token-goat 2.9.16 → 2.9.18

package/dist/{token-goat-chunk-GMXBQS6O.mjs → token-goat-chunk-WFX2V3OF.mjs}

@@ -4,7 +4,7 @@ import {
   canRunWrappedShell,
   clipToDeliveryCap,
   deliveredOutputBytes
-} from "./token-goat-chunk-UXHDBVUR.mjs";
+} from "./token-goat-chunk-RHHFEXKF.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   HOOK_EVENTS,
@@ -17,7 +17,7 @@ import {
   readStdinJson,
   reconcileProject,
   storeWebOutput
-} from "./token-goat-chunk-UMXD2M7O.mjs";
+} from "./token-goat-chunk-V3ZWBEHM.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   GENERIC_SERVED_OUTPUT_KEY,
@@ -144,7 +144,7 @@ import {
   wasFileReadThisSession,
   wasHintShown,
   withPreservedBlocks
-} from "./token-goat-chunk-XOHTFRDH.mjs";
+} from "./token-goat-chunk-BFEWOMA3.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   commandHash,
@@ -167,26 +167,26 @@ import {
   splitOwnTrailingNotices,
   storeBashOutput,
   summarizeOutputDelta
-} from "./token-goat-chunk-5USHO7B6.mjs";
+} from "./token-goat-chunk-CTOYJ232.mjs";
 import {
   recordStat,
   redactSecrets,
   savedTokensFromBytes,
   storeBlob,
   stripAnsiEscapes
-} from "./token-goat-chunk-DMQ32ZSR.mjs";
+} from "./token-goat-chunk-HPOFR6QX.mjs";
 import {
   extractMarkdownHeadings,
   formatHeadingTreeParts
-} from "./token-goat-chunk-BFNTLGVA.mjs";
+} from "./token-goat-chunk-W3E65QOW.mjs";
 import {
   countSymbols
-} from "./token-goat-chunk-63QWJ6UM.mjs";
+} from "./token-goat-chunk-I67CPTDD.mjs";
 import {
   detectLanguage,
   getDb,
   languageHasFlag
-} from "./token-goat-chunk-R3X5TCPB.mjs";
+} from "./token-goat-chunk-L7VCX33I.mjs";
 import {
   detectHarness,
   envBool,
@@ -196,7 +196,7 @@ import {
   isUnderSystemTemp,
   loadConfig,
   shortFingerprint
-} from "./token-goat-chunk-H3DXI6VD.mjs";
+} from "./token-goat-chunk-CA6V36KW.mjs";
 import {
   ENV_KEYS,
   IDENTICAL_READ_MIN_BODY_BYTES,
@@ -207,6 +207,7 @@ import {
   countNoun,
   dataDir,
   ensureDirSync,
+  escapeRegExp,
   escapesOntoNetworkThroughLinks,
   extractErrorMessage,
   foldPath,
@@ -215,7 +216,7 @@ import {
   isInsideRoot,
   runGit,
   toKB
-} from "./token-goat-chunk-3H6FQT62.mjs";
+} from "./token-goat-chunk-QIDLJGXZ.mjs";
 import {
   UNTRUSTED_TOOL_TAG,
   displaySafePath,
@@ -403,7 +404,7 @@ function grepIntInput(toolInput, key) {
 function grepSignature(toolInput) {
   const pattern = toolInput["pattern"];
   if (typeof pattern !== "string" || pattern === "") return null;
-  const path4 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
+  const path5 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
   const outputMode = typeof toolInput["output_mode"] === "string" ? toolInput["output_mode"] : "files_with_matches";
   const glob = typeof toolInput["glob"] === "string" ? toolInput["glob"] : "";
   const type = typeof toolInput["type"] === "string" ? toolInput["type"] : "";
@@ -418,7 +419,7 @@ function grepSignature(toolInput) {
   const offset = grepIntInput(toolInput, "offset");
   return JSON.stringify([
     pattern,
-    path4,
+    path5,
     outputMode,
     glob,
     type,
@@ -562,8 +563,8 @@ function isBroadCatchAllGlob(pattern, pathArg) {
 function globSignature(toolInput) {
   const pattern = toolInput["pattern"];
   if (typeof pattern !== "string" || pattern === "") return null;
-  const path4 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
-  return JSON.stringify([pattern, path4]);
+  const path5 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
+  return JSON.stringify([pattern, path5]);
 }
 var { post: postGlobHandler, pre: preGlobDedupHandler } = makeDedupHintHandlers({
   toolName: "Glob",
@@ -717,6 +718,7 @@ registerHook("pre_tool_use", preWriteRewriteHandler, { toolName: "Write" });
 // src/hooks_compact.ts
 init_define_import_meta_env();
 import { spawnSync } from "node:child_process";
+import * as path3 from "node:path";
 var MEM_EPOCH_TIMEOUT_MS = 800;
 var MAX_ROWS = 40;
 function appendCappedSection(lines, header, rows, cap) {
@@ -919,8 +921,14 @@ function postCompactHandler(event) {
   const summary = typeof raw === "string" ? raw : "";
   const bytes = Buffer.byteLength(summary, "utf-8");
   const sample = manifestPathSample(event.sessionId);
-  const haystack = foldPath(summary);
-  const survived = sample.filter((p) => haystack.includes(foldPath(p))).length;
+  const cwd = normalizePath(getCwd(event) ?? process.cwd());
+  const spell = (p) => foldPath(p.replaceAll("\\", "/"));
+  const haystack = spell(summary);
+  const survived = sample.filter((p) => {
+    const rel = path3.relative(cwd, p);
+    const forms = rel !== "" && !rel.startsWith("..") && !path3.isAbsolute(rel) ? [p, rel] : [p];
+    return forms.some((f) => haystack.includes(spell(f)));
+  }).length;
   const trigger = typeof event.raw["trigger"] === "string" ? event.raw["trigger"] : "unknown";
   const budget = loadConfig().compact_assist.summary_budget_chars;
   const over = budget > 0 && summary.length > budget ? 1 : 0;
@@ -945,7 +953,7 @@ init_define_import_meta_env();
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-QMZMHQRR.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-BWCRC23L.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -1234,8 +1242,10 @@ function reconcileNote(cwd, indexed) {
     const budgetMs = envInt(ENV_KEYS.RECONCILE_BUDGET_MS, DEFAULT_RECONCILE_BUDGET_MS, 0, 6e4);
     const result = reconcileProject({ cwd, budgetMs });
     if (isReconcileClean(result) && !result.budgetExhausted) return null;
+    const upgraded = result.parserStale + result.embedStale;
+    const edited = result.changed.length - upgraded;
     const parts = [];
-    if (result.changed.length > 0) parts.push(`${result.changed.length} changed`);
+    if (edited > 0) parts.push(`${edited} changed`);
     if (result.added.length > 0) parts.push(`${result.added.length} new`);
     if (result.removed.length > 0) parts.push(`${result.removed.length} removed`);
     const breakdown = parts.length > 1 ? ` (${parts.join(", ")})` : "";
@@ -1244,7 +1254,11 @@ function reconcileNote(cwd, indexed) {
     if (total === 0) {
       return `token-goat: index drift check${truncated} found nothing in the part it had time to scan. Symbol lookups may be briefly stale.`;
     }
-    return `token-goat: reindexing ${countNoun(total, "file")} that changed outside this session${breakdown}${truncated}. Symbol lookups may be briefly stale.`;
+    const drifted = total - upgraded;
+    const clauses = [];
+    if (drifted > 0) clauses.push(`${countNoun(drifted, "file")} that changed outside this session${breakdown}`);
+    if (upgraded > 0) clauses.push(`${countNoun(upgraded, "file")} unchanged on disk but indexed by an older version of token-goat`);
+    return `token-goat: reindexing ${clauses.join(" and ")}${truncated}. Symbol lookups may be briefly stale.`;
   } catch {
     return null;
   }
@@ -1773,11 +1787,11 @@ function toRegExp(r, i) {
     if (r.str.length === 0) {
       throw new Error(`Rule #${i} ("${r.name}") has empty "str" property, which is not allowed.`);
     }
-    return new RegExp(escapeRegExp(r.str), "y");
+    return new RegExp(escapeRegExp2(r.str), "y");
   }
-  return new RegExp(escapeRegExp(r.name), "y");
+  return new RegExp(escapeRegExp2(r.name), "y");
 }
-function escapeRegExp(str) {
+function escapeRegExp2(str) {
   return str.replace(/[-[\]{}()*+!<=:?./\\^$|#\s,]/g, "\\$&");
 }
 function toSticky(re) {
@@ -5837,8 +5851,8 @@ function trimCharacterEnd(str, char) {
 function unicodeEscape(str) {
   return str.replace(/[\s\S]/g, (c) => "\\u" + c.charCodeAt().toString(16).padStart(4, "0"));
 }
-function get(obj, path4) {
-  for (const key of path4) {
+function get(obj, path5) {
+  for (const key of path5) {
     if (!obj) {
       return void 0;
     }
@@ -7039,8 +7053,8 @@ function withBrackets(str, brackets) {
   const rbr = typeof brackets[1] === "string" ? brackets[1] : "]";
   return lbr + str + rbr;
 }
-function pathRewrite(path4, rewriter, baseUrl, metadata, elem) {
-  const modifiedPath = typeof rewriter === "function" ? rewriter(path4, metadata, elem) : path4;
+function pathRewrite(path5, rewriter, baseUrl, metadata, elem) {
+  const modifiedPath = typeof rewriter === "function" ? rewriter(path5, metadata, elem) : path5;
   return modifiedPath[0] === "/" && baseUrl ? trimCharacterEnd(baseUrl, "/") + modifiedPath : modifiedPath;
 }
 function formatImage(elem, walk, builder, formatOptions) {
@@ -7364,9 +7378,9 @@ function handleDeprecatedOptions(options) {
     options.selectors.push(...tagDefinitions);
     options.selectors = mergeDuplicatesPreferLast(options.selectors, ((s) => s.selector));
   }
-  function set(obj, path4, value) {
-    const valueKey = path4.pop();
-    for (const key of path4) {
+  function set(obj, path5, value) {
+    const valueKey = path5.pop();
+    for (const key of path5) {
       let nested = obj[key];
       if (!nested) {
         nested = {};
@@ -7705,10 +7719,7 @@ function splitShellSegments(cmd) {
 }
 function isTempPath(fp) {
   const norm = fp.replace(/\\/g, "/");
-  return /^\/tmp\//i.test(norm) || /\/var\/folders\//i.test(norm) || // Anchored to a local drive root on purpose. Unanchored, this clause said yes to
-  // `//host/share/AppData/Local/Temp/x.md`, and the caller's answer to yes is to stat the path --
-  // which on Windows opens an SMB session to whatever host a command named. A temp directory is
-  // somewhere on a local volume; nothing that starts with two separators is one.
+  return /^\/tmp\//i.test(norm) || /\/var\/folders\//i.test(norm) || // Anchored to a local drive root on purpose. Unanchored, this clause said yes to `//host/share/AppData/Local/Temp/x.md`, and the caller's answer to yes is to stat the path -- which on Windows opens an SMB session to whatever host a command named. A temp directory is somewhere on a local volume; nothing that starts with two separators is one.
   /^[a-z]:\/(?:[^/]+\/)*AppData\/Local\/Temp\//i.test(norm) || norm.startsWith("/c/Users/") && norm.includes("/AppData/Local/Temp/") || isUnderSystemTemp(fp);
 }
 function isOrchestratorStateFile(filePath) {
@@ -8256,6 +8267,7 @@ function extractNodeFileRead(cmd) {
     const filePath = readSync2[1];
     if (isOrchestratorStateFile(filePath)) return null;
     if (isTempPath(filePath)) return null;
+    if (new RegExp(`(?:writeFileSync|appendFileSync)\\(\\s*['"]${escapeRegExp(filePath)}['"]`).test(cmd)) return null;
     const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
     return { filePath, isDoc, isConfig, isSql };
   }
@@ -8521,10 +8533,7 @@ var CURL_VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--range",
   "-r",
   "--interface",
-  // Options whose own value is a URL or a host. Leaving these out was the same defect as reading
-  // the first URL in the string: `curl --doh-url https://doh/ -o f https://target` answered with
-  // the DoH resolver rather than the file being fetched. `--url-query` belongs here too -- it
-  // appends query data to the request, it does not name the request target.
+  // Options whose own value is a URL or a host. Leaving these out was the same defect as reading the first URL in the string: `curl --doh-url https://doh/ -o f https://target` answered with the DoH resolver rather than the file being fetched. `--url-query` belongs here too -- it appends query data to the request, it does not name the request target.
   "--url-query",
   "--doh-url",
   "--preproxy",
@@ -9988,7 +9997,8 @@ function recordBashFileReadsForSessionCache(cmd, cwd) {
 }
 async function maybeEmitLargeUncompressedHint(cmd, output, exitCode, cwd, isUnwrapped, event, ansiResult) {
   const outputBytes = Buffer.byteLength(output, "utf-8");
-  if (outputBytes < 4096 || process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0" || exitCode !== null && exitCode !== 0 || event.raw["_tg_harness"] !== "vscode" && (isCompressibleSingleCommand(cmd) || !isUnwrapped)) {
+  if (outputBytes < 4096 || process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0" || exitCode !== null && exitCode !== 0 || // token-goat's own output is already the narrow form; telling the model to compress it is noise.
+  /^\s*token-goat\s/.test(cmd) || event.raw["_tg_harness"] !== "vscode" && (isCompressibleSingleCommand(cmd) || !isUnwrapped)) {
     return null;
   }
   const key = `bash-uncompressed-4k:${event.sessionId ?? ""}:${shortFingerprint(cmd)}`;
@@ -9997,7 +10007,8 @@ async function maybeEmitLargeUncompressedHint(cmd, output, exitCode, cwd, isUnwr
   recordStat("session_hint", 0, 0);
   const id = await storeBashOutput(cmd, output, exitCode ?? 0, cwd);
   const kb = Math.round(outputBytes / 1024);
-  const msg = `[tg] Output was ${kb}KB uncompressed. For large tool outputs, run with 'token-goat compress -c "${displaySafeText(cmd)}"' or inspect via 'token-goat bash-output ${id}'.`;
+  const compressable = !/["`$\r\n]/.test(cmd);
+  const msg = `[tg] Output was ${kb}KB uncompressed; \`token-goat bash-output ${id}\` recalls it` + (compressable ? `, and \`token-goat compress -c "${displaySafeText(cmd)}"\` compresses the next run.` : ".");
   if (ansiResult !== null && ansiResult.hookType === "rewriteOutput") {
     return emitRewrite(msg + "\n" + fenceUntrusted(ansiResult.updatedOutput, UNTRUSTED_TOOL_TAG), "large uncompressed output hint", void 0, "counted-elsewhere");
   }
@@ -10322,7 +10333,7 @@ registerHook("post_tool_use", postTaskOutputHandler, { toolName: "TaskOutput" })
 // src/hooks_tool_failure.ts
 init_define_import_meta_env();
 import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync7, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, relative } from "node:path";
+import { dirname as dirname2, relative as relative2 } from "node:path";
 var FAILURE_SUFFIX = ".tool-failures.json";
 var MAX_TRACKED_FAILURES = 64;
 var SIGNATURE_ERROR_CHARS = 200;
@@ -10393,7 +10404,7 @@ function diagnoseEditFailure(event, errorText) {
     const stat = statSync7(absPath);
     if (stat.size > MAX_EDIT_DIAGNOSE_BYTES) return null;
     const fileContent = readFileSync3(absPath, "utf8");
-    const relDisplay = displaySafeText(relative(process.cwd(), absPath).replace(/\\/g, "/") || absPath);
+    const relDisplay = displaySafeText(relative2(process.cwd(), absPath).replace(/\\/g, "/") || absPath);
     if (isMultiple) {
       const matchLines = [];
       let pos = 0;
@@ -11243,7 +11254,7 @@ init_define_import_meta_env();
 import { createHash as createHash2 } from "node:crypto";
 import * as fs2 from "node:fs";
 import * as os2 from "node:os";
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 var BRIEFING_TARGET_TOKENS = 550;
 function buildSubagentBriefing() {
   try {
@@ -11468,8 +11479,8 @@ function parseAgentDefinition(text, fallbackName) {
   return { name: name2, restricted: false };
 }
 function findRestrictedAgentNames(roots) {
-  const projectAgentsRoot = path3.join(process.cwd(), ".claude", "agents");
-  const scanRoots = roots ?? [path3.join(os2.homedir(), ".claude", "agents"), projectAgentsRoot];
+  const projectAgentsRoot = path4.join(process.cwd(), ".claude", "agents");
+  const scanRoots = roots ?? [path4.join(os2.homedir(), ".claude", "agents"), projectAgentsRoot];
   const names = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   let filesSeen = 0;
@@ -11493,7 +11504,7 @@ function findRestrictedAgentNames(roots) {
     }
     for (const entry of entries) {
       if (filesSeen >= ROSTER_WALK_MAX_FILES) return;
-      const full = path3.join(dir, entry.name);
+      const full = path4.join(dir, entry.name);
       let stat;
       try {
         stat = fs2.statSync(full);
@@ -11512,12 +11523,12 @@ function findRestrictedAgentNames(roots) {
       } catch {
         continue;
       }
-      const parsed = parseAgentDefinition(text, path3.basename(entry.name, path3.extname(entry.name)));
+      const parsed = parseAgentDefinition(text, path4.basename(entry.name, path4.extname(entry.name)));
       if (parsed !== null && parsed.restricted) names.add(parsed.name);
     }
   };
   for (const root of scanRoots) {
-    const isProjectRoot = roots === void 0 && path3.resolve(root) === path3.resolve(projectAgentsRoot);
+    const isProjectRoot = roots === void 0 && path4.resolve(root) === path4.resolve(projectAgentsRoot);
     if (!isProjectRoot) {
       walk(root, 0, null);
       continue;

package/dist/{token-goat-chunk-4DC6DDIB.mjs → token-goat-chunk-YQZE5NS6.mjs}

@@ -20,17 +20,17 @@ import {
   setOcrTimeoutForTesting,
   setTesseractEntryForTesting,
   verifyOcrLangCache
-} from "./token-goat-chunk-EJCY6KHO.mjs";
-import "./token-goat-chunk-DMQ32ZSR.mjs";
-import "./token-goat-chunk-R3X5TCPB.mjs";
+} from "./token-goat-chunk-H3FONFBO.mjs";
+import "./token-goat-chunk-HPOFR6QX.mjs";
+import "./token-goat-chunk-L7VCX33I.mjs";
 import {
   DEFAULT_OCR_LANG,
   isSupportedOcrLang,
   resolveOcrLangs
-} from "./token-goat-chunk-H3DXI6VD.mjs";
+} from "./token-goat-chunk-CA6V36KW.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-OSUFN2FV.mjs";
-import "./token-goat-chunk-3H6FQT62.mjs";
+import "./token-goat-chunk-QIDLJGXZ.mjs";
 import "./token-goat-chunk-ERTXEKB6.mjs";
 import "./token-goat-chunk-GMOUBOX4.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";

package/dist/token-goat-hook.mjs

@@ -2,20 +2,20 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-GMXBQS6O.mjs";
-import "./token-goat-chunk-UXHDBVUR.mjs";
-import "./token-goat-chunk-UMXD2M7O.mjs";
-import "./token-goat-chunk-XOHTFRDH.mjs";
-import "./token-goat-chunk-5USHO7B6.mjs";
-import "./token-goat-chunk-DMQ32ZSR.mjs";
+} from "./token-goat-chunk-WFX2V3OF.mjs";
+import "./token-goat-chunk-RHHFEXKF.mjs";
+import "./token-goat-chunk-V3ZWBEHM.mjs";
+import "./token-goat-chunk-BFEWOMA3.mjs";
+import "./token-goat-chunk-CTOYJ232.mjs";
+import "./token-goat-chunk-HPOFR6QX.mjs";
 import "./token-goat-chunk-3BTK54F3.mjs";
-import "./token-goat-chunk-BFNTLGVA.mjs";
-import "./token-goat-chunk-63QWJ6UM.mjs";
-import "./token-goat-chunk-R3X5TCPB.mjs";
-import "./token-goat-chunk-H3DXI6VD.mjs";
+import "./token-goat-chunk-W3E65QOW.mjs";
+import "./token-goat-chunk-I67CPTDD.mjs";
+import "./token-goat-chunk-L7VCX33I.mjs";
+import "./token-goat-chunk-CA6V36KW.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-OSUFN2FV.mjs";
-import "./token-goat-chunk-3H6FQT62.mjs";
+import "./token-goat-chunk-QIDLJGXZ.mjs";
 import "./token-goat-chunk-ERTXEKB6.mjs";
 import "./token-goat-chunk-Y4AFKTHK.mjs";
 import "./token-goat-chunk-GMOUBOX4.mjs";

package/dist/token-goat.core.mjs

@@ -2,33 +2,33 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-Z5VPAXTC.mjs";
-import "./token-goat-chunk-2PCFAQAS.mjs";
-import "./token-goat-chunk-EJCY6KHO.mjs";
+} from "./token-goat-chunk-LTYWLKAG.mjs";
+import "./token-goat-chunk-QML7ITHJ.mjs";
+import "./token-goat-chunk-H3FONFBO.mjs";
 import "./token-goat-chunk-LMFO66YD.mjs";
-import "./token-goat-chunk-UMXD2M7O.mjs";
-import "./token-goat-chunk-XOHTFRDH.mjs";
-import "./token-goat-chunk-5USHO7B6.mjs";
-import "./token-goat-chunk-DMQ32ZSR.mjs";
+import "./token-goat-chunk-V3ZWBEHM.mjs";
+import "./token-goat-chunk-BFEWOMA3.mjs";
+import "./token-goat-chunk-CTOYJ232.mjs";
+import "./token-goat-chunk-HPOFR6QX.mjs";
 import "./token-goat-chunk-LKSXAMJB.mjs";
-import "./token-goat-chunk-NQZCSVN2.mjs";
-import "./token-goat-chunk-2IEIBVVD.mjs";
-import "./token-goat-chunk-NAMH252H.mjs";
-import "./token-goat-chunk-GIMGT34T.mjs";
+import "./token-goat-chunk-UENEL6KX.mjs";
+import "./token-goat-chunk-ARNRFR6M.mjs";
+import "./token-goat-chunk-LA3O4JGD.mjs";
+import "./token-goat-chunk-EPXNOKIV.mjs";
 import "./token-goat-chunk-3BTK54F3.mjs";
-import "./token-goat-chunk-MA5BZ2KI.mjs";
+import "./token-goat-chunk-7VLWNQDQ.mjs";
 import "./token-goat-chunk-XTQAOTSO.mjs";
 import "./token-goat-chunk-AH6QILZM.mjs";
-import "./token-goat-chunk-YPS64ACE.mjs";
-import "./token-goat-chunk-BFNTLGVA.mjs";
-import "./token-goat-chunk-63QWJ6UM.mjs";
-import "./token-goat-chunk-R3X5TCPB.mjs";
-import "./token-goat-chunk-H3DXI6VD.mjs";
+import "./token-goat-chunk-GRI6HWX3.mjs";
+import "./token-goat-chunk-W3E65QOW.mjs";
+import "./token-goat-chunk-I67CPTDD.mjs";
+import "./token-goat-chunk-L7VCX33I.mjs";
+import "./token-goat-chunk-CA6V36KW.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-OSUFN2FV.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-3H6FQT62.mjs";
+} from "./token-goat-chunk-QIDLJGXZ.mjs";
 import "./token-goat-chunk-ERTXEKB6.mjs";
 import "./token-goat-chunk-Y4AFKTHK.mjs";
 import "./token-goat-chunk-GMOUBOX4.mjs";

package/docs/cli.md

@@ -74,6 +74,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat imports "file"` | Show the import graph for a file one level deep. Accepts a comma-separated file list (`"a,b,c"`) to cover several files in one call, one clearly-headed block per file; extra space-separated file arguments are reported in a note naming that comma form instead of being silently dropped. `--grep <pattern>` only shows imports whose MODULE SPECIFIER matches this regex (literal substring if it is not valid regex), applied before `--json`'s truncation; when it matches nothing among real imports, the output names the active filter instead of reading like the file has no imports at all. |
 | `token-goat dep-docs <package>` | Extract one installed npm package's README, `package.json` metadata, and (if resolvable) a compact `.d.ts` signature outline, instead of grepping `node_modules`. |
 | `token-goat find "<query>"` | Find the FILES defining a symbol whose name matches a pattern: a case-insensitive substring scan over indexed symbol names, emitting the distinct file paths. When no name contains the pattern, falls back to an edit-distance match so a mistyped name still lands (`getUserr` → `getUser`) — the same ranking `Did you mean:` uses. The fallback runs only when the substring pass found nothing, so an exact match is never reordered or displaced, and a query near nothing still reports a clean miss instead of unrelated names. A recovered match names what it actually matched on stderr rather than silently answering for a name you didn't type; `--json` marks it with `fuzzy: true` and `matchedNames`, both absent on an exact hit. `--limit <n>` caps the file count. Matches on NAMES only — for meaning-based search over file content use `token-goat semantic`. |
+| `token-goat locate <spec>` | Locate a symbol or landmark with exact line spans across the project or in a specific file. Supports `name` or `file::name`, with fuzzy edit-distance fallback when no exact match is found. `--file <path>` restricts search to a specific file; `--limit <n>` caps results; `--json` emits the shared envelope with exact line spans. |
 | `token-goat similar "file::symbol"` | Find the top-k symbols most similar to a given symbol, via full-text search over symbol names and bodies. Also accepts `read`'s `symbol@LINE` anchor to pick out an otherwise-ambiguous candidate. |
 | `token-goat test-for "file"` | Find test file(s) for an implementation file and list their test functions. `--json`'s `testFile` renders root-relative when a project root resolves, absolute when none does, matching plain-text output. `--json` emits the shared `{items, truncated, totalCount}` envelope — the same shape `symbol`/`refs`/`skeleton`/`outline --json` return, present whether or not truncation occurred, so a script never has to branch on shape. |
 | `token-goat dead` | Surface functions, methods, and classes with no recorded callers in the project index. Private names and common entry points (`main`, `app`, etc.) are excluded by default. `--include-private` lifts the underscore filter; `--kind` narrows to specific symbol types, comma-separated for a union (`--kind function,method`) — an unrecognized kind errors instead of silently reading as a clean codebase; `--top N` caps output; `--json` for structured output. `--exclude-tests` hides dead symbols DEFINED in a test file (opt-in — omitted, output is unchanged); prints a note naming how many were hidden. `--grep <pattern>` only shows dead symbols whose NAME matches this regex (literal substring if it is not valid regex), applied before `--top`'s slice; when it matches nothing among dead symbols that do exist, the output names the active filter instead of reading like a genuinely clean codebase. Results are a heuristic lead — dynamic dispatch and external callers are invisible to static indexing. `--json` emits both `file` and `filePath` with the identical value, root-relative when a project root resolves, absolute when none does, matching plain-text output; `file` is retained for this release only and will be removed in a future release, `filePath` is the spelling to migrate to (matching `symbol`/`types --json`). `--json` emits the shared `{items, truncated, totalCount}` envelope — the same shape `symbol`/`refs`/`skeleton`/`outline --json` return, present whether or not truncation occurred, so a script never has to branch on shape. |
@@ -147,7 +148,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat transcript <file>` | Slice a WebVTT/SRT transcript by `--speaker <name>`, `--from`/`--to <hh:mm:ss>`, and/or `--grep <pattern>` instead of a raw Read. |
 | `token-goat screenshot <url> <destPath>` | Capture a local headless-browser screenshot, shrunk the same way local image reads are (image-shrink pipeline). `--executable-path` overrides the Chrome/Chromium binary; `--width`/`--height` set the viewport (default 1280x800); `--full-page` captures the full scrollable page. Only `http:`/`https:` targets are allowed, and loopback/link-local/private/cloud-metadata addresses are refused by default (`screenshot.block_private_targets`, env `TOKEN_GOAT_SCREENSHOT_BLOCK_PRIVATE_TARGETS`) — see [Security, privacy, and uninstall](security.md) for what that check does and does not cover. |
 | `token-goat clean-cache` | Prune on-disk caches to their configured floor without waiting for the worker. |
-| `token-goat reclaim-index` | Shrink an oversized symbol index (`VACUUM` + WAL checkpoint). `--rebuild` also drops every derived row — files/symbols/refs/chunks — so the next `token-goat index` re-derives them under current parser rules, which is what actually reclaims space held by rows a since-fixed extractor wrote too large. Refuses to run while the worker daemon is writing to the index unless `--force`. `token-goat doctor` points here when `global.db` grows past 1 GB, and separately when it finds a stored symbol body above the parser's own size cap — a leftover from a since-fixed extractor bug, which only `--rebuild` can clear (a plain `VACUUM` reclaims freed pages but never deletes row content). |
+| `token-goat reclaim-index` | Shrink an oversized symbol index (`VACUUM` + WAL checkpoint). `--rebuild` also drops every derived row — files/symbols/refs/chunks — so the next `token-goat index` re-derives them under current parser rules, which is what actually reclaims space held by rows a since-fixed extractor wrote too large. Refuses to run while the worker daemon is writing to the index unless `--force`. `token-goat doctor` points here when `global.db` grows past 1 GB and at least a tenth of it is free pages (it points to `project prune` instead for scratch files indexed under the OS temp dir), and separately when it finds a stored symbol body above the parser's own size cap — a leftover from a since-fixed extractor bug, which only `--rebuild` can clear (a plain `VACUUM` reclaims freed pages but never deletes row content). |
 | `token-goat prune-cache` | Manually trigger LRU eviction across all cache directories (images, bash, web, skills). |
 | `token-goat session-summary` | Compact one-liner about current session state — designed for orchestrators and multi-agent loops. |
 | `token-goat cache-audit` | Audit your Claude Code config for patterns that bust the prompt cache. |
@@ -173,7 +174,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat note set/get/unset/list/clear` | Persistent per-project notes stored as key-value pairs. Token-goat injects them at session start and after compaction so they survive conversation rollover. Use to pin decisions, constraints, or reminders that would otherwise vanish after compaction. `note list --json` for machine-readable output; `note clear` removes everything at once. |
 | `token-goat project list` | Show all project roots indexed by token-goat with their file counts. Roots on the blocklist appear tagged `[excluded]`. `--json` for structured output. |
 | `token-goat project exclude <path>` | Add a project root to the blocklist so the worker never indexes it. Writes the resolved absolute path to `[worker] blocked_roots` in `config.toml`; idempotent. It also removes anything already indexed under that path and says how many files went, so excluding a directory means its contents stop being readable through `symbol` rather than merely stopping future indexing. Remove the entry from the config to re-enable indexing, then run `token-goat index` to bring the contents back. |
-| `token-goat project prune [--dry-run]` | Remove blocked/excluded roots that no longer exist on disk. `--dry-run` previews removals without touching the config file. Useful after deleting or moving projects. |
+| `token-goat project prune [--dry-run]` | Remove blocked/excluded roots that no longer exist on disk, and index rows for files under the OS temp dir. `--dry-run` previews removals without touching the config file. Useful after deleting or moving projects. |
 | `token-goat install` | Wire up hooks (and, with the harness flags below, other AI tool integrations). No `--dry-run` or `--verify` flag — run `token-goat doctor` after install to audit the result. |
 | `token-goat upgrade` | Check for updates or upgrade token-goat to the latest version via npm. Pass `--check` to report status without installing. `--json` emits machine-readable version status. |
 | `token-goat doctor` | Confirm everything is wired correctly. Surfaces install state, cold-import timing, cache hit rates, compaction-budget telemetry, opt-in flag status, and canonical-root sanity. A **Parser freshness** check reports how much of the index for this project was written by a different build of the extractor. The stamp only refreshes when something touches a file, so after an upgrade a project goes on answering `symbol`, `read`, `outline` and `skeleton` from the previous extractor with nothing saying so. It warns past a quarter and names the fix: a plain `token-goat index` in that project, which is enough on its own, since a parser mismatch reparses without `--force`. A **Tool names** check reports any tool name a harness sent that reached no handler wanting it, and calls out the ones that differ from a handled name only by capitalisation or punctuation — the signature of a bridge that forgot to rename something, which is otherwise invisible. A **Security** section reports the posture in one place: whether offline mode is on, whether injection scanning is on, whether the Google Drive integration is enabled, whether fetching runs against an allow list or a deny list, whether MCP reads are confined to the project root, and whether the data directory is readable by other local users. It only warns when a protection that ships on has been switched off, so a default install stays quiet. It read-only audits `~/.copilot/mcp-config.json` for globally configured Chrome DevTools or Playwright `npx` launchers, recommending project scope or removal when inactive; it never prints server configuration or secrets. On Windows, it also reports duplicate Chrome DevTools/Playwright MCP launchers and orphaned Node processes without terminating anything. Pass `--context` to show the **Context footprint** section: a fill bar with severity (ok / warn / high / URGENT), per-component breakdown (skills catalog, loaded skill bodies, CLAUDE.md+MEMORY.md, conversation estimate), session-to-session growth trend with sessions-to-URGENT projection, and tiered compaction recommendations (Tier 0–4) naming the exact commands to run. Auto-shown when fill > 40 % or any loaded skill > 2 K tokens lacks a compact. `--json` emits the check results (one entry per check, with `ok`/`warn`/`fail` status) as JSON instead of text. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.16",
+  "version": "2.9.18",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",