length === 1 ? "the file given is not tracked" : "none of the files given are tracked"} in this project.`);
+    } else {
+      emit(`No test files import ${countNoun(traced, "changed file")} (within ${countNoun(result.depth, "hop")}).`);
+    }
+  } else {
+    emit(`${countNoun(result.testFiles.length, "affected test file")} (${countNoun(result.reachedCount, "file")} reached within ${countNoun(result.depth, "hop")}):`);
+    for (const f of result.testFiles) emit(`  ${f}`);
+  }
+  if (result.unknownSeeds.length > 0) {
+    emitErr(`Not tracked in this project, so nothing was traced from ${result.unknownSeeds.length === 1 ? "it" : "them"}: ${result.unknownSeeds.join(", ")}`);
+  }
+  if (result.depthLimited) {
+    emitErr(`Stopped at --depth ${result.depth} with ${countNoun(result.unexploredAtFrontier, "file")} still unexplored; more tests may be affected (raise --depth).`);
+  }
+  return 0;
+}
+
 // src/purge.ts
 import * as fs10 from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 function directorySize(root) {
   let total = 0;
   let entries;
@@ -5664,7 +5776,7 @@ function directorySize(root) {
     return 0;
   }
   for (const entry of entries) {
-    const full = path9.join(root, entry.name);
+    const full = path10.join(root, entry.name);
     if (entry.isDirectory()) {
       total += directorySize(full);
       continue;
@@ -5707,7 +5819,7 @@ function formatBytes2(bytes) {
 
 // src/cli_stats.ts
 import * as fs11 from "node:fs";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 function writeRaw(text) {
   const payload = colorStdout() ? text : stripAnsi(text);
   process.stdout.write(ensureNewline(payload));
@@ -5719,7 +5831,7 @@ function formatTopFiles(ranked) {
   if (ranked.length === 0) return "";
   const lines = ["Top files this session:"];
   for (const { path: filePath, count } of ranked) {
-    const basename8 = path10.basename(filePath);
+    const basename8 = path11.basename(filePath);
     lines.push(`  ${count.toString().padStart(3)}x  ${basename8}  (${filePath})`);
   }
   return lines.join("\n");
@@ -5736,12 +5848,12 @@ function renderTopSessionFiles(topN = 5) {
 }
 function renderTopSessionFilesFromDisk(topN = 5, overrideSessionsDir) {
   try {
-    const sessionsDir = overrideSessionsDir ?? path10.join(dataDir(), "sessions");
+    const sessionsDir = overrideSessionsDir ?? path11.join(dataDir(), "sessions");
     if (!fs11.existsSync(sessionsDir)) return "";
-    const files = fs11.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, mtime: fs11.statSync(path10.join(sessionsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(0, 3);
+    const files = fs11.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, mtime: fs11.statSync(path11.join(sessionsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(0, 3);
     for (const { name } of files) {
       try {
-        const raw = fs11.readFileSync(path10.join(sessionsDir, name), "utf-8");
+        const raw = fs11.readFileSync(path11.join(sessionsDir, name), "utf-8");
         const data = JSON.parse(raw);
         const filesList = data["files"];
         if (!Array.isArray(filesList)) continue;
@@ -5761,8 +5873,8 @@ function renderTopSessionFilesFromDisk(topN = 5, overrideSessionsDir) {
 var METHODOLOGY = {
   estimate_scope: "Local estimate of content avoided or reduced by token-goat.",
   billing: "They are not GitHub Copilot usage, provider-reported token consumption, or billing data.",
-  byte_derived_formula: "Most read, hook, and command entries go through savedTokensFromBytes in src/stats.ts, which is Math.round(bytes_saved / 4).",
-  filter_estimates: "Output compressors record their filter-calculated delta; image entries use the byte-derived approximation unless the source provides a narrower estimate.",
+  byte_derived_formula: "Most read, hook, and command entries go through savedTokensFromBytes in src/stats.ts, which is Math.round(bytes_saved / 4). Image entries are the exception: they are priced in visual tokens, not bytes.",
+  filter_estimates: "Output compressors record their filter-calculated delta, measured against what the harness would actually have delivered rather than the full command output. Image entries are priced in visual tokens (28x28-pixel patches, capped at the configured vision tier), because an image is not billed by its byte size; where the pixel dimensions are unavailable the tier ceiling is used.",
   advisory_events: "Zero-byte, zero-token advisory events show that guidance fired, not that an agent followed it.",
   audit: "Use stats --full or stats --json for source and command breakdowns; reconcile billing with provider-exported usage data."
 };
@@ -5830,12 +5942,12 @@ function runStats(opts = {}) {
 // src/cli_doctor.ts
 import * as fs12 from "fs";
 import * as os8 from "os";
-import * as path11 from "path";
+import * as path12 from "path";
 import { execSync, spawnSync as spawnSync2 } from "child_process";
 function globalMcpConfigPath() {
   const copilotHome = process.env["COPILOT_HOME"];
-  const root = copilotHome !== void 0 && copilotHome.trim() !== "" ? path11.resolve(copilotHome) : path11.join(os8.homedir(), ".copilot");
-  return path11.join(root, "mcp-config.json");
+  const root = copilotHome !== void 0 && copilotHome.trim() !== "" ? path12.resolve(copilotHome) : path12.join(os8.homedir(), ".copilot");
+  return path12.join(root, "mcp-config.json");
 }
 function checkGlobalMcpConfig(configPath2 = globalMcpConfigPath()) {
   if (!fs12.existsSync(configPath2)) {
@@ -5952,7 +6064,7 @@ function checkWorkerRunning(dataDir2) {
 }
 var DB_SIZE_WARN_BYTES = 1024 * 1024 * 1024;
 function checkDbExists(dataDir2) {
-  const dbPath = path11.join(dataDir2, "global.db");
+  const dbPath = path12.join(dataDir2, "global.db");
   if (!fs12.existsSync(dbPath)) {
     return {
       name: "Database",
@@ -6027,6 +6139,42 @@ function checkSymbolCount(dbPath, rootDir) {
     };
   }
 }
+var EMBED_COVERAGE_WARN_FRACTION = 0.25;
+function checkEmbeddingCoverage(dbPath, rootDir) {
+  if (!fs12.existsSync(dbPath)) {
+    return { name: "Embedding coverage", status: "ok", message: "no database yet" };
+  }
+  const cfg = loadConfig();
+  if (!cfg.indexing.embeddings_enabled) {
+    return { name: "Embedding coverage", status: "ok", message: "disabled (indexing.embeddings_enabled = false)" };
+  }
+  try {
+    const { indexedFiles, embeddedFiles } = getEmbeddingCoverage(dbPath, rootDir);
+    if (indexedFiles === 0) {
+      return { name: "Embedding coverage", status: "ok", message: "no indexed files yet" };
+    }
+    const pct2 = Math.round(embeddedFiles / indexedFiles * 100);
+    const sizeKb = cfg.indexing.large_file_symbol_only_kb;
+    if (embeddedFiles / indexedFiles < EMBED_COVERAGE_WARN_FRACTION) {
+      return {
+        name: "Embedding coverage",
+        status: "warn",
+        message: `only ${embeddedFiles} of ${indexedFiles} indexed file(s) (${pct2}%) have embeddings \u2014 'semantic' searches those files only, and reports finding nothing in the same words it uses after searching everything. Files over indexing.large_file_symbol_only_kb (currently ${sizeKb} KB) are indexed for symbols only and are the usual reason; raise it with 'token-goat config set indexing.large_file_symbol_only_kb <KB>' and re-embed with 'token-goat index --force' to widen coverage. Exact symbol lookups are unaffected`
+      };
+    }
+    return {
+      name: "Embedding coverage",
+      status: "ok",
+      message: `${embeddedFiles} of ${indexedFiles} indexed file(s) (${pct2}%) have embeddings`
+    };
+  } catch (err2) {
+    return {
+      name: "Embedding coverage",
+      status: "warn",
+      message: `could not query embedding coverage: ${extractErrorMessage(err2)}`
+    };
+  }
+}
 var DIRTY_QUEUE_BACKLOG_WARN_THRESHOLD = 500;
 function checkDirtyQueueHealth(dataDir2) {
   let pendingCount = 0;
@@ -6387,14 +6535,15 @@ function runDoctor(dataDir2, configPath2, rootDir, processes) {
   results.push(checkStrayClaudeMdBlocks());
   results.push(checkWorkerRunning(actualDataDir) ? { name: "Worker", status: "ok", message: "running" } : { name: "Worker", status: "warn", message: "not running" });
   results.push(checkDbExists(actualDataDir));
-  results.push(checkSymbolBodySize(path11.join(actualDataDir, "global.db")));
-  results.push(checkSymbolCount(path11.join(actualDataDir, "global.db"), rootDir));
+  results.push(checkSymbolBodySize(path12.join(actualDataDir, "global.db")));
+  results.push(checkSymbolCount(path12.join(actualDataDir, "global.db"), rootDir));
   results.push(checkDirtyQueueHealth(actualDataDir));
-  results.push(checkCompactionChannel(path11.join(actualDataDir, "global.db")));
-  results.push(checkUnmappedTools(path11.join(actualDataDir, "global.db")));
+  results.push(checkCompactionChannel(path12.join(actualDataDir, "global.db")));
+  results.push(checkUnmappedTools(path12.join(actualDataDir, "global.db")));
   const actualConfigPath = configPath2 || configPath();
   results.push(checkConfigValid(actualConfigPath));
   results.push(checkEmbeddings(loadConfig(rootDir)));
+  results.push(checkEmbeddingCoverage(path12.join(actualDataDir, "global.db"), rootDir));
   for (const result of checkSecurityPosture(loadConfig(rootDir), actualDataDir)) results.push(result);
   results.push(checkDiskSpace(actualDataDir));
   const copilotResult = checkCopilotCli(copilotCliConfigPath(), copilotCliScriptPath());
@@ -6435,7 +6584,7 @@ async function runDoctorAndExit(opts) {
     console.log();
     try {
       const dir = skillOutputsDir();
-      const pregenPath = path11.join(dir, "pregen.json");
+      const pregenPath = path12.join(dir, "pregen.json");
       if (fs12.existsSync(pregenPath)) {
         const content = JSON.parse(fs12.readFileSync(pregenPath, "utf-8"));
         const pregenNames = new Set(content.names || []);
@@ -6445,7 +6594,7 @@ async function runDoctorAndExit(opts) {
           for (const entry of entries) {
             if (!entry.isFile() || !entry.name.endsWith(".meta")) continue;
             try {
-              const meta = JSON.parse(fs12.readFileSync(path11.join(dir, entry.name), "utf-8"));
+              const meta = JSON.parse(fs12.readFileSync(path12.join(dir, entry.name), "utf-8"));
               if (meta.skillName && !pregenNames.has(meta.skillName)) {
                 skillsSeen.add(meta.skillName);
               }
@@ -6472,7 +6621,7 @@ import { existsSync as existsSync7, readdirSync as readdirSync5, statSync as sta
 import * as http from "http";
 import * as https from "https";
 import { isIPv4, isIPv6 } from "net";
-import { resolve as resolve4, join as join10 } from "path";
+import { resolve as resolve5, join as join10 } from "path";
 import { URL as URL2 } from "url";
 import { promisify } from "util";
 import { lookup as dnsLookup } from "dns";
@@ -6661,7 +6810,7 @@ function cleanupStaleDownloads() {
     const files = readdirSync5(cacheDir);
     for (const file of files) {
       if (file.endsWith(".tmp")) {
-        const filePath = resolve4(cacheDir, file);
+        const filePath = resolve5(cacheDir, file);
         try {
           const stat = statSync4(filePath);
           if (Date.now() - stat.mtimeMs < STALE_DOWNLOAD_AGE_MS) continue;
@@ -6927,7 +7076,7 @@ async function getSectionContent(fileId, heading, opts = {}) {
 
 // src/pack.ts
 import * as fs13 from "node:fs";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 
 // node_modules/minimatch/dist/esm/index.js
 var esm_exports = {};
@@ -8051,11 +8200,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path12 = {
+var path13 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep2 = defaultPlatform === "win32" ? path12.win32.sep : path12.posix.sep;
+var sep2 = defaultPlatform === "win32" ? path13.win32.sep : path13.posix.sep;
 minimatch.sep = sep2;
 var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -8840,7 +8989,7 @@ var LANG_MAP = {
   ".exs": "elixir"
 };
 function getLang(filePath) {
-  const ext2 = path13.extname(filePath).toLowerCase();
+  const ext2 = path14.extname(filePath).toLowerCase();
   return LANG_MAP[ext2] ?? "";
 }
 function matches(rel, patterns) {
@@ -8850,8 +8999,8 @@ function matches(rel, patterns) {
   return patterns.some((pat) => mm.minimatch(norm, pat) || mm.minimatch(base, pat));
 }
 function isPathWithinRoot(rootReal, resolvedPath) {
-  const rel = path13.relative(rootReal, resolvedPath);
-  return rel !== "" && rel !== ".." && !rel.startsWith(".." + path13.sep) && !path13.isAbsolute(rel);
+  const rel = path14.relative(rootReal, resolvedPath);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + path14.sep) && !path14.isAbsolute(rel);
 }
 function openWithinRoot(rootReal, p) {
   let fd;
@@ -8891,11 +9040,11 @@ function openWithinRoot(rootReal, p) {
 }
 function* resolveOpenCandidates(projectRoot, patterns, rootReal, ignorePatterns, seen, skipped) {
   for (const pattern of patterns) {
-    const p = path13.isAbsolute(pattern) ? pattern : path13.join(projectRoot, pattern);
+    const p = path14.isAbsolute(pattern) ? pattern : path14.join(projectRoot, pattern);
     if (seen.has(p)) continue;
     let rel;
     try {
-      rel = path13.relative(projectRoot, p).replace(/\\/g, "/");
+      rel = path14.relative(projectRoot, p).replace(/\\/g, "/");
     } catch {
       skipped.push(`${p} (outside project root)`);
       continue;
@@ -8969,7 +9118,7 @@ function stripBlockComments(content, pattern, lineStates) {
   );
 }
 function stripComments(content, filePath) {
-  const ext2 = path13.extname(filePath).toLowerCase();
+  const ext2 = path14.extname(filePath).toLowerCase();
   const lineStates = computeLineStartQuoteStates(content);
   if (ext2 === ".py") {
     return stripLineComments(content, PY_LINE_COMMENT_RE, lineStates);
@@ -9007,7 +9156,7 @@ var SAFE_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp
 function scanSecrets(files) {
   const hits = [];
   for (const pf of files) {
-    if (SAFE_EXTS.has(path13.extname(pf.path).toLowerCase())) {
+    if (SAFE_EXTS.has(path14.extname(pf.path).toLowerCase())) {
       continue;
     }
     for (const [lineno, line] of pf.content.split("\n").entries()) {
@@ -9030,7 +9179,7 @@ function scanSecrets(files) {
 function collectFiles(projectRoot, patterns, opts = {}) {
   const result = { files: [], skipped: [], total_lines: 0, total_tokens: 0 };
   const seen = /* @__PURE__ */ new Set();
-  const rootResolved = path13.resolve(projectRoot);
+  const rootResolved = path14.resolve(projectRoot);
   let rootReal;
   try {
     rootReal = fs13.realpathSync(rootResolved);
@@ -9205,7 +9354,7 @@ function formatPack(result, style, opts = {}) {
 function estimateBudget(projectRoot, patterns, opts = {}) {
   const result = { entries: [], skipped: [], total_lines: 0, total_tokens: 0 };
   const seen = /* @__PURE__ */ new Set();
-  const rootResolved = path13.resolve(projectRoot);
+  const rootResolved = path14.resolve(projectRoot);
   let rootReal;
   try {
     rootReal = fs13.realpathSync(rootResolved);
@@ -9702,7 +9851,7 @@ function formatFailureDeltaJson(delta, runner) {
 
 // src/failures_state.ts
 import * as fs14 from "node:fs";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 var KEY_RE = /^[A-Za-z0-9_-]{1,80}$/;
 var DEFAULT_FAILURES_STATE_KEY = "default";
 function validateKey(key) {
@@ -9714,7 +9863,7 @@ function validateKey(key) {
 }
 function failuresStatePath(projectHash, key) {
   validateKey(key);
-  return path14.join(dataDir(), "projects", `${projectHash}_failures_${key}.json`);
+  return path15.join(dataDir(), "projects", `${projectHash}_failures_${key}.json`);
 }
 function loadFailureSnapshot(projectHash, key) {
   const p = failuresStatePath(projectHash, key);
@@ -9735,7 +9884,7 @@ function loadFailureSnapshot(projectHash, key) {
 }
 function saveFailureSnapshot(projectHash, key, snapshot) {
   const p = failuresStatePath(projectHash, key);
-  const dir = path14.dirname(p);
+  const dir = path15.dirname(p);
   ensureDirSync(dir);
   const content = JSON.stringify(snapshot);
   const doSave = () => {
@@ -9747,18 +9896,18 @@ function saveFailureSnapshot(projectHash, key, snapshot) {
 
 // src/text_commands.ts
 import * as fs16 from "fs";
-import * as path16 from "path";
+import * as path17 from "path";
 
 // src/project_memory.ts
 import * as fs15 from "node:fs";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 var MAX_ENTRIES = 30;
 var KEY_RE2 = /^[A-Za-z0-9_-]{1,80}$/;
 function ordinal(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
 }
 function memoryPath(projectHash) {
-  return path15.join(dataDir(), "projects", `${projectHash}_memory.toml`);
+  return path16.join(dataDir(), "projects", `${projectHash}_memory.toml`);
 }
 function validateKey2(key) {
   if (!KEY_RE2.test(key)) {
@@ -9817,7 +9966,7 @@ function save(filePath, entries) {
     lines.push(`${k} = "${escaped}"`);
   }
   const content = lines.length > 0 ? lines.join("\n") + "\n" : "";
-  const dir = path15.dirname(filePath);
+  const dir = path16.dirname(filePath);
   ensureDirSync(dir);
   atomicWriteText(filePath, content);
 }
@@ -9827,7 +9976,7 @@ function loadEntries(projectHash) {
 function setEntry(projectHash, key, value) {
   validateKey2(key);
   const p = memoryPath(projectHash);
-  const dir = path15.dirname(p);
+  const dir = path16.dirname(p);
   ensureDirSync(dir);
   const doSet = () => {
     const entries = loadRaw(p);
@@ -9925,7 +10074,7 @@ function collectTodoFiles(patterns) {
   if (patterns.length > 0) {
     const results = [];
     for (const p of patterns) {
-      const abs = path16.resolve(p);
+      const abs = path17.resolve(p);
       try {
         const stat = fs16.statSync(abs);
         if (stat.isDirectory()) {
@@ -10196,7 +10345,7 @@ function isProjectFrame(framePath, cwd) {
   if (framePath.includes("/rustc/")) return false;
   if (framePath.includes(".cargo/registry") || framePath.includes(".cargo\\registry")) return false;
   if (/^<.+>$/.test(framePath)) return false;
-  if (!path16.isAbsolute(framePath) && !framePath.startsWith("..")) return true;
+  if (!path17.isAbsolute(framePath) && !framePath.startsWith("..")) return true;
   return false;
 }
 function resolveFrameSymbol(frame, projectRoot) {
@@ -10366,14 +10515,23 @@ function applyFiltersAndFold(lines, noNormalize, foldRepeats) {
 }
 function cmdLogfold(src, opts) {
   const text = readInput(src);
-  let lines = splitLines(text);
+  const rawLines = splitLines(text);
+  const allLines = rawLines.length > 1 && rawLines[rawLines.length - 1] === "" ? rawLines.slice(0, -1) : rawLines;
+  let lines = allLines;
   if (opts.tail !== void 0) {
     const n = requireNonNegativeStrictInt("--tail", opts.tail);
     lines = lines.slice(Math.max(0, lines.length - n));
   }
+  const inputLines = allLines.length;
+  const shownLines = lines.length;
+  const truncated = shownLines < inputLines;
   const folded = applyFiltersAndFold(lines, opts.noNormalize === true, opts.foldRepeats === true);
+  if (truncated) {
+    process.stderr.write(`Showing last ${shownLines} of ${inputLines} lines (raise --tail to see more).
+`);
+  }
   if (opts.json === true) {
-    process.stdout.write(JSON.stringify({ lines: folded }, null, 2) + "\n");
+    process.stdout.write(JSON.stringify({ lines: folded, truncated, inputLines, shownLines }, null, 2) + "\n");
     return;
   }
   for (const item of folded) {
@@ -10400,17 +10558,17 @@ function findLockfile(startPath) {
   if (stat !== void 0 && stat.isFile()) {
     return { file: startPath, others: [] };
   }
-  const dir = stat !== void 0 && stat.isDirectory() ? startPath : path16.dirname(startPath);
+  const dir = stat !== void 0 && stat.isDirectory() ? startPath : path17.dirname(startPath);
   const found = [];
   for (const name of LOCK_PRIORITY) {
-    const candidate = path16.join(dir, name);
+    const candidate = path17.join(dir, name);
     if (fs16.existsSync(candidate)) found.push(candidate);
   }
   try {
     const entries = fs16.readdirSync(dir);
     for (const e of entries) {
       if (/^requirements.*\.txt$/.test(e)) {
-        const p = path16.join(dir, e);
+        const p = path17.join(dir, e);
         if (!found.includes(p)) found.push(p);
       }
     }
@@ -10607,7 +10765,7 @@ function parsePnpmLock(content) {
   return deps;
 }
 function parseLockFile(filePath) {
-  const base = path16.basename(filePath);
+  const base = path17.basename(filePath);
   const content = fs16.readFileSync(filePath, "utf8");
   if (base === "package-lock.json") return { format: "npm", deps: parsePackageLockJson(content) };
   if (base === "yarn.lock") return { format: "yarn", deps: parseYarnLock(content) };
@@ -10723,7 +10881,7 @@ Depended on by direct/top-level deps (${dependedOnBy.length}):
 `);
 }
 function cmdLockdeps(filePath, opts) {
-  const target = filePath !== void 0 ? path16.resolve(filePath) : process.cwd();
+  const target = filePath !== void 0 ? path17.resolve(filePath) : process.cwd();
   const found = findLockfile(target);
   if (found === null) {
     throw new Error("No lockfile found. Expected one of: " + LOCK_PRIORITY.join(", ") + ", requirements*.txt");
@@ -10811,7 +10969,7 @@ function cmdNote(action, key, value, opts) {
   throw new Error(`Unknown note action: ${action}. Use: set, get, unset, list, clear`);
 }
 function loadAllSessionReadCounts() {
-  const sessionsDir = path16.join(tokenGoatHome(), "sessions");
+  const sessionsDir = path17.join(tokenGoatHome(), "sessions");
   const totals = /* @__PURE__ */ new Map();
   let entries;
   try {
@@ -10821,7 +10979,7 @@ function loadAllSessionReadCounts() {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const filePath = path16.join(sessionsDir, entry.name);
+    const filePath = path17.join(sessionsDir, entry.name);
     let raw;
     try {
       raw = JSON.parse(fs16.readFileSync(filePath, "utf8"));
@@ -10859,9 +11017,11 @@ function cmdHot(opts) {
     }
   }
   entries.sort((a, b) => b.readCount - a.readCount);
+  const eligibleCount = entries.length;
   entries = entries.slice(0, limit);
+  const truncated = entries.length < eligibleCount;
   if (opts.json === true) {
-    process.stdout.write(JSON.stringify({ entries }, null, 2) + "\n");
+    process.stdout.write(JSON.stringify({ entries, truncated, totalCount: eligibleCount }, null, 2) + "\n");
     return;
   }
   if (entries.length === 0) {
@@ -10877,6 +11037,10 @@ function cmdHot(opts) {
   const hotDisplayRoot = getDisplayRoot();
   for (const e of entries) {
     process.stdout.write(`${e.readCount}	${toDisplayPath(hotDisplayRoot, e.path)}
+`);
+  }
+  if (truncated) {
+    process.stdout.write(`...and ${eligibleCount - entries.length} more (raise --limit to see them).
 `);
   }
 }
@@ -10951,7 +11115,7 @@ function cmdIgnores(opts) {
 }
 function countPackIgnorePatterns(root) {
   try {
-    return fs16.readFileSync(path16.join(root, ".tokengoatignore"), "utf8").split("\n").map((ln) => ln.trim()).filter((ln) => ln.length > 0 && !ln.startsWith("#")).length;
+    return fs16.readFileSync(path17.join(root, ".tokengoatignore"), "utf8").split("\n").map((ln) => ln.trim()).filter((ln) => ln.length > 0 && !ln.startsWith("#")).length;
   } catch {
     return 0;
   }
@@ -10960,7 +11124,7 @@ function countPackIgnorePatterns(root) {
 // src/dep_docs.ts
 import { createRequire } from "node:module";
 import * as fs17 from "node:fs";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 var _require = createRequire(import.meta.url);
 var _ts = null;
 var _tsLoadAttempted = false;
@@ -11011,7 +11175,7 @@ function listInstalledPackageNames(nodeModulesDir) {
     if (entry.name.startsWith("@")) {
       let scoped;
       try {
-        scoped = fs17.readdirSync(path17.join(nodeModulesDir, entry.name), { withFileTypes: true });
+        scoped = fs17.readdirSync(path18.join(nodeModulesDir, entry.name), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -11028,7 +11192,7 @@ var README_NAME_RE = /^readme(\.(md|markdown|txt))?$/i;
 function findReadmeFile(pkgDir) {
   const direct = findReadmeIn(pkgDir);
   if (direct !== null) return direct;
-  return findReadmeIn(path17.join(pkgDir, "docs"));
+  return findReadmeIn(path18.join(pkgDir, "docs"));
 }
 function findReadmeIn(dir) {
   let entries;
@@ -11045,7 +11209,7 @@ function findReadmeIn(dir) {
     return 1;
   };
   matches2.sort((a, b) => rank(a.name) - rank(b.name));
-  return path17.join(dir, matches2[0].name);
+  return path18.join(dir, matches2[0].name);
 }
 function typesPackageDirName(pkgName) {
   if (pkgName.startsWith("@")) {
@@ -11072,30 +11236,30 @@ function resolveTypesLocation(pkgDir, pkgJson, nodeModulesDir, pkgName) {
   if (declared !== void 0) {
     const candidates = [declared, declared.endsWith(".d.ts") ? declared : `${declared}.d.ts`, declared.replace(/\.[cm]?[jt]s$/, ".d.ts")];
     for (const c of candidates) {
-      const p = path17.join(pkgDir, c);
+      const p = path18.join(pkgDir, c);
       if (fileExists(p)) return { path: p, source: "bundled" };
     }
   }
   const main = typeof pkgJson["main"] === "string" ? pkgJson["main"] : "index.js";
-  const mainDts = path17.join(pkgDir, main.replace(/\.[cm]?js$/, ".d.ts"));
+  const mainDts = path18.join(pkgDir, main.replace(/\.[cm]?js$/, ".d.ts"));
   if (fileExists(mainDts)) return { path: mainDts, source: "bundled" };
-  const indexDts = path17.join(pkgDir, "index.d.ts");
+  const indexDts = path18.join(pkgDir, "index.d.ts");
   if (fileExists(indexDts)) return { path: indexDts, source: "bundled" };
   const typesDirName = typesPackageDirName(pkgName);
-  const typesPkgDir = path17.join(nodeModulesDir, "@types", typesDirName);
-  const typesPkgJsonRaw = readFileTextOrNull(path17.join(typesPkgDir, "package.json"));
+  const typesPkgDir = path18.join(nodeModulesDir, "@types", typesDirName);
+  const typesPkgJsonRaw = readFileTextOrNull(path18.join(typesPkgDir, "package.json"));
   if (typesPkgJsonRaw !== null) {
     try {
       const typesPkgJson = JSON.parse(typesPkgJsonRaw);
       const entry = (typeof typesPkgJson["types"] === "string" ? typesPkgJson["types"] : void 0) ?? (typeof typesPkgJson["main"] === "string" ? typesPkgJson["main"] : void 0) ?? "index.d.ts";
       const entryCandidates = [entry, entry.endsWith(".d.ts") ? entry : `${entry}.d.ts`, entry.replace(/\.[cm]?[jt]s$/, ".d.ts")];
       for (const c of entryCandidates) {
-        const entryPath = path17.join(typesPkgDir, c);
+        const entryPath = path18.join(typesPkgDir, c);
         if (fileExists(entryPath)) return { path: entryPath, source: "@types" };
       }
     } catch {
     }
-    const fallback = path17.join(typesPkgDir, "index.d.ts");
+    const fallback = path18.join(typesPkgDir, "index.d.ts");
     if (fileExists(fallback)) return { path: fallback, source: "@types" };
   }
   return null;
@@ -11162,9 +11326,9 @@ function recordDepDocsStat(fullSourceBytes, emittedText, packageName) {
 }
 function runDepDocs(opts) {
   const root = resolveProjectRoot({ project: opts.projectRoot ?? process.cwd() });
-  const nodeModulesDir = path17.join(root, "node_modules");
-  const pkgDir = path17.join(nodeModulesDir, opts.packageName);
-  const pkgJsonPath = path17.join(pkgDir, "package.json");
+  const nodeModulesDir = path18.join(root, "node_modules");
+  const pkgDir = path18.join(nodeModulesDir, opts.packageName);
+  const pkgJsonPath = path18.join(pkgDir, "package.json");
   if (!dirExists(pkgDir) || !fileExists(pkgJsonPath)) {
     const known = listInstalledPackageNames(nodeModulesDir);
     const suggestions = suggestPackageNames(opts.packageName, known);
@@ -11327,20 +11491,27 @@ async function buildResumePacket(sessionId) {
 }
 
 // src/cache_session_commands.ts
-function emitErr(text) {
+function emitErr2(text) {
   process.stderr.write(ensureNewline(text));
 }
+function capAndNote(rows, limit) {
+  const shown = rows.slice(0, limit);
+  if (shown.length < rows.length) {
+    emitErr2(`Showing ${shown.length} of ${rows.length} entries (raise --limit to see the rest).`);
+  }
+  return shown;
+}
 function parseLimitOpt(cmdName, limitStr, dflt = 30) {
   if (limitStr === void 0) return dflt;
   let n;
   try {
     n = requireNonNegativeStrictInt("--limit", limitStr);
   } catch (e) {
-    emitErr(`${cmdName}: --limit must be a positive number, got: "${limitStr}"`);
+    emitErr2(`${cmdName}: --limit must be a positive number, got: "${limitStr}"`);
     throw new Error(`invalid --limit: ${limitStr}`, { cause: e });
   }
   if (n === 0) {
-    emitErr(`${cmdName}: --limit must be a positive number, got: "${limitStr}"`);
+    emitErr2(`${cmdName}: --limit must be a positive number, got: "${limitStr}"`);
     throw new Error(`invalid --limit: ${limitStr}`);
   }
   return n;
@@ -11369,7 +11540,7 @@ function getNewestSessionFiles() {
 function cmdBashHistory(opts) {
   const limit = parseLimitOpt("bash-history", opts.limit);
   const blobs = listBlobs(BASH_OUTPUT_SUBDIR);
-  const items = blobs.map(({ id, mtime, value }) => {
+  const allItems = blobs.map(({ id, mtime, value }) => {
     if (typeof value !== "object" || value === null) return null;
     const v = value;
     return {
@@ -11379,7 +11550,8 @@ function cmdBashHistory(opts) {
       exitCode: typeof v["exitCode"] === "number" ? v["exitCode"] : -1,
       sizeBytes: typeof v["sizeBytes"] === "number" ? v["sizeBytes"] : 0
     };
-  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt);
+  const items = capAndNote(allItems, limit);
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -11400,7 +11572,7 @@ function cmdBashHistory(opts) {
 function cmdWebHistory(opts) {
   const limit = parseLimitOpt("web-history", opts.limit);
   const blobs = listBlobs(WEB_OUTPUT_SUBDIR);
-  const items = blobs.map(({ id, mtime, value }) => {
+  const allItems = blobs.map(({ id, mtime, value }) => {
     if (typeof value !== "object" || value === null) return null;
     const v = value;
     return {
@@ -11409,7 +11581,8 @@ function cmdWebHistory(opts) {
       bytes: typeof v["content"] === "string" ? Buffer.byteLength(v["content"], "utf8") : 0,
       storedAt: mtime
     };
-  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt);
+  const items = capAndNote(allItems, limit);
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -11428,7 +11601,7 @@ function cmdWebHistory(opts) {
 function cmdMcpHistory(opts) {
   const limit = parseLimitOpt("mcp-history", opts.limit);
   const blobs = listBlobs(BASH_OUTPUT_SUBDIR).filter((b) => b.id.startsWith("mcp_"));
-  const items = blobs.map(({ id, mtime, value }) => {
+  const allItems = blobs.map(({ id, mtime, value }) => {
     if (typeof value !== "object" || value === null) return null;
     const v = value;
     const command = typeof v["command"] === "string" ? v["command"] : "";
@@ -11439,7 +11612,8 @@ function cmdMcpHistory(opts) {
       storedAt: typeof v["storedAt"] === "number" ? v["storedAt"] : mtime,
       sizeBytes: typeof v["sizeBytes"] === "number" ? v["sizeBytes"] : 0
     };
-  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  }).filter((x) => x !== null).sort((a, b) => b.storedAt - a.storedAt);
+  const items = capAndNote(allItems, limit);
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
@@ -11671,7 +11845,7 @@ function cmdBaseline(opts) {
 
 // src/index_reclaim.ts
 import * as fs18 from "node:fs";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 var DERIVED_TABLES = ["chunk_vectors", "chunks", "refs", "symbols", "files"];
 function indexSizeBytes(dbPath) {
   let total = 0;
@@ -11755,7 +11929,7 @@ function mb(bytes) {
 }
 function cmdReclaimIndex(opts) {
   const dbPath = opts.dbPath ?? globalDbPath();
-  if (opts.force !== true && isWorkerRunning(path18.dirname(dbPath))) {
+  if (opts.force !== true && isWorkerRunning(path19.dirname(dbPath))) {
     throw new Error(
       "reclaim-index: the worker daemon is running and writing to this index. Stop it first with 'token-goat worker stop', then re-run. Pass --force to proceed anyway (results may be inaccurate if the worker is really live)."
     );
@@ -11789,7 +11963,7 @@ function cmdReclaimIndex(opts) {
   }
   if (result.checkpointBusy) {
     process.stdout.write(
-      `  note: a concurrent reader blocked WAL truncation, so some space is still held in ${path18.basename(dbPath)}-wal and the figures above count the main file only. The next checkpoint releases it
+      `  note: a concurrent reader blocked WAL truncation, so some space is still held in ${path19.basename(dbPath)}-wal and the figures above count the main file only. The next checkpoint releases it
 `
     );
   }
@@ -11798,16 +11972,16 @@ function cmdReclaimIndex(opts) {
 // src/config_commands.ts
 import * as fs19 from "node:fs";
 import * as os9 from "node:os";
-import * as path19 from "node:path";
-function emit(text) {
+import * as path20 from "node:path";
+function emit2(text) {
   const payload = colorStdout() ? text : stripAnsi(text);
   process.stdout.write(ensureNewline(payload));
 }
-function emitErr2(text) {
+function emitErr3(text) {
   process.stderr.write(ensureNewline(text));
 }
 function saveConfigSafe(cfg) {
-  ensureDirSync(path19.dirname(configPath()));
+  ensureDirSync(path20.dirname(configPath()));
   saveConfig(cfg);
 }
 function levenshtein(a, b, cap = 3) {
@@ -11969,16 +12143,16 @@ function cmdConfig(opts) {
         if (state.layer !== "global" && state.layer !== "project-unparsed") sources[k] = layerJson(state);
       }
       if (Object.keys(sources).length > 0) payload["_sources"] = sources;
-      emit(JSON.stringify(payload, null, 2));
+      emit2(JSON.stringify(payload, null, 2));
       return;
     }
     for (const [k, v] of pairs) {
       const state = resolveConfigKeyLayer(k, v, cfg, projectInfo);
-      emit(`${k} = ${JSON.stringify(v)}${state.layer === "project-unparsed" ? "" : layerAnnotation(state)}`);
+      emit2(`${k} = ${JSON.stringify(v)}${state.layer === "project-unparsed" ? "" : layerAnnotation(state)}`);
     }
     if (projectInfo !== null) {
-      emit("");
-      emit(
+      emit2("");
+      emit2(
         projectInfo.parseError !== null ? `# project override ${projectInfo.path} failed to parse (${projectInfo.parseError}); ignored` : `# project override: ${projectInfo.path}`
       );
     }
@@ -11996,11 +12170,11 @@ function cmdConfig(opts) {
     }
     const getState = resolveConfigKeyLayer(opts.key, result.value, cfg, getProjectConfigInfo());
     if (opts.json === true) {
-      emit(JSON.stringify({ key: opts.key, value: result.value, ...layerJson(getState) }, null, 2));
+      emit2(JSON.stringify({ key: opts.key, value: result.value, ...layerJson(getState) }, null, 2));
       return;
     }
     const rendered = typeof result.value === "string" ? result.value : JSON.stringify(result.value);
-    emit(`${rendered}${layerAnnotation(getState)}`);
+    emit2(`${rendered}${layerAnnotation(getState)}`);
     return;
   }
   if (action === "set") {
@@ -12019,7 +12193,7 @@ function cmdConfig(opts) {
       if (parseErrAtLoad !== null) {
         try {
           fs19.copyFileSync(configPath(), `${configPath()}.bak`);
-          emitErr2(`config set: warning: config.toml failed to parse (${parseErrAtLoad}); backed up the original to config.toml.bak and rewriting it from defaults`);
+          emitErr3(`config set: warning: config.toml failed to parse (${parseErrAtLoad}); backed up the original to config.toml.bak and rewriting it from defaults`);
         } catch {
         }
       }
@@ -12054,8 +12228,8 @@ function cmdConfig(opts) {
       saveConfigSafe(cfg);
       return coercedValue;
     };
-    ensureDirSync(path19.dirname(configPath()));
-    const lockPath = path19.join(path19.dirname(configPath()), ".config.lock");
+    ensureDirSync(path20.dirname(configPath()));
+    const lockPath = path20.join(path20.dirname(configPath()), ".config.lock");
     const lockResult = withFileLock(lockPath, applySet, { waitMs: LOCK_WAIT_MS_HARDENED });
     const coerced = lockResult === void 0 ? applySet() : lockResult;
     invalidateConfigCache();
@@ -12064,19 +12238,19 @@ function cmdConfig(opts) {
     const setState = resolveConfigKeyLayer(key, setEffective.found ? setEffective.value : void 0, effectiveCfg, getProjectConfigInfo());
     const shadowed = setEffective.found && setEffective.value !== coerced;
     if (shadowed && setState.layer === "env") {
-      emitErr2(`config set: warning: ${key} was saved to config.toml, but ${setState.envVar} is currently set and overrides it at runtime \u2014 unset ${setState.envVar} for this change to take effect`);
+      emitErr3(`config set: warning: ${key} was saved to config.toml, but ${setState.envVar} is currently set and overrides it at runtime \u2014 unset ${setState.envVar} for this change to take effect`);
     } else if (shadowed && setState.layer === "env-invalid") {
-      emitErr2(`config set: warning: ${key} was saved to config.toml, but ${setState.envVar} is currently set to ${JSON.stringify(setState.rawValue)}${setState.reason !== null ? ` (${setState.reason})` : ""} and still overrides it at runtime, taking effect as ${JSON.stringify(setState.effectiveValue)} \u2014 unset ${setState.envVar} for this change to take effect`);
+      emitErr3(`config set: warning: ${key} was saved to config.toml, but ${setState.envVar} is currently set to ${JSON.stringify(setState.rawValue)}${setState.reason !== null ? ` (${setState.reason})` : ""} and still overrides it at runtime, taking effect as ${JSON.stringify(setState.effectiveValue)} \u2014 unset ${setState.envVar} for this change to take effect`);
     } else if (setState.layer === "project") {
-      emitErr2(`config set: warning: ${key} was saved to config.toml, but ${setState.path} also sets it and overrides it in this project \u2014 remove it there for this change to take effect here`);
+      emitErr3(`config set: warning: ${key} was saved to config.toml, but ${setState.path} also sets it and overrides it in this project \u2014 remove it there for this change to take effect here`);
     } else if (setState.layer === "project-invalid") {
-      emitErr2(`config set: warning: ${key} was saved to config.toml, but ${setState.path} sets it to ${JSON.stringify(setState.rawValue)}${setState.reason !== null ? ` (${setState.reason})` : ""} and still overrides it in this project, taking effect as ${JSON.stringify(setState.effectiveValue)} \u2014 remove it there for this change to take effect here`);
+      emitErr3(`config set: warning: ${key} was saved to config.toml, but ${setState.path} sets it to ${JSON.stringify(setState.rawValue)}${setState.reason !== null ? ` (${setState.reason})` : ""} and still overrides it in this project, taking effect as ${JSON.stringify(setState.effectiveValue)} \u2014 remove it there for this change to take effect here`);
     }
     if (opts.json === true) {
-      emit(JSON.stringify({ key, value: coerced }, null, 2));
+      emit2(JSON.stringify({ key, value: coerced }, null, 2));
       return;
     }
-    emit(`${key} = ${JSON.stringify(coerced)}`);
+    emit2(`${key} = ${JSON.stringify(coerced)}`);
     return;
   }
   if (action === "validate") {
@@ -12144,19 +12318,19 @@ function cmdConfig(opts) {
     }
     if (findings.length > 0) process.exitCode = 1;
     if (opts.json === true) {
-      emit(JSON.stringify({ findings, ok: findings.length === 0 }, null, 2));
+      emit2(JSON.stringify({ findings, ok: findings.length === 0 }, null, 2));
       return;
     }
     if (findings.length === 0) {
-      emit("config validate: no issues found");
+      emit2("config validate: no issues found");
       return;
     }
     for (const f of findings) {
       const isNearMiss = f.kind === "unknown_section" || f.kind === "unknown_key";
       const hint = f.suggestion === void 0 ? "" : isNearMiss ? ` (did you mean: ${f.suggestion}?)` : ` (${f.suggestion})`;
-      emit(`[${f.kind}] ${f.key}${hint}`);
+      emit2(`[${f.kind}] ${f.key}${hint}`);
     }
-    emit(`config validate: ${findings.length} issue(s) found`);
+    emit2(`config validate: ${findings.length} issue(s) found`);
     return;
   }
   throw new Error(`config: unknown action '${action}'. Use list, get, set, or validate.`);
@@ -12168,33 +12342,33 @@ function cmdProject(opts) {
     const active = findProject(process.cwd());
     const blocked = cfg.worker.blocked_roots;
     if (opts.json === true) {
-      emit(JSON.stringify({ active: active ? { root: active.root, hash: active.hash, marker: active.marker } : null, blocked_roots: blocked }, null, 2));
+      emit2(JSON.stringify({ active: active ? { root: active.root, hash: active.hash, marker: active.marker } : null, blocked_roots: blocked }, null, 2));
       return;
     }
     if (active) {
-      emit(`Active project: ${active.root}`);
-      emit(`  marker: ${active.marker}`);
+      emit2(`Active project: ${active.root}`);
+      emit2(`  marker: ${active.marker}`);
     } else {
-      emit("Active project: (none \u2014 not inside a recognized project root)");
+      emit2("Active project: (none \u2014 not inside a recognized project root)");
     }
     if (blocked.length === 0) {
-      emit("Blocked roots: (none)");
+      emit2("Blocked roots: (none)");
     } else {
-      emit("Blocked roots:");
-      for (const r of blocked) emit(`  ${r}`);
+      emit2("Blocked roots:");
+      for (const r of blocked) emit2(`  ${r}`);
     }
     return;
   }
   if (action === "exclude") {
     if (!opts.pathArg) {
-      emitErr2("project exclude requires a path argument");
+      emitErr3("project exclude requires a path argument");
       throw new Error("missing path");
     }
-    const target = path19.resolve(opts.pathArg);
+    const target = path20.resolve(opts.pathArg);
     const cfg = loadPersistedConfig();
     const targetFolded = foldPath(normalizePath(target));
     if (cfg.worker.blocked_roots.some((r) => foldPath(normalizePath(r)) === targetFolded)) {
-      emit(`Already excluded: ${target}`);
+      emit2(`Already excluded: ${target}`);
       return;
     }
     cfg.worker.blocked_roots = [...cfg.worker.blocked_roots, target];
@@ -12202,12 +12376,12 @@ function cmdProject(opts) {
     invalidateConfigCache();
     const purged = pruneBlockedRoot(target);
     if (opts.json === true) {
-      emit(JSON.stringify({ excluded: target, purgedFromIndex: purged.length, blocked_roots: cfg.worker.blocked_roots }, null, 2));
+      emit2(JSON.stringify({ excluded: target, purgedFromIndex: purged.length, blocked_roots: cfg.worker.blocked_roots }, null, 2));
       return;
     }
-    emit(`Excluded: ${target}`);
+    emit2(`Excluded: ${target}`);
     if (purged.length > 0) {
-      emit(`Removed ${purged.length} already-indexed file${purged.length === 1 ? "" : "s"} under it from the index.`);
+      emit2(`Removed ${purged.length} already-indexed file${purged.length === 1 ? "" : "s"} under it from the index.`);
     }
     return;
   }
@@ -12227,26 +12401,26 @@ function cmdProject(opts) {
     const orphanChunkPaths = findOrphanedChunkPaths();
     if (opts.dryRun === true) {
       if (opts.json === true) {
-        emit(JSON.stringify({ dryRun: true, wouldPrune: removed, stale, wouldPruneTempFiles: staleTempFiles.length, staleTempFiles, wouldPruneOrphanChunkFiles: orphanChunkPaths.length, orphanChunkPaths, blocked_roots: before }, null, 2));
+        emit2(JSON.stringify({ dryRun: true, wouldPrune: removed, stale, wouldPruneTempFiles: staleTempFiles.length, staleTempFiles, wouldPruneOrphanChunkFiles: orphanChunkPaths.length, orphanChunkPaths, blocked_roots: before }, null, 2));
         return;
       }
       if (removed === 0) {
-        emit("Would prune 0 stale root(s). Nothing to do.");
+        emit2("Would prune 0 stale root(s). Nothing to do.");
       } else {
-        emit(`Would prune ${removed} stale root(s):`);
-        for (const r of stale) emit(`  ${r}`);
+        emit2(`Would prune ${removed} stale root(s):`);
+        for (const r of stale) emit2(`  ${r}`);
       }
       if (staleTempFiles.length === 0) {
-        emit("Would prune 0 stale indexed temp-dir file(s). Nothing to do.");
+        emit2("Would prune 0 stale indexed temp-dir file(s). Nothing to do.");
       } else {
-        emit(`Would prune ${staleTempFiles.length} stale indexed temp-dir file(s):`);
-        for (const p of staleTempFiles) emit(`  ${p}`);
+        emit2(`Would prune ${staleTempFiles.length} stale indexed temp-dir file(s):`);
+        for (const p of staleTempFiles) emit2(`  ${p}`);
       }
       if (orphanChunkPaths.length === 0) {
-        emit("Would prune 0 orphaned embedding chunk file(s). Nothing to do.");
+        emit2("Would prune 0 orphaned embedding chunk file(s). Nothing to do.");
       } else {
-        emit(`Would prune orphaned embedding chunks for ${orphanChunkPaths.length} file(s):`);
-        for (const p of orphanChunkPaths) emit(`  ${p}`);
+        emit2(`Would prune orphaned embedding chunks for ${orphanChunkPaths.length} file(s):`);
+        for (const p of orphanChunkPaths) emit2(`  ${p}`);
       }
       return;
     }
@@ -12256,37 +12430,37 @@ function cmdProject(opts) {
     const prunedTempFiles = pruneSystemTempFiles();
     const prunedOrphanChunks = pruneOrphanedChunks();
     if (opts.json === true) {
-      emit(JSON.stringify({ pruned: removed, blocked_roots: after, prunedTempFiles: prunedTempFiles.length, prunedOrphanChunkFiles: prunedOrphanChunks.length }, null, 2));
+      emit2(JSON.stringify({ pruned: removed, blocked_roots: after, prunedTempFiles: prunedTempFiles.length, prunedOrphanChunkFiles: prunedOrphanChunks.length }, null, 2));
       return;
     }
-    emit(`Pruned ${removed} stale root(s). Remaining: ${after.length}`);
-    emit(`Pruned ${prunedTempFiles.length} stale indexed temp-dir file(s).`);
-    emit(`Pruned orphaned embedding chunks for ${prunedOrphanChunks.length} file(s).`);
+    emit2(`Pruned ${removed} stale root(s). Remaining: ${after.length}`);
+    emit2(`Pruned ${prunedTempFiles.length} stale indexed temp-dir file(s).`);
+    emit2(`Pruned orphaned embedding chunks for ${prunedOrphanChunks.length} file(s).`);
     return;
   }
-  emitErr2(`project: unknown action '${action}'. Use list, exclude, or prune.`);
+  emitErr3(`project: unknown action '${action}'. Use list, exclude, or prune.`);
   throw new Error(`unknown project action: ${action}`);
 }
 function recordCompactDocStat(fullSourceBytes, emittedText, detail) {
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(emittedText, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(emittedText, "utf8"));
   recordStat("compact_doc", bytesSaved, savedTokensFromBytes(bytesSaved), void 0, detail);
 }
 function cmdCompactDoc(opts) {
-  const resolved = path19.resolve(opts.filePath);
+  const resolved = path20.resolve(opts.filePath);
   if (opts.heading !== void 0) {
     const result = compactDoc(resolved, opts.heading);
     if (result === null) {
-      emitErr2(`compact-doc: could not read or compact '${resolved}'`);
+      emitErr3(`compact-doc: could not read or compact '${resolved}'`);
       throw new Error(`could not compact: ${resolved}`);
     }
     const legacyFullBytes = fs19.statSync(resolved).size;
     if (opts.json === true) {
       const jsonText = JSON.stringify({ path: resolved, compact: result }, null, 2);
-      emit(jsonText);
+      emit2(jsonText);
       recordCompactDocStat(legacyFullBytes, jsonText, resolved);
       return;
     }
-    emit(result);
+    emit2(result);
     recordCompactDocStat(legacyFullBytes, result, resolved);
     return;
   }
@@ -12295,7 +12469,7 @@ function cmdCompactDoc(opts) {
     try {
       sentences = requirePositiveStrictInt("--sentences", opts.sentences);
     } catch (e) {
-      emitErr2(`compact-doc: --sentences must be a positive number, got: "${opts.sentences}"`);
+      emitErr3(`compact-doc: --sentences must be a positive number, got: "${opts.sentences}"`);
       throw new Error(`invalid --sentences: ${opts.sentences}`, { cause: e });
     }
   }
@@ -12308,7 +12482,7 @@ function cmdCompactDoc(opts) {
     try {
       sourceText = fs19.readFileSync(resolved, "utf-8");
     } catch {
-      emitErr2(`compact-doc: could not read or compact '${resolved}'`);
+      emitErr3(`compact-doc: could not read or compact '${resolved}'`);
       throw new Error(`could not compact: ${resolved}`);
     }
     body = buildExtractiveCompact(sourceText, sentences);
@@ -12317,7 +12491,7 @@ function cmdCompactDoc(opts) {
   } else {
     const existing = readCompactBody(compactPath);
     if (existing === null) {
-      emitErr2(`compact-doc: could not read or compact '${resolved}'`);
+      emitErr3(`compact-doc: could not read or compact '${resolved}'`);
       throw new Error(`could not compact: ${resolved}`);
     }
     body = existing;
@@ -12325,16 +12499,16 @@ function cmdCompactDoc(opts) {
   const extractiveFullBytes = fs19.statSync(resolved).size;
   if (opts.json === true) {
     const jsonText = JSON.stringify({ path: resolved, compactPath, rebuilt, compact: body }, null, 2);
-    emit(jsonText);
+    emit2(jsonText);
     recordCompactDocStat(extractiveFullBytes, jsonText, resolved);
     return;
   }
   if (opts.show === true) {
-    emit(body);
+    emit2(body);
     recordCompactDocStat(extractiveFullBytes, body, resolved);
     return;
   }
-  emit(
+  emit2(
     `Compact sidecar ${rebuilt ? "built" : "already fresh"} at ${compactPath} (source: ${resolved}). Use --show to print it, --force to rebuild.`
   );
 }
@@ -12375,11 +12549,11 @@ async function cmdFetchImage(opts) {
   try {
     fetched = await fetchBuffer(opts.url);
   } catch (e) {
-    emitErr2(`fetch-image: network error \u2014 ${extractErrorMessage(e)}`);
+    emitErr3(`fetch-image: network error \u2014 ${extractErrorMessage(e)}`);
     throw new Error(`fetch failed: ${opts.url}`, { cause: e });
   }
   const buf = fetched.body;
-  const outPath = opts.out ?? path19.join(os9.tmpdir(), `tg-fetch-${Date.now()}${extensionForContentType(fetched.contentType)}`);
+  const outPath = opts.out ?? path20.join(os9.tmpdir(), `tg-fetch-${Date.now()}${extensionForContentType(fetched.contentType)}`);
   const originalBytes = buf.length;
   let shrunkBytes;
   let outData;
@@ -12402,11 +12576,11 @@ async function cmdFetchImage(opts) {
   }
   atomicWriteBytes(finalPath, outData);
   if (opts.json === true) {
-    emit(JSON.stringify({ url: opts.url, out: finalPath, originalBytes, shrunkBytes, wasShrunk }, null, 2));
+    emit2(JSON.stringify({ url: opts.url, out: finalPath, originalBytes, shrunkBytes, wasShrunk }, null, 2));
     return;
   }
   const savings = wasShrunk ? ` (saved ${originalBytes - shrunkBytes} bytes)` : " (not shrunk \u2014 already small or unsupported format)";
-  emit(`Fetched ${originalBytes} bytes \u2192 ${finalPath}${savings}`);
+  emit2(`Fetched ${originalBytes} bytes \u2192 ${finalPath}${savings}`);
 }
 function cmdHistory(opts) {
   let limit = 30;
@@ -12414,11 +12588,11 @@ function cmdHistory(opts) {
     try {
       limit = requireNonNegativeStrictInt("--limit", opts.limit);
     } catch (e) {
-      emitErr2(`history: --limit must be a non-negative number, got: "${opts.limit}"`);
+      emitErr3(`history: --limit must be a non-negative number, got: "${opts.limit}"`);
       throw new Error(`invalid --limit: ${opts.limit}`, { cause: e });
     }
     if (limit === 0) {
-      emitErr2(`history: --limit must be a positive number, got: "${opts.limit}"`);
+      emitErr3(`history: --limit must be a positive number, got: "${opts.limit}"`);
       throw new Error(`invalid --limit: ${opts.limit}`);
     }
   }
@@ -12442,27 +12616,32 @@ function cmdHistory(opts) {
       summary: typeof v["url"] === "string" ? v["url"] : ""
     };
   }).filter((x) => x !== null);
-  const items = [...bashItems, ...webItems].sort((a, b) => b.storedAt - a.storedAt).slice(0, limit);
+  const allItems = [...bashItems, ...webItems].sort((a, b) => b.storedAt - a.storedAt);
+  const items = allItems.slice(0, limit);
+  if (items.length < allItems.length) {
+    process.stderr.write(`Showing ${items.length} of ${allItems.length} entries (raise --limit to see the rest).
+`);
+  }
   if (opts.json === true) {
     process.stdout.write(JSON.stringify(items, null, 2) + "\n");
     return;
   }
   if (items.length === 0) {
-    emit("No history entries found (no cached bash outputs or web fetches).");
+    emit2("No history entries found (no cached bash outputs or web fetches).");
     return;
   }
   const pad2 = (s, n) => s.length >= n ? s : s + " ".repeat(n - s.length);
-  emit(`${pad2("type", 5)}  ${pad2("id", 18)}  summary`);
+  emit2(`${pad2("type", 5)}  ${pad2("id", 18)}  summary`);
   for (const item of items) {
     const preview = item.summary.length > 80 ? item.summary.slice(0, 77) + "..." : item.summary;
-    emit(`${pad2(item.type, 5)}  ${pad2(item.id, 18)}  ${preview}`);
+    emit2(`${pad2(item.type, 5)}  ${pad2(item.id, 18)}  ${preview}`);
   }
 }
 
 // src/cli_bootstrap_audit.ts
 import * as fs20 from "node:fs";
 import * as os10 from "node:os";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 import * as readline from "node:readline";
 var FRONTMATTER_KEYS = /* @__PURE__ */ new Set(["description", "tools", "allowed-tools", "allowed_tools"]);
 function parseBudget(name, value) {
@@ -12521,17 +12700,17 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
     logicalRoot = await fs20.promises.realpath(root);
   } catch (error) {
     if (error.code === "ENOENT") return entries;
-    diagnostics.push({ path: path20.resolve(root), reason: "unreadable root" });
+    diagnostics.push({ path: path21.resolve(root), reason: "unreadable root" });
     return entries;
   }
   if (rootIsLink && !followLinks) {
-    diagnostics.push({ path: path20.resolve(root), reason: "external root link skipped (use --follow-links)" });
+    diagnostics.push({ path: path21.resolve(root), reason: "external root link skipped (use --follow-links)" });
     return entries;
   }
   const canonicalKey = (candidate) => process.platform === "win32" ? candidate.toLocaleLowerCase() : candidate;
   const isContained = (candidate, allowedRoot) => {
-    const relative3 = path20.relative(canonicalKey(allowedRoot), canonicalKey(candidate));
-    return relative3 === "" || relative3 !== ".." && !relative3.startsWith(`..${path20.sep}`) && !path20.isAbsolute(relative3);
+    const relative3 = path21.relative(canonicalKey(allowedRoot), canonicalKey(candidate));
+    return relative3 === "" || relative3 !== ".." && !relative3.startsWith(`..${path21.sep}`) && !path21.isAbsolute(relative3);
   };
   async function visit(candidate, allowedRoot, topLevel = false) {
     let real;
@@ -12540,13 +12719,13 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       candidateIsLink = (await fs20.promises.lstat(candidate)).isSymbolicLink();
       real = await fs20.promises.realpath(candidate);
     } catch {
-      diagnostics.push({ path: path20.resolve(candidate), reason: "broken or unreadable link" });
+      diagnostics.push({ path: path21.resolve(candidate), reason: "broken or unreadable link" });
       return;
     }
     const withinAllowedRoot = allowedRoot === void 0 ? isContained(real, logicalRoot) : isContained(real, allowedRoot);
     const canFollowExternal = followLinks && topLevel;
     if (!withinAllowedRoot && !canFollowExternal) {
-      diagnostics.push({ path: path20.resolve(candidate), reason: candidateIsLink ? "external link skipped (use --follow-links)" : "canonical target outside scan root" });
+      diagnostics.push({ path: path21.resolve(candidate), reason: candidateIsLink ? "external link skipped (use --follow-links)" : "canonical target outside scan root" });
       return;
     }
     const trustedRoot = !withinAllowedRoot && canFollowExternal ? real : allowedRoot ?? real;
@@ -12554,7 +12733,7 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
     try {
       stat = await fs20.promises.stat(real);
     } catch {
-      diagnostics.push({ path: path20.resolve(candidate), reason: "unreadable" });
+      diagnostics.push({ path: path21.resolve(candidate), reason: "unreadable" });
       return;
     }
     const canonical = process.platform === "win32" ? real.toLocaleLowerCase() : real;
@@ -12565,14 +12744,14 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       try {
         children = await fs20.promises.readdir(real, { withFileTypes: true });
       } catch {
-        diagnostics.push({ path: path20.resolve(candidate), reason: "unreadable directory" });
+        diagnostics.push({ path: path21.resolve(candidate), reason: "unreadable directory" });
         return;
       }
       children.sort((a, b) => a.name.localeCompare(b.name));
-      for (const child of children) await visit(path20.join(real, child.name), trustedRoot);
+      for (const child of children) await visit(path21.join(real, child.name), trustedRoot);
       return;
     }
-    if (!stat.isFile() || path20.extname(real).toLowerCase() !== ".md") return;
+    if (!stat.isFile() || path21.extname(real).toLowerCase() !== ".md") return;
     if (seenFiles.has(canonical)) return;
     seenFiles.add(canonical);
     try {
@@ -12582,36 +12761,38 @@ async function scanMetadataRoot(root, kind, diagnostics, visitedDirs = /* @__PUR
       const toolsBytes = Buffer.byteLength(metadata.tools, "utf8");
       entries.push({
         kind,
-        path: path20.resolve(real),
+        path: path21.resolve(real),
         description_bytes: descriptionBytes,
         tools_bytes: toolsBytes,
         metadata_bytes: descriptionBytes + toolsBytes,
         estimated_tokens: Math.floor((descriptionBytes + toolsBytes) / 4)
       });
     } catch {
-      diagnostics.push({ path: path20.resolve(candidate), reason: "unreadable file" });
+      diagnostics.push({ path: path21.resolve(candidate), reason: "unreadable file" });
     }
   }
   try {
     const children = await fs20.promises.readdir(logicalRoot, { withFileTypes: true });
     children.sort((a, b) => a.name.localeCompare(b.name));
-    for (const child of children) await visit(path20.join(logicalRoot, child.name), void 0, true);
+    for (const child of children) await visit(path21.join(logicalRoot, child.name), void 0, true);
   } catch {
-    diagnostics.push({ path: path20.resolve(root), reason: "unreadable root" });
+    diagnostics.push({ path: path21.resolve(root), reason: "unreadable root" });
   }
   return entries;
 }
 async function buildBootstrapAudit(opts = {}) {
   const project = resolveProjectRoot(opts.project === void 0 ? {} : { project: opts.project });
-  const home = path20.resolve(opts.home ?? os10.homedir());
+  const home = path21.resolve(opts.home ?? os10.homedir());
   const context = buildStats(project, home, opts.project === void 0 ? [] : [opts.project]);
   const diagnostics = [];
   const top = opts.top === void 0 ? 10 : parseBudget("--top", opts.top) ?? 10;
   const visitedDirs = /* @__PURE__ */ new Set();
   const seenFiles = /* @__PURE__ */ new Set();
-  const agents = await scanMetadataRoot(path20.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
-  const skills = await scanMetadataRoot(path20.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
-  const largest = [...agents, ...skills].sort((a, b) => b.metadata_bytes - a.metadata_bytes || a.path.localeCompare(b.path)).slice(0, top);
+  const agents = await scanMetadataRoot(path21.join(home, ".claude", "agents"), "agent", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
+  const skills = await scanMetadataRoot(path21.join(home, ".claude", "skills"), "skill", diagnostics, visitedDirs, seenFiles, opts.followLinks === true);
+  const rankedEntries = [...agents, ...skills].sort((a, b) => b.metadata_bytes - a.metadata_bytes || a.path.localeCompare(b.path));
+  const largestTotal = rankedEntries.length;
+  const largest = rankedEntries.slice(0, top);
   const metadataBytes = [...agents, ...skills].reduce((sum, entry) => sum + entry.metadata_bytes, 0);
   const totalTokens = context.total_tokens + Math.floor(metadataBytes / 4);
   const warnTokens = parseBudget("--warn-tokens", opts.warnTokens);
@@ -12635,6 +12816,8 @@ async function buildBootstrapAudit(opts = {}) {
     total_estimated_tokens: totalTokens,
     counts: { agents: agents.length, skills: skills.length, metadata_files: agents.length + skills.length },
     largest,
+    largestTotal,
+    largestTruncated: largest.length < largestTotal,
     diagnostics,
     budgets: { warn_tokens: warnTokens, fail_tokens: failTokens, warn_bytes: warnBytes, fail_bytes: failBytes, warnings, failures }
   };
@@ -12658,6 +12841,8 @@ async function runBootstrapAudit(opts = {}) {
 `);
     process.stdout.write("Largest metadata entries:\n");
     for (const entry of result.largest) process.stdout.write(`  ${entry.metadata_bytes.toString().padStart(7)} bytes  ${entry.path}
+`);
+    if (result.largestTruncated) process.stdout.write(`  ...and ${result.largestTotal - result.largest.length} more (raise --top to see them).
 `);
     for (const diagnostic of result.diagnostics) process.stderr.write(`token-goat: bootstrap-audit: skipped ${diagnostic.path} (${diagnostic.reason})
 `);
@@ -12671,7 +12856,7 @@ async function runBootstrapAudit(opts = {}) {
 
 // src/cli_memory.ts
 import * as fs21 from "node:fs";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function removeExactDupLines(text, report) {
   if (report.exactDupLines.length === 0) return text;
   const toRemove = new Set(report.exactDupLines.map(([, dupIdx]) => dupIdx));
@@ -12729,7 +12914,7 @@ function printReport(reports, clusters) {
   } else {
     for (const cluster of clusters) {
       w(
-        `  [${cluster.method}, similarity ${cluster.similarity}, ~${cluster.tokens} tok] ${cluster.members.map((m) => path21.basename(m)).join(", ")}
+        `  [${cluster.method}, similarity ${cluster.similarity}, ~${cluster.tokens} tok] ${cluster.members.map((m) => path22.basename(m)).join(", ")}
 `
       );
     }
@@ -12744,7 +12929,7 @@ async function runMemoryCommand(opts = {}) {
   const claudeMds = findClaudeMdFiles(projectRoot);
   const reports = auditClaudeMd(claudeMds);
   const memoryMdPath = findMemoryMd(projectRoot);
-  const clusters = memoryMdPath !== null ? await findContentDuplicates(path21.dirname(memoryMdPath)) : [];
+  const clusters = memoryMdPath !== null ? await findContentDuplicates(path22.dirname(memoryMdPath)) : [];
   printReport(reports, clusters);
   if (opts.fix !== true) return;
   const changes = [];
@@ -12790,16 +12975,16 @@ async function runMemoryCommand(opts = {}) {
 
 // src/cli_waste.ts
 import * as fs24 from "node:fs";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 
 // src/waste.ts
 import * as fs22 from "node:fs";
 import * as os11 from "node:os";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function projectTranscriptsDir(projectRoot) {
-  const rootStr = path22.resolve(projectRoot);
+  const rootStr = path23.resolve(projectRoot);
   const slug = rootStr.replace(/[^A-Za-z0-9]/g, "-");
-  return path22.join(os11.homedir(), ".claude", "projects", slug);
+  return path23.join(os11.homedir(), ".claude", "projects", slug);
 }
 function findLatestTranscript(projectRoot) {
   const dir = projectTranscriptsDir(projectRoot);
@@ -12811,7 +12996,7 @@ function findLatestTranscript(projectRoot) {
   }
   let best = null;
   for (const name of entries) {
-    const full = path22.join(dir, name);
+    const full = path23.join(dir, name);
     let stat;
     try {
       stat = fs22.statSync(full);
@@ -13041,7 +13226,7 @@ async function buildWasteReport(transcriptPath, opts = {}) {
 
 // src/copilot_waste.ts
 import * as fs23 from "node:fs";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 var HOOK_RECORD_TYPES = /* @__PURE__ */ new Set(["hook.start", "hook.end"]);
 function splitInjectedBlocks(transformed) {
   const out2 = [];
@@ -13060,7 +13245,7 @@ function splitInjectedBlocks(transformed) {
   return out2;
 }
 function findLatestCopilotSession() {
-  const root = path23.join(copilotCliUserRoot(), "session-state");
+  const root = path24.join(copilotCliUserRoot(), "session-state");
   let entries;
   try {
     entries = fs23.readdirSync(root);
@@ -13070,7 +13255,7 @@ function findLatestCopilotSession() {
   let best = null;
   let bestMtime = -Infinity;
   for (const entry of entries) {
-    const candidate = path23.join(root, entry, "events.jsonl");
+    const candidate = path24.join(root, entry, "events.jsonl");
     try {
       const st = fs23.statSync(candidate);
       if (!st.isFile()) continue;
@@ -13091,7 +13276,7 @@ function buildCopilotWasteReport(eventsPath) {
   const raw = fs23.readFileSync(eventsPath, "utf-8");
   const report = {
     sessionPath: eventsPath,
-    sessionId: path23.basename(path23.dirname(eventsPath)),
+    sessionId: path24.basename(path24.dirname(eventsPath)),
     turns: 0,
     tokens: null,
     blocks: [],
@@ -13370,7 +13555,7 @@ function printResidentContext(resident, w) {
 }
 async function runWasteCommand(opts = {}) {
   if (opts.copilot === true) {
-    const eventsPath = opts.transcript !== void 0 ? path24.resolve(opts.transcript) : findLatestCopilotSession();
+    const eventsPath = opts.transcript !== void 0 ? path25.resolve(opts.transcript) : findLatestCopilotSession();
     if (eventsPath === null || !fs24.existsSync(eventsPath)) {
       const detail = eventsPath === null ? "no Copilot CLI session found under <copilot-home>/session-state" : `Copilot session event log not found: ${eventsPath}`;
       if (opts.json === true) {
@@ -13394,7 +13579,7 @@ async function runWasteCommand(opts = {}) {
     return;
   }
   const projectRoot = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
-  const transcriptPath = opts.transcript !== void 0 ? path24.resolve(opts.transcript) : findLatestTranscript(projectRoot);
+  const transcriptPath = opts.transcript !== void 0 ? path25.resolve(opts.transcript) : findLatestTranscript(projectRoot);
   if (transcriptPath === null) {
     if (opts.json === true) {
       process.stdout.write(`${JSON.stringify({ error: "no session transcript found", project: projectRoot })}
@@ -13425,7 +13610,7 @@ async function runWasteCommand(opts = {}) {
 
 // src/session_read.ts
 import * as fs25 from "node:fs";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 import * as readline2 from "node:readline";
 function resolveSessionTranscript(arg, opts = {}) {
   if (arg !== void 0 && arg !== "") {
@@ -13433,7 +13618,7 @@ function resolveSessionTranscript(arg, opts = {}) {
     const projectRoot2 = resolveProjectRoot(opts.project !== void 0 ? { project: opts.project } : {});
     const dir = projectTranscriptsDir(projectRoot2);
     const byId = arg.endsWith(".jsonl") ? arg : `${arg}.jsonl`;
-    const candidate = path25.join(dir, byId);
+    const candidate = path26.join(dir, byId);
     if (fs25.existsSync(candidate) && fs25.statSync(candidate).isFile()) return candidate;
     return null;
   }
@@ -13592,7 +13777,7 @@ function formatSessionSlice(turns) {
 // src/session_audit.ts
 import * as fs26 from "node:fs";
 import * as os12 from "node:os";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 import * as readline3 from "node:readline";
 function emptyMeasured() {
   return { apiCalls: 0, inputTokens: 0, cacheCreationTokens: 0, cacheReadTokens: 0, outputTokens: 0 };
@@ -13639,6 +13824,64 @@ var CACHE_READ_MULTIPLIER = 0.1;
 var READ_DIVERT_MARKER_RE = /(?:was already read this session|Already read |You've already read|Use `token-goat (?:section|read|bash-output|config-get|skeleton)|token-goat bash-output --file)/;
 var READ_DIVERT_MAX_BYTES = 2500;
 var READ_FULL_SERVE_MIN_BYTES = 10240;
+var DENY_TEMPLATES = [
+  { kind: "node_modules_deny", re: /node_modules is typically noise/ },
+  { kind: "lock_file_deny", re: /Lock files are rarely useful to read in full/ },
+  { kind: "tsbuildinfo_deny", re: /TypeScript incremental build cache file/ },
+  { kind: "generated_build_deny", re: /Generated\/build artifact — read the source file instead\./ },
+  { kind: "compact_sidecar_served", re: /Serving the extractive compact sidecar in place of the full file/ },
+  { kind: "notebook_sidecar_served", re: /Serving the output-stripped notebook in place of the full file/ },
+  // Must stay ABOVE markdown_heading_tree_deny: this deny's message embeds the same "Large markdown file (N headings)" guidance block, so the generic alternative would swallow it and the new intervention would be uncountable. DENY_TEMPLATES is scanned with `.find`, so the more specific wording has to come first.
+  { kind: "subagent_markdown_first_read_deny", re: /Subagent first read of a large markdown file/ },
+  { kind: "markdown_heading_tree_deny", re: /Large markdown file \(\d+ headings\)/ },
+  // The first alternative is a wording hooks_read.ts no longer emits (it claimed a compact-manifest
+  // section that never existed, reworded in 3d044feb). It stays because this table classifies a
+  // historical corpus, not just today's output: transcripts written before the rewording still
+  // carry the old text, and dropping the alternative silently shrank this kind from 51 events to
+  // 30 -- 41% of its history -- with a green suite. A superseded alternative is only removable
+  // once no transcript contains it, which source code cannot tell you. See the superseded-wording
+  // test in tests/deny_outcomes.test.ts.
+  { kind: "memory_md_reread_deny", re: /MEMORY\.md was read this session\. Its content is in the compact manifest|already read this session\. Memory files rarely change mid-session/ },
+  { kind: "improve_state_reread_deny", re: /Orchestrator state already read this session/ },
+  { kind: "env_reread_deny", re: /Environment files rarely change mid-session/ },
+  { kind: "session_artifact_truncated_deny", re: /File was truncated on last read\. Use `token-goat bash-output/ },
+  { kind: "session_artifact_unchanged_deny", re: /is unchanged since last read\. Use `token-goat bash-output/ },
+  { kind: "session_artifact_diff_deny", re: /Content changed since last read of [\s\S]*?bash-output --file/ },
+  { kind: "session_artifact_large_deny", re: /(?:Session transcript|Tool-result file) is large \(/ },
+  { kind: "session_artifact_generic_reread_deny", re: /already read this session\. Use `token-goat bash-output --file/ },
+  { kind: "truncated_read_deny", re: /File was truncated on last read \(>33K tokens\)/ },
+  { kind: "doc_unchanged_deny", re: /is unchanged since last read\. Use `token-goat (?:section|read)/ },
+  { kind: "doc_diff_deny", re: /Content changed since last read of [\s\S]*?Use `token-goat (?:section|read)/ },
+  { kind: "read_served_deny", re: /was already served in this session, byte for byte/ },
+  { kind: "markdown_already_read_deny", re: /Markdown file already read this session\. Use `token-goat section/ },
+  { kind: "read_count_deny", re: /Read this file \d+ times already/ },
+  { kind: "generic_reread_deny", re: /was already read this session \(\d+ read/ },
+  { kind: "large_file_deny", re: /is very large \(\d+(?:\.\d+)?KB\)\./ },
+  { kind: "file_type_handler_deny", re: /too large to preview \(exceeds the in-hook scan cap\)|cannot be read as text\.|Read cannot return spreadsheet content|Read cannot return slide content|Read cannot return document content|Use Read with offset and limit parameters to read specific line ranges/ }
+];
+var DENY_KINDS_WITH_SIZE = /* @__PURE__ */ new Set(["large_file_deny", "session_artifact_large_deny", "file_type_handler_deny"]);
+var DENY_SIZE_RE = /(\d+(?:\.\d+)?)\s*(B|KB|MB|GB|TB)\b/;
+function parseWithheldBytes(kind, text) {
+  if (!DENY_KINDS_WITH_SIZE.has(kind)) return null;
+  const m = DENY_SIZE_RE.exec(text);
+  if (m === null) return null;
+  const n = Number.parseFloat(m[1]);
+  const unit = m[2].toUpperCase();
+  const mult = unit === "B" ? 1 : unit === "KB" ? 1024 : unit === "MB" ? 1024 * 1024 : unit === "GB" ? 1024 ** 3 : 1024 ** 4;
+  return Math.round(n * mult);
+}
+var SURGICAL_COMMAND_RE = /(?:^|[\s;&|(])(?:token-goat|tg|node\s+\S*token-goat\.mjs)\s+(read|section|symbol|skeleton|outline|bash-output|config-get|skill-section|skill-body)\b/;
+var SHELL_READER_TOKEN_RE = /\b(?:sed|grep|cat|head|tail|awk|rg|less|nl|python3?|node)\b/;
+function escapeRegExp2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function shellReadMatch(command, basename8) {
+  if (basename8 === "" || !SHELL_READER_TOKEN_RE.test(command)) return "none";
+  if (!command.includes(basename8)) return "none";
+  const escaped = escapeRegExp2(basename8);
+  const strict = new RegExp(`(?:^|["'\`/\\\\\\s])${escaped}(?:$|["'\`/\\\\\\s,;:)])`);
+  return strict.test(command) ? "match" : "ambiguous";
+}
 var BASH_FILTER_MARKER_RE = /\[token-goat[:\]]/;
 var BASH_SMALL_RESULT_MAX_BYTES = 1024;
 function commandHead(raw) {
@@ -13693,7 +13936,7 @@ function listCorpusTranscripts(corpusDir) {
   const found = [];
   const walk = (dir, entries) => {
     for (const entry of entries) {
-      const full = path26.join(dir, entry.name);
+      const full = path27.join(dir, entry.name);
       if (entry.name.endsWith(".jsonl")) {
         found.push(full);
       } else if (entry.isDirectory()) {
@@ -13711,9 +13954,9 @@ function listCorpusTranscripts(corpusDir) {
   return found.sort();
 }
 function defaultCorpusDir() {
-  return path26.join(os12.homedir(), ".claude", "projects");
+  return path27.join(os12.homedir(), ".claude", "projects");
 }
-async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneObservations, bashHeadMap) {
+async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneObservations, bashHeadMap, denyRows) {
   const isLane = filePath.split(/[\\/]/).includes("subagents");
   let laneFirstPrefix = null;
   let laneBriefBytes = -1;
@@ -13721,8 +13964,12 @@ async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneOb
   const bashHeadById = /* @__PURE__ */ new Map();
   let pendingBashReread = [];
   const readCallById = /* @__PURE__ */ new Map();
+  const readPathById = /* @__PURE__ */ new Map();
+  const editPathById = /* @__PURE__ */ new Map();
+  const editErrorById = /* @__PURE__ */ new Map();
   const readPathEpoch = /* @__PURE__ */ new Map();
   let compactEpoch = 0;
+  const openDenies = [];
   let sawTokenGoatHook = false;
   let fileRepeats = 0;
   let fileRepeatsFullNoRange = 0;
@@ -13817,13 +14064,38 @@ async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneOb
               toolNameById.set(block["id"], name);
               toolRollup(toolMap, name).calls += 1;
               const input = block["input"] !== null && typeof block["input"] === "object" ? block["input"] : {};
+              let readNorm;
+              let editNorm;
               if (name === "Bash" && typeof input["command"] === "string") {
                 bashHeadById.set(block["id"], commandHead(input["command"]));
               } else if (name === "Read" && typeof input["file_path"] === "string") {
-                const norm = normalizeReadPath(input["file_path"]);
-                const priorEpoch = readPathEpoch.get(norm);
+                readNorm = normalizeReadPath(input["file_path"]);
+                const priorEpoch = readPathEpoch.get(readNorm);
                 readCallById.set(block["id"], { wasSeenBefore: priorEpoch !== void 0, hasRange: input["offset"] !== void 0 || input["limit"] !== void 0, afterCompaction: priorEpoch !== void 0 && compactEpoch > priorEpoch });
-                readPathEpoch.set(norm, compactEpoch);
+                readPathById.set(block["id"], readNorm);
+                readPathEpoch.set(readNorm, compactEpoch);
+              } else if (name === "Edit" && typeof input["file_path"] === "string") {
+                editNorm = normalizeReadPath(input["file_path"]);
+                editPathById.set(block["id"], editNorm);
+                s.editErrorBaseline.totalEdits += 1;
+              }
+              if (openDenies.length > 0) {
+                const bashCommand = name === "Bash" && typeof input["command"] === "string" ? input["command"] : void 0;
+                for (const o of openDenies) {
+                  if (o.toolCalls.length >= 10) continue;
+                  const isReadSamePath = readNorm !== void 0 && o.path !== "" && readNorm === o.path;
+                  const isSurgicalSamePath = bashCommand !== void 0 && o.basename !== "" && SURGICAL_COMMAND_RE.test(bashCommand) && bashCommand.includes(o.basename);
+                  const shellRead = bashCommand !== void 0 && o.basename !== "" ? shellReadMatch(bashCommand, o.basename) : "none";
+                  const isEditSamePath = editNorm !== void 0 && o.path !== "" && editNorm === o.path;
+                  o.toolCalls.push({
+                    isReadSamePath,
+                    isSurgicalSamePath,
+                    isShellReadSamePath: shellRead === "match",
+                    isShellReadAmbiguous: shellRead === "ambiguous",
+                    editCallId: isEditSamePath ? block["id"] : void 0
+                  });
+                  if (o.toolCalls.length === 3) o.compactEpochAtWindow = compactEpoch;
+                }
               }
             }
             let inputBytes;
@@ -13852,8 +14124,27 @@ async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneOb
           if (!toolNameById.has(id)) roll.calls += 1;
           roll.resultBytes += bytes;
           roll.resultEstTokens += estimateTokensFromLength(bytes);
+          if (name === "Edit" && block["is_error"] === true) {
+            s.editErrorBaseline.totalErrors += 1;
+            editErrorById.set(id, true);
+          }
           if (name === "Read") {
             s.readInterception.readResults += 1;
+            const denyTemplate = DENY_TEMPLATES.find((t) => t.re.test(text));
+            if (denyTemplate !== void 0) {
+              const path30 = readPathById.get(id) ?? "";
+              const lastSlash = path30.lastIndexOf("/");
+              openDenies.push({
+                kind: denyTemplate.kind,
+                withheldBytes: parseWithheldBytes(denyTemplate.kind, text),
+                path: path30,
+                basename: lastSlash === -1 ? path30 : path30.slice(lastSlash + 1),
+                callIndexAtDeny: perCall.length,
+                compactEpochAtOpen: compactEpoch,
+                compactEpochAtWindow: null,
+                toolCalls: []
+              });
+            }
             if (bytes < READ_DIVERT_MAX_BYTES && READ_DIVERT_MARKER_RE.test(text)) {
               s.readInterception.divertedByMarker += 1;
               s.readInterception.divertedBytes += bytes;
@@ -13990,6 +14281,42 @@ async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneOb
   }
   flushLane(0);
   flushLane(1);
+  for (const o of openDenies) {
+    if (o.compactEpochAtWindow === null) o.compactEpochAtWindow = compactEpoch;
+    const windowCalls = o.toolCalls.slice(0, 3);
+    let outcome;
+    if (o.compactEpochAtWindow > o.compactEpochAtOpen) {
+      outcome = "compacted";
+    } else if (windowCalls.some((c) => c.isReadSamePath)) {
+      outcome = "retried";
+    } else if (windowCalls.some((c) => c.isSurgicalSamePath)) {
+      outcome = "substituted";
+    } else if (windowCalls.some((c) => c.isShellReadSamePath)) {
+      outcome = "shell_read";
+    } else if (o.toolCalls.length < 3) {
+      outcome = "unresolved";
+    } else {
+      outcome = "abandoned";
+    }
+    const retriedWithin10 = o.toolCalls.some((c) => c.isReadSamePath);
+    const shellReadAmbiguous = windowCalls.some((c) => c.isShellReadAmbiguous);
+    const editWithin10 = o.toolCalls.some((c) => c.editCallId !== void 0);
+    const editErrorWithin10 = o.toolCalls.some((c) => c.editCallId !== void 0 && editErrorById.get(c.editCallId) === true);
+    const R = perCall.length - o.callIndexAtDeny;
+    const nextCall = perCall[o.callIndexAtDeny];
+    denyRows.push({
+      kind: o.kind,
+      withheldBytes: o.withheldBytes,
+      R,
+      nextCallInputTotal: nextCall?.inputTotal ?? 0,
+      nextCallCacheRead: nextCall?.cacheRead ?? 0,
+      outcome,
+      retriedWithin10,
+      shellReadAmbiguous,
+      editWithin10,
+      editErrorWithin10
+    });
+  }
   if (sawTokenGoatHook) {
     s.readInterception.repeatInHookedSessions += fileRepeats;
     s.readInterception.repeatFullNoRangeInHookedSessions += fileRepeatsFullNoRange;
@@ -14039,8 +14366,47 @@ function hookRollup(hookMap, origin, event) {
   }
   return roll;
 }
+function median(arr) {
+  if (arr.length === 0) return 0;
+  const sorted = [...arr].sort((a, b) => a - b);
+  return sorted[Math.floor(sorted.length / 2)];
+}
+function aggregateDenyOutcomes(rows) {
+  const byKind = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const bucket = byKind.get(r.kind);
+    if (bucket === void 0) byKind.set(r.kind, [r]);
+    else bucket.push(r);
+  }
+  const result = [];
+  for (const [kind, kindRows] of byKind) {
+    const count = kindRows.length;
+    const rateOf = (outcome) => kindRows.filter((r) => r.outcome === outcome).length / count;
+    const knownBytes = kindRows.map((r) => r.withheldBytes).filter((b) => b !== null);
+    result.push({
+      kind,
+      count,
+      compactedRate: rateOf("compacted"),
+      retriedRate: rateOf("retried"),
+      substitutedRate: rateOf("substituted"),
+      shellReadRate: rateOf("shell_read"),
+      unresolvedRate: rateOf("unresolved"),
+      abandonedRate: rateOf("abandoned"),
+      retriedWithin10Rate: kindRows.filter((r) => r.retriedWithin10).length / count,
+      medianWithheldBytes: knownBytes.length === 0 ? null : median(knownBytes),
+      withheldBytesUnknownFraction: (count - knownBytes.length) / count,
+      medianR: median(kindRows.map((r) => r.R)),
+      medianNextCallInputTotal: median(kindRows.map((r) => r.nextCallInputTotal)),
+      medianNextCallCacheRead: median(kindRows.map((r) => r.nextCallCacheRead)),
+      shellReadAmbiguousCount: kindRows.filter((r) => r.shellReadAmbiguous).length,
+      editWithin10Count: kindRows.filter((r) => r.editWithin10).length,
+      editErrorWithin10Count: kindRows.filter((r) => r.editErrorWithin10).length
+    });
+  }
+  return result.sort((a, b) => b.count - a.count || a.kind.localeCompare(b.kind));
+}
 async function auditSessionCorpus(opts = {}) {
-  const corpusDir = path26.resolve(opts.dir ?? defaultCorpusDir());
+  const corpusDir = path27.resolve(opts.dir ?? defaultCorpusDir());
   if (!fs26.existsSync(corpusDir)) {
     throw new Error(`session corpus directory not found: ${corpusDir}`);
   }
@@ -14078,6 +14444,8 @@ async function auditSessionCorpus(opts = {}) {
     laneAgentTypes: [],
     readInterception: { readResults: 0, divertedByMarker: 0, divertedBytes: 0, fullServesOver10k: 0, fullServeBytesOver10k: 0, fullServesFirstRead: 0, fullServesRepeat: 0, repeatBytes: 0, repeatWithRange: 0, repeatFullNoRange: 0, repeatInHookedSessions: 0, repeatFullNoRangeInHookedSessions: 0, repeatFullNoRangeHookedAfterCompaction: 0, fullServesPathUnknown: 0 },
     bashInterception: { bashResults: 0, markedByFilter: 0, markedBytes: 0, smallUntouched: 0, smallUntouchedBytes: 0, untouched: 0, untouchedBytes: 0, untouchedEstTokens: 0, untouchedRereadTokens: 0, untouchedBilledEquivTokens: 0, untouchedHeads: [] },
+    denyOutcomes: [],
+    editErrorBaseline: { totalEdits: 0, totalErrors: 0, rate: 0 },
     lineTypes: {},
     omissionMarkers: { fires: 0, linesOmitted: 0 }
   };
@@ -14086,9 +14454,10 @@ async function auditSessionCorpus(opts = {}) {
   const hookMap = /* @__PURE__ */ new Map();
   const laneObservations = [];
   const bashHeadMap = /* @__PURE__ */ new Map();
+  const denyRows = [];
   for (const file of files) {
     try {
-      await auditOneFile(file, summary, toolMap, attachmentMap, hookMap, laneObservations, bashHeadMap);
+      await auditOneFile(file, summary, toolMap, attachmentMap, hookMap, laneObservations, bashHeadMap, denyRows);
       summary.filesScanned += 1;
     } catch {
       summary.filesFailed += 1;
@@ -14125,6 +14494,8 @@ async function auditSessionCorpus(opts = {}) {
   }
   summary.attachmentKinds = [...attachmentMap.values()].sort((a, b) => b.billedEquivTokens - a.billedEquivTokens || b.injections - a.injections || a.kind.localeCompare(b.kind));
   summary.hookOutputs = [...hookMap.values()].sort((a, b) => b.contextBytes - a.contextBytes || b.fires - a.fires || a.origin.localeCompare(b.origin) || a.event.localeCompare(b.event));
+  summary.denyOutcomes = aggregateDenyOutcomes(denyRows);
+  summary.editErrorBaseline.rate = summary.editErrorBaseline.totalEdits === 0 ? 0 : summary.editErrorBaseline.totalErrors / summary.editErrorBaseline.totalEdits;
   summary.runtimeMs = Date.now() - started;
   return summary;
 }
@@ -14210,6 +14581,15 @@ function formatSessionAudit(s) {
   lines.push(`Full-serve split (same transcript file; a session's lanes are separate files, so repeats UNDER-count): first read ${fmt(ri.fullServesFirstRead)}, repeat ${fmt(ri.fullServesRepeat)} (${fmt(ri.repeatBytes)} bytes), path unknown ${fmt(ri.fullServesPathUnknown)}`);
   lines.push(`Repeats: with offset/limit ${fmt(ri.repeatWithRange)} (deliberate paging), whole-file ${fmt(ri.repeatFullNoRange)} (divert-miss candidates), in sessions with a token-goat hook fire ${fmt(ri.repeatInHookedSessions)} (whole-file among them: ${fmt(ri.repeatFullNoRangeInHookedSessions)}, of which post-compaction and so correct by design: ${fmt(ri.repeatFullNoRangeHookedAfterCompaction)})`);
   lines.push("");
+  lines.push("## Deny outcomes (what actually happened after a token-goat Read deny; raw tokens, not billed units)");
+  const eb = s.editErrorBaseline;
+  lines.push(`Edit-error baseline (all Edit tool_results, corpus-wide, independent of any deny): ${fmt(eb.totalErrors)}/${fmt(eb.totalEdits)} (${(eb.rate * 100).toFixed(1)}%) -- compare each row's edit-error<=10 ratio against this rate.`);
+  for (const d of s.denyOutcomes) {
+    const editErrorRatio = d.editWithin10Count > 0 ? `${fmt(d.editErrorWithin10Count)}/${fmt(d.editWithin10Count)}` : "n/a";
+    lines.push(`${d.kind.padEnd(34)} n ${fmt(d.count).padStart(6)}  compacted ${pct(d.compactedRate * d.count, d.count)}  retried ${pct(d.retriedRate * d.count, d.count)}  substituted ${pct(d.substitutedRate * d.count, d.count)}  shell-read ${pct(d.shellReadRate * d.count, d.count)}  unresolved ${pct(d.unresolvedRate * d.count, d.count)}  abandoned ${pct(d.abandonedRate * d.count, d.count)}  retried<=10 ${pct(d.retriedWithin10Rate * d.count, d.count)}  median-withheld ${d.medianWithheldBytes === null ? "n/a" : fmt(d.medianWithheldBytes) + "B"} (unknown ${pct(d.withheldBytesUnknownFraction * d.count, d.count)})  median-R ${fmt(d.medianR)}  shell-read-ambiguous ${fmt(d.shellReadAmbiguousCount)}  edit-error<=10 ${editErrorRatio}`);
+  }
+  if (s.denyOutcomes.length === 0) lines.push("(no denies matched a known template)");
+  lines.push("");
   lines.push("## Bash filter fire-rate (token-goat in-band markers inside Bash tool results)");
   const bi = s.bashInterception;
   lines.push(`Bash results: ${fmt(bi.bashResults)}; marked by a filter: ${fmt(bi.markedByFilter)} (${fmt(bi.markedBytes)} bytes); small unmarked <${fmt(BASH_SMALL_RESULT_MAX_BYTES)} B: ${fmt(bi.smallUntouched)} (${fmt(bi.smallUntouchedBytes)} bytes)`);
@@ -14228,7 +14608,7 @@ function formatSessionAudit(s) {
 // src/cli_mcp_audit.ts
 import * as fs27 from "node:fs";
 import * as os13 from "node:os";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 function readMcpJsonFile(configPath2) {
   try {
     if (!fs27.existsSync(configPath2)) return null;
@@ -14267,8 +14647,8 @@ function readClaudeJsonConfig(claudeJsonPath, projectRoot) {
   }
 }
 function discoverMcpConfig(projectRoot, home) {
-  const mcpJsonPath = path27.join(projectRoot, ".mcp.json");
-  const claudeJsonPath = path27.join(home, ".claude.json");
+  const mcpJsonPath = path28.join(projectRoot, ".mcp.json");
+  const claudeJsonPath = path28.join(home, ".claude.json");
   const sourcesChecked = [mcpJsonPath, claudeJsonPath];
   const fromMcpJson = readMcpJsonFile(mcpJsonPath);
   if (fromMcpJson !== null) return { servers: fromMcpJson, sourcePath: mcpJsonPath, sourcesChecked };
@@ -14387,15 +14767,14 @@ var RECALL_COMMAND = {
 function fenceTagForCacheType(cacheType) {
   return cacheType === "web" ? UNTRUSTED_WEB_TAG : UNTRUSTED_TOOL_TAG;
 }
+function fenceRecallListing(text, hits) {
+  const tags = new Set(hits.map((hit) => fenceTagForCacheType(hit.cacheType)));
+  const tag = tags.size === 1 ? [...tags][0] ?? UNTRUSTED_TOOL_TAG : UNTRUSTED_TOOL_TAG;
+  return fenceUntrusted(text, tag);
+}
 function fenceSnippetIfMatched(hit) {
-  let matches2 = [];
-  try {
-    if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(hit.snippet);
-  } catch {
-    matches2 = [];
-  }
+  const matches2 = scanAndRecord(hit.snippet);
   if (matches2.length === 0) return hit.snippet;
-  recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
   return fenceUntrustedContent(hit.snippet, matches2, fenceTagForCacheType(hit.cacheType));
 }
 function printHits(query, hits) {
@@ -14407,16 +14786,15 @@ function printHits(query, hits) {
 `);
     return;
   }
-  for (const hit of hits) {
+  const body = hits.map((hit) => {
     const label = hit.label.length > 80 ? hit.label.slice(0, 77) + "..." : hit.label;
-    w(`[${pad(hit.cacheType, 4)}] ${hit.id}  (token-goat ${RECALL_COMMAND[hit.cacheType]} ${hit.id})
-`);
-    w(`  ${label}
-`);
-    w(`  ${fenceSnippetIfMatched(hit)}
-
+    return `[${pad(hit.cacheType, 4)}] ${hit.id}  (token-goat ${RECALL_COMMAND[hit.cacheType]} ${hit.id})
+  ${label}
+  ${hit.snippet}
+`;
+  }).join("\n");
+  w(`${fenceRecallListing(body, hits)}
 `);
-  }
 }
 function runRecallCommand(query, opts = {}) {
   const browse = query === void 0 || query.trim() === "";
@@ -14424,7 +14802,13 @@ function runRecallCommand(query, opts = {}) {
     ...opts.type !== void 0 ? { type: opts.type } : {},
     ...opts.limit !== void 0 ? { limit: opts.limit } : {}
   };
-  const hits = browse ? listRecentRecall(scope) : searchRecall(query, scope);
+  const effectiveLimit = opts.limit ?? RECALL_DEFAULT_LIMIT;
+  const fetched = browse ? listRecentRecall({ ...scope, limit: effectiveLimit + 1 }) : searchRecall(query, { ...scope, limit: effectiveLimit + 1 });
+  const hits = fetched.slice(0, effectiveLimit);
+  if (fetched.length > hits.length) {
+    process.stderr.write(`Showing ${hits.length} entries; more are available (raise --limit to see them).
+`);
+  }
   if (opts.json === true) {
     const fenced = hits.map((hit) => ({ ...hit, snippet: fenceSnippetIfMatched(hit) }));
     process.stdout.write(`${JSON.stringify(fenced)}
@@ -14681,6 +15065,7 @@ async function cmdSemantic(query, opts) {
   process.exitCode = code;
 }
 async function cmdIndex(pathArg, opts = {}) {
+  applyIndexingPriority();
   const root = pathArg ?? process.cwd();
   const dbPath = opts.dbPath ?? globalDbPath();
   const force = opts.force === true;
@@ -14823,7 +15208,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-LZOAPGWR.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-CD6U5OD6.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-324QOJYZ.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -14836,8 +15221,8 @@ async function cmdMcpServe() {
   const server = await createMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  await new Promise((resolve13) => {
-    server.onclose = resolve13;
+  await new Promise((resolve14) => {
+    server.onclose = resolve14;
   });
 }
 function printBridgeVerificationNotice(harness) {
@@ -14848,7 +15233,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-L6YP6FKQ.mjs");
+  const { relay } = await import("./token-goat-chunk-AUM22UQ2.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -14961,14 +15346,14 @@ async function cmdInstall(opts) {
     );
   }
   try {
-    const skillDir = path28.join(homedir13(), ".claude", "skills");
+    const skillDir = path29.join(homedir13(), ".claude", "skills");
     if (fs28.existsSync(skillDir)) {
       const entries = fs28.readdirSync(skillDir, { withFileTypes: true });
       const skillNames = [];
       const sessionId = getSessionId();
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const skillFile = path28.join(skillDir, entry.name, "SKILL.md");
+        const skillFile = path29.join(skillDir, entry.name, "SKILL.md");
         if (fs28.existsSync(skillFile)) {
           const body = fs28.readFileSync(skillFile, "utf-8");
           const compact = extractCompactFromMarker(body);
@@ -14981,7 +15366,7 @@ async function cmdInstall(opts) {
       if (skillNames.length > 0) {
         const dir = skillOutputsDir();
         await fs28.promises.mkdir(dir, { recursive: true });
-        const pregenPath = path28.join(dir, "pregen.json");
+        const pregenPath = path29.join(dir, "pregen.json");
         const pregenData = { ts: Date.now(), names: skillNames };
         await fs28.promises.writeFile(pregenPath, JSON.stringify(pregenData, null, 2));
         out(`Pre-generated ${skillNames.length} skill compacts.`);
@@ -15182,7 +15567,7 @@ async function cmdSessionOutline(sessionIdOrPath, opts = {}) {
 ${formatSessionOutline(turns)}`;
   out(text);
   const fullSourceBytes = sessionTranscriptSize(transcriptPath);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
   recordStat("session_outline", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 function sessionTranscriptSize(transcriptPath) {
@@ -15204,7 +15589,7 @@ async function cmdSessionSlice(sessionIdOrPath, opts) {
   const text = opts.json === true ? JSON.stringify({ transcriptPath, turns }) : formatSessionSlice(turns);
   out(text);
   const fullSourceBytes = sessionTranscriptSize(transcriptPath);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
   recordStat("session_slice", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 function cmdMcpAudit(opts = {}) {
@@ -15244,24 +15629,13 @@ function cmdHintStats(opts = {}) {
     ...opts.markIneffective !== void 0 && isHintCategory(opts.markIneffective) ? { markIneffective: opts.markIneffective } : {}
   });
 }
-function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag = UNTRUSTED_WEB_TAG) {
-  const emit2 = (text) => {
-    if (!fenceUntrusted || text === "") {
-      out(text);
-      return text;
-    }
-    let matches2 = [];
-    try {
-      if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(text);
-    } catch {
-      matches2 = [];
-    }
-    if (matches2.length === 0) {
+function _applyFiltersAndPrint(content, opts, fenceByProvenance = false, fenceTag = UNTRUSTED_WEB_TAG) {
+  const emit3 = (text) => {
+    if (!fenceByProvenance || text === "") {
       out(text);
       return text;
     }
-    recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
-    const fenced = fenceUntrustedContent(text, matches2, fenceTag);
+    const fenced = fenceUntrusted(text, fenceTag);
     out(fenced);
     return fenced;
   };
@@ -15293,12 +15667,17 @@ function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag =
   }
   const rawLines = content.split(/\r?\n/);
   if (opts.full === true) {
-    return emit2(rawLines.join("\n"));
+    return emit3(rawLines.join("\n"));
   }
   const lines = rawLines.length > 1 && rawLines[rawLines.length - 1] === "" ? rawLines.slice(0, -1) : rawLines;
   const headN = opts.head !== void 0 ? requireNonNegativeInt("--head", opts.head) : 30;
   const tailN = opts.tail !== void 0 ? requireNonNegativeInt("--tail", opts.tail) : 80;
   const applyElision = (lines2, headN2, tailN2) => lines2.length > headN2 + tailN2 + 1 ? [...lines2.slice(0, headN2), "...(elided)...", ...lines2.slice(lines2.length - tailN2)] : lines2;
+  const noteLineCap = (which, flag, shown, total) => {
+    if (shown >= total) return;
+    process.stderr.write(`Showing ${which} ${shown} of ${total} lines (raise --${flag}, or --full for the whole body).
+`);
+  };
   let result = lines;
   if (opts.head === void 0 && opts.tail === void 0) {
     result = applyElision(lines, headN, tailN);
@@ -15306,20 +15685,19 @@ function _applyFiltersAndPrint(content, opts, fenceUntrusted = false, fenceTag =
     result = applyElision(lines, headN, tailN);
   } else if (opts.head !== void 0) {
     result = lines.slice(0, headN);
+    noteLineCap("first", "head", result.length, lines.length);
   } else if (opts.tail !== void 0) {
     result = lines.slice(Math.max(0, lines.length - tailN));
+    noteLineCap("last", "tail", result.length, lines.length);
   }
-  return emit2(result.join("\n"));
+  return emit3(result.join("\n"));
 }
-function fenceFileTextIfMatched(text) {
-  let matches2 = [];
-  try {
-    if (loadConfig().injection.enabled) matches2 = scanForInjectionPatterns(text);
-  } catch {
-    matches2 = [];
-  }
+function fenceFileText(text) {
+  return fenceUntrusted(text, UNTRUSTED_FILE_TAG);
+}
+function fenceFileFieldIfMatched(text) {
+  const matches2 = scanAndRecord(text);
   if (matches2.length === 0) return text;
-  recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
   return fenceUntrustedContent(text, matches2, UNTRUSTED_FILE_TAG);
 }
 function fileSizeOrZero(filePath) {
@@ -15387,7 +15765,7 @@ async function cmdPdfExtract(file, opts) {
   const text = await runPdfExtractText(file, opts.pages, opts.layout === true);
   const printed = _applyFiltersAndPrint(text, opts, true, UNTRUSTED_FILE_TAG);
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(printed, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(printed, "utf8"));
   recordStat("pdf_extract", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 async function cmdPdfLocate(file, pattern, opts) {
@@ -15398,24 +15776,26 @@ async function cmdPdfLocate(file, pattern, opts) {
   if (opts.context !== void 0) locateOpts.context = requirePositiveInt("--context", opts.context);
   if (opts.pages !== void 0) locateOpts.pages = opts.pages;
   const matches2 = await runPdfLocate(file, pattern, locateOpts);
-  const fencedMatches = matches2.map((m) => ({ ...m, snippet: fenceFileTextIfMatched(m.snippet) }));
-  const pages = fencedMatches.map((m) => m.page);
+  const pages = matches2.map((m) => m.page);
   let printed;
   if (opts.json === true) {
+    const fencedMatches = matches2.map((m) => ({ ...m, snippet: fenceFileFieldIfMatched(m.snippet) }));
     printed = JSON.stringify({ file, pattern, matchCount: fencedMatches.length, pages, matches: fencedMatches }, null, 2);
     out(printed);
-  } else if (fencedMatches.length === 0) {
+  } else if (matches2.length === 0) {
     printed = "(no matches)";
     out(printed);
   } else {
-    const lines = fencedMatches.map((m) => `p${m.page}: ${m.snippet}`);
-    printed = `${lines.join("\n")}
+    const lines = matches2.map((m) => `p${m.page}: ${m.snippet}`);
+    printed = fenceFileText(
+      `${lines.join("\n")}
 
-${countNoun(fencedMatches.length, "match", "matches")} across ${countNoun(pages.length, "page")}`;
+${countNoun(matches2.length, "match", "matches")} across ${countNoun(pages.length, "page")}`
+    );
     out(printed);
   }
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(printed, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(printed, "utf8"));
   recordStat("pdf_locate", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 async function cmdPdfOutline(file, opts) {
@@ -15428,11 +15808,10 @@ async function cmdPdfOutline(file, opts) {
     }
     return;
   }
-  const fencedEntries = entries.map((e) => ({ ...e, title: fenceFileTextIfMatched(e.title) }));
-  const text = opts.json === true ? JSON.stringify(fencedEntries, null, 2) : fencedEntries.map((e) => `${"  ".repeat(e.level)}${e.title}${e.page !== null ? `  (p.${e.page})` : ""}`).join("\n");
+  const text = opts.json === true ? JSON.stringify(entries.map((e) => ({ ...e, title: fenceFileFieldIfMatched(e.title) })), null, 2) : fenceFileText(entries.map((e) => `${"  ".repeat(e.level)}${e.title}${e.page !== null ? `  (p.${e.page})` : ""}`).join("\n"));
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
   recordStat("pdf_outline", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 async function cmdPdfMeta(file, opts = {}) {
@@ -15446,7 +15825,7 @@ async function cmdPdfMeta(file, opts = {}) {
   const text = opts.json === true ? JSON.stringify({ pageCount: meta.pageCount, title: meta.title, author: meta.author, hasTextLayer: meta.hasTextLayer }, null, 2) : lines.join("\n");
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
   recordStat("pdf_meta", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 async function cmdImageMeta(file, opts = {}) {
@@ -15468,17 +15847,12 @@ ${msg}`;
   const text = opts.json === true ? JSON.stringify(meta, null, 2) : lines.join("\n");
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
-  recordStat("image_meta", bytesSaved, savedTokensFromBytes(bytesSaved));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
+  recordStat("image_meta", bytesSaved, visionTokensSavedByText(meta.width, meta.height, Buffer.byteLength(text, "utf8"), loadConfig().image_shrink.vision_tier));
 }
 function fenceOcrText(text) {
-  try {
-    if (loadConfig().injection.enabled) {
-      const matches2 = scanForInjectionPatterns(text);
-      if (matches2.length > 0) recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
-    }
-  } catch {
-  }
+  if (!injectionFencingEnabled()) return text;
+  scanAndRecord(text);
   return fenceUntrustedOcrText(text);
 }
 async function cmdImageText(file, opts = {}) {
@@ -15505,8 +15879,8 @@ ${fenceOcrText(result.text)}` : `${lines.join("\n")}
   }
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
-  recordStat("image_text", bytesSaved, savedTokensFromBytes(bytesSaved));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
+  recordStat("image_text", bytesSaved, visionTokensSavedByText(null, null, Buffer.byteLength(text, "utf8"), loadConfig().image_shrink.vision_tier));
 }
 function cmdVideoChapters(file) {
   const { chapters, subtitleStreams } = extractVideoChapters(file);
@@ -15531,7 +15905,7 @@ function cmdVideoChapters(file) {
   const text = lines.join("\n");
   out(text);
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(text, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(text, "utf8"));
   recordStat("video_chapters", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 function formatVideoTimestamp(totalSeconds) {
@@ -15558,25 +15932,24 @@ function cmdSharepointResolve(url) {
 }
 function recordXlsxStat(kind, file, emitted) {
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(emitted, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(emitted, "utf8"));
   recordStat(kind, bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 async function cmdXlsxSheets(file, opts = {}) {
   const sheets = await listSheets(file);
-  const fencedSheets = sheets.map((s) => ({ ...s, name: fenceFileTextIfMatched(s.name) }));
-  const text = opts.json === true ? JSON.stringify(fencedSheets.map((s) => ({ name: s.name, ref: s.ref, rows: s.rows, cols: s.cols })), null, 2) : fencedSheets.map((s) => `${s.name}  ${s.ref}  (${s.rows} rows x ${s.cols} cols)`).join("\n");
+  const text = opts.json === true ? JSON.stringify(sheets.map((s) => ({ name: fenceFileFieldIfMatched(s.name), ref: s.ref, rows: s.rows, cols: s.cols })), null, 2) : fenceFileText(sheets.map((s) => `${s.name}  ${s.ref}  (${s.rows} rows x ${s.cols} cols)`).join("\n"));
   out(text);
   recordXlsxStat("xlsx_sheets", file, text);
 }
 async function cmdXlsxHead(file, opts) {
   const rows = opts.rows !== void 0 ? requireNonNegativeInt("--rows", opts.rows) : 20;
-  const text = fenceFileTextIfMatched(await headSheet(file, opts.sheet, rows));
+  const text = fenceFileText(await headSheet(file, opts.sheet, rows));
   out(text);
   recordXlsxStat("xlsx_head", file, text);
 }
 async function cmdXlsxRange(file, opts) {
   const result = await rangeSheet(file, opts.sheet, opts.range, opts.formulas === true);
-  const text = fenceFileTextIfMatched(formatXlsxRange(result));
+  const text = fenceFileText(formatXlsxRange(result));
   out(text);
   recordXlsxStat("xlsx_range", file, text);
 }
@@ -15588,32 +15961,33 @@ async function cmdXlsxQuery(file, opts) {
     ...wheres !== void 0 ? { wheres } : {},
     ...opts.head !== void 0 ? { head: requireNonNegativeInt("--head", opts.head) } : {}
   });
-  const text = fenceFileTextIfMatched(formatCsvTable(result, (opts.where ?? []).map((w) => `--where ${w}`)));
+  const text = fenceFileText(formatCsvTable(result, (opts.where ?? []).map((w) => `--where ${w}`)));
   out(text);
   recordXlsxStat("xlsx_query", file, text);
 }
 function recordDocStat(kind, file, emitted) {
   const fullSourceBytes = fileSizeOrZero(file);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(emitted, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(emitted, "utf8"));
   recordStat(kind, bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 async function cmdPptxOutline(file, opts) {
   const slides = await pptxOutline(file);
-  const fencedSlides = slides.map((s) => ({ ...s, title: fenceFileTextIfMatched(s.title) }));
-  const text = opts.json === true ? JSON.stringify(fencedSlides, null, 2) : fencedSlides.map((s) => `${s.slide}. ${s.title || "(untitled)"}  [${s.bodyChars} body chars${s.hasNotes ? ", has notes" : ""}]`).join("\n");
+  const text = opts.json === true ? JSON.stringify(slides.map((s) => ({ ...s, title: fenceFileFieldIfMatched(s.title) })), null, 2) : fenceFileText(
+    slides.map((s) => `${s.slide}. ${s.title || "(untitled)"}  [${s.bodyChars} body chars${s.hasNotes ? ", has notes" : ""}]`).join("\n")
+  );
   out(text);
   recordDocStat("pptx_outline", file, text);
 }
 async function cmdPptxSlide(file, opts) {
   const n = requireNonNegativeInt("--slide", opts.slide);
-  const text = fenceFileTextIfMatched(await pptxSlideText(file, n, opts.notes === true));
+  const text = fenceFileText(await pptxSlideText(file, n, opts.notes === true));
   out(text);
   recordDocStat("pptx_slide", file, text);
 }
 async function cmdPptxNotes(file, opts) {
   const n = opts.slide !== void 0 ? requireNonNegativeInt("--slide", opts.slide) : void 0;
   const text = await pptxNotesText(file, n);
-  const printed = text.length > 0 ? fenceFileTextIfMatched(text) : "no speaker notes found";
+  const printed = text.length > 0 ? fenceFileText(text) : "no speaker notes found";
   out(printed);
   recordDocStat("pptx_notes", file, printed);
 }
@@ -15623,7 +15997,7 @@ async function cmdPptxText(file, opts) {
     out("no matches");
     return;
   }
-  const text = fenceFileTextIfMatched(matches2.map((m) => `Slide ${m.slide}: ...${m.snippet}...`).join("\n"));
+  const text = fenceFileText(matches2.map((m) => `Slide ${m.slide}: ...${m.snippet}...`).join("\n"));
   out(text);
   recordDocStat("pptx_text", file, text);
 }
@@ -15637,8 +16011,7 @@ async function cmdDocxOutline(file, opts) {
     }
     return;
   }
-  const fencedHeadings = headings.map((h) => ({ ...h, text: fenceFileTextIfMatched(h.text) }));
-  const text = opts.json === true ? JSON.stringify(fencedHeadings, null, 2) : fencedHeadings.map((h) => `${"  ".repeat(h.level - 1)}${h.text}`).join("\n");
+  const text = opts.json === true ? JSON.stringify(headings.map((h) => ({ ...h, text: fenceFileFieldIfMatched(h.text) })), null, 2) : fenceFileText(headings.map((h) => `${"  ".repeat(h.level - 1)}${h.text}`).join("\n"));
   out(text);
   recordDocStat("docx_outline", file, text);
 }
@@ -15752,6 +16125,18 @@ function cmdConflicts(targetPath, opts) {
 async function cmdScreenshot(url, destPath, opts) {
   out(await runScreenshot(url, destPath, opts));
 }
+function readStdinPaths() {
+  if (process.stdin.isTTY) {
+    throw new CliError("--stdin requires piped input, e.g. `git diff --name-only | token-goat affected --stdin`");
+  }
+  let raw;
+  try {
+    raw = fs28.readFileSync(0, "utf8");
+  } catch (e) {
+    throw new CliError(`could not read the file list from stdin: ${extractErrorMessage(e)}`);
+  }
+  return raw.split("\n").map((line) => line.trim()).filter((line) => line !== "");
+}
 function runExit(fn) {
   try {
     process.exitCode = fn();
@@ -15782,7 +16167,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-NZFTWBGV.mjs");
+    const bashRunner = await import("./token-goat-chunk-4KD2N46D.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -15880,8 +16265,8 @@ async function cmdSkillCompact(name, opts) {
       }
       throw new CliError(`failed to read skill file '${opts.path}': ${extractErrorMessage(e)}`);
     }
-    cacheName = name ?? path28.basename(path28.dirname(path28.resolve(opts.path)));
-    sourcePath = path28.resolve(opts.path);
+    cacheName = name ?? path29.basename(path29.dirname(path29.resolve(opts.path)));
+    sourcePath = path29.resolve(opts.path);
   } else {
     if (name === void 0 || !name.trim()) {
       throw new CliError("skill-compact requires a <name> or --path <file>");
@@ -16022,8 +16407,8 @@ async function cmdSkillDiff(name) {
   }
   const newer = versions[0];
   const older = versions[1];
-  const newerBody = await fs28.promises.readFile(path28.resolve(dir, `${newer.outputId}.txt`), "utf-8").catch(() => null);
-  const olderBody = await fs28.promises.readFile(path28.resolve(dir, `${older.outputId}.txt`), "utf-8").catch(() => null);
+  const newerBody = await fs28.promises.readFile(path29.resolve(dir, `${newer.outputId}.txt`), "utf-8").catch(() => null);
+  const olderBody = await fs28.promises.readFile(path29.resolve(dir, `${older.outputId}.txt`), "utf-8").catch(() => null);
   if (newerBody === null || olderBody === null) {
     out(`a cached version of '${name}' was evicted while diffing -- try again`);
     return;
@@ -16075,7 +16460,7 @@ function atomicWriteBuffer(dest, data) {
     if (e.code !== "ENOENT") throw e;
   }
   const rnd = randomBytes(4).toString("hex");
-  const tmp = path28.join(path28.dirname(path28.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
+  const tmp = path29.join(path29.dirname(path29.resolve(dest)), `.tmp.${process.pid}.${rnd}`);
   try {
     fs28.writeFileSync(tmp, data, { mode: 384 });
     try {
@@ -16113,9 +16498,9 @@ function mapFsError(e, src, dest, srcLabel = "source") {
   const fe = e;
   if (fe.code === "ENOENT") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && path28.resolve(errPath) === path28.resolve(src);
+    const isSource = src !== void 0 && path29.resolve(errPath) === path29.resolve(src);
     if (isSource) throw new CliError(`${/\bfile$/i.test(srcLabel) ? srcLabel : `${srcLabel} file`} not found: ${src}`);
-    const destDir = dest ? path28.dirname(path28.resolve(dest)) : path28.dirname(path28.resolve(errPath || "."));
+    const destDir = dest ? path29.dirname(path29.resolve(dest)) : path29.dirname(path29.resolve(errPath || "."));
     throw new CliError(`destination directory does not exist: ${destDir}`);
   }
   if (fe.code === "ENOTDIR") {
@@ -16126,7 +16511,7 @@ function mapFsError(e, src, dest, srcLabel = "source") {
   }
   if (fe.code === "EISDIR") {
     const errPath = fe.path ?? "";
-    const isSource = src !== void 0 && (errPath === "" || path28.resolve(errPath) === path28.resolve(src));
+    const isSource = src !== void 0 && (errPath === "" || path29.resolve(errPath) === path29.resolve(src));
     if (isSource) throw new CliError(`source is a directory, not a file: ${src}`);
     throw new CliError(`destination is a directory, not a file: ${dest ?? (errPath || "(unknown)")}`);
   }
@@ -16195,7 +16580,7 @@ function validateWritablePath(dest, label) {
     throw new CliError(`${label} path contains a null byte`);
   }
   if (isWindows()) {
-    const base = path28.basename(dest);
+    const base = path29.basename(dest);
     const stem = base.replace(/\.[^.]*$/, "").toUpperCase();
     if (WIN_RESERVED.has(stem)) {
       throw new CliError(`${label} '${base}' is a reserved Windows device name`);
@@ -16336,7 +16721,7 @@ function cmdWriteFile(dest, opts) {
     throw new CliError(`TOKEN_GOAT_MAX_STDIN_MB must be a positive integer; got '${process.env["TOKEN_GOAT_MAX_STDIN_MB"] ?? ""}'`);
   }
   const maxBytes = maxMB * 1024 * 1024;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const chunks = [];
     let totalBytes = 0;
     let settled = false;
@@ -16360,7 +16745,7 @@ function cmdWriteFile(dest, opts) {
       try {
         atomicWriteBuffer(dest, Buffer.concat(chunks));
         enqueueDirtyPathSafe(dest);
-        resolve13();
+        resolve14();
       } catch (e) {
         try {
           mapFsError(e, void 0, dest);
@@ -16710,19 +17095,9 @@ ${content}`;
     const sections = await getDocSections(fileId, { fresh: false });
     emitted = formatSections(sections);
   }
-  let toEmit = emitted;
-  try {
-    if (loadConfig().injection.enabled) {
-      const matches2 = scanForInjectionPatterns(emitted);
-      if (matches2.length > 0) {
-        recordStat("injection_detected", 0, 0, void 0, matches2.join(","));
-        toEmit = fenceUntrustedContent(emitted, matches2, UNTRUSTED_WEB_TAG);
-      }
-    }
-  } catch {
-  }
+  const toEmit = fenceUntrusted(emitted, UNTRUSTED_WEB_TAG);
   out(toEmit);
-  const bytesSaved = Math.max(1, fullSourceBytes - Buffer.byteLength(toEmit, "utf8"));
+  const bytesSaved = cappedSourceBytesSaved(fullSourceBytes, Buffer.byteLength(toEmit, "utf8"));
   recordStat("gdrive_sections", bytesSaved, savedTokensFromBytes(bytesSaved));
 }
 function expandGlobs(root, patterns, globFnOverride) {
@@ -16732,17 +17107,17 @@ function expandGlobs(root, patterns, globFnOverride) {
     if (globFn !== void 0 && (p.includes("*") || p.includes("?") || p.includes("{"))) {
       try {
         const hits = globFn(p, { cwd: root });
-        for (const h of hits) out2.push(path28.isAbsolute(h) ? h : path28.join(root, h));
+        for (const h of hits) out2.push(path29.isAbsolute(h) ? h : path29.join(root, h));
         continue;
       } catch {
       }
     }
-    out2.push(path28.isAbsolute(p) ? p : path28.join(root, p));
+    out2.push(path29.isAbsolute(p) ? p : path29.join(root, p));
   }
   return out2;
 }
 function readIgnoreFile(root) {
-  const ignorePath = path28.join(root, ".tokengoatignore");
+  const ignorePath = path29.join(root, ".tokengoatignore");
   let raw;
   try {
     raw = fs28.readFileSync(ignorePath, "utf8");
@@ -16803,15 +17178,17 @@ function cmdTokens(patterns, opts) {
   const result = estimateBudget(root, expandGlobs(root, patterns ?? []));
   let entries = [...result.entries];
   if (opts.asc === true) entries.reverse();
+  const eligibleCount = entries.length;
   if (opts.top !== void 0) entries = entries.slice(0, requireNonNegativeInt("--top", opts.top));
+  const truncated = entries.length < eligibleCount;
   if (opts.json === true) {
-    out(JSON.stringify({ entries, total_tokens: result.total_tokens, total_lines: result.total_lines }, null, 2));
+    out(JSON.stringify({ entries, truncated, totalCount: eligibleCount, total_tokens: result.total_tokens, total_lines: result.total_lines }, null, 2));
     return;
   }
   if (opts.tree === true) {
     const dirs = /* @__PURE__ */ new Map();
     for (const e of entries) {
-      const dir = path28.dirname(e.rel_path);
+      const dir = path29.dirname(e.rel_path);
       if (!dirs.has(dir)) dirs.set(dir, []);
       dirs.get(dir).push(e);
     }
@@ -16821,7 +17198,7 @@ function cmdTokens(patterns, opts) {
       const pct2 = result.total_tokens > 0 ? Math.round(dirTokens / result.total_tokens * 100) : 0;
       lines2.push(`${dir}/ (${dirTokens} tokens, ${pct2}%)`);
       for (const e of dirEntries) {
-        lines2.push(`  ${path28.basename(e.rel_path).padEnd(30)}  ${String(e.tokens).padStart(8)} tokens`);
+        lines2.push(`  ${path29.basename(e.rel_path).padEnd(30)}  ${String(e.tokens).padStart(8)} tokens`);
       }
     }
     out(lines2.join("\n"));
@@ -16839,6 +17216,9 @@ function cmdTokens(patterns, opts) {
   for (const e of entries) {
     lines.push(`${e.rel_path.padEnd(colW)}  ${String(e.tokens).padStart(8)}  ${String(e.lines).padStart(6)}`);
   }
+  if (truncated) {
+    lines.push(`...and ${eligibleCount - entries.length} more (raise --top to see them).`);
+  }
   out(lines.join("\n"));
 }
 function cmdBudget(patterns, opts) {
@@ -16869,6 +17249,63 @@ function cmdFailures(src, opts) {
   saveFailureSnapshot(project.hash, key, { signatures, runner: result.runner, storedAt: Date.now() });
   out(opts.json === true ? formatFailureDeltaJson(delta, result.runner) : formatFailureDeltaText(delta, result.runner));
 }
+var originalHelpInformation = null;
+function generateCompactHelp() {
+  const lines = [
+    "Usage: token-goat [options] [command]",
+    "",
+    "Surgical token-reduction companion for AI coding agents",
+    "",
+    "Options:",
+    "  -v, --version                   print the token-goat version",
+    "  --cwd <path>                    run as if invoked from this directory",
+    "  -h, --help                      display help for command",
+    "",
+    "Reads: symbol, read, brief, section, semantic, skeleton, outline, refs, scope,",
+    "  similar, context-for, call-chain, impact, callers, dead, test-for",
+    "",
+    "Analysis: arch, affected, blame, deps, types, coverage-gaps, changed, diff, log,",
+    "  exports, imports, find, grep",
+    "",
+    "File Formats: pdf-meta, pdf-outline, pdf-extract, pdf-locate, xlsx-sheets,",
+    "  xlsx-head, xlsx-query, xlsx-range, yaml-outline, yaml-query, json-outline,",
+    "  json-query, xml-outline, xml-query, docx-outline, docx-text, pptx-outline,",
+    "  pptx-slide, pptx-text, pptx-notes",
+    "",
+    "Index & Search: index, map, reconcile, doctor, commands, ask, pack, tokens,",
+    "  budget, failures, todo, trace, logfold, lockdeps, dep-docs, recent, hot,",
+    "  snapshot-snapshot, baseline, cost, coverage-report-gaps, clean-cache,",
+    "  cache-audit, reclaim-index, project",
+    "",
+    "Session: stats, waste, session-outline, session-audit, session-slice,",
+    "  session-summary, context-stats, bootstrap-audit, memory, hint-stats,",
+    "  mcp-audit",
+    "",
+    "Skills: skill-body, skill-compact, skill-list, skill-size, skill-history,",
+    "  skill-diff, skill-section",
+    "",
+    "Compression: compress-text, retrieve, handoff-create, handoff-resolve,",
+    "  compress, recall, bash-output, web-output, mcp-output, compress-text,",
+    "  compress",
+    "",
+    "Config & Integration: install, uninstall, mcp-serve, mcp-status, hook,",
+    "  bridges-status, worker, statusline, version, config, config-get, help",
+    "",
+    "Data: note, note-add, note-get, note-list, sqlite-query, sqlite-schema,",
+    "  csv-profile, csv-query",
+    "",
+    "Utils: ignores, bash-history, web-history, openapi-op, openapi-outline,",
+    "  gdrive-sections, screenshot, opencode-*, fetch-image, image-meta,",
+    "  image-text, start, stop, resume, replace, insert-section, pr-slice,",
+    "  sharepoint-resolve, transcript, transcript-outline, video-chapters,",
+    "  write-file, zip-list, zip-read, mcp-history, compact-doc, compact-hint,",
+    "  conflicts, prune-cache",
+    "",
+    "Tip: look up one command instead of this whole list: 'token-goat help <command>', or 'token-goat commands --grep <pattern>' anchored ('^read$' ~700B; bare 'read' matches descriptions too, ~7KB).",
+    ""
+  ];
+  return lines.join("\n");
+}
 function buildProgram() {
   const program2 = new Command();
   program2.name("token-goat").description("Surgical token-reduction companion for AI coding agents").version(VERSION, "-v, --version", "print the token-goat version").option("--cwd <path>", "run as if invoked from this directory (overrides the real working directory)");
@@ -17047,6 +17484,15 @@ function buildProgram() {
   worker.command("stop").description("stop the background indexer").action(guard(cmdWorkerStop));
   worker.command("status").description("check if the indexer is running").action(guard(cmdWorkerStatus));
   program2.command("stats").description("show session statistics (bare = totals only; --full for the breakdown)").option("-j, --json", "output as JSON").option("--full", "show the full breakdown (by source, by command, by day)").option("--short", "force the rich short KPI view even when stdout is not a TTY (e.g. piped)").option("--methodology", "explain local savings estimates and their billing limits").option("--window-days <days>", "days to include (0 = all time)", "30").option("--home-dir <path>", "home directory (for testing)").action(guard(cmdStats));
+  program2.command("reconcile").description("sweep this project for files that changed while token-goat was not watching, and queue them for reindexing").option("--dry-run", "report the drift without queueing anything").option("--budget-ms <ms>", `wall-clock budget for the sweep (default ${DEFAULT_RECONCILE_BUDGET_MS})`).option("-j, --json", "output as JSON").action(
+    (opts) => runExit(
+      () => runReconcile({
+        ...opts.dryRun === true ? { dryRun: true } : {},
+        ...opts.budgetMs !== void 0 ? { budgetMs: requireNonNegativeInt("--budget-ms", opts.budgetMs) } : {},
+        ...opts.json === true ? { json: true } : {}
+      })
+    )
+  );
   program2.command("doctor").description("diagnose token-goat health").option("--context", "include context footprint analysis").option("--json", "emit check results as JSON instead of text").action(guard(cmdDoctor));
   program2.command("context-stats").description("show context statistics").option("--project <path>", "project root to analyze").option("-j, --json", "output as JSON").option("--fix", "apply automatic fixes (confirm-gated; shows a diff before writing)").option("-y, --yes", "with --fix, apply without prompting (non-interactive / scripted use)").action(guard(cmdContextStats));
   program2.command("bootstrap-audit").description("audit Claude Code startup-context contributors without reading prompt bodies").option("--project <path>", "project root to analyze").option("--home <path>", "home directory override (for CI/testing)").option("--follow-links", "follow external symlink/junction roots and direct children").option("-j, --json", "output as JSON").option("--top <n>", "largest metadata entries to show (default 10)", "10").option("--warn-tokens <n>", "warn when total estimated startup tokens exceed n").option("--fail-tokens <n>", "fail when total estimated startup tokens exceed n").option("--warn-bytes <n>", "warn when agent/skill metadata bytes exceed n").option("--fail-bytes <n>", "fail when agent/skill metadata bytes exceed n").action(guard(cmdBootstrapAudit));
@@ -17197,10 +17643,22 @@ function buildProgram() {
       })
     )
   );
-  program2.command("arch").description("internal import graph analysis: hubs, entry points, cycles").option("--top <n>", "limit hubs and entry points to top N (default 10)").option("-j, --json", "output as JSON").action(
+  program2.command("arch").description("internal import graph analysis: hubs, entry points, cycles, and with --modules the groups of files that mostly import each other").option("--top <n>", "limit hubs, entry points, modules and cross-module pairs to top N (default 10)").option("--modules", "also group files into modules by who imports whom, and report which modules reach into which (--json carries the full member list of each)").option("-j, --json", "output as JSON").action(
     (opts) => runExit(
       () => runArch({
         ...opts.top !== void 0 ? { top: requireNonNegativeInt("--top", opts.top) } : {},
+        ...opts.json === true ? { json: true } : {},
+        ...opts.modules === true ? { modules: true } : {}
+      })
+    )
+  );
+  program2.command("affected [files...]").description("test files that transitively import the given changed files (for narrowing a CI run)").option("--stdin", "read the changed-file list from stdin, one path per line").option("--depth <n>", `max reverse-import hops (default ${DEFAULT_AFFECTED_DEPTH})`).option("--filter <regex>", "regex deciding which reached files count as tests (default: the built-in test-file heuristic)").option("-q, --quiet", "print bare paths only, for piping into a test runner").option("-j, --json", "output as JSON").action(
+    (files, opts) => runExit(
+      () => runAffected({
+        files: opts.stdin === true ? [...files, ...readStdinPaths()] : files,
+        ...opts.depth !== void 0 ? { depth: requireNonNegativeInt("--depth", opts.depth) } : {},
+        ...opts.filter !== void 0 ? { filter: opts.filter } : {},
+        ...opts.quiet === true ? { quiet: true } : {},
         ...opts.json === true ? { json: true } : {}
       })
     )
@@ -17425,8 +17883,24 @@ function buildProgram() {
       out(VERSION);
     })
   );
-  const footer = "\nTip: look up one command instead of this whole list: 'token-goat help <command>', or 'token-goat commands --grep <pattern>' anchored ('^read$' ~700B; bare 'read' matches descriptions too, ~7KB).\n";
-  program2.addHelpText("after", footer);
+  program2.command("help [command]").description("show help for a command").option("--full", "show full original help instead of compact summary").action(
+    guard((cmd, opts) => {
+      const options = opts;
+      if (options?.["full"] && !cmd) {
+        out(originalHelpInformation ? originalHelpInformation() : generateCompactHelp());
+        return;
+      }
+      if (cmd) {
+        const argv = [process.argv[0] ?? "node", process.argv[1] ?? "token-goat", cmd, "--help"];
+        program2.parse(argv);
+      } else {
+        out(generateCompactHelp());
+      }
+    })
+  );
+  program2.helpOption("-h, --help", "display help for command");
+  originalHelpInformation = program2.helpInformation.bind(program2);
+  program2.helpInformation = () => generateCompactHelp();
   return program2;
 }
 function applyExitOverride(command) {