token-goat 2.9.30 → 2.9.31

package/dist/{token-goat-chunk-Q5VTGRH7.mjs → token-goat-chunk-LCNQ2CNN.mjs}

@@ -1,67 +1,66 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
+import {
+  projectNotesFor
+} from "./token-goat-chunk-GWFLAUMQ.mjs";
 import {
   computeAdaptiveBudget,
-  formatAge,
   getContextPressure,
   isNoisePath,
+  loadSessionCache
+} from "./token-goat-chunk-NMD42SFQ.mjs";
+import {
   listSiblingSessionStates,
-  loadSessionCache,
   sessionSidecarPath
-} from "./token-goat-chunk-Y776AENC.mjs";
+} from "./token-goat-chunk-WBA5SKT4.mjs";
 import {
-  getBashOutput,
-  indexRecallEntry
-} from "./token-goat-chunk-AFLYLHDH.mjs";
-import {
-  WEB_FETCH_KEY_SEP,
-  getSessionBashOutputs,
-  getSessionBashReruns,
-  getSessionFiles,
-  getSessionWebFetches
-} from "./token-goat-chunk-C63JQV5K.mjs";
+  getBashOutput
+} from "./token-goat-chunk-KQBLRPBN.mjs";
 import {
   blobPath,
+  indexRecallEntry,
   isBlobStale,
   loadBlob,
   storeBlob
-} from "./token-goat-chunk-ARDNEC2U.mjs";
+} from "./token-goat-chunk-4ZBFWLXF.mjs";
+import {
+  WEB_FETCH_KEY_SEP,
+  epochReadCounts,
+  getSessionBashOutputs,
+  getSessionBashReruns,
+  getSessionFiles,
+  getSessionWebFetches,
+  mergeEpochBase,
+  wasEditedSinceCompaction
+} from "./token-goat-chunk-GL3ETKSC.mjs";
 import {
   redactSecrets
-} from "./token-goat-chunk-4FVIAHSI.mjs";
+} from "./token-goat-chunk-T5P5ACNQ.mjs";
+import {
+  loadConfig
+} from "./token-goat-chunk-7EZTZOMC.mjs";
 import {
-  findProject,
-  loadConfig,
   shortFingerprint
-} from "./token-goat-chunk-7IN2MKDS.mjs";
+} from "./token-goat-chunk-4GBVPH3D.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-YZAAZU2S.mjs";
 import {
-  LOCK_WAIT_MS_HARDENED,
-  atomicWriteText,
   ensureDirSync,
   runGit,
-  toKB,
-  withFileLock,
-  withRetryOnLock
-} from "./token-goat-chunk-GOLEOXZP.mjs";
+  toKB
+} from "./token-goat-chunk-HU4TORC5.mjs";
 import {
   foldPath,
   resolveOnPath,
-  sleepSync,
   spawnResolvedSync
 } from "./token-goat-chunk-AM5V6GSX.mjs";
 import {
   UNTRUSTED_FILE_TAG,
   displaySafePath,
   displaySafeText,
-  fenceUntrustedFileContent,
   neutralizeSpokenMarkers
 } from "./token-goat-chunk-FNFBKLRD.mjs";
-import {
-  dataDir
-} from "./token-goat-chunk-VES7EL7O.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -133,271 +132,6 @@ registerReset(() => {
   _urlIndex = /* @__PURE__ */ new Map();
 }, { perRequest: true });
 
-// src/project_memory.ts
-init_define_import_meta_env();
-import * as fs2 from "node:fs";
-import * as path from "node:path";
-var MAX_ENTRIES = 30;
-var MAX_VALUE_LEN = 300;
-var MAX_TOTAL_CHARS = 4e3;
-var KEY_RE = /^[A-Za-z0-9_-]{1,80}$/;
-var SET_AT_RE = /^#\s*set\s+(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z)$/;
-var ANCHOR_RE = /^#\s*anchor:\s*(\S.*)::([^:@\s]+)@([0-9a-f]{64})$/;
-function anchorLabel(status) {
-  if (status === "changed") return " (changed since note)";
-  if (status === "gone") return " (anchored symbol gone)";
-  return "";
-}
-function anchorLine(anchor) {
-  const line = `# anchor: ${anchor.file}::${anchor.symbol}@${anchor.sha}`;
-  const back = ANCHOR_RE.exec(line);
-  return back !== null && back[1] === anchor.file && back[2] === anchor.symbol ? line : null;
-}
-function noteMap() {
-  return /* @__PURE__ */ Object.create(null);
-}
-function ordinal(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function memoryPath(projectHash) {
-  return path.join(dataDir(), "projects", `${projectHash}_memory.toml`);
-}
-function validateKey(key) {
-  if (!KEY_RE.test(key)) {
-    throw new Error(
-      `Invalid memory key ${JSON.stringify(key)}: use only letters, digits, hyphens, underscores (max 80 chars)`
-    );
-  }
-}
-function parseTOML(content, unparsed = [], setAt = /* @__PURE__ */ new Map(), anchors = /* @__PURE__ */ new Map()) {
-  const result = noteMap();
-  let pendingSetAt;
-  let pendingAnchor;
-  for (const [i, line] of content.split("\n").entries()) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      continue;
-    }
-    if (trimmed.startsWith("#")) {
-      const time = SET_AT_RE.exec(trimmed)?.[1];
-      if (time !== void 0 && !Number.isNaN(Date.parse(time))) pendingSetAt = time;
-      const anchor = ANCHOR_RE.exec(trimmed);
-      if (anchor !== null) pendingAnchor = { file: anchor[1], symbol: anchor[2], sha: anchor[3] };
-      continue;
-    }
-    const entrySetAt = pendingSetAt;
-    const entryAnchor = pendingAnchor;
-    pendingSetAt = void 0;
-    pendingAnchor = void 0;
-    const match = trimmed.match(/^([A-Za-z0-9_-]+)\s*=\s*"(.*)"\s*$/s);
-    if (match) {
-      const [, key, value] = match;
-      if (key && value !== void 0) {
-        const unescaped = value.replace(/\\(u202[89]|[\\nrt"])/g, (_, c) => {
-          switch (c) {
-            case "u2028":
-              return "\u2028";
-            case "u2029":
-              return "\u2029";
-            case "\\":
-              return "\\";
-            case "n":
-              return "\n";
-            case "r":
-              return "\r";
-            case '"':
-              return '"';
-            default:
-              return _;
-          }
-        });
-        result[key] = unescaped;
-        if (entrySetAt === void 0) setAt.delete(key);
-        else setAt.set(key, entrySetAt);
-        if (entryAnchor === void 0) anchors.delete(key);
-        else anchors.set(key, entryAnchor);
-      }
-    } else {
-      unparsed.push(i + 1);
-    }
-  }
-  return result;
-}
-function loadRaw(filePath, forUpdate = false, setAt, anchors) {
-  let content = "";
-  try {
-    withRetryOnLock(() => {
-      content = fs2.readFileSync(filePath, "utf-8");
-    });
-  } catch (err) {
-    if (err.code === "ENOENT") return noteMap();
-    throw err;
-  }
-  const unparsed = [];
-  const entries = parseTOML(content, unparsed, setAt, anchors);
-  if (forUpdate && unparsed.length > 0) {
-    const one = unparsed.length === 1;
-    throw new Error(`Not updating ${filePath}: ${one ? "line" : "lines"} ${unparsed.join(", ")} ${one ? "is" : "are"} not in the key = "value" form, and saving would drop ${one ? "it" : "them"}. Fix or remove ${one ? "it" : "them"}, then try again.`);
-  }
-  return entries;
-}
-function save(filePath, entries, setAt = /* @__PURE__ */ new Map(), anchors = /* @__PURE__ */ new Map()) {
-  const lines = [];
-  const sorted = Object.entries(entries).sort(([a], [b]) => ordinal(a, b));
-  for (const [k, v] of sorted) {
-    const escaped = v.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-    const time = setAt.get(k);
-    if (time !== void 0) lines.push(`# set ${time}`);
-    const anchor = anchors.get(k);
-    const anchored = anchor === void 0 ? null : anchorLine(anchor);
-    if (anchored !== null) lines.push(anchored);
-    lines.push(`${k} = "${escaped}"`);
-  }
-  const content = lines.length > 0 ? lines.join("\n") + "\n" : "";
-  const dir = path.dirname(filePath);
-  ensureDirSync(dir);
-  atomicWriteText(filePath, content);
-}
-function loadEntries(projectHash) {
-  return loadRaw(memoryPath(projectHash));
-}
-function loadDatedEntries(projectHash) {
-  const setAt = /* @__PURE__ */ new Map();
-  const anchors = /* @__PURE__ */ new Map();
-  const entries = loadRaw(memoryPath(projectHash), false, setAt, anchors);
-  const result = noteMap();
-  for (const [key, value] of Object.entries(entries)) {
-    const note = { value };
-    const time = setAt.get(key);
-    if (time !== void 0) note.setAt = time;
-    const anchor = anchors.get(key);
-    if (anchor !== void 0) note.anchor = anchor;
-    result[key] = note;
-  }
-  return result;
-}
-function noteAgeLabel(note, now = Date.now()) {
-  if (note.setAt === void 0) return "";
-  return ` (set ${formatAge(Math.max(0, now - Date.parse(note.setAt)))} ago)`;
-}
-function oneLineNoteValue(value) {
-  return value.replace(/\r\n|[\r\n\u0085\u2028\u2029]/g, "\\n");
-}
-function byRecency(a, aSetAt, b, bSetAt) {
-  const ta = aSetAt === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(aSetAt);
-  const tb = bSetAt === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(bSetAt);
-  return ta !== tb ? ta > tb ? -1 : 1 : ordinal(a, b);
-}
-function setEntry(projectHash, key, value, anchor) {
-  validateKey(key);
-  const p = memoryPath(projectHash);
-  const dir = path.dirname(p);
-  ensureDirSync(dir);
-  const result = { evicted: [] };
-  const doSet = () => {
-    const setAt = /* @__PURE__ */ new Map();
-    const anchors = /* @__PURE__ */ new Map();
-    const entries = loadRaw(p, true, setAt, anchors);
-    const old = Object.hasOwn(entries, key) ? entries[key] : void 0;
-    if (old !== void 0) result.previous = old;
-    const isNewKey = !Object.hasOwn(entries, key);
-    if (isNewKey && Object.keys(entries).length >= MAX_ENTRIES) {
-      const keysToKeep = MAX_ENTRIES - 1;
-      const allKeys = Object.keys(entries).sort((a, b) => byRecency(a, setAt.get(a), b, setAt.get(b)));
-      for (const k of allKeys.slice(keysToKeep)) {
-        result.evicted.push(k);
-        delete entries[k];
-        setAt.delete(k);
-        anchors.delete(k);
-      }
-    }
-    entries[key] = value;
-    setAt.set(key, (/* @__PURE__ */ new Date()).toISOString());
-    if (anchor === void 0) anchors.delete(key);
-    else anchors.set(key, anchor);
-    save(p, entries, setAt, anchors);
-    return true;
-  };
-  underNotesLock(p, doSet);
-  return result;
-}
-function underNotesLock(p, update) {
-  const lockPath = `${p}.lock`;
-  ensureDirSync(path.dirname(p));
-  for (let attempt = 1; attempt <= 3; attempt++) {
-    if (withFileLock(lockPath, update, { waitMs: LOCK_WAIT_MS_HARDENED }) !== void 0) return;
-    if (fs2.existsSync(lockPath)) break;
-    if (attempt < 3) sleepSync(50 * attempt);
-  }
-  throw new Error(`Could not lock ${p} for writing; no note was changed. Another token-goat process may be writing notes: try again.`);
-}
-function unsetEntry(projectHash, key) {
-  validateKey(key);
-  const p = memoryPath(projectHash);
-  let removed = false;
-  const doUnset = () => {
-    const setAt = /* @__PURE__ */ new Map();
-    const anchors = /* @__PURE__ */ new Map();
-    const entries = loadRaw(p, true, setAt, anchors);
-    if (Object.hasOwn(entries, key)) {
-      delete entries[key];
-      save(p, entries, setAt, anchors);
-      removed = true;
-    }
-    return true;
-  };
-  underNotesLock(p, doUnset);
-  return removed;
-}
-function clearAll(projectHash) {
-  const p = memoryPath(projectHash);
-  const doClear = () => {
-    if (fs2.existsSync(p)) {
-      save(p, {});
-    }
-    return true;
-  };
-  underNotesLock(p, doClear);
-}
-function buildInjection(projectHash, root, statusOf) {
-  try {
-    const entries = loadDatedEntries(projectHash);
-    if (Object.keys(entries).length === 0) {
-      return null;
-    }
-    const now = Date.now();
-    const header = '### Project notes (`token-goat note set <key> "<finding>"`)';
-    const render2 = (shown2, skipped) => {
-      const parts = [header];
-      if (shown2.length > 0) parts.push(fenceUntrustedFileContent(shown2.join("\n")));
-      if (skipped > 0) parts.push(`- (+${skipped} more memory entries omitted)`);
-      return parts.join("\n");
-    };
-    const entries_list = Object.entries(entries).sort(([a, na], [b, nb]) => byRecency(a, na.setAt, b, nb.setAt));
-    const shown = [];
-    for (const [key, note] of entries_list.slice(0, MAX_ENTRIES)) {
-      const val = note.value;
-      const display = val.length <= MAX_VALUE_LEN ? val : val.slice(0, MAX_VALUE_LEN) + "\u2026";
-      const flag = root === void 0 || statusOf === void 0 || note.anchor === void 0 ? "" : anchorLabel(statusOf(root, note.anchor));
-      const line = `- **${key}**${noteAgeLabel(note, now)}${flag}: ${oneLineNoteValue(display)}`;
-      if (render2([...shown, line], entries_list.length - shown.length - 1).length > MAX_TOTAL_CHARS) break;
-      shown.push(line);
-    }
-    return render2(shown, entries_list.length - shown.length);
-  } catch {
-    return null;
-  }
-}
-function projectNotesFor(cwd, statusOf) {
-  if (cwd === void 0) return null;
-  try {
-    const project = findProject(cwd);
-    return project === null ? null : buildInjection(project.hash, project.root, statusOf);
-  } catch {
-    return null;
-  }
-}
-
 // src/manifest_fit.ts
 init_define_import_meta_env();
 var RESERVE_SHARE = 0.25;
@@ -456,7 +190,7 @@ function fitSections(sections, budget) {
 }
 
 // src/manifest.ts
-var MEM_EPOCH_TIMEOUT_MS = 800;
+var MEM_EPOCH_TIMEOUT_MS = 2e3;
 var MAX_ROWS = 40;
 function renderReadRow(entry) {
   const kb = Math.max(1, toKB(entry.sizeBytes));
@@ -478,14 +212,22 @@ function mergeManifestFiles(parent, siblingFiles) {
       continue;
     }
     const mergedSymbols = [.../* @__PURE__ */ new Set([...prev.symbols_read ?? [], ...f.symbols_read ?? []])];
+    const fullReadCount = Math.max(prev.fullReadCount ?? 0, f.fullReadCount ?? 0);
+    const lastFullReadAt = Math.max(prev.lastFullReadAt ?? -1, f.lastFullReadAt ?? -1);
+    const epochBase = mergeEpochBase(prev.epochBase, f.epochBase);
+    const lastEditedAt = Math.max(prev.lastEditedAt ?? 0, f.lastEditedAt ?? 0);
     byPath.set(key, {
       path: prev.path,
       readCount: Math.max(prev.readCount, f.readCount),
       lastReadAt: Math.max(prev.lastReadAt, f.lastReadAt),
+      ...fullReadCount > 0 ? { fullReadCount } : {},
+      ...lastFullReadAt >= 0 ? { lastFullReadAt } : {},
       wasEdited: prev.wasEdited || f.wasEdited,
+      ...lastEditedAt > 0 ? { lastEditedAt } : {},
       sizeBytes: f.lastReadAt >= prev.lastReadAt ? f.sizeBytes : prev.sizeBytes,
       ...prev.wasTruncated || f.wasTruncated ? { wasTruncated: true } : {},
-      ...mergedSymbols.length > 0 ? { symbols_read: mergedSymbols } : {}
+      ...mergedSymbols.length > 0 ? { symbols_read: mergedSymbols } : {},
+      ...epochBase !== void 0 ? { epochBase } : {}
     });
   }
   return Array.from(byPath.values());
@@ -552,10 +294,10 @@ function buildManifestParts(sessionId, cwd, transcriptPath) {
   for (const { entries, section } of fileSections) {
     const count = fit.shown[sections.indexOf(section)] ?? 0;
     for (const entry of entries.slice(0, count)) {
-      const path2 = displaySafePath(entry.path);
-      if (seen.has(path2)) continue;
-      seen.add(path2);
-      printed.push(path2);
+      const path = displaySafePath(entry.path);
+      if (seen.has(path)) continue;
+      seen.add(path);
+      printed.push(path);
     }
   }
   return { text: fit.text, printed };
@@ -630,6 +372,11 @@ function notesSection(notes) {
   }
   return { header: ["", ...lines.slice(0, open + 1)], rows, footer: lines.slice(close), priority: 2, maxRows: MAX_ROWS };
 }
+function readIsSuperseded(f) {
+  const { reads, fullReads } = epochReadCounts(f);
+  if (wasEditedSinceCompaction(f)) return fullReads > 0;
+  return fullReads > 1 || reads > 1 && fullReads > 0 && f.lastFullReadAt !== void 0 && f.lastFullReadAt >= f.lastReadAt;
+}
 function buildSafeToDiscardSection(files) {
   const rerunHashes = getSessionBashReruns();
   const bashOutputs = getSessionBashOutputs();
@@ -645,8 +392,8 @@ function buildSafeToDiscardSection(files) {
   }
   const supersededReadRows = [];
   for (const f of files) {
-    if (f.readCount > 1 || f.wasEdited && f.readCount > 0) {
-      const reason = f.wasEdited ? "edited after being read" : "re-read " + f.readCount + "x";
+    if (readIsSuperseded(f)) {
+      const reason = wasEditedSinceCompaction(f) ? "edited after being read" : "re-read " + epochReadCounts(f).reads + "x";
       supersededReadRows.push("- " + displaySafePath(f.path) + " (" + reason + " \u2014 only the latest content already in context is current)");
     }
   }
@@ -673,14 +420,14 @@ function buildSafeToDiscardSection(files) {
   }
   return sections;
 }
-function buildMemEpochSection() {
+function buildMemEpochSection(timeoutMs = MEM_EPOCH_TIMEOUT_MS) {
   let result;
   try {
     const resolved = resolveOnPath("mem");
     if (resolved === null) return [];
     result = spawnResolvedSync(resolved, ["epoch"], {
       encoding: "utf-8",
-      timeout: MEM_EPOCH_TIMEOUT_MS,
+      timeout: timeoutMs,
       windowsHide: true
     });
   } catch {
@@ -705,8 +452,8 @@ function summaryBudgetDirective(budgetChars) {
 
 // src/compact_dropped.ts
 init_define_import_meta_env();
-import { readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 var DROPPED_SUFFIX = ".compact-dropped";
 function recordCompactDroppedPaths(stateKey, paths) {
   const target = sessionSidecarPath(stateKey, DROPPED_SUFFIX);
@@ -716,7 +463,7 @@ function recordCompactDroppedPaths(stateKey, paths) {
       rmSync(target, { force: true });
       return;
     }
-    ensureDirSync(dirname2(target));
+    ensureDirSync(dirname(target));
     writeFileSync(target, JSON.stringify(paths), "utf8");
   } catch {
   }
@@ -725,7 +472,7 @@ function readCompactDroppedPaths(stateKey) {
   const target = sessionSidecarPath(stateKey, DROPPED_SUFFIX);
   if (target === null) return [];
   try {
-    const parsed = JSON.parse(readFileSync2(target, "utf8"));
+    const parsed = JSON.parse(readFileSync(target, "utf8"));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string" && p !== "") : [];
   } catch {
     return [];
@@ -738,17 +485,6 @@ export {
   getWebOutput,
   getWebOutputRaw,
   getWebOutputByUrlFromDisk,
-  MAX_ENTRIES,
-  anchorLabel,
-  anchorLine,
-  loadEntries,
-  loadDatedEntries,
-  noteAgeLabel,
-  oneLineNoteValue,
-  setEntry,
-  unsetEntry,
-  clearAll,
-  projectNotesFor,
   renderWebFetchRows,
   manifestPrintedPaths,
   buildManifest,

package/dist/token-goat-chunk-M3LFJDPU.mjs

@@ -0,0 +1,58 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  getDb,
+  pathEqClause
+} from "./token-goat-chunk-GVB2MUST.mjs";
+import {
+  findProject
+} from "./token-goat-chunk-4GBVPH3D.mjs";
+import {
+  canonicalize,
+  foldPath
+} from "./token-goat-chunk-AM5V6GSX.mjs";
+import {
+  normalizePath
+} from "./token-goat-chunk-FNFBKLRD.mjs";
+import {
+  globalDbPath
+} from "./token-goat-chunk-CO3UYX6G.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/indexed_roots.ts
+init_define_import_meta_env();
+import * as path from "node:path";
+function indexedRootOf(dir) {
+  const project = findProject(dir);
+  if (project !== null) return normalizePath(project.root);
+  try {
+    return normalizePath(canonicalize(path.resolve(dir)));
+  } catch {
+    return null;
+  }
+}
+function recordIndexedRoot(dir, dbPath = globalDbPath()) {
+  try {
+    const root = indexedRootOf(dir);
+    if (root === null) return;
+    getDb(dbPath).prepare("INSERT INTO indexed_roots (root, indexed_ms) VALUES (?, ?) ON CONFLICT(root) DO UPDATE SET indexed_ms = excluded.indexed_ms").run(root, Date.now());
+  } catch {
+  }
+}
+function isIndexedRoot(dir, dbPath = globalDbPath()) {
+  if (dir === void 0) return false;
+  try {
+    const root = indexedRootOf(dir);
+    if (root === null) return false;
+    return getDb(dbPath).prepare(`SELECT 1 FROM indexed_roots WHERE ${pathEqClause("root")} LIMIT 1`).get(foldPath(root)) !== void 0;
+  } catch {
+    return false;
+  }
+}
+
+export {
+  recordIndexedRoot,
+  isIndexedRoot
+};

package/dist/token-goat-chunk-M52KPT3C.mjs

@@ -0,0 +1,87 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  fenceUntrusted,
+  fenceWithMatches
+} from "./token-goat-chunk-4NAPX7BA.mjs";
+import {
+  estimateTokens,
+  trimToBudget
+} from "./token-goat-chunk-BFCWY73P.mjs";
+import {
+  GUARD_UNITS_PER_TOKEN,
+  guardUnits
+} from "./token-goat-chunk-XX6O25RN.mjs";
+import {
+  redactSecrets
+} from "./token-goat-chunk-T5P5ACNQ.mjs";
+import {
+  loadConfig
+} from "./token-goat-chunk-7EZTZOMC.mjs";
+import {
+  UNTRUSTED_FILE_TAG,
+  scanForInjectionPatterns
+} from "./token-goat-chunk-FNFBKLRD.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/fence_cap.ts
+init_define_import_meta_env();
+function guardThenFence(text, command, tag) {
+  const cfg = loadConfig();
+  if (!cfg.overflow_guard.enabled) return fenceUntrusted(text, tag);
+  const budget = cfg.overflow_guard.max_tokens;
+  let capped = trimToBudget(text, budget, command);
+  let reserve = 0;
+  for (let pass = 0; pass < 8; pass++) {
+    const excess = estimateTokens(fenceThenMarker(capped, text, (body) => fenceWithMatches(body, scanUnrecorded(body), tag))) - budget;
+    if (excess <= 0) break;
+    reserve += excess;
+    capped = trimToBudget(text, budget, command, { reserveTokens: reserve });
+  }
+  return fenceThenMarker(capped, text, (body) => fenceUntrusted(body, tag));
+}
+function fenceThenMarker(capped, text, fence) {
+  if (capped === text) return fence(text);
+  const markerAt = capped.lastIndexOf("\n");
+  return `${fence(capped.slice(0, markerAt))}
+${capped.slice(markerAt + 1)}`;
+}
+function scanUnrecorded(text) {
+  try {
+    return scanForInjectionPatterns(text);
+  } catch {
+    return [];
+  }
+}
+function guardRedactAndFence(text, command, tag) {
+  return guardThenFence(redactSecrets(text).text, command, tag);
+}
+function guardAndFenceFileText(text, command) {
+  return guardRedactAndFence(text, command, UNTRUSTED_FILE_TAG);
+}
+function capListField(obj, key, render) {
+  const full = render(obj);
+  const cfg = loadConfig();
+  if (!cfg.overflow_guard.enabled) return full;
+  const budget = cfg.overflow_guard.max_tokens * GUARD_UNITS_PER_TOKEN;
+  const items = obj[key];
+  if (guardUnits(full) <= budget || items.length <= 1) return full;
+  const cut = (kept) => render({ ...obj, [key]: items.slice(0, kept), truncated: true, totalCount: items.length });
+  let lo = 1;
+  let hi = items.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (guardUnits(cut(mid)) <= budget) lo = mid;
+    else hi = mid - 1;
+  }
+  return cut(lo);
+}
+
+export {
+  guardThenFence,
+  guardRedactAndFence,
+  guardAndFenceFileText,
+  capListField
+};