token-goat 2.9.14 → 2.9.15

package/dist/{token-goat-chunk-XVZ4MNQC.mjs → token-goat-chunk-SZWYESBS.mjs}

@@ -4,19 +4,20 @@ import {
   canRunWrappedShell,
   clipToDeliveryCap,
   deliveredOutputBytes
-} from "./token-goat-chunk-3XQPEJMV.mjs";
+} from "./token-goat-chunk-YZX7EFG4.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   HOOK_EVENTS,
   buildCommandManifest,
   checkSymbolBodySize,
+  diagnoseSqlFailure,
   flattenCommandNames,
   getWebOutput,
   isReconcileClean,
   readStdinJson,
   reconcileProject,
   storeWebOutput
-} from "./token-goat-chunk-ZYNNQ36L.mjs";
+} from "./token-goat-chunk-OUGNPMDA.mjs";
 import {
   GENERIC_SERVED_OUTPUT_KEY,
   OUTLINE_MAX_REPLACEMENT_RATIO,
@@ -35,14 +36,12 @@ import {
   enqueueDirtyPathSafe,
   ensureWorkerAlive,
   extractCompactFromMarker,
-  extractMarkdownHeadings,
   fenceUntrusted,
   fenceUntrustedSpans,
   fenceWithMatches,
   foldDelivery,
   foldDetail,
   foldingEnabled,
-  formatHeadingTreeParts,
   formatProjectMap,
   formatShrinkSummary,
   getBashOutputId,
@@ -119,7 +118,7 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-IT6O3PNN.mjs";
+} from "./token-goat-chunk-BL5LNGBG.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   BODY_FIRST_TOOL_RESPONSE_KEYS,
@@ -127,7 +126,6 @@ import {
   commandHash,
   compressOutput,
   contextOutput,
-  countSymbols,
   dedupeConsecutive,
   denyOutput,
   detectFromCommand,
@@ -169,17 +167,26 @@ import {
   storeBashOutput,
   summarizeOutputDelta,
   withPreservedBlocks
-} from "./token-goat-chunk-VZYD4OZB.mjs";
+} from "./token-goat-chunk-YQ7WI2CO.mjs";
+import {
+  extractMarkdownHeadings,
+  formatHeadingTreeParts
+} from "./token-goat-chunk-NDRP4KJQ.mjs";
+import {
+  countSymbols
+} from "./token-goat-chunk-2X2EBBC6.mjs";
 import {
-  detectLanguage,
-  getDb,
-  languageHasFlag,
   recordStat,
   redactSecrets,
   savedTokensFromBytes,
   storeBlob,
   stripAnsiEscapes
-} from "./token-goat-chunk-T2IWWTHB.mjs";
+} from "./token-goat-chunk-IVUQLQWN.mjs";
+import {
+  detectLanguage,
+  getDb,
+  languageHasFlag
+} from "./token-goat-chunk-K7F2BFIK.mjs";
 import {
   detectHarness,
   envBool,
@@ -189,34 +196,36 @@ import {
   isUnderSystemTemp,
   loadConfig,
   shortFingerprint
-} from "./token-goat-chunk-SAQ5PG4L.mjs";
+} from "./token-goat-chunk-S4XRY446.mjs";
 import {
   ENV_KEYS,
   IDENTICAL_READ_MIN_BODY_BYTES,
   PER_FILE_COUNTERFACTUAL_CEILING,
-  UNTRUSTED_TOOL_TAG,
   VERSION,
   atomicWriteText,
   containsLineRun,
   countNoun,
   dataDir,
-  displaySafePath,
-  displaySafeText,
   ensureDirSync,
   escapesOntoNetworkThroughLinks,
   extractErrorMessage,
-  fenceUntrustedFileContent,
   foldPath,
   globalDbPath,
   hasCreatedConfig,
   isInsideRoot,
+  runGit,
+  toKB
+} from "./token-goat-chunk-PM76YS22.mjs";
+import {
+  UNTRUSTED_TOOL_TAG,
+  displaySafePath,
+  displaySafeText,
+  fenceUntrustedFileContent,
   neutralizeSpokenMarkers,
   normalizePath,
   resolveIndexPath,
-  runGit,
-  toDisplayPath,
-  toKB
-} from "./token-goat-chunk-AMYCQJX4.mjs";
+  toDisplayPath
+} from "./token-goat-chunk-ERTXEKB6.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -936,7 +945,7 @@ init_define_import_meta_env();
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-O5WAMISC.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-NDPO7GAH.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -7656,11 +7665,11 @@ import { statSync as statSync5 } from "node:fs";
 // src/bash_extractors.ts
 init_define_import_meta_env();
 import { statSync as statSync4, openSync as openSync2, readSync, closeSync as closeSync2 } from "node:fs";
-function surgicalHintFor(hintPath, isEnv, isConfig, isDoc) {
-  return isEnv ? 'Use `token-goat config-get "' + hintPath + '" KEY_NAME` to read a specific variable.' : isConfig ? 'Use `token-goat config-get "' + hintPath + '" KEY_NAME` or `token-goat section "' + hintPath + '::sectionName"` to read a specific value.' : isDoc ? 'Use `token-goat section "' + hintPath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + hintPath + '::SymbolName"` to read one function or class.';
+function surgicalHintFor(hintPath, isEnv, isConfig, isDoc, isXml = false) {
+  return isXml ? 'Use `token-goat xml-outline "' + hintPath + '"` to inspect structure, or `token-goat xml-query "' + hintPath + '" "<selector>"` to query specific nodes.' : isEnv ? 'Use `token-goat config-get "' + hintPath + '" KEY_NAME` to read a specific variable.' : isConfig ? 'Use `token-goat config-get "' + hintPath + '" KEY_NAME` or `token-goat section "' + hintPath + '::sectionName"` to read a specific value.' : isDoc ? 'Use `token-goat section "' + hintPath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + hintPath + '::SymbolName"` to read one function or class.';
 }
-function surgicalHintForConfigDoc(filePath, isConfig, isDoc, isSql) {
-  return isConfig ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to read a specific value.' : isSql ? 'Use `token-goat section "' + filePath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.' : isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` or `token-goat skeleton "' + filePath + '"` to see the file structure.';
+function surgicalHintForConfigDoc(filePath, isConfig, isDoc, isSql, isXml = false) {
+  return isXml ? 'Use `token-goat xml-outline "' + filePath + '"` to inspect structure, or `token-goat xml-query "' + filePath + '" "<selector>"` to query specific nodes.' : isConfig ? 'Use `token-goat config-get "' + filePath + '" KEY_NAME` or `token-goat section "' + filePath + '::sectionName"` to read a specific value.' : isSql ? 'Use `token-goat section "' + filePath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.' : isDoc ? 'Use `token-goat section "' + filePath + '::SectionHeading"` to read one section.' : 'Use `token-goat read "' + filePath + '::SymbolName"` or `token-goat skeleton "' + filePath + '"` to see the file structure.';
 }
 function splitShellSegments(cmd) {
   const segments = [];
@@ -7713,19 +7722,21 @@ function extractCatSourceFile(cmd) {
 function classifyFileExtensions(filePath) {
   const basename3 = (filePath.includes("/") ? filePath.split("/").at(-1) : filePath.split("\\").at(-1)) ?? filePath;
   const isEnvFile = /^\.env(\.\w+)?$/i.test(basename3);
-  const hasKnownExt = /\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less|md|mdx|rst|txt|json|yaml|yml|toml|xml|conf|cfg|ini|properties|sql|ps1|psm1|env)$/i.test(filePath);
+  const hasKnownExt = /\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less|md|mdx|rst|txt|json|yaml|yml|toml|xml|dtsx|ampkg|xaml|conf|cfg|ini|properties|sql|ps1|psm1|env)$/i.test(filePath);
   if (!hasKnownExt && !isEnvFile) return null;
   const isSql = /\.sql$/i.test(filePath);
   const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
   const isEnv = isEnvFile || /\.env$/i.test(filePath);
   const isConfig = /\.(?:json|yaml|yml|toml|conf|cfg|ini|properties)$/i.test(filePath);
-  return { isDoc, isEnv, isConfig, isSql };
+  const isXml = /\.(?:xml|dtsx|ampkg|xaml)$/i.test(filePath);
+  return { isDoc, isEnv, isConfig, isSql, isXml };
 }
 function classifyDocConfig(filePath) {
   const isDoc = /\.(?:md|mdx|rst|txt)$/i.test(filePath);
   const isConfig = /\.(?:json|yaml|yml|toml|conf|cfg|ini|properties)$/i.test(filePath);
   const isSql = /\.sql$/i.test(filePath);
-  return { isDoc, isConfig, isSql };
+  const isXml = /\.(?:xml|dtsx|ampkg|xaml)$/i.test(filePath);
+  return { isDoc, isConfig, isSql, isXml };
 }
 function classifyCatPath(filePath, cmd0) {
   if (isTempPath(filePath)) return null;
@@ -7802,10 +7813,10 @@ function extractPowerShellFileMethodRead(cmd, event) {
   }
   const flags = classifyFileExtensions(filePath);
   if (flags === null) {
-    const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
-    return { filePath, isDoc, isEnv: false, isConfig, isSql };
+    const { isDoc, isConfig, isSql, isXml } = classifyDocConfig(filePath);
+    return { filePath, isDoc, isEnv: false, isConfig, isSql, isXml };
   }
-  return { filePath, isDoc: flags.isDoc, isEnv: flags.isEnv, isConfig: flags.isConfig, isSql: flags.isSql };
+  return { filePath, isDoc: flags.isDoc, isEnv: flags.isEnv, isConfig: flags.isConfig, isSql: flags.isSql, isXml: flags.isXml };
 }
 function extractRgSymbolSearch(cmd) {
   if (!/^(?:rg|grep)\s+/.test(cmd)) return null;
@@ -7960,7 +7971,7 @@ function pythonOpenPathsAreAllLiteral(text) {
   const calls = pythonOpenCalls(text);
   return calls.length > 0 && calls.every((call) => call.pathLiteral !== null);
 }
-var KNOWN_PYTHON_EXT_STR = "java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less|md|mdx|rst|txt|json|yaml|yml|toml|xml|html|htm|conf|cfg|ini|properties|sql|ps1|psm1|env";
+var KNOWN_PYTHON_EXT_STR = "java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less|md|mdx|rst|txt|json|yaml|yml|toml|xml|dtsx|ampkg|xaml|html|htm|conf|cfg|ini|properties|sql|ps1|psm1|env";
 var OPEN_EXT = new RegExp(`\\.(?:${KNOWN_PYTHON_EXT_STR})$`, "i");
 function extractPythonFileRead(cmd) {
   let inner = cmd.trim();
@@ -7986,11 +7997,11 @@ function extractPythonFileRead(cmd) {
   const classifyResult = (filePath) => {
     const flags = classifyFileExtensions(filePath);
     if (flags !== null) {
-      return { filePath, isDoc: flags.isDoc, isConfig: flags.isConfig, isEnv: flags.isEnv, isSql: flags.isSql, isOutputFile: false };
+      return { filePath, isDoc: flags.isDoc, isConfig: flags.isConfig, isEnv: flags.isEnv, isSql: flags.isSql, isXml: flags.isXml, isOutputFile: false };
     }
-    const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
+    const { isDoc, isConfig, isSql, isXml } = classifyDocConfig(filePath);
     const isEnv = /\.env(\.\w+)?$/i.test(filePath);
-    return { filePath, isDoc, isConfig, isEnv, isSql, isOutputFile: false };
+    return { filePath, isDoc, isConfig, isEnv, isSql, isXml, isOutputFile: false };
   };
   const heredocMatch = /^python3?\s+-\s+<<\s*'?(\w+)'?\s*\n([\s\S]*?)\n\1\s*$/.exec(pythonBody);
   if (heredocMatch) {
@@ -8044,9 +8055,9 @@ function extractHeadFile(cmd) {
   const filePath = direct !== null ? direct[3] ?? direct[4] ?? direct[5] : piped[1] ?? piped[2] ?? piped[3];
   if (filePath === void 0) return null;
   if (isTempPath(filePath)) return null;
-  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh)$/i.test(filePath)) return null;
-  const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
-  return { filePath, isDoc, isConfig, isSql, n };
+  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh|xml|dtsx|ampkg|xaml)$/i.test(filePath)) return null;
+  const { isDoc, isConfig, isSql, isXml } = classifyDocConfig(filePath);
+  return { filePath, isDoc, isConfig, isSql, isXml, n };
 }
 function extractSedRange(cmd) {
   const m = /^sed\s+-n\s+(?:['"]((?:\d+,\d+p)(?:;\d+,\d+p)*)['"]|(\d+,\d+p))\s+(?:"([^"]+)"|'([^']+)'|(\S+))(?:\s+2>(?:\/dev\/null|&1))?\s*$/.exec(cmd);
@@ -8148,7 +8159,7 @@ function leadingLinesHint(lead, hintPath, start, end, flags, preHookCwd) {
   const key = resolveIndexPath(hintPath, preHookCwd ?? process.cwd());
   const prior = findRangeOverlap(getFileLineRanges(key), start, end);
   if (prior !== null) return sedOverlapHint(hintPath, prior, start, end);
-  return lead + surgicalHintForConfigDoc(hintPath, flags.isConfig, flags.isDoc, flags.isSql);
+  return lead + surgicalHintForConfigDoc(hintPath, flags.isConfig, flags.isDoc, flags.isSql, flags.isXml ?? false);
 }
 function findRangeOverlap(prior, start, end) {
   let best = null;
@@ -8205,9 +8216,9 @@ function extractTailFile(cmd) {
   const filePath = direct !== null ? direct[3] ?? direct[4] ?? direct[5] : piped[1] ?? piped[2] ?? piped[3];
   if (!filePath) return null;
   if (isTempPath(filePath)) return null;
-  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh)$/i.test(filePath)) return null;
-  const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
-  return { filePath, isDoc, isConfig, isSql };
+  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh|xml|dtsx|ampkg|xaml)$/i.test(filePath)) return null;
+  const { isDoc, isConfig, isSql, isXml } = classifyDocConfig(filePath);
+  return { filePath, isDoc, isConfig, isSql, isXml };
 }
 function extractGetContentTail(cmd) {
   const tailMatch = /-Tail\s+(\d+)/i.exec(cmd);
@@ -8222,9 +8233,9 @@ function extractGetContentTail(cmd) {
   const filePath = (beforeTail || afterTail).replace(/^["']|["']$/g, "");
   if (!filePath) return null;
   if (isTempPath(filePath)) return null;
-  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh|ps1|psm1)$/i.test(filePath)) return null;
-  const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
-  return { filePath, isDoc, isConfig, isSql };
+  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh|ps1|psm1|xml|dtsx|ampkg|xaml)$/i.test(filePath)) return null;
+  const { isDoc, isConfig, isSql, isXml } = classifyDocConfig(filePath);
+  return { filePath, isDoc, isConfig, isSql, isXml };
 }
 function extractGetContentSelectFirst(cmd) {
   const m = /^(Get-Content|gc)\s+([^|]+)\s*\|\s*(Select-Object|select)\s+(-First\s+(\d+))/i.exec(cmd);
@@ -8234,9 +8245,9 @@ function extractGetContentSelectFirst(cmd) {
   if (n <= 10) return null;
   if (!filePath) return null;
   if (isTempPath(filePath)) return null;
-  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh|ps1|psm1)$/i.test(filePath)) return null;
-  const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
-  return { filePath, isDoc, isConfig, isSql, n };
+  if (!/\.(?:ts|tsx|js|jsx|py|go|java|rs|rb|cs|md|mdx|rst|txt|json|yaml|yml|toml|sql|sh|ps1|psm1|xml|dtsx|ampkg|xaml)$/i.test(filePath)) return null;
+  const { isDoc, isConfig, isSql, isXml } = classifyDocConfig(filePath);
+  return { filePath, isDoc, isConfig, isSql, isXml, n };
 }
 function taskOutputIsJsonlTranscript(outPath) {
   let fd = null;
@@ -8611,6 +8622,42 @@ function isCompressibleSingleCommand(cmd) {
   if (hasBareBackgroundOrNewline(cmd)) return false;
   return true;
 }
+function extractTerminalXmlParsing(cmd) {
+  const trimmed = cmd.trim();
+  if (!trimmed) return null;
+  const selectXmlM = /\bSelect-Xml\b(?:\s+(?:-Path\s+)?["']?([^"'\s|;]+(?:\.xml|\.dtsx|\.ampkg|\.xaml))["']?)?/i.exec(trimmed);
+  if (selectXmlM) {
+    const rawPath = selectXmlM[1];
+    const filePath = rawPath && !rawPath.startsWith("-") ? rawPath : void 0;
+    return { filePath, toolOrScript: "Select-Xml" };
+  }
+  const psXmlCastM = /\[(?:xml|System\.Xml\.XmlDocument)\]/i.exec(trimmed);
+  if (psXmlCastM) {
+    const fileM = /["']([^"'\r\n]+\.(?:xml|dtsx|ampkg|xaml))["']/i.exec(trimmed) || /(?:Get-Content|gc|ReadAllText)\s+["']?([^"'\s|;)]+\.(?:xml|dtsx|ampkg|xaml))["']?/i.exec(trimmed);
+    const filePath = fileM?.[1];
+    return { filePath, toolOrScript: psXmlCastM[0] };
+  }
+  const inspectScriptM = /(?:powershell|pwsh|&|\.)?\s*["']?(\.?[/\\]?inspect_[^"'\s|;]+\.ps1)["']/i.exec(trimmed) || /\b(inspect_[^"'\s|;]+\.ps1)\b/i.exec(trimmed);
+  if (inspectScriptM) {
+    const fileM = /["']([^"'\r\n]+\.(?:xml|dtsx|ampkg|xaml))["']/i.exec(trimmed);
+    const filePath = fileM?.[1];
+    return { filePath, toolOrScript: inspectScriptM[1] ?? "inspect script" };
+  }
+  const pyXmlM = /\bpython(?:\d+(?:\.\d+)?)?(?:\.exe)?\b.*-c\s+["'].*?\b(xml\.etree|BeautifulSoup|minidom|lxml)\b/i.exec(trimmed);
+  if (pyXmlM) {
+    const fileM = /["']([^"'\r\n]+\.(?:xml|dtsx|ampkg|xaml))["']/i.exec(trimmed);
+    const filePath = fileM?.[1];
+    return { filePath, toolOrScript: `python ${pyXmlM[1]}` };
+  }
+  const cliXmlM = /\b(xmllint|xmlstarlet|xidel)\b/i.exec(trimmed);
+  if (cliXmlM) {
+    const fileM = /["']?([^"'\s|;]+\.(?:xml|dtsx|ampkg|xaml))["']?/i.exec(trimmed);
+    const rawPath = fileM?.[1];
+    const filePath = rawPath && !rawPath.startsWith("-") ? rawPath : void 0;
+    return { filePath, toolOrScript: cliXmlM[1] };
+  }
+  return null;
+}
 
 // src/hooks_bash_commands.ts
 var CD_PREFIX_RE = /^(?:cd\s+(?:"[^"]*"|'[^']*'|\S+)[ \t]*(?:&&|;|\r?\n)\s*)+/;
@@ -9281,9 +9328,9 @@ async function maybeElideServedGenericOutput(cmd, output, exitCode, cwd, cacheMi
   if (rewrittenText === null) return null;
   return emitRewrite(rewrittenText, "already-served shell output collapsed", { kind: "bash_compress:generic-served-elision", originalBytes: deliveredOutputBytes(originalBytes) });
 }
-async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes) {
+async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes, isUnwrapped = false) {
   if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
-  if (isCompressibleSingleCommand(cmd)) return null;
+  if (!isUnwrapped && isCompressibleSingleCommand(cmd)) return null;
   if (exitCode !== null && exitCode !== 0) return null;
   let cfg;
   try {
@@ -9293,7 +9340,7 @@ async function maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinB
   }
   if (!cfg.enabled || cfg.disabled_filters.includes("generic")) return null;
   if (Buffer.byteLength(output, "utf-8") < cacheMinBytes) return null;
-  const shaped = pipelineShapeFilter(cmd, cwd);
+  const shaped = pipelineShapeFilter(cmd, cwd) ?? (isUnwrapped ? detectFromCommand(cmd, cwd ?? void 0)?.filter ?? null : null);
   const filter3 = shaped !== null && !cfg.disabled_filters.includes(shaped.name) ? shaped : filterByName("generic");
   if (filter3 === null) return null;
   const compressed = compressOutput(filter3, output, "", exitCode ?? 0, [], {
@@ -9436,6 +9483,15 @@ function preBashHandlerInner(event) {
       "Use `token-goat outline <file>` to see symbol names and line counts without loading files."
     );
   }
+  const terminalXml = extractTerminalXmlParsing(cmd);
+  if (terminalXml !== null) {
+    const { filePath, toolOrScript } = terminalXml;
+    recordStat("session_hint", 0, 0);
+    const target = filePath ? displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath) : "<file>";
+    return contextOutput(
+      `token-goat available for this file type, consider 'token-goat xml-query "${target}" "<xpath>"' or 'token-goat xml-outline "${target}"' first instead of terminal XML parsing (${toolOrScript}).`
+    );
+  }
   const singleLineRangeRead = extractLineRangeRead(cmd);
   const sedReads = singleLineRangeRead !== null ? [singleLineRangeRead] : extractLineRangeReadsCompound(cmd);
   if (sedReads !== null) {
@@ -9462,17 +9518,17 @@ function preBashHandlerInner(event) {
   }
   const gcTailResult = extractGetContentTail(cmd);
   if (gcTailResult !== null) {
-    const { filePath, isDoc, isConfig, isSql } = gcTailResult;
+    const { filePath, isDoc, isConfig, isSql, isXml } = gcTailResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
-    return contextOutput("`Get-Content -Tail` bypasses read hooks. " + surgicalHintForConfigDoc(hintPath, isConfig, isDoc, isSql));
+    return contextOutput("`Get-Content -Tail` bypasses read hooks. " + surgicalHintForConfigDoc(hintPath, isConfig, isDoc, isSql, isXml));
   }
   const gcSelectResult = extractGetContentSelectFirst(cmd);
   if (gcSelectResult !== null) {
-    const { filePath, isDoc, isConfig, isSql, n } = gcSelectResult;
+    const { filePath, isDoc, isConfig, isSql, isXml, n } = gcSelectResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
-    return contextOutput(leadingLinesHint("`Select-Object -First` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql }, preHookCwd));
+    return contextOutput(leadingLinesHint("`Select-Object -First` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql, isXml }, preHookCwd));
   }
   const catJsonPipe = extractCatJsonPipe(cmd);
   if (catJsonPipe !== null) {
@@ -9485,7 +9541,7 @@ function preBashHandlerInner(event) {
   }
   const catResult = extractCatFile(cmd);
   if (catResult !== null) {
-    const { filePath, isDoc, isEnv, isConfig, isSql, cmd0, advisoryOnly } = catResult;
+    const { filePath, isDoc, isEnv, isConfig, isSql, isXml, cmd0, advisoryOnly } = catResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
     if (isSql) {
@@ -9493,16 +9549,16 @@ function preBashHandlerInner(event) {
         "`" + cmd0 + '` loads the entire file into context. Use `token-goat section "' + hintPath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.'
       );
     }
-    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc);
+    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc, isXml);
     return cdStripped || advisoryOnly ? contextOutput("`" + cmd0 + "` loads the entire file into context. " + hint) : denyOutput("`" + cmd0 + "` loads the entire file into context. " + hint);
   }
   const catMulti = extractCatFilesMulti(cmd);
   if (catMulti !== null) {
     recordStat("session_hint", 0, 0);
     const cmd0 = catMulti[0].cmd0;
-    const perPath = catMulti.map(({ filePath, isDoc, isEnv, isConfig, isSql }) => {
+    const perPath = catMulti.map(({ filePath, isDoc, isEnv, isConfig, isSql, isXml }) => {
       const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
-      const how = isSql ? 'token-goat section "' + hintPath + '::table_name"' : isEnv || isConfig ? 'token-goat config-get "' + hintPath + '" KEY_NAME' : isDoc ? 'token-goat section "' + hintPath + '::SectionHeading"' : 'token-goat read "' + hintPath + '::SymbolName"';
+      const how = isXml ? 'token-goat xml-outline "' + hintPath + '" or token-goat xml-query "' + hintPath + '" "<selector>"' : isSql ? 'token-goat section "' + hintPath + '::table_name"' : isEnv || isConfig ? 'token-goat config-get "' + hintPath + '" KEY_NAME' : isDoc ? 'token-goat section "' + hintPath + '::SectionHeading"' : 'token-goat read "' + hintPath + '::SymbolName"';
       return "  " + hintPath + " -> `" + how + "`";
     });
     const msg = "`" + cmd0 + "` on multiple files loads them all into context. Read each surgically instead:\n" + perPath.join("\n");
@@ -9510,19 +9566,19 @@ function preBashHandlerInner(event) {
   }
   const psGetContentResult = extractPowerShellWrappedGetContent(cmd, event);
   if (psGetContentResult !== null) {
-    const { filePath, isDoc, isEnv, isConfig, isSql } = psGetContentResult;
+    const { filePath, isDoc, isEnv, isConfig, isSql, isXml } = psGetContentResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
     const lead = "`Get-Content` via a `powershell -Command` wrapper bypasses read hooks and loads the entire file into context. ";
     if (isSql) {
       return contextOutput(lead + 'Use `token-goat section "' + hintPath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.');
     }
-    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc);
+    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc, isXml);
     return cdStripped ? contextOutput(lead + hint) : denyOutput(lead + hint);
   }
   const wslCatResult = extractWslCatFile(cmd);
   if (wslCatResult !== null) {
-    const { filePath, isDoc, isEnv, isConfig, isSql } = wslCatResult;
+    const { filePath, isDoc, isEnv, isConfig, isSql, isXml } = wslCatResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
     if (isSql) {
@@ -9530,12 +9586,12 @@ function preBashHandlerInner(event) {
         '`cat` loads the entire file into context. Use `token-goat section "' + hintPath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.'
       );
     }
-    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc);
+    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc, isXml);
     return cdStripped ? contextOutput("`cat` loads the entire file into context. " + hint) : denyOutput("`cat` loads the entire file into context. " + hint);
   }
   const pyRead = extractPythonFileRead(cmd);
   if (pyRead !== null) {
-    const { filePath, isDoc, isConfig, isEnv, isSql, isOutputFile } = pyRead;
+    const { filePath, isDoc, isConfig, isEnv, isSql, isXml, isOutputFile } = pyRead;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
     if (isOutputFile) {
@@ -9552,22 +9608,22 @@ function preBashHandlerInner(event) {
         'Python `open()` file reads bypass read hooks. Use `token-goat section "' + hintPath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.'
       );
     }
-    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc);
+    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc, isXml);
     return cdStripped ? contextOutput("Python `open()` file reads bypass read hooks. " + hint) : denyOutput("Python `open()` file reads bypass read hooks. " + hint);
   }
   const tailResult = extractTailFile(cmd);
   if (tailResult !== null) {
-    const { filePath, isDoc, isConfig, isSql } = tailResult;
+    const { filePath, isDoc, isConfig, isSql, isXml } = tailResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
-    return contextOutput("`tail` bypasses read hooks. " + surgicalHintForConfigDoc(hintPath, isConfig, isDoc, isSql));
+    return contextOutput("`tail` bypasses read hooks. " + surgicalHintForConfigDoc(hintPath, isConfig, isDoc, isSql, isXml));
   }
   const headResult = extractHeadFile(cmd);
   if (headResult !== null) {
-    const { filePath, isDoc, isConfig, isSql, n } = headResult;
+    const { filePath, isDoc, isConfig, isSql, isXml, n } = headResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     recordStat("session_hint", 0, 0);
-    return contextOutput(leadingLinesHint("`head` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql }, preHookCwd));
+    return contextOutput(leadingLinesHint("`head` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql, isXml }, preHookCwd));
   }
   const nodeRead = extractNodeFileRead(cmd);
   if (nodeRead !== null) {
@@ -9584,14 +9640,14 @@ function preBashHandlerInner(event) {
   }
   const psMethodRead = extractPowerShellFileMethodRead(cmd, event);
   if (psMethodRead !== null) {
-    const { filePath, isDoc, isEnv, isConfig, isSql } = psMethodRead;
+    const { filePath, isDoc, isEnv, isConfig, isSql, isXml } = psMethodRead;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     const lead = "PowerShell `[IO.File]::ReadAllText()` bypasses read hooks. ";
     if (isSql) {
       recordStat("session_hint", 0, 0);
       return contextOutput(lead + 'Use `token-goat section "' + hintPath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.');
     }
-    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc);
+    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc, isXml);
     recordStat("session_hint", 0, 0);
     return cdStripped ? contextOutput(lead + hint) : denyOutput(lead + hint);
   }
@@ -9763,15 +9819,25 @@ function extractExitCode(raw) {
   return null;
 }
 var GH_SECURITY_PATHS = ["/security_advisories", "/advisories", "security_events"];
-var GH_SCOPE_PHRASES = ["Must have push access", "Resource not accessible by integration", "Must be an admin"];
+var GH_SCOPE_PHRASES = [
+  "Must have push access",
+  "Resource not accessible by integration",
+  "Must be an admin",
+  "You are not authorized to perform this operation"
+];
+var GH_NOT_FOUND = /^gh: .*\(HTTP 404\)|"status":\s*"404"/m;
 function buildGhApiHint(cmd, stdout, exitCode) {
   if (stdout === "" || !cmd.startsWith("gh api")) return null;
   const hints = [];
   const isSecurityPath = GH_SECURITY_PATHS.some((p) => cmd.includes(p));
   const hasScopePhrase = GH_SCOPE_PHRASES.some((p) => stdout.includes(p));
-  const failedSecurityCall = exitCode !== null && exitCode !== 0 && isSecurityPath;
-  if (hasScopePhrase || failedSecurityCall) {
+  const ambiguousSecurity404 = exitCode !== null && exitCode !== 0 && isSecurityPath && GH_NOT_FOUND.test(stdout);
+  if (hasScopePhrase) {
     hints.push("[token-goat] GitHub API scope issue: try gh auth refresh -s security_events");
+  } else if (ambiguousSecurity404) {
+    hints.push(
+      "[token-goat] GitHub answers 404 both for a resource that does not exist and for one your token cannot see: check the owner/repo spelling, then gh auth status for the security_events scope."
+    );
   }
   const trimmed = stdout.trimStart();
   if (trimmed.startsWith("{")) {
@@ -9845,6 +9911,7 @@ async function postBashHandler(event) {
   try {
     const rawCmdRaw = extractCommand(event);
     if (rawCmdRaw === void 0) return passOutput();
+    const isUnwrapped = unwrapCompressCommand(rawCmdRaw) === null;
     const rawCmd = unwrapCompressCommand(rawCmdRaw) ?? rawCmdRaw;
     const cmd = stripCdPrefix(rawCmd);
     const output = extractBashOutput(event.raw);
@@ -9928,13 +9995,19 @@ async function postBashHandler(event) {
       const gitScopedCacheId = await storeBashOutput(cmd, output, exitCode ?? 0, cwd);
       recordBashOutput(gitScopedCacheHash, gitScopedCacheId, Buffer.byteLength(output, "utf-8"));
     }
+    if (isUnwrapped && /^git(?:\s+-[^\s]+|\s+--[^\s]+)*\s+diff\b/i.test(cmd)) {
+      const unwrappedCompressed = await maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes, isUnwrapped);
+      if (unwrappedCompressed !== null) return unwrappedCompressed;
+    }
     const isMonitoring = getMonitoringRecallHint(cmd) !== null;
     const isFileRead = pureFileReadPath(cmd) !== null;
     if (isFileRead || !isMonitoring && !isBuildCommand(cmd) && !isCurlGetCommand(cmd)) {
       const identical = await maybeCollapseIdenticalRead(cmd, rawCmd, output, exitCode, cwd, cacheMinBytes);
       if (identical !== null) return identical;
-      const compound = await maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes);
-      if (compound !== null) return compound;
+      if (!isFileRead && (!isUnwrapped || !isCompressibleSingleCommand(cmd))) {
+        const compound = await maybeCompressCompoundOutput(cmd, output, exitCode, cwd, cacheMinBytes, isUnwrapped);
+        if (compound !== null) return compound;
+      }
       if (!isFileRead && extractLineRangeReadsCompound(cmd) === null) {
         const genericElision = await maybeElideServedGenericOutput(cmd, output, exitCode, cwd, cacheMinBytes);
         if (genericElision !== null) return genericElision;
@@ -10275,6 +10348,7 @@ function postToolUseFailureHandler(event) {
     const ledger = readLedger(target);
     const priorState = ledger.seen[signature];
     const editDiagnostic = diagnoseEditFailure(event, errorText);
+    const sqlDiagnostic = diagnoseSqlFailure(event, errorText);
     if (priorState === void 0) {
       ledger.seen[signature] = false;
       ledger.order.push(signature);
@@ -10288,6 +10362,11 @@ function postToolUseFailureHandler(event) {
         writeLedger(target, ledger);
         return contextOutput(editDiagnostic);
       }
+      if (sqlDiagnostic !== null) {
+        ledger.seen[signature] = true;
+        writeLedger(target, ledger);
+        return contextOutput(sqlDiagnostic);
+      }
       return passOutput();
     }
     if (priorState) return passOutput();
@@ -10296,6 +10375,9 @@ function postToolUseFailureHandler(event) {
     if (editDiagnostic !== null) {
       return contextOutput(editDiagnostic);
     }
+    if (sqlDiagnostic !== null) {
+      return contextOutput(sqlDiagnostic);
+    }
     return contextOutput(repeatFailureNotice(toolName));
   } catch {
     return passOutput();
@@ -10572,6 +10654,37 @@ function compressGithubMcpResult(toolName, resultText) {
   const stripped = deepStrip(parsed, githubShouldStrip);
   return finishWithGenericPass(resultText, stripped);
 }
+var ATLASSIAN_TOOL_RE = /(?:jira|confluence|atlassian)/i;
+var ATLASSIAN_STRIP_EXACT_KEYS = /* @__PURE__ */ new Set([
+  "avatarUrls",
+  "avatarUrl",
+  "iconUrl",
+  "iconUrls",
+  "self",
+  "expand",
+  "schema",
+  "operations",
+  "editmeta",
+  "names",
+  "_links",
+  "_expandable",
+  "extensions",
+  "timeZone"
+]);
+function atlassianShouldStrip(key) {
+  return ATLASSIAN_STRIP_EXACT_KEYS.has(key);
+}
+function compressAtlassianMcpResult(toolName, resultText) {
+  if (!ATLASSIAN_TOOL_RE.test(toolName)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(resultText);
+  } catch {
+    return null;
+  }
+  const stripped = deepStrip(parsed, atlassianShouldStrip);
+  return finishWithGenericPass(resultText, stripped);
+}
 var BROWSER_TOOL_RE = /^mcp__.*(?:chrome-devtools|claude-in-chrome|playwright).*__/i;
 var BROWSER_CONSOLE_METHOD_RE = /(?:^|_)(?:read|list)_console_messages$/i;
 var BROWSER_NETWORK_METHOD_RE = /(?:^|_)(?:read|list)_network_requests$/i;
@@ -10722,10 +10835,11 @@ function stripBase64DataUrls(resultText) {
 function compressMcpResultWithPacks(toolName, resultText) {
   const base64Stripped = stripBase64DataUrls(resultText);
   const text = base64Stripped ?? resultText;
-  return compressGithubMcpResult(toolName, text) ?? compressBrowserMcpResult(toolName, text) ?? compressGWorkspaceMcpResult(toolName, text) ?? base64Stripped;
+  return compressGithubMcpResult(toolName, text) ?? compressAtlassianMcpResult(toolName, text) ?? compressBrowserMcpResult(toolName, text) ?? compressGWorkspaceMcpResult(toolName, text) ?? base64Stripped;
 }
 
 // src/hooks_mcp.ts
+var MCP_OVERSIZED_THRESHOLD_BYTES = 25e3;
 function preMcpHandler(event) {
   const toolName = getToolName(event);
   if (!toolName || !event.sessionId) return passOutput();
@@ -10783,9 +10897,15 @@ function postMcpHandler(event) {
           minNetSavingsBytes: resolveMinNetSavingsBytes()
         });
         if (worthwhile) {
+          const bodyBytes = Buffer.byteLength(redactedBody, "utf-8");
+          let finalBody = redactedBody;
+          if (bodyBytes >= MCP_OVERSIZED_THRESHOLD_BYTES) {
+            const preview = clipToDeliveryCap(redactedBody, Buffer.byteLength(notice, "utf-8") + 500);
+            finalBody = preview.text + (preview.clipped ? "\n\n...[preview truncated by token-goat; use mcp-output above to query full payload]..." : "");
+          }
           return preserve(
             emitRewrite(
-              `${notice}${fenceWithMatches(redactedBody, injectionMatches, UNTRUSTED_TOOL_TAG)}`,
+              `${notice}${fenceWithMatches(finalBody, injectionMatches, UNTRUSTED_TOOL_TAG)}`,
               "mcp",
               { kind: "mcp:compress", originalBytes }
             )
@@ -10794,6 +10914,29 @@ function postMcpHandler(event) {
       }
     }
   }
+  const rawBytes = Buffer.byteLength(resultText, "utf-8");
+  if (rawBytes >= MCP_OVERSIZED_THRESHOLD_BYTES && process.env["TOKEN_GOAT_MCP_COMPRESS"] !== "0") {
+    if (id === null) id = storeMcpOutput(event.sessionId, toolName, toolInput, resultText);
+    if (id !== null) {
+      const notice = `[token-goat: oversized MCP result (${rawBytes} bytes) cached as ${id}]
+The full payload was cached to prevent harness context spill. Slicing commands:
+  token-goat mcp-output ${id} --json-query '<path>' (e.g. 'issues[*].key', 'values[*].id')
+  token-goat mcp-output ${id} --section '<heading>'
+  token-goat mcp-output ${id} --grep '<regex>' --max-matches 20
+  token-goat mcp-output ${id} --head 50
+
+`;
+      const preview = clipToDeliveryCap(redactedResult.text, Buffer.byteLength(notice, "utf-8") + 500);
+      const previewBody = preview.text + (preview.clipped ? "\n\n...[preview truncated by token-goat; use mcp-output above to query full payload]..." : "");
+      return preserve(
+        emitRewrite(
+          `${notice}${fenceWithMatches(previewBody, injectionMatches, UNTRUSTED_TOOL_TAG)}`,
+          "mcp",
+          { kind: "mcp:oversized", originalBytes: rawBytes }
+        )
+      );
+    }
+  }
   return passOrFence();
 }
 registerHook("pre_tool_use", preMcpHandler, { toolPattern: "^mcp__" });