token-goat 2.9.2 → 2.9.4

package/dist/{token-goat-chunk-VCNW7BGU.mjs → token-goat-chunk-FSC44QOH.mjs}

@@ -9,7 +9,7 @@ import {
   isBlobStale,
   loadBlob,
   storeBlob
-} from "./token-goat-chunk-LJ3CHCTT.mjs";
+} from "./token-goat-chunk-CBO45DYZ.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   copilotCliMcpToolsDir,
@@ -24,12 +24,22 @@ import {
   resolveIndexPath,
   shortFingerprint,
   toDisplayPath
-} from "./token-goat-chunk-UZ2NFOOZ.mjs";
+} from "./token-goat-chunk-3ZR4NLB3.mjs";
 import {
   registerReset
-} from "./token-goat-chunk-AO2QD2AG.mjs";
+} from "./token-goat-chunk-EEIDFMEM.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/hooks_cli.ts
+init_define_import_meta_env();
+
+// src/copilot_mcp_names.ts
+init_define_import_meta_env();
 
 // src/copilot_mcp_tools.ts
+init_define_import_meta_env();
 import fs from "node:fs";
 import path from "node:path";
 function wireShapeLength(tools) {
@@ -314,6 +324,7 @@ function normalizePayload(payload, harness = "claude") {
 }
 
 // src/web_cache.ts
+init_define_import_meta_env();
 var WEB_OUTPUT_SUBDIR = "web_outputs";
 var _byId = /* @__PURE__ */ new Map();
 var _rawById = /* @__PURE__ */ new Map();
@@ -370,6 +381,7 @@ registerReset(() => {
 });
 
 // src/types.ts
+init_define_import_meta_env();
 var HOOK_EVENTS = [
   "pre_tool_use",
   "post_tool_use",
@@ -384,6 +396,7 @@ var HOOK_EVENTS = [
 ];
 
 // src/cli_commands.ts
+init_define_import_meta_env();
 function toEntry(cmd) {
   return {
     name: cmd.name(),
@@ -452,6 +465,7 @@ function formatCommandManifest(manifest) {
 }
 
 // src/reconcile.ts
+init_define_import_meta_env();
 import * as fs2 from "node:fs";
 var DEFAULT_RECONCILE_BUDGET_MS = 1500;
 function runReconcile(opts = {}) {
@@ -575,6 +589,7 @@ function reconcileProject(opts = {}) {
 }
 
 // src/stdin_json.ts
+init_define_import_meta_env();
 var DEFAULT_STDIN_TIMEOUT_MS = 5e3;
 var MAX_STDIN_WALL_MS = 6e4;
 var MAX_STDIN_BYTES = 64 * 1024 * 1024;
@@ -641,6 +656,7 @@ function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDI
 }
 
 // src/symbol_body_probe.ts
+init_define_import_meta_env();
 import * as fs3 from "fs";
 var OVERSIZED_BODY_PROBE_SQL = `SELECT 1 FROM symbols WHERE LENGTH(body) > ${SYMBOL_BODY_CHAR_CAP} LIMIT 1`;
 function checkSymbolBodySize(dbPath) {
@@ -668,6 +684,7 @@ function checkSymbolBodySize(dbPath) {
 }
 
 // src/resident_context.ts
+init_define_import_meta_env();
 import * as fs4 from "node:fs";
 var LARGE_TASK_LIST_BYTES = 2e4;
 var LARGE_SKILL_BODY_BYTES = 2e4;

package/dist/{token-goat-chunk-JMUBXBG7.mjs → token-goat-chunk-GEXHIIKM.mjs}

@@ -7,13 +7,13 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-KKIB7O3Z.mjs";
-import "./token-goat-chunk-FXAPKVRG.mjs";
-import "./token-goat-chunk-VCNW7BGU.mjs";
-import "./token-goat-chunk-LJ3CHCTT.mjs";
-import "./token-goat-chunk-UZ2NFOOZ.mjs";
-import "./token-goat-chunk-AO2QD2AG.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
+} from "./token-goat-chunk-6MU6FHE3.mjs";
+import "./token-goat-chunk-US57I7GN.mjs";
+import "./token-goat-chunk-FSC44QOH.mjs";
+import "./token-goat-chunk-CBO45DYZ.mjs";
+import "./token-goat-chunk-3ZR4NLB3.mjs";
+import "./token-goat-chunk-EEIDFMEM.mjs";
+import "./token-goat-chunk-A37V4PBF.mjs";
 export {
   applyExitOverride,
   buildProgram,

package/dist/{token-goat-chunk-5CVKO3DA.mjs → token-goat-chunk-LYWIRYCF.mjs}

@@ -2,10 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   external_exports
-} from "./token-goat-chunk-WN5T5EW5.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
+} from "./token-goat-chunk-FQD3OB5W.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
 
 // src/mcp_jsonrpc.ts
+init_define_import_meta_env();
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,

package/dist/{token-goat-chunk-LEBYARO3.mjs → token-goat-chunk-OZAEJQ7L.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-FXAPKVRG.mjs";
+} from "./token-goat-chunk-US57I7GN.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-LJ3CHCTT.mjs";
+} from "./token-goat-chunk-CBO45DYZ.mjs";
 import {
   ENV_KEYS,
   VERSION,
@@ -48,11 +48,14 @@ import {
   recordStat,
   resolveProjectRoot,
   savedTokensFromBytes
-} from "./token-goat-chunk-UZ2NFOOZ.mjs";
-import "./token-goat-chunk-AO2QD2AG.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
+} from "./token-goat-chunk-3ZR4NLB3.mjs";
+import "./token-goat-chunk-EEIDFMEM.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
 
 // src/mcp_server.ts
+init_define_import_meta_env();
 import * as fs from "fs";
 import * as path from "path";
 var TOKEN_GOAT_RETRY_RE = /token-goat (\w[\w-]*) "([^"]+)"/g;
@@ -208,7 +211,7 @@ function mcpToolAllowlist() {
   return names.length === 0 ? null : new Set(names);
 }
 async function createMcpServer() {
-  const [{ McpServer }, { z }] = await Promise.all([import("./token-goat-chunk-5CVKO3DA.mjs"), import("./token-goat-chunk-R4SR7MQY.mjs")]);
+  const [{ McpServer }, { z }] = await Promise.all([import("./token-goat-chunk-LYWIRYCF.mjs"), import("./token-goat-chunk-PXWBHSFB.mjs")]);
   const server = new McpServer({ name: "token-goat", version: VERSION });
   const allowlist = mcpToolAllowlist();
   if (allowlist !== null) {

package/dist/{token-goat-chunk-R4SR7MQY.mjs → token-goat-chunk-PXWBHSFB.mjs}

@@ -240,8 +240,8 @@ import {
   xid,
   xor,
   zod_default
-} from "./token-goat-chunk-WN5T5EW5.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
+} from "./token-goat-chunk-FQD3OB5W.mjs";
+import "./token-goat-chunk-A37V4PBF.mjs";
 export {
   $brand,
   $input,

package/dist/{token-goat-chunk-FXAPKVRG.mjs → token-goat-chunk-US57I7GN.mjs}

@@ -68,7 +68,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-LJ3CHCTT.mjs";
+} from "./token-goat-chunk-CBO45DYZ.mjs";
 import {
   Database,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -122,12 +122,16 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-UZ2NFOOZ.mjs";
+} from "./token-goat-chunk-3ZR4NLB3.mjs";
 import {
   registerReset
-} from "./token-goat-chunk-AO2QD2AG.mjs";
+} from "./token-goat-chunk-EEIDFMEM.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
 
 // src/section_reader.ts
+init_define_import_meta_env();
 import { readFileSync } from "node:fs";
 function parseHeadingSpec(spec, headers) {
   const m = /^([^#\r\n]+)#(\d+)$/.exec(spec);
@@ -447,6 +451,7 @@ function listSections(filePath, readFn) {
 }
 
 // src/graph_commands.ts
+init_define_import_meta_env();
 import * as fs6 from "node:fs";
 import * as os from "node:os";
 import * as path6 from "node:path";
@@ -454,10 +459,12 @@ import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 
 // src/read_commands.ts
+init_define_import_meta_env();
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
 
 // src/json_query.ts
+init_define_import_meta_env();
 function jsonType(value) {
   if (value === null) return "null";
   if (Array.isArray(value)) return "array";
@@ -596,6 +603,7 @@ function queryJson(data, spec) {
 }
 
 // src/xml_query.ts
+init_define_import_meta_env();
 var XML_NAME_START = "A-Za-z_:\xC0-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uD800-\uDFFF\uF900-\uFDCF\uFDF0-\uFFFD";
 var XML_NAME_REST = "A-Za-z_:\xC0-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uD800-\uDFFF\uF900-\uFDCF\uFDF0-\uFFFD0-9.\xB7\u0300-\u036F\u203F-\u2040-";
 var XML_NAME = `[${XML_NAME_START}][${XML_NAME_REST}]*`;
@@ -1064,6 +1072,7 @@ function queryXml(xmlText, pathStr) {
 }
 
 // node_modules/js-yaml/dist/js-yaml.mjs
+init_define_import_meta_env();
 var NOT_RESOLVED = /* @__PURE__ */ Symbol("NOT_RESOLVED");
 function defineScalarTag(tagName, options) {
   return {
@@ -3530,6 +3539,7 @@ var CHOMPING_STRIP = CHOMPING_MODE.STRIP;
 var CHOMPING_KEEP = CHOMPING_MODE.KEEP;
 
 // src/openapi_query.ts
+init_define_import_meta_env();
 import * as path from "node:path";
 var HTTP_METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
 function parseOpenApiSpec(text, filePath) {
@@ -3676,6 +3686,7 @@ function formatOperationDetail(op) {
 }
 
 // src/archive_query.ts
+init_define_import_meta_env();
 var loadFflate = createLazyModuleLoader(
   async () => await import("fflate"),
   "archive reading disabled (fflate unavailable)"
@@ -3719,6 +3730,7 @@ async function extractZipEntry(data, entryPath) {
 }
 
 // src/pr_slice.ts
+init_define_import_meta_env();
 import { spawnSync } from "node:child_process";
 var _ghAvailable;
 function isGhAvailable() {
@@ -3888,6 +3900,7 @@ ${c.body}`).join("\n\n");
 }
 
 // src/sqlite_query.ts
+init_define_import_meta_env();
 import * as fs from "node:fs";
 var SQLITE_QUERY_ROW_CAP = 5e3;
 var SQLITE_MAGIC = Buffer.from([83, 81, 76, 105, 116, 101, 32, 102, 111, 114, 109, 97, 116, 32, 51, 0]);
@@ -4150,6 +4163,7 @@ function quoteCsvCellLocal(cell) {
 }
 
 // src/coverage_query.ts
+init_define_import_meta_env();
 function num(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : 0;
 }
@@ -4451,6 +4465,7 @@ function formatCoverageGaps(report) {
 }
 
 // src/conflict_query.ts
+init_define_import_meta_env();
 var OURS_RE = /^<{7}(?:\s+(.*))?$/;
 var BASE_RE = /^\|{7}(?:\s+(.*))?$/;
 var SEP_RE = /^={7}\s*$/;
@@ -4615,6 +4630,7 @@ function formatConflictSummaries(summaries) {
 }
 
 // src/screenshot.ts
+init_define_import_meta_env();
 import dns from "node:dns/promises";
 import fs2 from "node:fs";
 import path2 from "node:path";
@@ -4941,6 +4957,7 @@ async function takeScreenshot(url, destPath, opts) {
 }
 
 // src/notes.ts
+init_define_import_meta_env();
 import * as fs3 from "node:fs";
 var WHOLE_FILE_NOTE_SYMBOL = "";
 function toNoteRow(row) {
@@ -5016,6 +5033,7 @@ function isNoteStale(note, dbPath = globalDbPath()) {
 }
 
 // src/ts_refs.ts
+init_define_import_meta_env();
 import { createRequire } from "node:module";
 import * as path3 from "node:path";
 var _require = createRequire(import.meta.url);
@@ -7498,7 +7516,7 @@ async function runImageMeta(file) {
     throw e;
   }
   if (probe === null) {
-    return { width: 0, height: 0, format: null, bytes, sharpAvailable: false, wouldShrink: false, shrunkBytes: null };
+    return { width: 0, height: 0, format: null, bytes, decodable: false, wouldShrink: false, shrunkBytes: null };
   }
   const shrink = await shrinkImage(data, { sizeThresholdBytes: 0 });
   return {
@@ -7506,7 +7524,7 @@ async function runImageMeta(file) {
     height: probe.height,
     format: probe.format,
     bytes,
-    sharpAvailable: true,
+    decodable: true,
     wouldShrink: shrink !== null,
     shrunkBytes: shrink !== null ? shrink.shrunkBytes : null
   };
@@ -9206,6 +9224,7 @@ function runNoteList(opts = {}) {
 }
 
 // src/import_graph.ts
+init_define_import_meta_env();
 import * as fs5 from "node:fs";
 import * as path5 from "node:path";
 var DIRECT_PROBE_EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".mjs", ".cjs", ".cts", ".py"];
@@ -9257,6 +9276,7 @@ function buildImportGraph(cwd) {
 }
 
 // src/modules.ts
+init_define_import_meta_env();
 var WEAK_MODULARITY = 0.3;
 var MAX_PASSES = 32;
 var GAIN_EPSILON = 1e-12;
@@ -10762,6 +10782,7 @@ ANSWER:`;
 }
 
 // src/content_store.ts
+init_define_import_meta_env();
 import { deflateRawSync } from "node:zlib";
 import * as path7 from "node:path";
 var CONTENT_MAX_INPUT_CHARS = 512 * 1024;

package/dist/token-goat-hook.mjs

@@ -2,13 +2,18 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-Q4LOQY44.mjs";
-import "./token-goat-chunk-VCNW7BGU.mjs";
-import "./token-goat-chunk-LJ3CHCTT.mjs";
-import "./token-goat-chunk-CGWACYYZ.mjs";
-import "./token-goat-chunk-UZ2NFOOZ.mjs";
-import "./token-goat-chunk-AO2QD2AG.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
+} from "./token-goat-chunk-63XEQMNU.mjs";
+import "./token-goat-chunk-FSC44QOH.mjs";
+import "./token-goat-chunk-CBO45DYZ.mjs";
+import "./token-goat-chunk-EPX5DWGM.mjs";
+import "./token-goat-chunk-3ZR4NLB3.mjs";
+import "./token-goat-chunk-EEIDFMEM.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/hook_lib.ts
+init_define_import_meta_env();
 export {
   relayInProcess
 };

package/dist/token-goat.core.mjs

@@ -2,16 +2,19 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-KKIB7O3Z.mjs";
-import "./token-goat-chunk-FXAPKVRG.mjs";
-import "./token-goat-chunk-VCNW7BGU.mjs";
-import "./token-goat-chunk-LJ3CHCTT.mjs";
+} from "./token-goat-chunk-6MU6FHE3.mjs";
+import "./token-goat-chunk-US57I7GN.mjs";
+import "./token-goat-chunk-FSC44QOH.mjs";
+import "./token-goat-chunk-CBO45DYZ.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-UZ2NFOOZ.mjs";
-import "./token-goat-chunk-AO2QD2AG.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
+} from "./token-goat-chunk-3ZR4NLB3.mjs";
+import "./token-goat-chunk-EEIDFMEM.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
 
 // src/main.ts
+init_define_import_meta_env();
 installEpipeGuard();
 void run();

package/docs/cli.md

@@ -167,10 +167,10 @@ token-goat pdf-extract manual.pdf --pages 12-15 --layout --head 120
 | `token-goat project exclude <path>` | Add a project root to the blocklist so the worker never indexes it. Writes the resolved absolute path to `[worker] blocked_roots` in `config.toml`; idempotent. It also removes anything already indexed under that path and says how many files went, so excluding a directory means its contents stop being readable through `symbol` rather than merely stopping future indexing. Remove the entry from the config to re-enable indexing, then run `token-goat index` to bring the contents back. |
 | `token-goat project prune [--dry-run]` | Remove blocked/excluded roots that no longer exist on disk. `--dry-run` previews removals without touching the config file. Useful after deleting or moving projects. |
 | `token-goat install` | Wire up hooks (and, with the harness flags below, other AI tool integrations). No `--dry-run` or `--verify` flag — run `token-goat doctor` after install to audit the result. |
-| `token-goat doctor` | Confirm everything is wired correctly. Surfaces install state, cold-import timing, cache hit rates, compaction-budget telemetry, opt-in flag status, and canonical-root sanity. A **Tool names** check reports any tool name a harness sent that reached no handler wanting it, and calls out the ones that differ from a handled name only by capitalisation or punctuation — the signature of a bridge that forgot to rename something, which is otherwise invisible. A **Security** section reports the posture in one place: whether offline mode is on, whether injection scanning is on, whether the Google Drive integration is enabled, whether fetching runs against an allow list or a deny list, whether MCP reads are confined to the project root, and whether the data directory is readable by other local users. It only warns when a protection that ships on has been switched off, so a default install stays quiet. It read-only audits `~/.copilot/mcp-config.json` for globally configured Chrome DevTools or Playwright `npx` launchers, recommending project scope or removal when inactive; it never prints server configuration or secrets. On Windows, it also reports duplicate Chrome DevTools/Playwright MCP launchers and orphaned Node processes without terminating anything. Pass `--context` to show the **Context footprint** section: a fill bar with severity (ok / warn / high / URGENT), per-component breakdown (skills catalog, loaded skill bodies, CLAUDE.md+MEMORY.md, conversation estimate), session-to-session growth trend with sessions-to-URGENT projection, and tiered compaction recommendations (Tier 0–4) naming the exact commands to run. Auto-shown when fill > 40 % or any loaded skill > 2 K tokens lacks a compact. `--json` emits the check results (one entry per check, with `ok`/`warn`/`fail` status) as JSON instead of text. |
+| `token-goat doctor` | Confirm everything is wired correctly. Surfaces install state, cold-import timing, cache hit rates, compaction-budget telemetry, opt-in flag status, and canonical-root sanity. A **Parser freshness** check reports how much of the index for this project was written by a different build of the extractor. The stamp only refreshes when something touches a file, so after an upgrade a project goes on answering `symbol`, `read`, `outline` and `skeleton` from the previous extractor with nothing saying so. It warns past a quarter and names the fix: a plain `token-goat index` in that project, which is enough on its own, since a parser mismatch reparses without `--force`. A **Tool names** check reports any tool name a harness sent that reached no handler wanting it, and calls out the ones that differ from a handled name only by capitalisation or punctuation — the signature of a bridge that forgot to rename something, which is otherwise invisible. A **Security** section reports the posture in one place: whether offline mode is on, whether injection scanning is on, whether the Google Drive integration is enabled, whether fetching runs against an allow list or a deny list, whether MCP reads are confined to the project root, and whether the data directory is readable by other local users. It only warns when a protection that ships on has been switched off, so a default install stays quiet. It read-only audits `~/.copilot/mcp-config.json` for globally configured Chrome DevTools or Playwright `npx` launchers, recommending project scope or removal when inactive; it never prints server configuration or secrets. On Windows, it also reports duplicate Chrome DevTools/Playwright MCP launchers and orphaned Node processes without terminating anything. Pass `--context` to show the **Context footprint** section: a fill bar with severity (ok / warn / high / URGENT), per-component breakdown (skills catalog, loaded skill bodies, CLAUDE.md+MEMORY.md, conversation estimate), session-to-session growth trend with sessions-to-URGENT projection, and tiered compaction recommendations (Tier 0–4) naming the exact commands to run. Auto-shown when fill > 40 % or any loaded skill > 2 K tokens lacks a compact. `--json` emits the check results (one entry per check, with `ok`/`warn`/`fail` status) as JSON instead of text. |
 | `token-goat capabilities` | List every capability that can send data off this machine or leave data on it, with whether it is currently on, the config key that decides that, and the exact `file::symbol` where the decision is made — so a reviewer can open the code rather than take the list's word for it. `--json` emits the same thing for a pipeline to assert on, which is the point: the answer comes from the binary installed on your machine, not from documentation that may describe a different build. A test in the suite fails the build when a module that can open a network connection is missing from this list, and equally when the list names one that no longer connects anywhere. |
 | `token-goat baseline` | Emit a project map: file count, per-language file counts, the top indexed symbols (by name/kind/location), and the most recently modified files. `--subagent` emits a terser variant (fewer symbols, fewer recent files) for context handed to a freshly spawned subagent; `--json` for the machine-readable form. |
-| `token-goat compact-doc <path>` | Build an extractive compact sidecar for a large reference doc (`.md`/`.markdown`). The compact is stored in the token-goat data dir as a SHA-keyed sidecar; `pre_read` serves it in place of the full file when it exists and is fresh, saving 80–95% of context tokens. Use `--force` to rebuild, `--sentences N` to control lines per section (default 2), `--show` to print the result. The sidecar is automatically marked stale when you edit the source file. Config: `[hints] stable_doc_compacts = true` (default on). |
+| `token-goat compact-doc <path>` | Build an extractive compact sidecar for a large reference doc (`.md`/`.markdown`). The compact is stored in the token-goat data dir as a SHA-keyed sidecar; `pre_read` serves it in place of the full file when it exists and is fresh, typically saving 60–95% of the tokens the full read would cost (measured across this repo's own 44 docs: median 67%, range 5–99%, depending on how much of the doc is prose under headings). Use `--force` to rebuild, `--sentences N` to control lines per section (default 2), `--show` to print the result. The sidecar is automatically marked stale when you edit the source file. Config: `[hints] stable_doc_compacts = true` (default on). |
 
 Missed lookups recover surgically: `read` and `section` print a "Did you mean…?" list on a miss, and `section` auto-redirects on an unambiguous heading-prefix match — a typo costs at most one extra glance, not a re-read.
 
@@ -302,12 +302,12 @@ that category — the real cost of emitting it, not just how often it fired):
 
 ```
 $ token-goat hint-stats
-category              emitted  acted-on  efficacy  suppressed  manual+  manual-  spent
-bash_redirect          42       9         21.4%     no          0        0        3150
-bash_recall            18       15        83.3%     no          0        0        1080
-read_reread_dedup      11       2         18.2%     no          0        0        660
-read_structural_nav    7        1         14.3%     yes         0        1        420
-edit_reread_suggest    3        0         0%        no          0        0        180
+category              emitted  acted-on  efficacy   suppressed  manual+  manual-  spent
+bash_redirect          42       9         21.4%      no          0        0        3150
+bash_recall            18       15        83.3%      no          0        0        1080
+read_reread_dedup      11       2         18.2% *    no          0        0        660
+read_structural_nav    7        1         14.3%      yes         0        1        420
+edit_reread_suggest    3        0         0% *       no          0        0        180
 
 TOTAL   saved=48200   spent=5490   net=42710
 ```
@@ -325,6 +325,13 @@ emissions (default 5) AND its efficacy falls below `hint_stats.suppress_threshol
 emission. Once suppressed, that hook stops emitting that category until `token-goat hint-stats
 --reset` clears the tracked data. Configure both knobs with `token-goat config set hint_stats.min_sample_size <n>` / `token-goat config set hint_stats.suppress_threshold_pct <pct>`.
 
+A `*` on an efficacy figure means that category is scored on an absence. Those hints ask the
+agent *not* to do something, so a window that expires with no re-read counts as compliance, while
+an unmarked category only scores when the agent actually runs the command the hint named. The two
+percentages sit on different scales and comparing them straight across gives the wrong answer: a
+high starred figure means the warned-against read was not seen, not that the hint persuaded
+anyone.
+
 "Acted on" is a real, session-scoped signal (the exact file path or cached-output id the hint's
 own text pointed at is checked against the next few tool calls in that session) — not a guess —
 but it is a proxy for correlation, not proof of causation: a match means the agent ran the
@@ -337,3 +344,56 @@ are shown alongside the automatic percentage but never blended into it. `--json`
 Note that what this feature calls "harness" (Claude Code, Codex, Gemini, ...) is not the same as
 "which LLM model" — no bridge in this codebase exposes an LLM model identifier to hooks, so
 harness is the closest real signal available.
+
+### Scoring the compressors — `token-goat bench`
+
+`token-goat bench` replays a fixed corpus of captured command output through the same function
+that decides what a real shell command hands back to the model, and reports how much smaller the
+result is. It exists so a change to a compressor can be measured instead of guessed at:
+
+```
+$ token-goat bench
+case          filter           in        out    saved  fidelity
+---------------------------------------------------------------
+git-log-stat  git-log       57227       3027    94.7%  2/2
+npm-ls-all    dep-list      34546       1060    96.9%  2/2
+vitest-run    vitest        22684      22682        -  2/2
+---------------------------------------------------------------
+TOTAL                      114457      26769    76.6%  6/6
+
+ratio    76.6% saved  (PRIMARY -- must improve; measured floor 0.0%, headroom 23.4%)
+fidelity 6/6 kept   (GUARD -- must not regress; any miss exits 1)
+coverage 3/157 filters exercised, 2/3 cases compressed
+```
+
+There are two numbers on purpose. **Ratio** is the thing to push up. **Fidelity** counts the lines
+each case declares it must never lose, and it is what stops the ratio from being gamed: deleting
+output raises the ratio, so a benchmark reporting only the ratio would reward destroying the very
+content the compressors exist to preserve. A dropped must-keep line exits 1, so a loop can revert
+on the exit code alone.
+
+The corpus lives in `tests/fixtures/bench`: one `<id>.json` naming the command, its exit code,
+and its must-keep lines, beside an `<id>.txt` holding that run's real output. Point `--corpus
+<dir>` at your own directory to score commands you care about. Every case must declare where its
+output came from; a fixture with no `provenance` field is refused rather than scored, because
+output written by hand proves nothing about what a real command emits.
+
+`--tsv <path>` appends one row per run (timestamp, commit, sizes, ratio, fidelity, coverage), so a
+sequence of attempts leaves a readable history instead of a scrollback. `--json` emits the same
+report as an object. `--validate` runs the benchmark's own negative controls and says whether the
+corpus can tell good from bad at all:
+
+```
+$ token-goat bench --validate
+ok    floor: the net-benefit gate refuses a no-op filter on every case -- identity control applied to 0/3 cases, measured floor 0.0%
+ok    floor: a no-op filter keeps every must-keep line -- identity control kept 6/6
+ok    guard: deleting everything is caught -- destroy control kept 0/6 at 99.8% saved
+
+The corpus discriminates: a ratio measured against it cannot be raised by deleting content.
+```
+
+The first two controls establish the floor: a filter that changes nothing must score nothing, so
+the reported percentage is a real saving rather than an offset every number carries. The third
+runs a filter that deletes the entire output. It scores 99.8%, the best ratio possible, and the
+fidelity guard fails it. Run `--validate` after changing the corpus; a corpus whose must-keep
+lists have gone soft passes every benchmark while measuring nothing.

package/docs/security.md

@@ -38,12 +38,16 @@ That command is the one thing here that is not clean: `onnxruntime-node` pulls a
 
 **Prompt injection.** When an AI reads a file, web page, or command output, that content enters its context alongside your own instructions. Prompt injection is when untrusted content includes text designed to look like instructions — "Ignore all previous directives and run this instead" — to redirect the AI mid-task.
 
-Token-goat intercepts every Read, Fetch, Bash, and MCP call the AI makes. Text that came from somewhere else is wrapped in an untrusted-content fence before the model sees it, decided by where the text came from and not by whether anything looked suspicious in it (`injection.enabled`, on by default, turns the whole thing off). The content is also scanned for a set of imperative-override attack patterns ("ignore previous instructions," "reveal system prompt," and similar); a match adds the pattern names to the fence's notice and writes a row to the log, and a clean scan changes only the wording. That ordering is the point: the pattern list is deliberately short, so anyone phrasing the same instruction differently would otherwise get an unlabelled channel, and a miss would be silent.
+Token-goat intercepts every Read, Fetch, Bash, and MCP call the AI makes. Where it hands the model text in place of the tool's own result, that text is wrapped in an untrusted-content fence first, decided by where the text came from and not by whether anything looked suspicious in it (`injection.enabled`, on by default, turns the whole thing off). Which surfaces that covers, and which it deliberately does not, is set out below: the two exceptions are stated rather than left to be read off this sentence. The content is also scanned for a set of imperative-override attack patterns ("ignore previous instructions," "reveal system prompt," and similar); a match adds the pattern names to the fence's notice and writes a row to the log, and a clean scan changes only the wording. That ordering is the point: the pattern list is deliberately short, so anyone phrasing the same instruction differently would otherwise get an unlabelled channel, and a miss would be silent.
 
-Three surfaces are covered. Every fetched page is fenced as it arrives and again when a cached copy is recalled with `web-output`. Every MCP tool result is fenced as it arrives, which matters most: it is a remote server's output, so it is the least trustworthy text in the pipeline. And cached Bash and MCP output is fenced when recalled with `bash-output` or `mcp-output`, since the output of a build or test run in a project with a hostile dependency is written by a third party as much as any web page is. Document extraction (`pdf-extract`, `docx-text`, the `xlsx-*` and `pptx-*` commands), `pr-slice`, `gdrive-sections`, and `recall` are covered the same way. The fence naming tool output is a different tag from the one naming web content, so the label tells the model where the text came from.
+The line that decides is substitution: wherever token-goat replaces a tool result with text of its own, that text is fenced. Every fetched page is fenced as it arrives and again when a cached copy is recalled with `web-output`. Every MCP tool result is fenced as it arrives, which matters most: it is a remote server's output, so it is the least trustworthy text in the pipeline. Bash output is fenced when token-goat compresses it, since a compressed body is not the command's output but token-goat's account of it, and it is fenced again when a cached copy is recalled with `bash-output` or `mcp-output`: the output of a build or test run in a project with a hostile dependency is written by a third party as much as any web page is. Document extraction (`pdf-extract`, `docx-text`, the `xlsx-*` and `pptx-*` commands), `pr-slice`, `gdrive-sections`, and `recall` are covered the same way. The fence naming tool output is a different tag from the one naming web content, so the label tells the model where the text came from.
+
+In every one of those cases the fence wraps the third-party bytes and stops there. Token-goat's own notice, the filter's marker, and the pointer telling the model how to recall the full output all sit outside the closing tag, because the fence is the model's one signal for where token-goat stops speaking. Fold them inside and that signal is gone, and anyone who guesses the marker's wording can write a line the model reads as token-goat's own.
 
 Read is the exception: file content passes through to the model unfiltered, because filtering it would silently break legitimate use cases. Where token-goat splices a piece of a file into its own hint or denial message, that excerpt is fenced. Outside of the fence, the primary defense is the model's own training to treat tool output as data, not as commands from a trusted party.
 
+Bash output that token-goat does not rewrite is the same kind of exception, and worth stating plainly rather than leaving to be inferred from the paragraph above. A command whose output is short, or too incompressible to be worth touching, reaches the model exactly as the harness delivered it, with no fence. So does output whose only change was stripping the colour codes a terminal would have rendered, since that path emits the command's own bytes and adds nothing of token-goat's to delimit. Fencing those cases would mean rewriting the result of every shell command an agent runs, a permanent cost on the most-used path in the tool, to re-label bytes the model was going to receive in that form anyway. The fence is worth its bytes where token-goat has substituted its own account of the output and the model can no longer tell whose words are whose. Where token-goat has stayed out of the way, the defense is the same as for Read: the model's training to treat tool output as data.
+
 One deliberate gap: `--json` output cannot carry a fence around the envelope, because a fence wrapped around JSON is no longer JSON and callers parse it. Those envelopes fence individual fields on a pattern match instead, since the fixed wrapper would otherwise cost more than a short field is worth. The printed (non-`--json`) form of the same command is always fenced.
 
 Separately from that pass-through case: when a read hook *denies* a Read and substitutes its own message, any file bytes it embeds in that message (a markdown heading tree, a served compact or notebook sidecar, a re-read diff, a CSV header row, an HTML title) are wrapped in an `<untrusted-file-content>` fence first, so a hostile repo cannot get its own text presented to the model as token-goat speaking. That fencing is unconditional, not gated on the pattern scan — as all of it now is.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.2",
+  "version": "2.9.4",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",
@@ -73,7 +73,9 @@
     "@eslint/js": "^10.0.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/better-sqlite3": "^9.6.0",
+    "@types/jpeg-js": "^0.3.0",
     "@types/node": "^26.2.0",
+    "@types/omggif": "^1.0.5",
     "@xenova/transformers": "^2.17.2",
     "better-sqlite3": "^12.11.1",
     "commander": "^15.0.0",
@@ -84,8 +86,10 @@
     "exceljs": "^4.4.0",
     "fast-xml-parser": "^5.9.3",
     "html-to-text": "^10.0.1",
+    "jpeg-js": "^0.4.4",
     "js-yaml": "^5.2.1",
     "lefthook": "^2.1.10",
+    "omggif": "^1.0.10",
     "onnxruntime-node": "^1.27.0",
     "smol-toml": "^1.8.0",
     "tsx": "^4.23.12",
@@ -119,6 +123,8 @@
     "uuid": "^14.0.1",
     "sharp": "$sharp",
     "unzipper": "^0.12.5",
-    "adm-zip": "^0.6.0"
+    "adm-zip": "^0.6.0",
+    "fast-uri": "^3.1.6",
+    "qs": "^6.16.0"
   }
 }

package/dist/token-goat-chunk-AEX54RUZ.mjs

@@ -1,11 +0,0 @@
-import { createRequire as __cjsRequire } from 'node:module';
-const require = __cjsRequire(import.meta.url);
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-export {
-  __export
-};

package/dist/token-goat-chunk-ZVN5WHTO.mjs

@@ -1,23 +0,0 @@
-import { createRequire as __cjsRequire } from 'node:module';
-const require = __cjsRequire(import.meta.url);
-import {
-  buildEvent,
-  relay,
-  relayInProcess
-} from "./token-goat-chunk-Q4LOQY44.mjs";
-import {
-  MAX_STDIN_BYTES,
-  readStdinJson
-} from "./token-goat-chunk-VCNW7BGU.mjs";
-import "./token-goat-chunk-LJ3CHCTT.mjs";
-import "./token-goat-chunk-CGWACYYZ.mjs";
-import "./token-goat-chunk-UZ2NFOOZ.mjs";
-import "./token-goat-chunk-AO2QD2AG.mjs";
-import "./token-goat-chunk-AEX54RUZ.mjs";
-export {
-  MAX_STDIN_BYTES,
-  buildEvent,
-  readStdinJson,
-  relay,
-  relayInProcess
-};