token-goat 2.9.30 → 2.9.31

package/README.md

@@ -113,15 +113,24 @@ The fastest way to reduce AI token costs is fixing these six, not writing shorte
 | Large markdown file read in full (README.md, CHANGELOG.md, CLAUDE.md ≥8 KB) | Heading tree intercepted instead — H1–H3 with `#2`/`#3` disambiguation; `token-goat section` shortcuts listed for well-known files; post-edit injects a re-read suggestion rather than the full file |
 | Subagent reads a ≥30 KB markdown file whole, on its first look at it | Off by default. Set `subagent_markdown_first_read_deny = true` under `[hints]` to block that read and answer with the heading tree instead. Only fires in a subagent, only on a first, un-ranged read of a `.md`/`.mdx`/`.markdown` file with at least three headings; a read that already asks for a line range, and every main-session read, pass through untouched |
 | Claude Code spawns an agent without `subagent_type` while tools-restricted agent definitions exist | Off by default. Set `agent_scoped_spawn_deny = true` under `[hints]` (or `TOKEN_GOAT_AGENT_SCOPED_SPAWN_DENY=1`) to refuse the first such spawn in a session and name the restricted agents, so the retry can pick one. An untyped spawn runs as general-purpose, whose context starts with every tool and MCP schema on the machine. Re-issuing the same call runs it: the refusal happens once per session. A spawn that names any `subagent_type`, `general-purpose` included, is never refused, and Copilot CLI and VS Code are left alone |
-| Claude Code Bash command on Windows that contains two backslashes in a row | Refused before it runs, with the reason and what to do instead. Git Bash halves every run of two or more backslashes in the command it is handed, so an escaped path, a regular expression or a `printf` format string would run as different text with no error. Write the text to a file with the Write tool and run it by path, use the PowerShell tool, or use forward slashes in paths. Claude Code on Windows only; set `deny_bash_double_backslash = false` under `[hints]` (or `TOKEN_GOAT_DENY_BASH_DOUBLE_BACKSLASH=0`) to turn it off |
+| An agent ends its turn after editing source files that no test, lint, typecheck or build run has covered since | A one-time note at the Stop event names the unverified files and the checks that would cover them. It is an advisory, never a block, because a block at Stop can trap a session in a loop. Claude Code and Codex CLI show it; Copilot CLI's and VS Code's stop hooks accept only a block, so it stays silent there. Turn it off with `stop_verification_advisory = false` under `[hints]` (or `TOKEN_GOAT_STOP_VERIFICATION_ADVISORY=0`) |
+| A subagent finishes with a failed last check, source edited after its last passing check, or a report that claims a change it never made | Up to three lines are appended to the report the parent receives, saying which of those happened. A subagent with nothing to flag gets nothing added. On Copilot CLI the lines ride on the subagent report rewrite; the report part of that rewrite is the secret-redacted original, so a secret token-goat redacted stays redacted. Copilot's tool events carry no agent id, so there only the claimed-a-change-never-made check applies to a subagent (it reads the git tree), not the failed-check or unverified-edit flags. On Codex the lines ride on the result of the multi-agent v1 `wait_agent` tool, keyed on the subagent's thread id; Codex's v2 multi-agent tools return no report, so nothing is delivered there. VS Code Chat gets no receipt, because its SubagentStop payload carries no report text, and Visual Studio and JetBrains have no agent hooks. Turn it off with `agent_receipt = false` under `[hints]` (or `TOKEN_GOAT_AGENT_RECEIPT=0`) |
+| Claude Code Bash command on Windows that contains two backslashes in a row | Run from a temp file when your permission rules already allow the command, otherwise refused before it runs, with the reason and what to do instead. Git Bash halves every run of two or more backslashes in the command it is handed, so an escaped path, a regular expression or a `printf` format string would run as different text with no error. A command that needs no prompt is written, as typed, to a file that deletes itself on its first line, and run from there; one that would prompt, or that uses `$`, a backtick, `eval`, rm or a protected path, is refused, because the prompt would show a file name and not the command. Then write the text to a file with the Write tool and run it by path, use the PowerShell tool, or use forward slashes in paths. A command over 7,000 characters with no such backslashes is left alone. Claude Code on Windows only; set `deny_bash_double_backslash = false` under `[hints]` (or `TOKEN_GOAT_DENY_BASH_DOUBLE_BACKSLASH=0`) to turn it off |
 | A source file is read whole for the first time, with no earlier copy to compare it against | Keeps each function's declaration and its first eight lines, replacing the rest with one line naming the symbol, the exact range removed, and the command that returns it. Set `fold_code_bodies = false` under `[hints]` to turn it off. Comment blocks of twelve lines or more fold to their first two on the same terms. Imports, signatures, type declarations, classes and interfaces are never folded, and a file whose index no longer matches what is on disk keeps its bodies. Measured on this repository's own source: 229 of 256 files fold, and 43% of what a read of them delivers is removed. A read that already names an offset or a limit, and any file holding something that looks like a secret, pass through untouched |
+| A source or markdown file of 50 KB or more is read whole for the first time, and token-goat has indexed its symbols or headings | The read goes through with a note naming the file's size, its symbol or heading count and the `read`, `outline` or `skeleton` command that returns just the part you need. Set `first_read_symbol_policy = "deny"` under `[hints]` (or `TOKEN_GOAT_FIRST_READ_SYMBOL_POLICY=deny`) to refuse the whole-file read instead, or `"off"` to say nothing. `first_read_symbol_bytes` sets the size (50000 by default, 0 turns the check off). Both can only be set in your global config or the environment: a repository's `.token-goat.toml` cannot set them |
+| A Write, Edit, MultiEdit or Codex `apply_patch` puts a placeholder such as `// ... existing code ...` or `[rest of file unchanged]` into a file, or a whole-file Write to a file that was only partly read deletes five or more lines the session never saw | Refused before it runs, with the placeholder or the unseen line ranges named and a `token-goat read` command for each range. Repeating the identical call goes through. Codex's pre-tool hook can refuse an `apply_patch`, and VS Code's `apply_patch` and `multi_replace_string_in_file` are checked; VS Code's `insert_edit_into_file` edits are not covered. Set `write_blind_drop = "warn"` under `[hints]` (or `TOKEN_GOAT_WRITE_BLIND_DROP=warn`) to add a note instead of refusing, or `"off"` to say nothing. A note is silenced during quiet hours, a refusal is not |
+| A Write creates a new file named like a copy of an existing one in the same directory (`solver_v2.py`, `solver_fixed.py`, `solver.py.bak`) and repeats most of that file | A note, once per original per session, naming how much of the original it repeats and suggesting `Edit`, `token-goat replace` or `token-goat outline` on the original. It needs the original to reach `write_rewrite_min_lines` (40) and `write_rewrite_unchanged_pct` (75) under `[hints]`. Files under `migrations`, `versions`, `fixtures`, `__snapshots__` and any `vN` directory below the project root are skipped, `write_sibling_copy_allow` adds path globs to skip, and `write_sibling_copy = false` (or `TOKEN_GOAT_WRITE_SIBLING_COPY=0`) turns it off |
+| A Read, Grep, Edit or Write names a path that does not exist, or a shell command fails with `No such file or directory` | The failed call is answered with up to three existing paths it probably meant (a stray `@` or `:12` suffix, a curly apostrophe, a one or two letter typo, a case difference, the same name in another directory), once per path per session. A credential-style file name is never offered. The read commands print the same list under `Did you mean:` |
+| An Edit fails because its `old_string` was one invisible character off (trailing space, curly quote, indentation) | The reply quotes the exact matching lines as they are on disk, so the retry copies them instead of re-reading the file. A credential-style file name gets the line range only |
+| A shell command fails that an earlier session fixed twice (an install, build or test command from a short allowlist) | One line offers the fix again, marked `not verified`. Only known runners and paths are kept, and no other part of the command is stored on disk, only digests |
+| A whole-file re-read is refused and the agent asks again, or tries the same file at other line ranges | The whole-file refusal is given at most once per file per compaction, then the read goes through with a short note. A refused line range locks later line-range reads on that file until it changes, and the refusal names the `read "path@START-END"` or `skeleton` command to use instead |
 | PDF opened via Read | Full read denied; PDF shows page count and outline (`token-goat pdf-extract` pulls the actual text, optionally paged/sliced, when the outline isn't enough) |
 | Excel/PowerPoint/Word file (.xlsx/.pptx/.docx) opened via Read | Full read denied; redirects to the matching narrow-slice command family (`xlsx-sheets`/`xlsx-columns`/`xlsx-head`/`xlsx-range`/`xlsx-query`, `pptx-outline`/`pptx-slide`/`pptx-notes`/`pptx-text`, `docx-outline`/`docx-tables`/`docx-text`) instead of extracting the whole document as text |
 | SQLite database (.db, .sqlite, .sqlite3, .db3) opened via Read | Full read denied; redirects to the SQLite narrow-slice family (`sqlite-tables`/`sqlite-schema`/`sqlite-query`) instead of reading binary bytes into context |
 | Parquet file (.parquet) opened via Read | Full read denied; redirects to DuckDB for SQL querying instead of reading binary columnar data |
 | Large JSON or YAML file (≥20 KB) read in full | Top-level keys or array summary previewed; redirects to `json-outline`/`json-query` or `yaml-outline`/`yaml-query` instead of blowing context on multi-megabyte payloads |
 | A file read through inline Python, Node or PowerShell (`python -c "...open('r.json')..."`) | Runs capped at 2,000 tokens with no other filtering, so a one-key projection comes back whole; a whole-file dump is cut, ends with a recall id, and names `json-outline`/`json-query` for JSON and YAML. Still refused where the wrapper cannot run: a pipeline or chain, a background `&`, compression turned off |
-| Findings you want to survive a compaction | `token-goat note set <key> "<finding>"` stores one per project; notes print at every session start and in the compaction manifest. Add `--anchor src/auth.ts::login`, or name a `file::symbol` in the finding, and the note is marked "(changed since note)" once that symbol changes |
+| Findings you want to survive a compaction | `token-goat note set <key> "<finding>"` stores one per project; notes print at every session start and in the compaction manifest. Add `--anchor src/auth.ts::login`, or name a `file::symbol` in the finding, and the note is marked "(changed since note)" once that symbol changes. If a slow start misses its 3-second deadline on Copilot CLI or VS Code, the session-start text and notes arrive with the first tool call |
 | Large JSON Lines file (.jsonl ≥20 KB) read in full | Record count and first-record schema shown; suggests slicing records with offset/limit instead of loading millions of tokens |
 | Other Office binary (.odt, .ods, .ott, .odp) opened via Read | Full read denied; redirects to `pandoc` for text extraction (no dedicated reader for these formats yet) |
 | Large CSV or TSV file (≥10 KB) read in full | Column headers, row count, and 3 sample rows shown; `token-goat csv-query` projects columns and/or filters rows instead of a full read; `duckdb` query suggestion for very large tabular data |
@@ -183,7 +192,7 @@ The fastest way to reduce AI token costs is fixing these six, not writing shorte
 | Broad recursive Glob sweep (`*`, `**/*`) on root directory | Pre-Glob hook warns against tree-dumping and points at `token-goat map --compact` for fast, lightweight structure inspection |
 | Guessing database column names in `session_store_sql` / `sql` and falling back to `SELECT *` | `token-goat session-schema [table]` and `describe <target>` provide instant schema discovery; `post_tool_use_failure` hook intercepts unknown columns and guides the query — ~85–95% smaller than trial-and-error `SELECT *` dumps |
 | Compound test/build pipeline (`npm run build && npm run typecheck && npm test`) | Post-Bash hook routes chained build/test/lint commands to `generic-ci` compression, dropping verbose passing steps and compiler noise |
-| Verbose command output on Windows under Codex CLI, Copilot CLI, or a PowerShell session, where the compression hook used to skip every command | Pre-Bash hook hands the command to PowerShell itself, base64-encoded through an environment variable the launched script clears first, so backslashes, quotes, and redirection survive and the output is compressed like anywhere else |
+| Verbose command output on Windows under Codex CLI or a PowerShell session, where the compression hook used to skip every command | Pre-Bash hook hands the command to PowerShell itself, base64-encoded through an environment variable the launched script clears first, so backslashes, quotes, and redirection survive and the output is compressed like anywhere else |
 
 On a per-token API plan, 100K wasted tokens per session runs about $0.30. Five sessions a week is ~$450/year. AI coding cost reduction at that scale comes from fixing the waste, not from using the product less. Token-goat is free. And on subscription plans, it can result in limits feeling 10x higher.
 
@@ -260,6 +269,8 @@ out: 38 lines              # ~300 tokens   (97% smaller)
 
 A line number works in place of a name, which is what you are holding when a grep hit, a stack frame, or a diff hunk points at code: `token-goat read "src/auth.py:142"` returns the symbol enclosing line 142, and `read "src/auth.py:142-190"` returns every symbol the range touches. A Windows drive letter stays part of the path, so `C:/src/auth.py:142` reads line 142 of that file, and a bare `C:142` stays a drive-relative path rather than a line number.
 
+A line range given as a flag (`--lines 1-5`, `--line`, `--range`, `--start`/`--end`, `--from`/`--to`, `--offset`/`--limit`) is not an option of `read`, but when the file argument names no place yet and the range is complete it runs as `read "file@1-5"` and says so on stderr: ``Note: ran as `token-goat read "f.ts@1-5"` ...``. A guessed spelling of a real flag (`--top`, `-k`, `--max` or `--count` for `--limit` on `search`, `semantic` and `recall`; `--search`, `--filter` or `--pattern` for `--grep` on the cached-output commands) runs the same way with the same note when its value is usable. Anything less certain still fails, with a `Did you mean` line naming the command to run.
+
 Same applies to `token-goat section "README.md::Install"` — one heading instead of the whole document. Anchor IDs and setext headings resolve too, so `section "doc.md::Quick-start"` works when the file uses `Quick start` as an `<h2>` with an explicit `{#quick-start}` anchor.
 
 ### 3. Compact manifest — preserve what mattered
@@ -321,6 +332,8 @@ Agents and interactive users must pass ordinary plain shell commands directly: a
 
 `-q` / `--quiet-success` trades a clean run's output for one line. On exit code 0 the full output is stored for recall and only the summary prints; on any other exit code the compressed output is delivered as usual.
 
+The wrapped command gets no standard input by default, on every path (plain, `--max-tokens`, `-q`, a filter, `--no-compress`), so a hook-wrapped command can never wait on input the harness will not send. `--stdin` hands it the caller's standard input instead, byte for byte: `printf 'héllo' | token-goat compress --stdin -c cat`.
+
 ```
 $ token-goat compress -q --cmd "npm run lint"
 [tg: ok] npm run lint (22.2s, recall: token-goat bash-output 326d9800e732eb9d)
@@ -370,7 +383,7 @@ Every command, with its flags, its output, and the comparison workflows that cha
 token-goat mcp-serve
 ```
 
-Runs token-goat as an MCP ([Model Context Protocol](https://modelcontextprotocol.io)) stdio server, exposing surgical-read tools (including `brief`, a one-shot symbol orientation call bundling body, callers, and containing doc section, and `index_status`, which reports whether a project's index has ever been populated, current file/symbol counts, dirty-queue depth, worker liveness, and embeddings availability — call it after an unexpectedly empty result from another tool, since an MCP-only client has no hook layer to warn it apart from a genuine "not found") plus `compress_text`, `retrieve_text`, `handoff_create`, and `handoff_resolve`. These local-only tools use bounded, redacted storage; MCP never intercepts a client's built-in file reads. Every tool takes an optional `projectRoot`. When a call leaves it out, the server infers the project: from an absolute path that exists, then from indexed file paths ending with the path you gave, then, for a bare name, from the project that defines that symbol. It only infers a project token-goat has indexed that sits inside the server's allowed roots; otherwise it keeps its own working directory, so with `mcp.confine_reads_to_project_root` on, a path outside it is still refused. Passing `projectRoot` always wins.
+Runs token-goat as an MCP ([Model Context Protocol](https://modelcontextprotocol.io)) stdio server, exposing seven tools by default (`symbol`, `read`, `section`, `outline`, `semantic`, `refs`, and `retrieve_text`, which recovers a compressed payload) and eleven more you switch on by name, since every tool listed is sent to the model on every turn. The others are surgical-read tools (including `brief`, a one-shot symbol orientation call bundling body, callers, and containing doc section, and `index_status`, which reports whether a project's index has ever been populated, current file/symbol counts, dirty-queue depth, worker liveness, and embeddings availability — call it after an unexpectedly empty result from another tool, since an MCP-only client has no hook layer to warn it apart from a genuine "not found") plus `compress_text`, `handoff_create`, and `handoff_resolve`. To switch on the others, set `TOKEN_GOAT_MCP_TOOLS` to the names you want, separated by commas (for example `symbol,read,section,outline,semantic,refs,retrieve_text,grep`); a list you set replaces the default, so name the seven too, and name all eighteen to get every tool. These local-only tools use bounded, redacted storage; MCP never intercepts a client's built-in file reads. Every tool takes an optional `projectRoot`. When a call leaves it out, the server infers the project: from an absolute path that exists, then from indexed file paths ending with the path you gave, then, for a bare name, from the project that defines that symbol. It only infers a project token-goat has indexed that sits inside the server's allowed roots; otherwise it keeps its own working directory, so with `mcp.confine_reads_to_project_root` on, a path outside it is still refused. Passing `projectRoot` always wins.
 
 ### Generic compression and handoffs
 
@@ -400,7 +413,7 @@ token-goat handoff-resolve review-notes --full
 }
 ```
 
-`token-goat install --vscode` creates or idempotently updates VS Code's user-profile `mcp.json` by default (`%APPDATA%\Code\User\mcp.json` on Windows, `~/Library/Application Support/Code/User/mcp.json` on macOS, `~/.config/Code/User/mcp.json` on Linux) — add `-p`/`--project` for the project-local `.vscode/mcp.json` shown above instead. It also adds a delimited routing block, preserving unrelated JSON and user text: to `~/.copilot/instructions/token-goat.instructions.md` for the user install (a personal instructions file VS Code applies in every workspace, so the folder you run it from is left alone), or to `.github/copilot-instructions.md` with `-p`. It fails clearly on malformed JSON, and refuses to install into one scope if the other scope already has a token-goat-managed entry (registering it twice would duplicate its tool schemas in that workspace). It also installs agent hooks in `~/.copilot/hooks/` (or `.github/hooks/` with `-p`), the folder VS Code's Copilot agent reads hooks from, so token-goat sees the agent's built-in reads, edits, and terminal commands. `token-goat uninstall --vscode` (add `-p`/`--project` for the project scope) removes only token-goat's server entry, guidance block, and hooks, and keeps the hooks if `--copilot` still uses them.
+`token-goat install --vscode` creates or idempotently updates VS Code's user-profile `mcp.json` by default (`%APPDATA%\Code\User\mcp.json` on Windows, `~/Library/Application Support/Code/User/mcp.json` on macOS, `~/.config/Code/User/mcp.json` on Linux, or under `$XDG_CONFIG_HOME` when that is set to an absolute path) — add `-p`/`--project` for the project-local `.vscode/mcp.json` shown above instead. It also adds a delimited routing block, preserving unrelated JSON and user text: to `~/.copilot/instructions/token-goat.instructions.md` for the user install (a personal instructions file VS Code applies in every workspace, so the folder you run it from is left alone), or to `.github/copilot-instructions.md` with `-p`. It fails clearly on malformed JSON, and refuses to install into one scope if the other scope already has a token-goat-managed entry (registering it twice would duplicate its tool schemas in that workspace). It also installs agent hooks in `~/.copilot/hooks/` (or `.github/hooks/` with `-p`), the folder VS Code's Copilot agent reads hooks from, so token-goat sees the agent's built-in reads, edits, and terminal commands. `token-goat uninstall --vscode` (add `-p`/`--project` for the project scope) removes only token-goat's server entry, guidance block, and hooks, and keeps the hooks if `--copilot` still uses them.
 
 **Visual Studio** (2022 17.14 or later, or 2026): `token-goat install --visualstudio` adds the same `servers` entry to `%USERPROFILE%\.mcp.json` and a routing block to `%USERPROFILE%\copilot-instructions.md` (Visual Studio 2026 reads that file). With `-p`/`--project` it writes `.mcp.json` and `.github/copilot-instructions.md` in the solution folder instead. Visual Studio has no agent hooks, so token-goat works there through its MCP tools and instructions only: no read dedup, hints, image shrink, or output folding. Two switches in Visual Studio turn it on: the Tools > Options checkbox for custom instructions, and the token-goat tools in the chat Tools picker, since new MCP tools start disabled. `token-goat uninstall --visualstudio` (add `-p` for the project) removes only token-goat's entry and block. See [Visual Studio users](docs/install.md#visual-studio-users).
 
@@ -432,7 +445,7 @@ If the extension is running somewhere that contribution did not take effect, it
 
 ## What gets installed?
 
-`token-goat install` writes hook entries and a delimited guidance block into your agent's config directory, plus an index, cache and models under a data directory. Nothing else, anywhere. Every entry is reversed by `token-goat uninstall`, integrations added with `--codex`, `--copilot` or a sibling flag are named rather than silently removed, and `token-goat doctor` lists what is present right now.
+`token-goat install` writes hook entries and a delimited guidance block into your agent's config directory, plus an index, cache and models under a data directory. Nothing else, anywhere. Every entry is reversed by `token-goat uninstall`, integrations added with `--codex`, `--copilot` or a sibling flag are named rather than silently removed, and `token-goat doctor` lists what is present right now. When `CODEX_HOME` is set, `install --codex`, `uninstall` and `doctor --repair` use that directory for Codex's config, `AGENTS.md` and hooks instead of `~/.codex`.
 
 **What the index actually holds, in plain terms.** The point of a surgical read is returning a function body without the file around it, which means the database stores those bodies. `symbols.body` holds the source text of every indexed symbol, `symbols.docstring` its doc comment, `refs.context` the line around each reference, and `chunks.text` the passages that semantic search embeds. There is also a full-text index over the bodies and docstrings. So the database is not a list of names and line numbers: it is a substantial copy of your source, sitting in a plain unencrypted SQLite file outside the repository.
 
@@ -446,7 +459,7 @@ Hooks fire automatically on every tool call once installed — nothing to start
 
 Hooks also answer faster after the first call. That call starts a small resident process, the hook server, and later hook calls go to it instead of starting Node and loading token-goat each time. In measurements on Windows that took a hook call from 110 to 135 ms down to about 70 ms in Claude Code, Codex, Copilot CLI and VS Code chat, and a read command such as `token-goat section` from 122 ms to 60 ms when its output goes to the agent rather than a terminal. You never start it yourself. It stops after 30 minutes idle, after an upgrade, when you turn it off, and when `uninstall --purge` runs. `token-goat hook-server status` shows what is running and `token-goat hook-server stop` stops it. To turn it off, set `server = false` under `[hooks]` in your global config, or `TOKEN_GOAT_HOOK_SERVER=0`. A project's `.token-goat.toml` cannot change this setting, because one server answers every project.
 
-To move to a newer release, `token-goat upgrade` installs it from npm and then re-runs `token-goat install`, so your hooks and integration manifests point at the build that just landed. `token-goat upgrade --check` reports whether one is available without installing anything, and `--json` gives the same answer for a script. The check asks `npm view` first, so a registry set up in npm (Artifactory, Nexus), its auth token and its CA certificate are used; it falls back to a direct request to the registry in `npm_config_registry`, or to npmjs.org. A successful result is cached for 24 hours, though `upgrade --check` itself always asks again. When a newer version is out, `token-goat doctor` mentions it at the end of its report, `token-goat stats` lists it in its insights, and the context added at session start says so. None of this happens when `network.offline` is set, and `token-goat doctor --repair` installs the update as its last step.
+To move to a newer release, `token-goat upgrade` installs it from npm and then re-runs `token-goat install`, so your hooks and integration manifests point at the build that just landed. `token-goat upgrade --check` reports whether one is available without installing anything, and `--json` gives the same answer for a script. When it cannot learn the latest version (`network.offline` is set, or the registry did not answer), it exits 1, with the reason on stderr or, under `--json`, in the `error` field. The check asks `npm view` first, so a registry set up in npm (Artifactory, Nexus), its auth token and its CA certificate are used; it falls back to a direct request to the registry in `npm_config_registry`, or to npmjs.org. A successful result is cached for 24 hours, though `upgrade --check` itself always asks again. When a newer version is out, `token-goat doctor` mentions it at the end of its report, `token-goat stats` lists it in its insights, and the context added at session start says so. None of this happens when `network.offline` is set, and `token-goat doctor --repair` installs the update as its last step.
 
 ## Verify
 
@@ -467,6 +480,8 @@ token-goat install
 
 `install` is idempotent: it adds missing entries, rewrites outdated token-goat entries in place, and leaves everything else in `settings.json` alone. Re-running it is always safe. Restart any running session afterwards so it picks up the new entries.
 
+`token-goat doctor --probe HOST` runs a host headless and reports whether its hooks reached the model. It exits 1 when a hook is at fault, 2 when the harness failed before its model replied (not logged in, access denied), and 3 for `vscode`, `visualstudio` and `jetbrains`, which run inside an editor and have no headless mode.
+
 **AI agents:** after `token-goat install`, run `token-goat doctor` and check the `Claude Code hook events` line before marking the install complete.
 
 ## Image support
@@ -483,6 +498,8 @@ The pipeline is written in TypeScript and decodes PNG, JPEG, GIF, and BMP itself
 
 The one thing the decoders will do is decline. A file whose header asks for more than 256 MB of pixel buffer, or that is in a variant token-goat cannot read exactly, is refused rather than guessed at, and the untouched original goes to the model. An untouched original is the right picture, so the only cost of a refusal is that the read is not shrunk.
 
+On Claude Code the shrunk copy reaches the model by pointing the Read at a temporary file holding it. The hook approves that rewritten read, and Claude Code asks before reading a file outside the session's working directory, so token-goat shrinks only images inside it; one outside is read unshrunk, after Claude Code's own prompt.
+
 When `tesseract.js` is installed, text-heavy images can also have their text extracted via OCR (`token-goat image-text <file>`) to replace raw pixel data with plain text. English (`eng`) is always enabled by default, and users can combine one or more additional languages (`token-goat image-text <file> --lang "fra,spa"`). Language preferences persist across version updates when saved globally (`token-goat config set image_shrink.ocr_lang "fra,spa"`), per-project in `.token-goat.toml` (`[image_shrink] ocr_lang = "fra+spa"`), or via `TOKEN_GOAT_OCR_LANG`. 16 languages are supported (`eng`, `fra`, `spa`, `deu`, `ita`, `por`, `nld`, `pol`, `rus`, `tur`, `swe`, `ara`, `chi_sim`, `chi_tra`, `jpn`, `kor`), each cryptographically verified against pinned package checksums to protect against supply-chain tampering.
 
 ## Stats display

package/SECURITY.md

@@ -39,9 +39,17 @@ The following are not treated as security issues unless paired with a working pr
 - Social-engineering attacks that require tricking the user into running malicious commands
 - Issues that require an already-compromised local user account
 
+## Check commands in the session record
+
+When a test, lint, typecheck or build command runs, the session record keeps the runner, its subcommand, a short list of known switches and any path-shaped word, and replaces every other word with an ellipsis. A secret passed as a bare positional argument that looks like a path, such as `hunter2.txt`, would be kept, because a file name is what identifies the check; a secret that follows a flag, uses a `user:pass@host` form or is shaped like a JWT is dropped.
+
+## Remembered failure fixes
+
+The failed commands token-goat learns fixes for are kept only as keyed digests, never as text, and the key sits in the same folder as the saved fixes, so a leak of that whole folder exposes both.
+
 ## Dependency advisories
 
-`npm audit` reports Token-Goat clean for anyone who installs it, and that has been true of a default install since the embedding library that carried every finding was removed. This repository's own tree is clean as well, development dependencies included: `adm-zip` and `hono` were resolved to patched versions once they had cleared Dependabot's seven-day cooldown, not bumped the day a fix was published -- see [`.github/dependabot.yml`](.github/dependabot.yml) for why a plain `npm update` isn't the fix. All three numbers below are reproducible with the commands shown. The one place an advisory can still reach is the optional native runtime, which a default install does not carry, and it is described further down rather than folded into these rows.
+`npm audit` reports Token-Goat clean for anyone who installs it, and that has been true of a default install since the embedding library that carried every finding was removed. This repository's own tree is clean as well, development dependencies included: `adm-zip`, `hono`, `proxy-addr` and `source-map-js` were resolved to patched versions through the lock-file refresh, not bumped by hand the day a fix was published -- see [`.github/dependabot.yml`](.github/dependabot.yml) for why a plain `npm update` isn't the fix. All three numbers below are reproducible with the commands shown. The one place an advisory can still reach is the optional native runtime, which a default install does not carry, and it is described further down rather than folded into these rows.
 
 | What you scan | Command | Result |
 | --- | --- | --- |
@@ -49,7 +57,7 @@ The following are not treated as security issues unless paired with a working pr
 | an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 2 packages |
 | a default install | `npm install token-goat` then `npm audit --omit=dev` | clean, 62 packages |
 
-The repository carries an `overrides` block in [`package.json`](package.json) that pins six packages to patched versions, and **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. That distinction used to matter a great deal, because a clean repository scan was standing in for an install that was not clean. It decides one thing now, and the section on the embedding runtime below says which. Otherwise the packages those pins were protecting against are not in a consumer's tree at all, whether or not the pins travel; the block stays because the development tree still resolves them.
+The repository carries an `overrides` block in [`package.json`](package.json) that pins nine packages to patched versions, and **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. That distinction used to matter a great deal, because a clean repository scan was standing in for an install that was not clean. It decides one thing now, and the section on the embedding runtime below says which. Otherwise the packages those pins were protecting against are not in a consumer's tree at all, whether or not the pins travel; the block stays because the development tree still resolves them.
 
 There is no table of reaching advisories here any more, and the last entry in it is worth recording rather than deleting. `@xenova/transformers` was an optional dependency, which in npm means everyone got it unless they asked not to, and it carried [`protobufjs`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) through `onnx-proto` and `onnxruntime-web` -- one critical advisory and four more -- plus its own nested, older `sharp` carrying [four inherited libvips CVEs](https://github.com/advisories/GHSA-f88m-g3jw-g9cj). None of the six was fixable from here: every one sits in a transitive package with no patched version, and the pins that would have solved it do not travel to consumers.
 

package/THIRD_PARTY_NOTICES.md

@@ -130,7 +130,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## csv-parse 7.0.2
+## csv-parse 7.0.3
 
 License: MIT
 

package/dist/{token-goat-chunk-QSBRTGM2.mjs → token-goat-chunk-25TRAWET.mjs}

@@ -2,10 +2,10 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   redactSecrets
-} from "./token-goat-chunk-4FVIAHSI.mjs";
+} from "./token-goat-chunk-T5P5ACNQ.mjs";
 import {
   loadConfig
-} from "./token-goat-chunk-7IN2MKDS.mjs";
+} from "./token-goat-chunk-7EZTZOMC.mjs";
 import {
   createLazyModuleLoader
 } from "./token-goat-chunk-AH6QILZM.mjs";
@@ -14,8 +14,9 @@ import {
   MAX_DOCUMENT_WORK_MILLIS
 } from "./token-goat-chunk-Y4AFKTHK.mjs";
 import {
-  compileGuardedRegex
-} from "./token-goat-chunk-GOLEOXZP.mjs";
+  compileGuardedRegex,
+  countNoun
+} from "./token-goat-chunk-HU4TORC5.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -145,7 +146,14 @@ function parsePageRange(spec, pageCount) {
   const end = m[2] ? parseInt(m[2], 10) : start;
   if (start < 1 || end < start) throw new Error(`invalid --pages spec: ${spec}`);
   if (start > pageCount) throw new Error(`invalid --pages spec: ${spec} (page ${start} is past end of document with ${pageCount} pages)`);
-  return { start, end: Math.min(end, pageCount) };
+  return end > pageCount ? { start, end: pageCount, requestedEnd: end } : { start, end };
+}
+function pagesPastEndNote(range, pageCount, stoppedAfter) {
+  if (range?.requestedEnd === void 0) return void 0;
+  const pages = (last) => range.start === last ? `page ${range.start}` : `pages ${range.start}-${last}`;
+  const cut = `--pages ${range.start}-${range.requestedEnd} runs past the document's ${countNoun(pageCount, "page")}`;
+  if (stoppedAfter !== void 0) return `${cut}; searched ${pages(stoppedAfter)} before --max-matches stopped the scan.`;
+  return `${cut}; showing ${pages(range.end)}.`;
 }
 var Y_EPSILON = 2;
 function reconstructLayout(items, deadline) {
@@ -292,7 +300,8 @@ async function extractPdfText(data, pagesSpec, layout = false) {
     }
     const text = pages.join("\n\n");
     assertPdfTextWithinBounds(text);
-    return { text, pageCount: doc.numPages, pagesExtracted: end - start + 1 };
+    const pagesNote = pagesPastEndNote(range, doc.numPages);
+    return { text, pageCount: doc.numPages, pagesExtracted: end - start + 1, ...pagesNote !== void 0 ? { pagesNote } : {} };
   });
 }
 async function locatePdfPages(data, pattern, opts) {
@@ -319,7 +328,8 @@ async function locatePdfPages(data, pattern, opts) {
       matches.push({ page: i, snippet: locateSnippet(pageText, m.index, m[0].length, context) });
     }
     const truncated = matches.length >= maxMatches && i <= end;
-    return { matches, truncated };
+    const pagesNote = pagesPastEndNote(range, doc.numPages, truncated ? i - 1 : void 0);
+    return { matches, truncated, ...pagesNote !== void 0 ? { pagesNote } : {} };
   });
 }
 function joinTextItems(items, eol) {

package/dist/token-goat-chunk-2KXO6V2B.mjs

@@ -0,0 +1,203 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  BRIDGE_CAPABILITY_MATRIX
+} from "./token-goat-chunk-RSLPOBKQ.mjs";
+import {
+  PROBE_EVENT_TAGS,
+  PROBE_NONCE_ENV,
+  probeDir
+} from "./token-goat-chunk-HLPW63A7.mjs";
+import "./token-goat-chunk-KKUFXAPD.mjs";
+import {
+  HOOK_PROBE_ENV
+} from "./token-goat-chunk-U4WHMG6Y.mjs";
+import "./token-goat-chunk-GVB2MUST.mjs";
+import "./token-goat-chunk-XB5KKOCG.mjs";
+import "./token-goat-chunk-OUKDTVNU.mjs";
+import "./token-goat-chunk-XX6O25RN.mjs";
+import "./token-goat-chunk-QYHO5CPH.mjs";
+import "./token-goat-chunk-YZAAZU2S.mjs";
+import "./token-goat-chunk-HU4TORC5.mjs";
+import "./token-goat-chunk-GGGG7RWB.mjs";
+import {
+  resolveOnPath,
+  spawnResolvedSync
+} from "./token-goat-chunk-AM5V6GSX.mjs";
+import {
+  displaySafeText
+} from "./token-goat-chunk-FNFBKLRD.mjs";
+import "./token-goat-chunk-CO3UYX6G.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/doctor_probe.ts
+init_define_import_meta_env();
+import { randomBytes } from "node:crypto";
+import { readdirSync, rmSync } from "node:fs";
+import path from "node:path";
+var PROBE_PROMPT = "Reply with every line of your context that begins with token-goat probe marker, copied exactly, one per line. If there are none, reply NONE.";
+var PROBE_COMMANDS = {
+  claudecode: { bin: "claude", args: ["-p", PROBE_PROMPT] },
+  codex: { bin: "codex", args: ["exec", PROBE_PROMPT] },
+  copilot_cli: { bin: "copilot", args: ["-p", PROBE_PROMPT] }
+};
+var IDE_HOSTS_WITHOUT_PROBE = /* @__PURE__ */ new Set(["vscode", "visualstudio", "jetbrains"]);
+var NO_HEADLESS_PROBE_EXIT_CODE = 3;
+function noHeadlessProbeMessage(host) {
+  return `${host} has no headless mode, so doctor --probe cannot send it a prompt; run token-goat doctor to check its install and hooks`;
+}
+function hideResolvedPath(message, resolved) {
+  if (resolved === "") return message;
+  if (process.platform !== "win32") return message.split(resolved).join("<harness>");
+  const fold = (text) => text.replaceAll("\\", "/").toLowerCase();
+  const haystack = fold(message);
+  const needle = fold(resolved);
+  if (haystack.length !== message.length || needle.length !== resolved.length) return message.split(resolved).join("<harness>");
+  let out = "";
+  let from = 0;
+  for (let at = haystack.indexOf(needle); at !== -1; at = haystack.indexOf(needle, Math.max(from, at + 1))) {
+    if (/[a-z0-9._-]/.test(haystack[at + needle.length] ?? "")) continue;
+    out += message.slice(from, at) + "<harness>";
+    from = at + needle.length;
+  }
+  return out + message.slice(from);
+}
+function isProbeHarness(name) {
+  return Object.prototype.hasOwnProperty.call(PROBE_COMMANDS, name);
+}
+var MISLEADING_ENV = ["TOKEN_GOAT_HARNESS_OVERRIDE", "CLAUDE_CODE_SESSION_ID", "CLAUDE_CODE_VERSION", "CLAUDE_CODE_ENTRYPOINT", "CLAUDECODE", "CODEX_SESSION_ID", "CODEX_SESSION"];
+var PROBE_TIMEOUT_MS = 24e4;
+function modelReplied(stdout, nonce) {
+  return stdout.includes(nonce) || /\bNONE\b/.test(stdout);
+}
+function classifyProbeEvent(opts) {
+  if (!opts.wired) return "not_wired";
+  if (!opts.modelReplied) return "inconclusive";
+  if (opts.stdout.includes(`${opts.nonce}-${opts.tag}`)) return "reached";
+  return opts.receipts.has(opts.tag) ? "fired_not_delivered" : "not_fired";
+}
+function probeEnv(nonce, env = process.env) {
+  const child = { ...env };
+  for (const key of MISLEADING_ENV) delete child[key];
+  if (child["TERM_PROGRAM"] === "claude-code") delete child["TERM_PROGRAM"];
+  child[PROBE_NONCE_ENV] = nonce;
+  child[HOOK_PROBE_ENV] = "1";
+  return child;
+}
+function receiptTags(nonce) {
+  const tags = /* @__PURE__ */ new Set();
+  try {
+    for (const name of readdirSync(probeDir())) {
+      if (name.startsWith(`${nonce}.`)) tags.add(name.slice(nonce.length + 1));
+    }
+  } catch {
+  }
+  return tags;
+}
+function removeReceipts(nonce) {
+  for (const tag of receiptTags(nonce)) rmSync(path.join(probeDir(), `${nonce}.${tag}`), { force: true });
+}
+function tail(text) {
+  return text.trim().split(/\r?\n/).slice(-5).join("\n");
+}
+var START_ERROR_CODES = /* @__PURE__ */ new Set(["ENOENT", "EACCES", "EPERM", "EINVAL", "EFTYPE", "ENOEXEC", "ENOTDIR"]);
+function runProbe(harness, opts = {}) {
+  const spec = PROBE_COMMANDS[harness];
+  if (spec === void 0) throw new Error(`no headless probe for ${harness}; supported: ${Object.keys(PROBE_COMMANDS).join(", ")}`);
+  const command = `${spec.bin} ${spec.args[0] ?? ""} "<probe prompt>"`;
+  const implemented = BRIDGE_CAPABILITY_MATRIX.find((r) => r.harness === harness)?.implemented ?? /* @__PURE__ */ new Set();
+  const probed = Object.keys(PROBE_EVENT_TAGS);
+  const resolved = (opts.resolve ?? resolveOnPath)(spec.bin);
+  if (resolved === null) {
+    return { harness, command, status: "not_installed", exitCode: null, events: probed.map((event) => ({ event, result: implemented.has(event) ? "not_fired" : "not_wired" })) };
+  }
+  const nonce = randomBytes(10).toString("hex");
+  try {
+    const run = spawnResolvedSync(resolved, spec.args, { cwd: opts.cwd ?? process.cwd(), env: probeEnv(nonce), encoding: "utf8", timeout: opts.timeoutMs ?? PROBE_TIMEOUT_MS, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = run.stdout ?? "";
+    const receipts = receiptTags(nonce);
+    const timedOut = run.error?.code === "ETIMEDOUT";
+    const status = timedOut ? "timeout" : run.status === 0 ? "ok" : "failed";
+    const output = `${run.stderr ?? ""}
+${stdout}`.trim();
+    const detail = tail(output || hideResolvedPath(run.error?.message ?? "", resolved));
+    const startError = run.error?.code;
+    const spawnError = startError !== void 0 && START_ERROR_CODES.has(startError) ? startError : void 0;
+    if (spawnError !== void 0) return { harness, command, status: "spawn_failed", exitCode: null, events: probed.map((event) => ({ event, result: implemented.has(event) ? "not_fired" : "not_wired" })), detail: spawnError };
+    const knownCause = probeCause(output);
+    const replied = status === "ok" || modelReplied(stdout, nonce) || status === "timeout" || knownCause === null;
+    const events = probed.map((event) => ({ event, result: classifyProbeEvent({ wired: implemented.has(event), nonce, tag: PROBE_EVENT_TAGS[event] ?? "", stdout, receipts, modelReplied: replied }) }));
+    const report = { harness, command, status, exitCode: run.status, events };
+    return status === "ok" ? report : { ...report, detail, knownCause };
+  } finally {
+    removeReceipts(nonce);
+  }
+}
+var RESULT_TEXT = {
+  reached: "reached the model",
+  fired_not_delivered: "hook ran, but the model never saw its output",
+  not_fired: "hook did not run",
+  not_wired: "not wired for this harness",
+  inconclusive: "not judged: the harness never produced a model reply"
+};
+function probeVerdict(report) {
+  if (report.events.some((e) => e.result === "inconclusive")) return "inconclusive";
+  if (report.status !== "ok") return "fail";
+  return report.events.every((e) => e.result === "reached" || e.result === "not_wired") ? "pass" : "fail";
+}
+function probePassed(report) {
+  return probeVerdict(report) === "pass";
+}
+var PROBE_CAUSES = [
+  // codex_untrusted_directory.stderr
+  { re: /^Not inside a trusted directory and --skip-git-repo-check was not specified\./m, cause: "the harness refused to run in an untrusted directory", remedy: "run the probe from a git repository or a directory the harness trusts" },
+  // claude_unknown_option.stderr and codex_unexpected_argument.stderr
+  { re: /^error: (?:unknown option|unexpected argument) '/m, cause: "the harness rejected a command-line flag", remedy: "its CLI changed; update token-goat, or report the harness version" },
+  // copilot_access_denied.stderr
+  { re: /^Error: Access denied by policy settings/m, cause: "the account or its organization policy denied the harness", remedy: "check the Copilot access and policy settings of the signed-in account" },
+  // claude_not_logged_in.stdout and copilot_no_authentication.stderr
+  { re: /^(?:Not logged in · Please run \/login|Error: No authentication information found\.)/m, cause: "the harness is not logged in", remedy: "sign in to the harness, then run the probe again" }
+];
+function probeCause(detail) {
+  const hit = PROBE_CAUSES.find((c) => c.re.test(detail));
+  return hit === void 0 ? null : { cause: hit.cause, remedy: hit.remedy };
+}
+function formatProbeReport(report) {
+  const lines = [`Probe: ${report.command} (one real prompt on your account)`];
+  const inconclusive = probeVerdict(report) === "inconclusive";
+  const mark = inconclusive ? "[WARN]" : "[FAIL]";
+  if (report.status === "not_installed") lines.push(`  [FAIL] ${PROBE_COMMANDS[report.harness]?.bin ?? report.harness} is not on PATH`);
+  else if (report.status === "timeout") lines.push(`  ${mark} the harness did not finish in time`);
+  else if (report.status === "spawn_failed") lines.push(displaySafeText(`  [FAIL] the harness could not be started: ${report.detail ?? "unknown error"}`));
+  else if (report.status === "failed") lines.push(`  ${mark} the harness exited with code ${report.exitCode ?? "unknown"}`);
+  if (inconclusive) {
+    const known = report.knownCause !== void 0 ? report.knownCause : probeCause(report.detail ?? "");
+    lines.push(displaySafeText(known === null ? "  Probe inconclusive: the harness failed before the model replied; see its output below" : `  Probe inconclusive: ${known.cause}. ${known.remedy}`));
+  }
+  if (report.status !== "not_installed" && report.status !== "spawn_failed") {
+    for (const e of report.events) {
+      const eventMark = e.result === "reached" ? "[OK]  " : e.result === "not_wired" ? "[--]  " : e.result === "inconclusive" ? "[??]  " : "[FAIL]";
+      lines.push(`  ${eventMark} ${e.event.padEnd(19)} ${RESULT_TEXT[e.result]}`);
+    }
+  }
+  if (report.status !== "spawn_failed" && report.detail !== void 0 && report.detail !== "") lines.push(...displaySafeText(report.detail).split("\n").map((l) => `         ${l}`));
+  return lines.join("\n");
+}
+export {
+  IDE_HOSTS_WITHOUT_PROBE,
+  NO_HEADLESS_PROBE_EXIT_CODE,
+  PROBE_COMMANDS,
+  PROBE_PROMPT,
+  classifyProbeEvent,
+  formatProbeReport,
+  hideResolvedPath,
+  isProbeHarness,
+  noHeadlessProbeMessage,
+  probeCause,
+  probeEnv,
+  probePassed,
+  probeVerdict,
+  runProbe
+};

package/dist/{token-goat-chunk-IVKIZWAB.mjs → token-goat-chunk-2M7E4PF7.mjs}

@@ -1,12 +1,16 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
+import {
+  charFinder,
+  findElements
+} from "./token-goat-chunk-E45INMY3.mjs";
 import {
   MAX_ZIP_INPUT_BYTES,
   MAX_ZIP_OUTPUT_BYTES,
   ZipInputTooLargeError,
   ZipOutputTooLargeError,
   unzipBounded
-} from "./token-goat-chunk-XTQAOTSO.mjs";
+} from "./token-goat-chunk-EDBDRVH5.mjs";
 import {
   createLazyModuleLoader
 } from "./token-goat-chunk-AH6QILZM.mjs";
@@ -16,7 +20,10 @@ import {
 } from "./token-goat-chunk-Y4AFKTHK.mjs";
 import {
   pushAll
-} from "./token-goat-chunk-GOLEOXZP.mjs";
+} from "./token-goat-chunk-HU4TORC5.mjs";
+import {
+  echoedValue
+} from "./token-goat-chunk-GGGG7RWB.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -268,8 +275,8 @@ var loadFflate = createLazyModuleLoader(
 );
 function accessFailureMessage(err, filePath) {
   const code = err?.code;
-  if (code === "ENOENT") return `File not found: ${filePath}`;
-  return `could not read ${filePath} (${code ?? "unknown error"})`;
+  if (code === "ENOENT") return `File not found: ${echoedValue(filePath)}`;
+  return `could not read ${echoedValue(filePath)} (${code ?? "unknown error"})`;
 }
 async function readOoxmlZip(filePath, kind) {
   const fflate = await loadFflate();
@@ -332,25 +339,47 @@ function pushTextValue(runs, val) {
     runs.push(String(val["#text"]));
   }
 }
-var MATH_PARA_RE = /<m:oMathPara(?:\s[^>]*)?>([\s\S]*?)<\/m:oMathPara>/g;
-var MATH_RE = /<m:oMath(?:\s[^>]*)?>([\s\S]*?)<\/m:oMath>/g;
-var MATH_TEXT_RE = /<m:t(?:\s[^>]*)?>([^<]*)<\/m:t>/g;
+var MATH_PARA_OPEN = /<m:oMathPara(?=[\s>])/g;
+var MATH_PARA_CLOSE = /<\/m:oMathPara>/g;
+var MATH_OPEN = /<m:oMath(?=[\s>])/g;
+var MATH_CLOSE = /<\/m:oMath>/g;
 function mathRunText(fragment) {
   let out = "";
-  for (const m of fragment.matchAll(MATH_TEXT_RE)) out += m[1];
+  const nextGt = charFinder(fragment, ">");
+  const nextLt = charFinder(fragment, "<");
+  const open = /<m:t(?=[\s>])/g;
+  let m;
+  while ((m = open.exec(fragment)) !== null) {
+    const gt = nextGt(m.index + m[0].length);
+    if (gt < 0) break;
+    const lt = nextLt(gt + 1);
+    if (lt < 0) break;
+    if (!fragment.startsWith("</m:t>", lt)) continue;
+    out += fragment.slice(gt + 1, lt);
+    open.lastIndex = lt + 6;
+  }
   return out;
 }
+function replaceElements(xml, open, close, fn) {
+  let out = "";
+  let pos = 0;
+  for (const el of findElements(xml, open, close)) {
+    out += xml.slice(pos, el.start) + fn(el.body);
+    pos = el.end;
+  }
+  return out + xml.slice(pos);
+}
 function inlineMathRuns(xml, openRun, closeRun) {
   const asRun = (text) => text.length > 0 ? `${openRun}${text}${closeRun}` : "";
-  const withParas = xml.replace(MATH_PARA_RE, (_whole, inner) => {
+  const withParas = replaceElements(xml, MATH_PARA_OPEN, MATH_PARA_CLOSE, (inner) => {
     const lines = [];
-    for (const m of inner.matchAll(MATH_RE)) {
-      const text = mathRunText(m[1]);
+    for (const el of findElements(inner, MATH_OPEN, MATH_CLOSE)) {
+      const text = mathRunText(el.body);
       if (text.length > 0) lines.push(text);
     }
     return asRun(lines.length > 0 ? lines.join(" ") : mathRunText(inner));
   });
-  return withParas.replace(MATH_RE, (_whole, inner) => asRun(mathRunText(inner)));
+  return replaceElements(withParas, MATH_OPEN, MATH_CLOSE, (inner) => asRun(mathRunText(inner)));
 }
 function collectTextRuns(node, tag, skipInside = []) {
   const runs = [];

package/dist/{token-goat-chunk-SMVRN2HU.mjs → token-goat-chunk-2UPZGKKY.mjs}

@@ -5,10 +5,10 @@ import {
   atomicWriteText,
   ensureDirSync,
   withFileLock
-} from "./token-goat-chunk-GOLEOXZP.mjs";
+} from "./token-goat-chunk-HU4TORC5.mjs";
 import {
   dataDir
-} from "./token-goat-chunk-VES7EL7O.mjs";
+} from "./token-goat-chunk-CO3UYX6G.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";