token-goat 2.8.6 → 2.9.2

package/dist/{token-goat-chunk-L2XHDICZ.mjs → token-goat-chunk-NY4HYRSK.mjs}

@@ -1,20 +1,23 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
+import {
+  deliveredOutputBytes,
+  wrappedShell
+} from "./token-goat-chunk-CGWACYYZ.mjs";
 import {
   ToolFilter,
   capTokens,
   combineStreams,
   compressOutput,
+  compressedTokensSaved,
+  dispatchArgv,
   filterByName,
+  loadConfig,
+  recordStat,
   resolveMinNetSavingsBytes,
   selectFilter,
-  shlexSplit,
-  wrappedShell
-} from "./token-goat-chunk-GUNYAGOZ.mjs";
-import {
-  loadConfig,
-  recordStat
-} from "./token-goat-chunk-2JZ66BBE.mjs";
+  shlexSplit
+} from "./token-goat-chunk-UZ2NFOOZ.mjs";
 import "./token-goat-chunk-AO2QD2AG.mjs";
 import "./token-goat-chunk-AEX54RUZ.mjs";
 
@@ -28,17 +31,19 @@ var DEFAULT_TIMEOUT_SECONDS = 600;
 var MAX_CAPTURE_BYTES = 32 * 1024 * 1024;
 var MIN_RECORD_STAT_BYTES = 32;
 function resolveFilter(command, filterName, cwd) {
-  if (filterName) {
-    const named = filterByName(filterName);
-    if (named !== null) return named;
-  }
-  let argv;
+  let split;
   try {
-    argv = shlexSplit(command);
+    split = shlexSplit(command);
   } catch {
-    return null;
+    split = null;
+  }
+  const argv = split === null ? [command] : dispatchArgv(split, cwd).argv;
+  if (filterName) {
+    const named = filterByName(filterName);
+    if (named !== null) return { filter: named, argv };
   }
-  return selectFilter(argv, cwd);
+  if (split === null) return { filter: null, argv };
+  return { filter: selectFilter(split, cwd), argv };
 }
 function baseSpawnOptions(timeout, cwd, env) {
   return { shell: wrappedShell(), timeout: timeout * 1e3, cwd, env };
@@ -66,14 +71,14 @@ function resolveCompressLimits() {
 }
 function run(command, opts = {}) {
   const timeout = opts.timeout ?? DEFAULT_TIMEOUT_SECONDS;
-  const filter = resolveFilter(command, opts.filterName, opts.cwd);
+  const { filter, argv } = resolveFilter(command, opts.filterName, opts.cwd);
   if (filter === null) {
     if ((opts.maxTokens ?? 0) > 0) {
-      return wrapAndCompress(command, new IdentityFilter(), timeout, resolveProfile(opts.compressionProfile), opts);
+      return wrapAndCompress(command, argv, new IdentityFilter(), timeout, resolveProfile(opts.compressionProfile), opts);
     }
     return passthrough(command, timeout, opts.cwd, opts.env);
   }
-  return wrapAndCompress(command, filter, timeout, resolveProfile(opts.compressionProfile), opts);
+  return wrapAndCompress(command, argv, filter, timeout, resolveProfile(opts.compressionProfile), opts);
 }
 function runRaw(command, timeout = DEFAULT_TIMEOUT_SECONDS) {
   return passthrough(command, timeout, void 0, void 0);
@@ -92,7 +97,7 @@ function decode(buf) {
   if (buf == null) return "";
   return typeof buf === "string" ? buf : buf.toString("utf8");
 }
-function wrapAndCompress(command, filter, timeout, profile, opts) {
+function wrapAndCompress(command, argv, filter, timeout, profile, opts) {
   const writeStdout = opts.writeStdout ?? ((s) => process.stdout.write(s));
   const result = spawnSync(command, {
     ...baseSpawnOptions(timeout, opts.cwd, opts.env),
@@ -118,12 +123,6 @@ function wrapAndCompress(command, filter, timeout, profile, opts) {
   } else {
     exitCode = 0;
   }
-  let argv;
-  try {
-    argv = shlexSplit(command);
-  } catch {
-    argv = [command];
-  }
   const limits = resolveCompressLimits();
   const compressed = compressOutput(filter, stdoutText, stderrText, exitCode, argv, {
     compressionProfile: profile,
@@ -142,8 +141,10 @@ function wrapAndCompress(command, filter, timeout, profile, opts) {
   return exitCode;
 }
 function recordSavings(result) {
-  if (result.bytesSaved < MIN_RECORD_STAT_BYTES) return;
-  recordStat(`bash_compress:${result.filterName}`, result.bytesSaved, result.tokensSaved);
+  const delivered = deliveredOutputBytes(result.originalBytes);
+  const bytesSaved = Math.max(0, delivered - result.compressedBytes);
+  if (bytesSaved < MIN_RECORD_STAT_BYTES) return;
+  recordStat(`bash_compress:${result.filterName}`, bytesSaved, compressedTokensSaved(bytesSaved));
 }
 export {
   DEFAULT_TIMEOUT_SECONDS,

package/dist/{token-goat-chunk-MA5237JN.mjs → token-goat-chunk-Q4LOQY44.mjs}

@@ -1,32 +1,26 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
-  BASH_OUTPUT_SUBDIR,
+  DEFAULT_RECONCILE_BUDGET_MS,
   HOOK_EVENTS,
   accumulateResidentLines,
   buildCommandManifest,
   checkSymbolBodySize,
-  commandHash,
   flattenCommandNames,
-  getBashOutput,
   getWebOutput,
-  indexRecallEntry,
-  isBashEntryStale,
-  isScopedGitStatusOrDiffStatCommand,
+  isReconcileClean,
   lineMayCarryResidentSignal,
   normalizePayload,
   readStdinJson,
   readTranscriptTail,
+  reconcileProject,
   repeatedSkillBodyHint,
-  storeBashOutput,
   storeWebOutput,
-  summarizeOutputDelta,
   summarizeResidentContext,
   taskListPruneHint
-} from "./token-goat-chunk-TELKICYU.mjs";
+} from "./token-goat-chunk-VCNW7BGU.mjs";
 import {
-  BODY_FIRST_TOOL_RESPONSE_KEYS,
-  OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
+  BASH_OUTPUT_SUBDIR,
   UNTRUSTED_TOOL_TAG,
   WEB_FETCH_KEY_SEP,
   appendDirtyPath,
@@ -36,51 +30,45 @@ import {
   classifyBashHint,
   classifyEditHint,
   clearCurlDownload,
+  commandHash,
   compactPathFor,
   computeAdaptiveBudget,
-  contextOutput,
   countSymbols,
-  denyOutput,
-  emitRewrite,
-  emitRewriteIfChanged,
   enqueueDirtyPathSafe,
   ensureWorkerAlive,
   estimateTokens,
   extractCompactFromMarker,
-  extractToolResponseField,
-  extractToolResultText,
   fenceWithMatches,
   formatProjectMap,
   formatShrinkSummary,
+  getBashOutput,
   getBashOutputId,
   getContextPressure,
   getCurlDownloadPath,
-  getCwd,
   getFileLineRanges,
-  getFilePath,
+  getFileServedOutputs,
   getGlobMatchCount,
   getGrepMatchCount,
-  getLastTabContext,
   getMonitoringRecallHint,
   getOutstandingAgentSpawns,
   getSessionBashOutputs,
   getSessionBashReruns,
   getSessionFiles,
   getSessionWebFetches,
-  getToolInput,
-  getToolName,
   hasSeenImage,
   hasSessionOutput,
   imageQualifiesForShrink,
   incrementSkillHit,
+  indexRecallEntry,
   installedSkillPath,
+  isBashEntryStale,
   isBuildCommand,
-  isMcpErrorResponse,
+  isScopedGitStatusOrDiffStatCommand,
   isTestRunnerCommand,
+  lastTabContextMatches,
   listSiblingSessionStates,
   loadSessionCache,
   loadSessionState,
-  makeDedupHintHandlers,
   markCompactStale,
   markCompacted,
   markFileTruncated,
@@ -88,7 +76,7 @@ import {
   matchesAllowPattern,
   matchesDenyPattern,
   meetsSavingsFloor,
-  passOutput,
+  metadataEndpointRefusal,
   probeImageMeta,
   recordBashOutput,
   recordBashRerun,
@@ -97,6 +85,7 @@ import {
   recordFileEdit,
   recordFileLineRange,
   recordFileRead,
+  recordFileServedOutput,
   recordGlobQuery,
   recordGrepQuery,
   recordKnownRootThrottled,
@@ -105,58 +94,125 @@ import {
   recordSeenImage,
   recordSymbolRead,
   recordWebFetch,
-  registerHook,
   removeOutstandingAgentSpawn,
-  runHook,
   saveSessionState,
   scanAndRecord,
-  serializeOutput,
   sessionOutputBodyBytes,
   sessionSidecarPath,
   setLastTabContext,
   shrinkImage,
+  storeBashOutput,
   storeBlob,
   storeOutput,
+  summarizeOutputDelta,
   takePendingLargeFileHint,
   visionTokens,
   visionTokensSaved,
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-DK4VLLYB.mjs";
+} from "./token-goat-chunk-LJ3CHCTT.mjs";
 import {
   canRunWrappedShell,
-  compressOutput,
-  dedupeConsecutive,
-  detectFromCommand,
-  filterByName,
-  hasBareBackgroundOrNewline,
-  isRewriteWorthwhile,
-  resolveMinNetSavingsBytes,
-  shlexSplit
-} from "./token-goat-chunk-GUNYAGOZ.mjs";
+  deliveredOutputBytes
+} from "./token-goat-chunk-CGWACYYZ.mjs";
 import {
+  BODY_FIRST_TOOL_RESPONSE_KEYS,
+  ENV_KEYS,
+  IDENTICAL_READ_MIN_BODY_BYTES,
+  OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
   PER_FILE_COUNTERFACTUAL_CEILING,
   VERSION,
+  compressOutput,
+  containsLineRun,
+  contextOutput,
+  countNoun,
+  dedupeConsecutive,
+  denyOutput,
+  detectFromCommand,
   detectHarness,
   detectLanguage,
   displaySafePath,
+  emitRewrite,
+  emitRewriteIfChanged,
+  envBool,
+  envInt,
   extractErrorMessage,
+  extractToolResponseField,
+  extractToolResultText,
+  filterByName,
   foldPath,
+  getCwd,
   getDb,
+  getFilePath,
   getHarnessName,
+  getToolInput,
+  getToolName,
   globalDbPath,
+  hasBareBackgroundOrNewline,
+  isMcpErrorResponse,
+  isRewriteWorthwhile,
   isUnderSystemTemp,
   loadConfig,
+  makeDedupHintHandlers,
   normalizePath,
+  passOutput,
   recordStat,
   redactSecrets,
+  registerHook,
   resolveIndexPath,
+  resolveMinNetSavingsBytes,
   runGit,
+  runHook,
   savedTokensFromBytes,
+  serializeOutput,
+  sessionStateKey,
+  shlexSplit,
   shortFingerprint,
+  stripAnsiEscapes,
   toKB
-} from "./token-goat-chunk-2JZ66BBE.mjs";
+} from "./token-goat-chunk-UZ2NFOOZ.mjs";
+
+// src/hint_suggestion_guard.ts
+function looksLikeSuggestion(slice) {
+  return slice.includes('"');
+}
+var SAFE_OUTSIDE_QUOTES = /^[A-Za-z0-9 \t_./=:,@+-]*$/;
+var CONTROL_OR_BIDI = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F\u200E\u200F\u202A-\u202E\u2066-\u2069\u061C\u200B-\u200D\u2028\u2029\uFE00-\uFE0F]|[\u{E0000}-\u{E007F}]/u;
+function suggestionIsUnsafe(slice) {
+  if (slice.includes("$") || slice.includes("\n") || slice.includes("\r") || slice.includes("`")) return true;
+  if (CONTROL_OR_BIDI.test(slice)) return true;
+  const regions = slice.split('"');
+  if (regions.length % 2 === 0) return true;
+  for (let i = 2; i < regions.length; i += 2) {
+    if (!SAFE_OUTSIDE_QUOTES.test(regions[i] ?? "")) return true;
+  }
+  return false;
+}
+var OMITTED = "token-goat (command omitted: the path contains shell metacharacters)";
+function stripUnsafeSuggestions(text) {
+  if (!text.includes("token-goat ")) return text;
+  let out = "";
+  let at = 0;
+  for (; ; ) {
+    const start = text.indexOf("token-goat ", at);
+    if (start === -1) return out + text.slice(at);
+    const lineBreak = text.slice(start).search(/[\r\n]/);
+    const line = lineBreak === -1 ? text.slice(start) : text.slice(start, start + lineBreak);
+    const firstTick = line.indexOf("`");
+    const narrow = firstTick === -1 ? line : line.slice(0, firstTick);
+    out += text.slice(at, start);
+    if (!looksLikeSuggestion(narrow) || !suggestionIsUnsafe(narrow)) {
+      out += narrow;
+      at = start + narrow.length;
+      continue;
+    }
+    const lastTick = line.lastIndexOf("`");
+    const wide = lastTick === -1 ? line : line.slice(0, lastTick);
+    out += OMITTED;
+    at = start + wide.length;
+  }
+}
 
 // src/hooks_grep.ts
 function grepIntInput(toolInput, key) {
@@ -631,7 +687,7 @@ import crypto from "node:crypto";
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-SHN4UTL4.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-JMUBXBG7.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -887,23 +943,47 @@ registerHook("post_tool_use", pendingContextHandler, { advisory: true, followsMa
 // src/hooks_session_start.ts
 var GENERIC_REMINDER = 'token-goat: prefer surgical reads over the Read/Grep tools on this codebase; shell commands like `rg`, `grep`, `fd`, `sed`, `cat`, `find`, and `ls` are just commands, not tool names -- `token-goat symbol <name>`, `token-goat read "file::symbol"`, `token-goat section "file::Heading"`, `token-goat semantic "description"`, `token-goat outline <file>`. Run `token-goat index .` if this project is not indexed yet.';
 var INDEXED_REMINDER = 'token-goat: this project is indexed. Prefer `symbol <name>`, `read "file::symbol"`, `section "file::Heading"`, `semantic "description"`, or `outline <file>` over a full Read/Grep tool call; for JSON/YAML use `json-query file \'a.b.c\'` or `yaml-query` (nested keys are not symbols); shell commands like `rg`, `grep`, `fd`, `sed`, `cat`, `find`, and `ls` are still just commands.';
-function buildReminder(cwd) {
-  if (cwd === void 0) return GENERIC_REMINDER;
-  let symbolCount;
+function isIndexedProject(cwd) {
+  if (cwd === void 0) return false;
   try {
-    symbolCount = countSymbols({ rootDir: cwd }, globalDbPath());
+    return countSymbols({ rootDir: cwd }, globalDbPath()) > 0;
+  } catch {
+    return false;
+  }
+}
+function buildReminder(indexed) {
+  return indexed ? INDEXED_REMINDER : GENERIC_REMINDER;
+}
+function reconcileNote(cwd, indexed) {
+  if (!indexed) return null;
+  if (!envBool(ENV_KEYS.RECONCILE, true)) return null;
+  try {
+    const budgetMs = envInt(ENV_KEYS.RECONCILE_BUDGET_MS, DEFAULT_RECONCILE_BUDGET_MS, 0, 6e4);
+    const result = reconcileProject({ cwd, budgetMs });
+    if (isReconcileClean(result)) return null;
+    const parts = [];
+    if (result.changed.length > 0) parts.push(`${result.changed.length} changed`);
+    if (result.added.length > 0) parts.push(`${result.added.length} new`);
+    if (result.removed.length > 0) parts.push(`${result.removed.length} removed`);
+    const breakdown = parts.length > 1 ? ` (${parts.join(", ")})` : "";
+    const truncated = result.budgetExhausted ? ` (sweep stopped at its time budget with ${countNoun(result.unscanned, "file")} unchecked, so there may be more)` : "";
+    const total = result.changed.length + result.added.length + result.removed.length;
+    return `token-goat: reindexing ${countNoun(total, "file")} that changed outside this session${breakdown}${truncated}. Symbol lookups may be briefly stale.`;
   } catch {
-    return GENERIC_REMINDER;
+    return null;
   }
-  if (symbolCount <= 0) return GENERIC_REMINDER;
-  return INDEXED_REMINDER;
 }
 function sessionStartHandler(event) {
   try {
     if (!loadConfig().hints.session_start_reminder) return passOutput();
     const cwd = getCwd(event);
-    let context = buildReminder(cwd);
+    const indexed = isIndexedProject(cwd);
+    let context = buildReminder(indexed);
     if (cwd !== void 0) {
+      const drift = reconcileNote(cwd, indexed);
+      if (drift !== null) context += `
+
+${drift}`;
       const capsule = buildDeltaCapsule(cwd);
       if (capsule !== null) context += `
 
@@ -5180,7 +5260,7 @@ function resolveCyclicReferences(value, utils, meta) {
   }
   const hierarchy = getMetaDataHierarchy(meta);
   const depth = getCyclicReferenceDepth(value, hierarchy, 0);
-  if (depth > 0 && hierarchy !== void 0) {
+  if (hierarchy !== void 0 && depth > 0) {
     return hierarchy[hierarchy.length - depth]?.result;
   }
   const type = getObjectType(value);
@@ -6997,6 +7077,10 @@ function preFetchHandler(event) {
   try {
     const urlOnlyCtx = resolveWebFetchUrl(event);
     if (urlOnlyCtx !== null) {
+      const metadataRefusal = metadataEndpointRefusal(urlOnlyCtx.url);
+      if (metadataRefusal !== null) {
+        return denyOutput(`WebFetch blocked: ${metadataRefusal}.`);
+      }
       const wfCfg = loadConfig().webfetch;
       if (wfCfg.deny.length > 0 && matchesDenyPattern(urlOnlyCtx.url, wfCfg.deny)) {
         return denyOutput(`WebFetch blocked: URL matches a configured webfetch.deny pattern.`);
@@ -7130,7 +7214,7 @@ async function preSkillHandler(event) {
       const denyCredit = cachedBytes !== null ? Math.min(cachedBytes, PER_FILE_COUNTERFACTUAL_CEILING) : 0;
       recordStat("session_hint", denyCredit, savedTokensFromBytes(denyCredit));
       return denyOutput(
-        "Skill `" + skillName + "` was already loaded this session and is cached. Use `token-goat skill-body " + skillName + " --compact` to recall the compact slice (or `token-goat skill-body " + skillName + "` for the full body) instead of re-loading it."
+        "Skill `" + skillName + "` was already loaded this session and is cached. Use `token-goat skill-section " + skillName + " '<heading>'` to recall a section, `token-goat skill-body " + skillName + " --compact` to recall the compact slice, or `token-goat skill-body " + skillName + "` for the full body instead of re-loading it."
       );
     }
     const sourcePath = await installedSkillPath(skillName);
@@ -7145,12 +7229,12 @@ async function preSkillHandler(event) {
             const savedBytes = bodyBytes - compactBytes;
             recordStat("skill_compact_inlined", savedBytes, savedTokensFromBytes(savedBytes));
             return denyOutput(
-              "Skill `" + skillName + "` is large (" + bodyBytes + " bytes); its compact slice (" + compactBytes + " bytes) is inlined below instead of the full body. Run `token-goat skill-body " + skillName + "` if you need the full body.\n\n" + compact
+              "Skill `" + skillName + "` is large (" + bodyBytes + " bytes); its compact slice (" + compactBytes + " bytes) is inlined below instead of the full body. For a specific section, run `token-goat skill-section " + skillName + " '<heading>'`, or `token-goat skill-body " + skillName + "` if you need the full body.\n\n" + compact
             );
           }
           recordStat("skill_oversized_first_load");
           return denyOutput(
-            "Skill `" + skillName + "` is large (" + bodyBytes + " bytes) and has a compact slice available. Use `token-goat skill-body " + skillName + " --compact` to load the compact slice instead of the full body."
+            "Skill `" + skillName + "` is large (" + bodyBytes + " bytes) and has a compact slice available. Use `token-goat skill-section " + skillName + " '<heading>'` to load a specific section, `token-goat skill-body " + skillName + " --compact` to load the compact slice, or `token-goat skill-body " + skillName + "` for the full body."
           );
         }
       } catch {
@@ -8383,6 +8467,40 @@ function maybeCompressRewrite(event, rawCmd, cmd) {
   const wrapped = `token-goat compress -f ${filterName} --timeout ${cfg.timeout_seconds} -c ${shellQuoteSingle(rawCmd)}`;
   return { hookType: "rewriteInput", updatedInput: { ...event.toolInput, command: wrapped } };
 }
+function pureFileReadPath(cmd) {
+  return extractCatFile(cmd)?.filePath ?? extractHeadFile(cmd)?.filePath ?? extractTailFile(cmd)?.filePath ?? extractLineRangeRead(cmd)?.filePath ?? null;
+}
+async function maybeCollapseIdenticalRead(cmd, output, exitCode, cwd, cacheMinBytes) {
+  if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
+  if (exitCode !== null && exitCode !== 0) return null;
+  const filePath = pureFileReadPath(cmd);
+  if (filePath === null) return null;
+  const originalBytes = Buffer.byteLength(output, "utf-8");
+  if (originalBytes < Math.max(cacheMinBytes, IDENTICAL_READ_MIN_BODY_BYTES)) return null;
+  const fileKey = resolveIndexPath(filePath, cwd ?? process.cwd());
+  const priorIds = getFileServedOutputs(fileKey);
+  let containerId = null;
+  let identical = false;
+  for (let i = priorIds.length - 1; i >= 0; i--) {
+    const id = priorIds[i];
+    if (id === void 0) continue;
+    const prior = getBashOutput(id);
+    if (prior === null || !containsLineRun(prior.output, output)) continue;
+    containerId = id;
+    identical = prior.output === output;
+    break;
+  }
+  const sessionKey = shortFingerprint(stripOutputPipeline(cmd));
+  if (containerId === null) {
+    const storedId = await storeBashOutput(cmd, output, exitCode ?? 0, cwd);
+    recordBashOutput(sessionKey, storedId, originalBytes);
+    recordFileServedOutput(fileKey, storedId);
+    return null;
+  }
+  const pointer = identical ? "[token-goat] Identical to an earlier run of this command in this session; the file has not changed since. " + originalBytes + " bytes withheld -- recall them with `token-goat bash-output " + containerId + "`." : "[token-goat] These " + originalBytes + " bytes already appear verbatim inside a wider read of " + filePath + " served earlier in this session. Withheld -- recall the full earlier output with `token-goat bash-output " + containerId + "`.";
+  if (!isRewriteWorthwhile({ originalBytes, rewrittenBytes: Buffer.byteLength(pointer, "utf-8"), noticeBytes: 0, minNetSavingsBytes: resolveMinNetSavingsBytes() })) return null;
+  return emitRewrite(pointer, identical ? "identical file re-read collapsed" : "already-served file lines collapsed", { kind: identical ? "bash_compress:identical-reread" : "bash_compress:contained-reread", originalBytes: deliveredOutputBytes(originalBytes) });
+}
 async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes) {
   if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
   if (isCompressibleSingleCommand(cmd)) return null;
@@ -8415,7 +8533,28 @@ async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinB
     return null;
   }
   await storeBashOutput(cmd, output, exitCode ?? 0, cwd);
-  return emitRewrite(body, "bash", { kind: "bash_compress:generic", originalBytes: compressed.originalBytes });
+  return emitRewrite(body, "bash", { kind: "bash_compress:generic", originalBytes: deliveredOutputBytes(compressed.originalBytes) });
+}
+function maybeStripAnsiOnly(output) {
+  if (!output.includes("\x1B")) return null;
+  let cfg;
+  try {
+    cfg = loadConfig().bash_compress;
+  } catch {
+    return null;
+  }
+  if (!cfg.enabled || cfg.disabled_filters.includes("ansi")) return null;
+  const stripped = stripAnsiEscapes(output);
+  const originalBytes = Buffer.byteLength(output, "utf-8");
+  if (!isRewriteWorthwhile({
+    originalBytes,
+    rewrittenBytes: Buffer.byteLength(stripped, "utf-8"),
+    noticeBytes: 0,
+    minNetSavingsBytes: resolveMinNetSavingsBytes()
+  })) {
+    return null;
+  }
+  return emitRewrite(stripped, "ansi escapes stripped", { kind: "bash_compress:ansi", originalBytes: deliveredOutputBytes(originalBytes) }, "counted-elsewhere");
 }
 function unwrapCompressCommand(executed) {
   const t = executed.trim();
@@ -9102,9 +9241,11 @@ async function postBashHandler(event) {
     }
     const isMonitoring = getMonitoringRecallHint(cmd) !== null;
     if (!isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) {
+      const identical = await maybeCollapseIdenticalRead(cmd, output, exitCode, cwd, cacheMinBytes);
+      if (identical !== null) return identical;
       const compound = await maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes);
       if (compound !== null) return compound;
-      return passOutput();
+      return maybeStripAnsiOnly(output) ?? passOutput();
     }
     if (Buffer.byteLength(output, "utf-8") < cacheMinBytes) return passOutput();
     const cacheKey = isCurlGetCommand(cmd) ? extractCurlUrl(cmd) ?? cmd : stripOutputPipeline(cmd);
@@ -9121,6 +9262,8 @@ async function postBashHandler(event) {
         return contextOutput(delta + " \u2014 full output: bash-output " + id);
       }
     }
+    const ansiOnly = maybeStripAnsiOnly(output);
+    if (ansiOnly !== null) return ansiOnly;
   } catch {
   }
   return passOutput();
@@ -10007,7 +10150,7 @@ ${dataUrl}`, changed: true, savedBytes: saved, savedTokens };
 var TAB_CONTEXT_UNCHANGED_NOTICE = "(tabs unchanged since last check)";
 function dedupTabContext(text) {
   if (!TAB_CONTEXT_RE.test(text)) return { text, changed: false };
-  const isRepeat = getLastTabContext() === text;
+  const isRepeat = lastTabContextMatches(text);
   setLastTabContext(text);
   if (!isRepeat) return { text, changed: false };
   const worthwhile = isRewriteWorthwhile({
@@ -10427,9 +10570,6 @@ function buildEvent(eventName, payload) {
   const tracestate = typeof rawTracestate === "string" && rawTracestate.trim() !== "" ? rawTracestate.trim() : void 0;
   return { eventName, toolName, toolInput, sessionId, agentId, traceparent, tracestate, raw: obj };
 }
-function sessionStateKey(event) {
-  return event.agentId !== void 0 ? `${event.sessionId}:agent:${event.agentId}` : event.sessionId;
-}
 function harnessForNormalization() {
   const detected = detectHarness();
   if (detected === "codex") return "codex";
@@ -10440,6 +10580,11 @@ function harnessForNormalization() {
   if (detected === "copilot_cli") return "copilot_cli";
   return "claude";
 }
+function safeSuggestions(output) {
+  if (output.hookType === "deny") return { hookType: "deny", message: stripUnsafeSuggestions(output.message) };
+  if (output.hookType === "context") return { hookType: "context", context: stripUnsafeSuggestions(output.context) };
+  return output;
+}
 async function relayInProcess(eventName, rawPayload) {
   try {
     if (!isHookEventName(eventName)) {
@@ -10462,12 +10607,12 @@ async function relayInProcess(eventName, rawPayload) {
       loadSessionState(stateKey);
     } catch {
     }
-    const output = await runHook(event);
+    const output = safeSuggestions(await runHook(event));
     try {
       saveSessionState(stateKey);
     } catch {
     }
-    return serializeOutput(output, event.eventName, harness);
+    return serializeOutput(output, event.eventName, harness, event);
   } catch {
     return "{}";
   }