token-goat 2.9.12 → 2.9.13

package/dist/token-goat-hook.mjs

@@ -2,13 +2,15 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-THLHC6QJ.mjs";
-import "./token-goat-chunk-6NIGPPN6.mjs";
-import "./token-goat-chunk-A6QTLAWO.mjs";
-import "./token-goat-chunk-GM6QZWCF.mjs";
-import "./token-goat-chunk-TOGYS5A7.mjs";
+} from "./token-goat-chunk-QWSUZWFP.mjs";
+import "./token-goat-chunk-2WC4ZUXN.mjs";
+import "./token-goat-chunk-FQCNJV4V.mjs";
+import "./token-goat-chunk-ZZI3IDQZ.mjs";
+import "./token-goat-chunk-JOXLE672.mjs";
+import "./token-goat-chunk-UM47DRD3.mjs";
+import "./token-goat-chunk-UMXJN7DI.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
-import "./token-goat-chunk-LOCOX2ML.mjs";
+import "./token-goat-chunk-QKXBGBQR.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";

package/dist/token-goat.core.mjs

@@ -2,16 +2,19 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-GCXX67HM.mjs";
-import "./token-goat-chunk-4CK445AW.mjs";
-import "./token-goat-chunk-6F5TLJC7.mjs";
-import "./token-goat-chunk-A6QTLAWO.mjs";
-import "./token-goat-chunk-GM6QZWCF.mjs";
-import "./token-goat-chunk-TOGYS5A7.mjs";
+} from "./token-goat-chunk-3ESRORNM.mjs";
+import "./token-goat-chunk-FQCNJV4V.mjs";
+import "./token-goat-chunk-U7X6LQD2.mjs";
+import "./token-goat-chunk-ZZI3IDQZ.mjs";
+import "./token-goat-chunk-JOXLE672.mjs";
+import "./token-goat-chunk-YOA4N6WA.mjs";
+import "./token-goat-chunk-UM47DRD3.mjs";
+import "./token-goat-chunk-UMXJN7DI.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
+import "./token-goat-chunk-B3CTCQTH.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-LOCOX2ML.mjs";
+} from "./token-goat-chunk-QKXBGBQR.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";

package/docs/cli.md

@@ -66,6 +66,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat types ["file"]` | List type definitions (TypedDict, Protocol, dataclass, Pydantic models) in a file or across the project. `--grep <pattern>` only shows type declarations whose NAME matches this regex (literal substring if it is not valid regex), applied before output is built; when it matches nothing among declarations that do exist, the output names the active filter instead of reading like there are none. `--exclude-tests` hides type declarations DEFINED in a test file (opt-in — omitted, output is unchanged), the same definition-site sense `dead --exclude-tests` uses. Applied before the per-kind `--limit` slice, so the flag selects from the whole matching set rather than an already-capped page; when it hides every declaration there was, the output names how many were hidden and exits 0, instead of the exit-1 `No type declarations found` a genuinely empty scope returns. `--json`'s `filePath` renders root-relative when a project root resolves, absolute when none does, matching plain-text output. `--json` emits the shared `{items, truncated, totalCount}` envelope — the same shape `symbol`/`refs`/`skeleton`/`outline --json` return, present whether or not truncation occurred, so a script never has to branch on shape. |
 | `token-goat openapi-outline <spec>` | Per-operation listing (method, path, operationId, summary, tags) of an OpenAPI 3.x / Swagger 2.0 spec (JSON or YAML) instead of a raw Read. |
 | `token-goat openapi-op <spec> <operation>` | Full detail (parameters, request body schema, response schemas, description) for exactly one OpenAPI operation instead of a raw Read. `operation` may be an operationId (exact match) or a `"METHOD path"` spec, e.g. `"GET /users/{id}"`. |
+| `token-goat sqlite-tables <db> [--json]` | Ultra-compact overview of tables, views, row counts, and column counts in a SQLite database instead of a raw Read. |
 | `token-goat sqlite-schema <db>` | Tables/views, columns, indexes, foreign keys, and row counts of a SQLite database instead of a raw Read. |
 | `token-goat sqlite-query <db> "<SELECT ...>"` | Run a read-only `SELECT` against a SQLite database instead of a raw Read or shelling out to `sqlite3` — rejects any non-`SELECT` statement. |
 | `token-goat imports "file"` | Show the import graph for a file one level deep. Accepts a comma-separated file list (`"a,b,c"`) to cover several files in one call, one clearly-headed block per file; extra space-separated file arguments are reported in a note naming that comma form instead of being silently dropped. `--grep <pattern>` only shows imports whose MODULE SPECIFIER matches this regex (literal substring if it is not valid regex), applied before `--json`'s truncation; when it matches nothing among real imports, the output names the active filter instead of reading like the file has no imports at all. |
@@ -123,20 +124,22 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat pdf-outline <file>` | List a PDF's bookmark/outline tree with page numbers instead of a raw Read. |
 | `token-goat pdf-meta <file> [--json]` | Page count, title/author, and whether a PDF has an extractable text layer (so you know before extracting whether it's scanned/image-only). `--json` emits `{ pageCount, title, author, hasTextLayer }` — `hasTextLayer` as a real boolean rather than a prose sentence, and an absent title/author as `null` rather than the literal `(none)`. |
 | `token-goat image-meta <file> [--json]` | Dimensions, format, byte size, and what a `shrinkImage` pass would cost — a cheap "should I even look at this" probe that reads image metadata only and never runs OCR. Needs no optional package: the image pipeline is pure TypeScript and ships in the bundle. Says so plainly when the bytes are not a format token-goat can read. |
-| `token-goat image-text <file> [--json]` | OCR text for an image instead of a raw Read. Reports confidence and character count either way; below the usefulness threshold it says so plainly instead of printing low-confidence noise as content. Requires `tesseract.js`; degrades with a clear message when it's missing. |
+| `token-goat image-text <file> [--lang <lang>] [--json]` | OCR text for an image instead of a raw Read. Reports confidence and character count either way; below the usefulness threshold it says so plainly instead of printing low-confidence noise as content. English (`eng`) is always included; accepts `--lang <lang>` (e.g. `--lang fra` or `--lang "fra,spa"`) for opt-in multilingual extraction (`eng`, `fra`, `spa`, `deu`, `ita`, `por`, `nld`, `pol`, `rus`, `tur`, `swe`, `ara`, `chi_sim`, `chi_tra`, `jpn`, `kor`), defaulting to `image_shrink.ocr_lang` in `config.toml` (persistent across upgrades) or `.token-goat.toml`. Requires `tesseract.js`; degrades with a clear message when it's missing. |
 | `token-goat csv-query <file>` | Project columns and/or filter rows from a CSV instead of a raw Read. `--columns <cols>` selects a comma-separated subset; `--where <spec>` is repeatable and ANDed, supporting `col=value`, `col!=value`, `col>value`, `col<value`, and `col~=regex`; `--head <n>` caps rows; `--json` emits rows as a JSON array of objects instead of a formatted table; `--delimiter <char>` and `--no-header` handle non-comma or headerless files. |
 | `token-goat csv-profile <file>` | Per-column type inference (number/date/string), null/distinct counts, and min/max or top values for low-cardinality columns, instead of a raw Read. Same `--delimiter`/`--no-header` flags as `csv-query`. |
 | `token-goat sharepoint-resolve <shareUrl>` | Best-effort resolve a SharePoint/OneDrive sharing URL to a local synced file path, purely from the local filesystem and `OneDrive`/`OneDriveCommercial` env vars -- no network call, no Graph API, no credentials. Prints the resolved path (feed it to `xlsx-sheets`/`pptx-outline`/etc.) or an honest "could not resolve" with the paths it tried. |
 | `token-goat video-chapters <file>` | Lists a video's embedded chapter markers (timestamps + titles) and subtitle/caption streams via `ffprobe`, instead of downloading/transcoding the file to inspect it. Requires ffmpeg on PATH; degrades with a clear message when it's missing. |
 | `token-goat xlsx-sheets <file> [--json]` | List sheet names, used range, and dimensions in an Excel workbook instead of a raw Read. `--json` emits `{ name, ref, rows, cols }[]`, so a sheet name can be fed straight into the `--sheet` of `xlsx-head`/`xlsx-range`/`xlsx-query` instead of being parsed back out of the text line. |
-| `token-goat xlsx-head <file> --sheet <name>` | Preview the header + first N rows of one sheet (`--rows`, default 20) instead of a raw Read. |
-| `token-goat xlsx-range <file> --sheet <name> --range <a1>` | Extract one cell range (e.g. `A1:D50`) from a sheet; `--formulas` shows formulas instead of computed values. |
-| `token-goat xlsx-query <file> --sheet <name>` | Project columns / filter rows from one sheet instead of a raw Read (same `--columns`/`--where`/`--head` shape as `csv-query`, via the sheet's CSV projection). |
+| `token-goat xlsx-columns <file> [--sheet <name>] [--head <n>] [--json]` | Column names, column letters, fill rates, and sample values across wide spreadsheets instead of a raw Read. `--sheet` defaults to the first sheet if omitted. |
+| `token-goat xlsx-head <file> [--sheet <name>]` | Preview the header + first N rows of one sheet (`--rows`, default 20) instead of a raw Read. `--columns <a,b,c>` projects only the specified column names or letters. `--sheet` defaults to the first sheet if omitted. |
+| `token-goat xlsx-range <file> [--sheet <name>] --range <a1>` | Extract one cell range (e.g. `A1:D50`) from a sheet; `--formulas` shows formulas instead of computed values. `--sheet` defaults to the first sheet if omitted. |
+| `token-goat xlsx-query <file> [--sheet <name>]` | Project columns / filter rows from one sheet instead of a raw Read (same `--columns`/`--where`/`--head` shape as `csv-query`, via the sheet's CSV projection). `--sheet` defaults to the first sheet if omitted. |
 | `token-goat pptx-outline <file>` | Per-slide title, body size, and speaker-notes flag instead of a raw Read. |
 | `token-goat pptx-slide <file> --slide <n>` | Full text of one slide; `--notes` appends that slide's speaker notes. |
 | `token-goat pptx-notes <file>` | Speaker notes for one slide (`--slide <n>`) or all slides, instead of a raw Read. |
 | `token-goat pptx-text <file> --grep <pattern>` | Find slides whose text matches a pattern instead of a raw Read. |
 | `token-goat docx-outline <file>` | Heading tree of a Word document instead of a raw Read. |
+| `token-goat docx-tables <file>` | Extract tables from a Word document as Markdown tables instead of a raw Read; `--table <n>` selects a specific table (1-based), `--json` outputs structured table data. |
 | `token-goat docx-text <file>` | Full body text of a Word document instead of a raw Read; `--head`/`--tail`/`--grep`/`--section`/`--max-matches` slice it the same way `pdf-extract` does. |
 | `token-goat transcript-outline <file>` | Speaker list, duration, and time-bucketed markers for a WebVTT/SRT transcript instead of a raw Read. |
 | `token-goat transcript <file>` | Slice a WebVTT/SRT transcript by `--speaker <name>`, `--from`/`--to <hh:mm:ss>`, and/or `--grep <pattern>` instead of a raw Read. |
@@ -360,13 +363,13 @@ case          filter           in        out    saved  fidelity
 ---------------------------------------------------------------
 git-log-stat  git-log       57227       3027    94.7%  2/2
 npm-ls-all    dep-list      34546       1060    96.9%  2/2
-vitest-run    vitest        22684      22682        -  2/2
+vitest-run    vitest        22684        322    98.6%  2/2
 ---------------------------------------------------------------
-TOTAL                      114457      26769    76.6%  6/6
+TOTAL                      114457       4409    96.1%  6/6
 
-ratio    76.6% saved  (PRIMARY -- must improve; measured floor 0.0%, headroom 23.4%)
+ratio    96.1% saved  (PRIMARY -- must improve; measured floor 0.0%, headroom 3.9%)
 fidelity 6/6 kept   (GUARD -- must not regress; any miss exits 1)
-coverage 3/157 filters exercised, 2/3 cases compressed
+coverage 3/157 filters exercised, 3/3 cases compressed
 ```
 
 There are two numbers on purpose. **Ratio** is the thing to push up. **Fidelity** counts the lines

package/docs/security.md

@@ -16,7 +16,7 @@ Outbound network is reserved to these explicit cases:
 - Image fetches from URLs: either explicit via `token-goat fetch-image <url>`, or when the AI agent issues a WebFetch call that returns image content — the hook intercepts and shrinks the image. The URL always originates from the agent's work, not from token-goat itself.
 - `token-goat screenshot <url>` navigates a headless browser to the URL you give it, subject to the target restrictions described below.
 - The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Setting `TOKEN_GOAT_MODEL_CACHE_DIR` adds one more place to look before the network: a directory you name that outlives any single data root, which is how a continuous-integration job stops refetching the weights once per worker. A file taken from there is checked against the same recorded digest as a downloaded one and dropped from the shared directory if it fails, and an entry that is not a plain file of the expected size is passed over without being read at all, so a tampered copy costs a download and cannot substitute different weights, stall the read, or fill the disk. Token-goat also writes there, and treats the directory as somebody else's: it creates its temporary file exclusively rather than through whatever is already sitting at that name, and removes only what it created. Point it at a directory you control all the same, since nothing token-goat does can stop another writer filling it with entries that will simply be rejected. It is an environment variable only, so no project config file can point it anywhere. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
-- The first optical-character read of an image downloads the English language data (about 4 MB) from `cdn.jsdelivr.net`, at a fixed version path. Subsequent reads use the local cache. This happens for an explicit `token-goat image-text`, and also for the automatic text extraction the image-shrink hook performs when the agent reads a screenshot; turn the automatic one off with `image_shrink.ocr_enabled = false`.
+- The first optical-character read of an image downloads the language data (about 4 MB; English `eng` by default, plus any additional opt-in languages configured via `image_shrink.ocr_lang`, `TOKEN_GOAT_OCR_LANG`, or `--lang` among 16 pinned models) from `cdn.jsdelivr.net`, at a fixed version path with precomputed SHA-256 integrity verification against the decompressed traineddata payload. Subsequent reads use the local cache. This happens for an explicit `token-goat image-text`, and also for the automatic text extraction the image-shrink hook performs when the agent reads a screenshot; turn the automatic one off with `image_shrink.ocr_enabled = false`.
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.12",
+  "version": "2.9.13",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",