token-goat 2.9.18 → 2.9.19

package/dist/{token-goat-chunk-QIDLJGXZ.mjs → token-goat-chunk-ZGQXRYKE.mjs}

@@ -8,7 +8,7 @@ import {
   lowercaseDriveLetter,
   normalizeDarwinSystemAlias,
   normalizePath
-} from "./token-goat-chunk-ERTXEKB6.mjs";
+} from "./token-goat-chunk-NMTKNYGF.mjs";
 import {
   compileGuardedRegex
 } from "./token-goat-chunk-GMOUBOX4.mjs";
@@ -21,7 +21,7 @@ init_define_import_meta_env();
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.9.18";
+    return "2.9.19";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -222,6 +222,10 @@ function isCaseInsensitiveFs() {
 function foldPath(p) {
   return isCaseInsensitiveFs() ? foldCase(p) : p;
 }
+function isNodeModulesPath(p) {
+  const check = foldPath(p);
+  return check.includes("/node_modules/") || check.includes("\\node_modules\\");
+}
 function foldCase(s) {
   return s.toLowerCase();
 }
@@ -599,7 +603,7 @@ function encodeUtf32(text, littleEndian) {
 // src/util.ts
 init_define_import_meta_env();
 import { spawn } from "node:child_process";
-import { chmodSync as chmodSync2, closeSync, constants as fsConstants, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, renameSync, statSync as statSync3, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { chmodSync as chmodSync2, closeSync, constants as fsConstants, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, openSync, readdirSync, readFileSync as readFileSync3, renameSync, rmdirSync, statSync as statSync3, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import * as path7 from "node:path";
 
 // src/bridges/created_configs.ts
@@ -734,7 +738,7 @@ function stripOwnHooksFromMap(hooks, isOurs) {
     const kept = [];
     for (const group of groups) {
       const keptHooks = (group.hooks ?? []).filter((h) => {
-        const isOur = isOurs(h.command);
+        const isOur = isOurs(h.command, h.args);
         if (isOur) removed = true;
         return !isOur;
       });
@@ -760,7 +764,7 @@ function stripStaleGroupHooks(groups, isOurs, matcherFilter) {
       next.push(group);
       continue;
     }
-    const keptHooks = (group.hooks ?? []).filter((h) => !isOurs(h.command));
+    const keptHooks = (group.hooks ?? []).filter((h) => !isOurs(h.command, h.args));
     if (keptHooks.length > 0) {
       next.push({ ...group, hooks: keptHooks });
     } else if ((group.hooks ?? []).length === 0) {
@@ -982,6 +986,19 @@ function removeFileInScope(p) {
     return false;
   }
 }
+function removeEmptyDirInScope(dirPath) {
+  assertWriteInScope(dirPath);
+  try {
+    const entries = readdirSync(dirPath);
+    if (entries.length === 0) {
+      rmdirSync(dirPath);
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
 function uninstallSingleFilePlugin(filePath, sidecarPath) {
   removeFileInScope(sidecarPath);
   return removeFileInScope(filePath);
@@ -1243,6 +1260,10 @@ function hookCommandFor(scriptPath, event) {
   const entryArg = entryPath ? ` ${quoteShellPath(entryPath)}` : "";
   return `${quoteShellPath(process.execPath)} ${quoteShellPath(scriptPath)} ${event}${entryArg}`;
 }
+function hookExecPartsFor(scriptPath, event) {
+  const entryPath = process.argv[1];
+  return { command: process.execPath, args: entryPath ? [scriptPath, event, entryPath] : [scriptPath, event] };
+}
 function hookPowershellCommand(scriptPath, event) {
   const entryPath = process.argv[1];
   const entryArg = entryPath ? ` ${quotePowershellPath(entryPath)}` : "";
@@ -1269,6 +1290,7 @@ export {
   removeCreatedBackups,
   isCaseInsensitiveFs,
   foldPath,
+  isNodeModulesPath,
   foldCase,
   foldCaseForContainment,
   foldPathForContainment,
@@ -1304,6 +1326,7 @@ export {
   atomicWriteBytes,
   installSingleFilePlugin,
   removeFileInScope,
+  removeEmptyDirInScope,
   uninstallSingleFilePlugin,
   backupFile,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -1337,5 +1360,6 @@ export {
   isUnderBlockedRoot,
   isWithinQuietHours,
   hookCommandFor,
+  hookExecPartsFor,
   hookPowershellCommand
 };

package/dist/token-goat-hook.mjs

@@ -2,21 +2,21 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-WFX2V3OF.mjs";
-import "./token-goat-chunk-RHHFEXKF.mjs";
-import "./token-goat-chunk-V3ZWBEHM.mjs";
-import "./token-goat-chunk-BFEWOMA3.mjs";
-import "./token-goat-chunk-CTOYJ232.mjs";
-import "./token-goat-chunk-HPOFR6QX.mjs";
+} from "./token-goat-chunk-HPMMLV37.mjs";
+import "./token-goat-chunk-MU6I4IDI.mjs";
+import "./token-goat-chunk-2GTB5RBZ.mjs";
+import "./token-goat-chunk-FQYMZASI.mjs";
+import "./token-goat-chunk-7DGTVBWP.mjs";
+import "./token-goat-chunk-S7RFIX4Y.mjs";
 import "./token-goat-chunk-3BTK54F3.mjs";
-import "./token-goat-chunk-W3E65QOW.mjs";
-import "./token-goat-chunk-I67CPTDD.mjs";
-import "./token-goat-chunk-L7VCX33I.mjs";
-import "./token-goat-chunk-CA6V36KW.mjs";
+import "./token-goat-chunk-EP7TCWHM.mjs";
+import "./token-goat-chunk-IBTFGZBX.mjs";
+import "./token-goat-chunk-JNIFSVWM.mjs";
+import "./token-goat-chunk-SOKAPOOC.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-OSUFN2FV.mjs";
-import "./token-goat-chunk-QIDLJGXZ.mjs";
-import "./token-goat-chunk-ERTXEKB6.mjs";
+import "./token-goat-chunk-ZGQXRYKE.mjs";
+import "./token-goat-chunk-NMTKNYGF.mjs";
 import "./token-goat-chunk-Y4AFKTHK.mjs";
 import "./token-goat-chunk-GMOUBOX4.mjs";
 import "./token-goat-chunk-RRNZMM3A.mjs";

package/dist/token-goat.core.mjs

@@ -2,34 +2,35 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-LTYWLKAG.mjs";
-import "./token-goat-chunk-QML7ITHJ.mjs";
-import "./token-goat-chunk-H3FONFBO.mjs";
-import "./token-goat-chunk-LMFO66YD.mjs";
-import "./token-goat-chunk-V3ZWBEHM.mjs";
-import "./token-goat-chunk-BFEWOMA3.mjs";
-import "./token-goat-chunk-CTOYJ232.mjs";
-import "./token-goat-chunk-HPOFR6QX.mjs";
+} from "./token-goat-chunk-WKO5TVNA.mjs";
+import "./token-goat-chunk-GYC34EGE.mjs";
+import "./token-goat-chunk-PIAESKVU.mjs";
+import "./token-goat-chunk-F24NE3FO.mjs";
+import "./token-goat-chunk-DA43OE7L.mjs";
+import "./token-goat-chunk-2GTB5RBZ.mjs";
+import "./token-goat-chunk-FQYMZASI.mjs";
+import "./token-goat-chunk-7DGTVBWP.mjs";
+import "./token-goat-chunk-S7RFIX4Y.mjs";
 import "./token-goat-chunk-LKSXAMJB.mjs";
-import "./token-goat-chunk-UENEL6KX.mjs";
-import "./token-goat-chunk-ARNRFR6M.mjs";
-import "./token-goat-chunk-LA3O4JGD.mjs";
-import "./token-goat-chunk-EPXNOKIV.mjs";
+import "./token-goat-chunk-DHIXE6GV.mjs";
+import "./token-goat-chunk-3W5P673V.mjs";
+import "./token-goat-chunk-FJZ5MZK7.mjs";
+import "./token-goat-chunk-KWM6KBPA.mjs";
 import "./token-goat-chunk-3BTK54F3.mjs";
-import "./token-goat-chunk-7VLWNQDQ.mjs";
+import "./token-goat-chunk-BTKDZW7F.mjs";
 import "./token-goat-chunk-XTQAOTSO.mjs";
 import "./token-goat-chunk-AH6QILZM.mjs";
-import "./token-goat-chunk-GRI6HWX3.mjs";
-import "./token-goat-chunk-W3E65QOW.mjs";
-import "./token-goat-chunk-I67CPTDD.mjs";
-import "./token-goat-chunk-L7VCX33I.mjs";
-import "./token-goat-chunk-CA6V36KW.mjs";
+import "./token-goat-chunk-NJKNAC37.mjs";
+import "./token-goat-chunk-EP7TCWHM.mjs";
+import "./token-goat-chunk-IBTFGZBX.mjs";
+import "./token-goat-chunk-JNIFSVWM.mjs";
+import "./token-goat-chunk-SOKAPOOC.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-OSUFN2FV.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-QIDLJGXZ.mjs";
-import "./token-goat-chunk-ERTXEKB6.mjs";
+} from "./token-goat-chunk-ZGQXRYKE.mjs";
+import "./token-goat-chunk-NMTKNYGF.mjs";
 import "./token-goat-chunk-Y4AFKTHK.mjs";
 import "./token-goat-chunk-GMOUBOX4.mjs";
 import "./token-goat-chunk-RRNZMM3A.mjs";

package/docs/cli.md

@@ -58,6 +58,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat call-chain <symbol>` | Trace every caller layer from a symbol back to the entry points — one step deeper than `callers`. Use when you need to know what reaches a function across the whole call graph, not only who invokes it directly. Pairs with `impact` for the downstream direction. Accepts `file::symbol` to disambiguate WHICH same-named definition the chain starts from — the file only narrows which definition, callers can still be found in any file. `--exclude-tests` prunes callers whose call site is a test file BEFORE they're admitted to the traversal, so nothing walks through a test node either (opt-in — omitted, output is unchanged); when every caller was a test, the "no callers" line names how many were hidden instead of reading as genuinely unreferenced. `Symbol not found: <symbol>` for an unindexed name (bare or `file::symbol`) now carries a `Did you mean:` suggestion when a near-name candidate is indexed. `--grep <pattern>` keeps only completed chains containing a symbol name matching this regex (literal substring if it is not valid regex) — the BFS still walks the full graph, this only narrows which finished chains are reported, so a chain passing through a matching symbol on its way to an unrelated root still surfaces; when it matches none of the chains that do exist, the output names how many were filtered out rather than reading as genuinely caller-less. A chain the walk abandoned because it ran out of `--depth` ends in a `(depth-limit)` marker, so a truncated chain is never mistaken for one that reached a real entry point. |
 | `token-goat impact <symbol>` | Walk the call-reference graph forward (breadth-first) and list every function that depends on a symbol, with hop depth; module-scope callers are surfaced as `(module scope) <file>` entries. Run before a refactor to size up the blast radius without starting a build. Accepts `file::symbol` to disambiguate WHICH same-named definition the walk starts from — the file only narrows which definition, callers can still be found in any file. `--exclude-tests` prunes callers (including module-scope entries) whose call site is a test file BEFORE they're enqueued for further traversal, so nothing walks through a test node either (opt-in — omitted, output is unchanged); when every caller was a test, the "no callers found" error names how many were hidden instead of reading as genuinely unreferenced. A bare name that isn't indexed at all reports `Symbol not found: <name>` (with a `Did you mean:` suggestion when a near-name candidate is indexed) instead of the misleading "no callers found", which is reserved for a real, indexed symbol that genuinely has zero impact. `--grep <pattern>` only shows impacted entries whose symbol name (or `(module scope) <file>` key) matches this regex (literal substring if it is not valid regex), the same filter `call-chain --grep`/`dead --grep` apply to their own results — applied BEFORE the `--top` slice, so it selects from the whole impacted set rather than an already-capped page; when it matches none of the impacted entries that do exist, the output names how many were filtered out instead of reading as genuinely impact-free. |
 | `token-goat context-for <task>` | Takes a natural-language task description, runs semantic search across the indexed codebase, and emits a prioritized list of `token-goat read` commands trimmed to a token budget. Fetches only the relevant slices instead of loading entire files. `--budget N` sets the token ceiling; `--top N` limits the file count; `--json` for structured output. Every emitted command carries the `file::symbol@LINE` anchor, so a suggestion still runs when the same symbol name has more than one definition in its file; `--json` entries carry the matching `line` field. |
+| `token-goat answer "<question>"` | Deterministic question router: classifies a plain-English question to one of six intents (where a symbol is, who calls it, what tests cover it, what a file exports, what a file imports, what breaks if a symbol changes), resolves the subject against the index, and delegates in-process to the command that already answers it. No model call, no inference, no fallback to a fuzzy match. Because the subject is looked up before anything runs, the router picks the right ARGUMENT FORM too: `answer "what tests cover foldPath"` resolves `foldPath` to `src/path_containment.ts` and runs `test-for` against the file, where passing a symbol to `test-for` directly fails. A bare basename resolves when exactly one file in the project carries it, and lists the candidates when several do. Every answer is preceded by `via: token-goat <command> <argument>` so the delegate can be verified or re-run with its own flags. Anything else refuses: `cannot answer deterministically: <why>; try: <command>`, exit 1. Questions of judgement, intent or runtime behaviour (`why does X...`, `is X correct`, `should I...`) refuse even when they name a real symbol. |
 | `token-goat ask "<question>"` *(experimental)* | Retrieves relevant slices via full-text (BM25) search over the symbol index — not semantic/embedding search — and lists them as pointer-citations plus `token-goat read` commands. Set `TOKEN_GOAT_ASK_BACKEND=claude` or `TOKEN_GOAT_ASK_BACKEND=codex` to synthesize a short answer via that CLI (whatever model it defaults to; token-goat does not force Haiku or any particular tier); with the env var unset, or the named CLI missing from PATH, `ask` degrades to printing the retrieved pointers with no network call. `--top N` caps the number of FTS hits (default 8); `--json` for structured output. Answers are not cached — each call re-retrieves and re-synthesizes from scratch. Every emitted command carries the `file::symbol@LINE` anchor, so a suggestion still runs when the same symbol name has more than one definition in its file; `--json` entries carry the matching `line` field. |
 | `token-goat changed [<ref>]` | List files (or `--symbol` for symbols) changed since a git ref, without reading the full diff. `<ref>` and `--since <ref>` are equivalent (default `HEAD~5`); `--since` wins if both are given. `--json` for structured output. `--grep <pattern>` only lists changed files whose path matches this regex (literal substring if it is not valid regex) — applied to the file list even in `--symbol` mode, before any downstream slicing; when it matches none of the files that did change, the output names the active filter instead of reading like nothing changed. `--exclude-tests` hides changed files that live in a test file (opt-in — omitted, output is unchanged), completing the flag family already on `refs`/`callers`/`dead`/`call-chain`/`impact`/`semantic`/`symbol`. `--grep` can only ever *select* a path, so there was no reliable way to ask for the non-test half of a diff: the negative-lookahead regex that expresses "not a test" silently degrades to a literal substring match whenever the regex-compile fallback fires. Test files are a large share of a typical diff — measured against this repo, 35–54% of changed files across the last 5, 10 and 20 commits. Like `--grep` it filters the file path, so it applies in `--symbol` mode too, and it prunes before the per-file index lookup rather than after, so a test file is never queried at all. Composable with `--grep` (a file must satisfy both; when both are active and `--grep` is what emptied the list, the `--grep` notice takes priority, and when `--grep` left only test files so that `--exclude-tests` emptied it, the message names both filters rather than claiming no non-test file changed). When it hides every changed file there was, the output names how many were hidden and exits 0, rather than a bare "No files changed." that would read as a clean diff. Every zero-row path emits the shared `{items, truncated, totalCount}` envelope under `--json`. |
 | `token-goat diff "file::symbol" [range]` | Show only the git diff hunk(s) that fall within one symbol's line range, e.g. `token-goat diff "file.ts::myFn" HEAD~3..HEAD`, instead of the whole file's diff. Also accepts `read`'s `symbol@LINE` anchor to pick out an otherwise-ambiguous candidate. |
@@ -177,7 +178,7 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat project prune [--dry-run]` | Remove blocked/excluded roots that no longer exist on disk, and index rows for files under the OS temp dir. `--dry-run` previews removals without touching the config file. Useful after deleting or moving projects. |
 | `token-goat install` | Wire up hooks (and, with the harness flags below, other AI tool integrations). No `--dry-run` or `--verify` flag — run `token-goat doctor` after install to audit the result. |
 | `token-goat upgrade` | Check for updates or upgrade token-goat to the latest version via npm. Pass `--check` to report status without installing. `--json` emits machine-readable version status. |
-| `token-goat doctor` | Confirm everything is wired correctly. Surfaces install state, cold-import timing, cache hit rates, compaction-budget telemetry, opt-in flag status, and canonical-root sanity. A **Parser freshness** check reports how much of the index for this project was written by a different build of the extractor. The stamp only refreshes when something touches a file, so after an upgrade a project goes on answering `symbol`, `read`, `outline` and `skeleton` from the previous extractor with nothing saying so. It warns past a quarter and names the fix: a plain `token-goat index` in that project, which is enough on its own, since a parser mismatch reparses without `--force`. A **Tool names** check reports any tool name a harness sent that reached no handler wanting it, and calls out the ones that differ from a handled name only by capitalisation or punctuation — the signature of a bridge that forgot to rename something, which is otherwise invisible. A **Security** section reports the posture in one place: whether offline mode is on, whether injection scanning is on, whether the Google Drive integration is enabled, whether fetching runs against an allow list or a deny list, whether MCP reads are confined to the project root, and whether the data directory is readable by other local users. It only warns when a protection that ships on has been switched off, so a default install stays quiet. It read-only audits `~/.copilot/mcp-config.json` for globally configured Chrome DevTools or Playwright `npx` launchers, recommending project scope or removal when inactive; it never prints server configuration or secrets. On Windows, it also reports duplicate Chrome DevTools/Playwright MCP launchers and orphaned Node processes without terminating anything. Pass `--context` to show the **Context footprint** section: a fill bar with severity (ok / warn / high / URGENT), per-component breakdown (skills catalog, loaded skill bodies, CLAUDE.md+MEMORY.md, conversation estimate), session-to-session growth trend with sessions-to-URGENT projection, and tiered compaction recommendations (Tier 0–4) naming the exact commands to run. Auto-shown when fill > 40 % or any loaded skill > 2 K tokens lacks a compact. `--json` emits the check results (one entry per check, with `ok`/`warn`/`fail` status) as JSON instead of text. |
+| `token-goat doctor` | Confirm everything is wired correctly. Surfaces install state, cold-import timing, cache hit rates, compaction-budget telemetry, opt-in flag status, and canonical-root sanity. A **Parser freshness** check reports how much of the index for this project was written by a different build of the extractor. The stamp only refreshes when something touches a file, so after an upgrade a project goes on answering `symbol`, `read`, `outline` and `skeleton` from the previous extractor with nothing saying so. It warns past a quarter and names the fix: a plain `token-goat index` in that project, which is enough on its own, since a parser mismatch reparses without `--force`. A **Tool names** check reports any tool name a harness sent that reached no handler wanting it, and calls out the ones that differ from a handled name only by capitalisation or punctuation — the signature of a bridge that forgot to rename something, which is otherwise invisible. When `global.db` passes 1 GB, the warning now also breaks the total down by category (symbol bodies, refs, chunk text, embedding vectors, stats detail) with each one's measured byte share and the exact command that shrinks it -- `reclaim-index --rebuild` for the derived-row categories, disabling `indexing.embeddings_enabled` first for vectors so they don't regrow, and nothing manual for stats detail, which ages out on its own. A **Security** section reports the posture in one place: whether offline mode is on, whether injection scanning is on, whether the Google Drive integration is enabled, whether fetching runs against an allow list or a deny list, whether MCP reads are confined to the project root, and whether the data directory is readable by other local users. It only warns when a protection that ships on has been switched off, so a default install stays quiet. It read-only audits `~/.copilot/mcp-config.json` for globally configured Chrome DevTools or Playwright `npx` launchers, recommending project scope or removal when inactive; it never prints server configuration or secrets. On Windows, it also reports duplicate Chrome DevTools/Playwright MCP launchers and orphaned Node processes without terminating anything. Pass `--context` to show the **Context footprint** section: a fill bar with severity (ok / warn / high / URGENT), per-component breakdown (skills catalog, loaded skill bodies, CLAUDE.md+MEMORY.md, conversation estimate), session-to-session growth trend with sessions-to-URGENT projection, and tiered compaction recommendations (Tier 0–4) naming the exact commands to run. Auto-shown when fill > 40 % or any loaded skill > 2 K tokens lacks a compact. `--json` emits the check results (one entry per check, with `ok`/`warn`/`fail` status) as JSON instead of text. |
 | `token-goat capabilities` | List every capability that can send data off this machine or leave data on it, with whether it is currently on, the config key that decides that, and the exact `file::symbol` where the decision is made — so a reviewer can open the code rather than take the list's word for it. `--json` emits the same thing for a pipeline to assert on, which is the point: the answer comes from the binary installed on your machine, not from documentation that may describe a different build. A test in the suite fails the build when a module that can open a network connection is missing from this list, and equally when the list names one that no longer connects anywhere. |
 | `token-goat baseline` | Emit a project map: file count, per-language file counts, the top indexed symbols (by name/kind/location), and the most recently modified files. `--subagent` emits a terser variant (fewer symbols, fewer recent files) for context handed to a freshly spawned subagent; `--json` for the machine-readable form. |
 | `token-goat compact-doc <path>` | Build an extractive compact sidecar for a large reference doc (`.md`/`.markdown`). The compact is stored in the token-goat data dir as a SHA-keyed sidecar; `pre_read` serves it in place of the full file when it exists and is fresh, typically saving 60–95% of the tokens the full read would cost (measured across this repo's own 44 docs: median 67%, range 5–99%, depending on how much of the doc is prose under headings). Use `--force` to rebuild, `--sentences N` to control lines per section (default 2), `--show` to print the result. The sidecar is automatically marked stale when you edit the source file. Config: `[hints] stable_doc_compacts = true` (default on). |

package/docs/security.md

@@ -20,7 +20,7 @@ Outbound network is reserved to these explicit cases:
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.
 
-**A repository cannot reconfigure the security controls.** A project-root `.token-goat.toml` layers on top of your global config, which is what it is for: hint thresholds, indexing settings, compression tuning. But that file arrives with the repository, so whoever wrote the repository wrote it. Seven whole sections are therefore off limits to it, and come from your global config or the environment only: `injection` (prompt-injection fencing), `webfetch` (the fetch allow and deny lists), `gdrive` (the Google Drive integration), `mcp` (root confinement and the allowed-roots list), `network` (offline mode), `redaction` (the secret-redaction rules), and `screenshot` (the headless browser). Thirteen individual keys inside otherwise-overridable sections are locked the same way. Five decide what gets indexed at all: `indexing.cross_project_symbols`, `indexing.skip_dirs`, `indexing.skip_files`, `indexing.large_file_skip_kb` and `indexing.large_file_symbol_only_kb`, which matter because an unindexed file answers `symbol`, `read` and `semantic` in the same words a name that never existed does. Five more are the switches that decide whether a large file arrives folded rather than whole: `hints.fold_code_bodies`, `hints.fold_comment_blocks`, `hints.fold_prose_paragraphs`, `hints.outline_large_documents` and `hints.skeleton_large_sources`. The last three are `image_shrink.max_image_pixels`, the decompression-bomb cap, `worker.blocked_roots`, the folders you have kept out of the index, and `compact_assist.summary_budget_chars`, the length target token-goat hands to whoever writes your compaction summary, which a repository must not be able to set low enough to erase the session. A project file that sets one of them is ignored, and token-goat prints a line naming what it dropped. Everything else stays project-overridable.
+**A repository cannot reconfigure the security controls.** A project-root `.token-goat.toml` layers on top of your global config, which is what it is for: hint thresholds, indexing settings, compression tuning. But that file arrives with the repository, so whoever wrote the repository wrote it. Seven whole sections are therefore off limits to it, and come from your global config or the environment only: `injection` (prompt-injection fencing), `webfetch` (the fetch allow and deny lists), `gdrive` (the Google Drive integration), `mcp` (root confinement and the allowed-roots list), `network` (offline mode), `redaction` (the secret-redaction rules), and `screenshot` (the headless browser). Fourteen individual keys inside otherwise-overridable sections are locked the same way. Six decide what gets indexed at all: `indexing.cross_project_symbols`, `indexing.skip_dirs`, `indexing.skip_files`, `indexing.large_file_skip_kb`, `indexing.large_file_symbol_only_kb` and `indexing.max_chunks_per_file`, which matter because an unindexed file answers `symbol`, `read` and `semantic` in the same words a name that never existed does. Five more are the switches that decide whether a large file arrives folded rather than whole: `hints.fold_code_bodies`, `hints.fold_comment_blocks`, `hints.fold_prose_paragraphs`, `hints.outline_large_documents` and `hints.skeleton_large_sources`. The last three are `image_shrink.max_image_pixels`, the decompression-bomb cap, `worker.blocked_roots`, the folders you have kept out of the index, and `compact_assist.summary_budget_chars`, the length target token-goat hands to whoever writes your compaction summary, which a repository must not be able to set low enough to erase the session. A project file that sets one of them is ignored, and token-goat prints a line naming what it dropped. Everything else stays project-overridable.
 
 **The lock covers the config file, not the environment.** These settings still read a `TOKEN_GOAT_*` environment variable, and a repository has ways to set one: a `.envrc` for direnv, a `terminal.integrated.env.*` block in a committed `.vscode/settings.json`, a `containerEnv` entry in a devcontainer. Refusing environment overrides would break the operator who exports a variable in their own shell, which is the legitimate case and the common one, so token-goat reports instead of refusing: `token-goat doctor` prints a `Security config overrides` line naming every locked security setting the environment is currently deciding, and the variable to unset. It covers all twenty locked keys that read an environment variable, and it derives that set from the same two tables that define what a project config may not write, rather than from a list kept alongside them. Settings with a safe side (booleans) are reported when the environment holds them open; settings without one (lists, sizes) are reported whenever the environment supplies a value at all, since there is nothing to compare against. A default install, where nothing is set, prints a single ok line.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.18",
+  "version": "2.9.19",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",

package/dist/token-goat-chunk-2KTZ6J7T.mjs

@@ -1,173 +0,0 @@
-import { createRequire as __cjsRequire } from 'node:module';
-const require = __cjsRequire(import.meta.url);
-import {
-  deliveredOutputBytes,
-  wrappedShell
-} from "./token-goat-chunk-RHHFEXKF.mjs";
-import {
-  ToolFilter,
-  capTokens,
-  compressedTokensSaved,
-  deliverCompressed,
-  dispatchArgv,
-  filterByName,
-  selectFilter,
-  shlexSplit,
-  storeBashOutputSync
-} from "./token-goat-chunk-CTOYJ232.mjs";
-import {
-  recordStat
-} from "./token-goat-chunk-HPOFR6QX.mjs";
-import "./token-goat-chunk-I67CPTDD.mjs";
-import "./token-goat-chunk-L7VCX33I.mjs";
-import {
-  loadConfig
-} from "./token-goat-chunk-CA6V36KW.mjs";
-import "./token-goat-chunk-EEIDFMEM.mjs";
-import "./token-goat-chunk-OSUFN2FV.mjs";
-import "./token-goat-chunk-QIDLJGXZ.mjs";
-import "./token-goat-chunk-ERTXEKB6.mjs";
-import "./token-goat-chunk-GMOUBOX4.mjs";
-import {
-  init_define_import_meta_env
-} from "./token-goat-chunk-A37V4PBF.mjs";
-
-// src/bash_runner.ts
-init_define_import_meta_env();
-import { spawnSync } from "node:child_process";
-import * as os from "node:os";
-var IdentityFilter = class extends ToolFilter {
-  name = "passthrough";
-};
-var DEFAULT_TIMEOUT_SECONDS = 600;
-var MAX_CAPTURE_BYTES = 32 * 1024 * 1024;
-var MIN_RECORD_STAT_BYTES = 32;
-function resolveFilter(command, filterName, cwd) {
-  let split;
-  try {
-    split = shlexSplit(command);
-  } catch {
-    split = null;
-  }
-  const argv = split === null ? [command] : dispatchArgv(split, cwd).argv;
-  if (filterName) {
-    const named = filterByName(filterName);
-    if (named !== null) return { filter: named, argv };
-  }
-  if (split === null) return { filter: null, argv };
-  return { filter: selectFilter(split, cwd), argv };
-}
-function baseSpawnOptions(timeout, cwd, env, nativeShell) {
-  return { shell: nativeShell ? true : wrappedShell(), timeout: timeout * 1e3, cwd, env };
-}
-function signalExitCode(signal) {
-  const num = os.constants.signals[signal];
-  return 128 + (num ?? 0);
-}
-function resolveProfile(explicit) {
-  if (explicit) return explicit;
-  try {
-    const p = loadConfig().compression.profile;
-    return p && p !== "auto" ? p : "balanced";
-  } catch {
-    return "balanced";
-  }
-}
-function resolveCompressLimits() {
-  try {
-    const bc = loadConfig().bash_compress;
-    return { maxLines: bc.max_lines, maxBytes: bc.max_bytes };
-  } catch {
-    return { maxLines: 1e3, maxBytes: 64 * 1024 };
-  }
-}
-function run(command, opts = {}) {
-  const timeout = opts.timeout ?? DEFAULT_TIMEOUT_SECONDS;
-  const { filter, argv } = resolveFilter(command, opts.filterName, opts.cwd);
-  if (filter === null) {
-    if ((opts.maxTokens ?? 0) > 0 || opts.quietSuccess) {
-      return wrapAndCompress(command, argv, new IdentityFilter(), timeout, resolveProfile(opts.compressionProfile), opts);
-    }
-    return passthrough(command, timeout, opts.cwd, opts.env, opts.nativeShell);
-  }
-  return wrapAndCompress(command, argv, filter, timeout, resolveProfile(opts.compressionProfile), opts);
-}
-function runRaw(command, timeout = DEFAULT_TIMEOUT_SECONDS) {
-  return passthrough(command, timeout, void 0, void 0);
-}
-function passthrough(command, timeout, cwd, env, nativeShell) {
-  const result = spawnSync(command, { ...baseSpawnOptions(timeout, cwd, env, nativeShell), stdio: "inherit" });
-  if (isTimeout(result.error)) return 124;
-  if (result.status !== null) return result.status;
-  if (result.signal) return signalExitCode(result.signal);
-  return 0;
-}
-function isTimeout(error) {
-  return !!error && error.code === "ETIMEDOUT";
-}
-function decode(buf) {
-  if (buf == null) return "";
-  return typeof buf === "string" ? buf : buf.toString("utf8");
-}
-function wrapAndCompress(command, argv, filter, timeout, profile, opts) {
-  const writeStdout = opts.writeStdout ?? ((s) => process.stdout.write(s));
-  const startTime = Date.now();
-  const result = spawnSync(command, {
-    ...baseSpawnOptions(timeout, opts.cwd, opts.env, opts.nativeShell),
-    stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: MAX_CAPTURE_BYTES
-  });
-  const timedOut = isTimeout(result.error);
-  const overflowed = !!result.error && result.error.code === "ENOBUFS";
-  let stdoutText = decode(result.stdout);
-  let stderrText = decode(result.stderr);
-  if (overflowed) {
-    stdoutText += `
-[token-goat: capture capped at ${MAX_CAPTURE_BYTES / (1024 * 1024)} MiB]`;
-  }
-  let exitCode;
-  if (timedOut) {
-    exitCode = 124;
-    stderrText = (stderrText ? stderrText + "\n" : "") + `[token-goat: command exceeded ${timeout}s timeout and was killed]`;
-  } else if (result.status !== null) {
-    exitCode = result.status;
-  } else if (result.signal) {
-    exitCode = signalExitCode(result.signal);
-  } else {
-    exitCode = 0;
-  }
-  if (opts.quietSuccess && exitCode === 0) {
-    const duration = ((Date.now() - startTime) / 1e3).toFixed(1) + "s";
-    const fullRaw = (stdoutText + (stderrText ? "\n" + stderrText : "")).trim();
-    const id = storeBashOutputSync(command, fullRaw, 0, opts.cwd ?? null);
-    const summary = `[tg: ok] ${command} (${duration}, recall: token-goat bash-output ${id})
-`;
-    writeStdout(summary);
-    return 0;
-  }
-  const limits = resolveCompressLimits();
-  const { applied, marker, compressed, text: delivered } = deliverCompressed(filter, stdoutText, stderrText, exitCode, argv, {
-    compressionProfile: profile,
-    maxLines: limits.maxLines,
-    maxBytes: limits.maxBytes
-  });
-  let text = delivered;
-  const maxTokens = opts.maxTokens ?? 0;
-  if (maxTokens > 0) text = capTokens(text, maxTokens);
-  const body = text + marker;
-  writeStdout(body.endsWith("\n") ? body : body + "\n");
-  if (applied) recordSavings(compressed);
-  return exitCode;
-}
-function recordSavings(result) {
-  const delivered = deliveredOutputBytes(result.originalBytes);
-  const bytesSaved = Math.max(0, delivered - result.compressedBytes);
-  if (bytesSaved < MIN_RECORD_STAT_BYTES) return;
-  recordStat(`bash_compress:${result.filterName}`, bytesSaved, compressedTokensSaved(bytesSaved));
-}
-export {
-  DEFAULT_TIMEOUT_SECONDS,
-  MAX_CAPTURE_BYTES,
-  run,
-  runRaw
-};

package/dist/token-goat-chunk-RHHFEXKF.mjs

@@ -1,93 +0,0 @@
-import { createRequire as __cjsRequire } from 'node:module';
-const require = __cjsRequire(import.meta.url);
-import {
-  detectHarness
-} from "./token-goat-chunk-CA6V36KW.mjs";
-import {
-  init_define_import_meta_env
-} from "./token-goat-chunk-A37V4PBF.mjs";
-
-// src/delivery_cap.ts
-init_define_import_meta_env();
-var CLAUDE_CODE_BASH_OUTPUT_CAP_BYTES = 2e4;
-function bashOutputCapBytes(harness = detectHarness()) {
-  return harness === "claudecode" ? CLAUDE_CODE_BASH_OUTPUT_CAP_BYTES : null;
-}
-function clipToDeliveryCap(text, reserveBytes) {
-  const cap = bashOutputCapBytes();
-  const room = cap === null ? null : cap - reserveBytes;
-  if (room === null || room <= 0 || Buffer.byteLength(text, "utf-8") <= room) return { text, clipped: false };
-  const sliced = Buffer.from(text, "utf-8").subarray(0, room).toString("utf-8");
-  const lastNewline = sliced.lastIndexOf("\n");
-  return { text: lastNewline > 0 ? sliced.slice(0, lastNewline) : sliced, clipped: true };
-}
-function deliveredOutputBytes(originalBytes, harness) {
-  const cap = bashOutputCapBytes(harness);
-  if (cap === null) return Math.max(0, originalBytes);
-  return Math.max(0, Math.min(originalBytes, cap));
-}
-
-// src/shell.ts
-init_define_import_meta_env();
-import * as fs from "node:fs";
-import * as path from "node:path";
-var WSL_LAUNCHER_SEGMENTS = /* @__PURE__ */ new Set(["system32", "syswow64", "windowsapps"]);
-function isExecutable(p) {
-  try {
-    return fs.statSync(p).isFile();
-  } catch {
-    return false;
-  }
-}
-function isWslLauncherDir(dir) {
-  return dir.toLowerCase().split(/[\\/]+/).some((seg) => WSL_LAUNCHER_SEGMENTS.has(seg));
-}
-function locateBashOnPath(pathValue, isExe = isExecutable) {
-  for (const dir of (pathValue ?? "").split(path.delimiter)) {
-    if (!dir || isWslLauncherDir(dir)) continue;
-    const cand = path.join(dir, "bash.exe");
-    if (isExe(cand)) return cand;
-  }
-  return null;
-}
-function knownGitBashPaths() {
-  const localPrograms = process.env["LOCALAPPDATA"] ? path.join(process.env["LOCALAPPDATA"], "Programs") : void 0;
-  const bases = [
-    process.env["ProgramFiles"],
-    process.env["ProgramFiles(x86)"],
-    process.env["ProgramW6432"],
-    localPrograms
-  ];
-  const out = [];
-  for (const base of bases) {
-    if (!base) continue;
-    out.push(path.join(base, "Git", "bin", "bash.exe"));
-    out.push(path.join(base, "Git", "usr", "bin", "bash.exe"));
-  }
-  return out;
-}
-function resolveWindowsBash() {
-  if (process.platform !== "win32") return null;
-  const override = process.env["TOKEN_GOAT_BASH"];
-  if (override && isExecutable(override)) return override;
-  const onPath = locateBashOnPath(process.env["PATH"]);
-  if (onPath) return onPath;
-  for (const cand of knownGitBashPaths()) {
-    if (isExecutable(cand)) return cand;
-  }
-  return null;
-}
-function wrappedShell() {
-  if (process.platform !== "win32") return true;
-  return resolveWindowsBash() ?? true;
-}
-function canRunWrappedShell() {
-  return process.platform !== "win32" || resolveWindowsBash() !== null;
-}
-
-export {
-  clipToDeliveryCap,
-  deliveredOutputBytes,
-  wrappedShell,
-  canRunWrappedShell
-};