token-goat 2.9.4 → 2.9.6

package/dist/{token-goat-chunk-6MU6FHE3.mjs → token-goat-chunk-J7LGMKF3.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-US57I7GN.mjs";
+} from "./token-goat-chunk-46VKOCUH.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
@@ -108,7 +108,7 @@ import {
   runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-FSC44QOH.mjs";
+} from "./token-goat-chunk-7GJBID7S.mjs";
 import {
   AGENT_SALT_MARKER,
   BASH_OUTPUT_SUBDIR,
@@ -121,9 +121,6 @@ import {
   SESSIONS_SUBDIR,
   SKILLS_OUTPUT_SUBDIR,
   SKIP_DIRS,
-  UNTRUSTED_FILE_TAG,
-  UNTRUSTED_TOOL_TAG,
-  UNTRUSTED_WEB_TAG,
   WORKER_HEARTBEAT_STALE_MS,
   WorkerAlreadyRunningError,
   applyIndexingPriority,
@@ -154,8 +151,6 @@ import {
   extractCompactFromMarker,
   extractNamedSection,
   fenceUntrusted,
-  fenceUntrustedContent,
-  fenceUntrustedOcrText,
   findClaudeMdFiles,
   findContentDuplicates,
   findLatestSessionId,
@@ -240,7 +235,7 @@ import {
   visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-CBO45DYZ.mjs";
+} from "./token-goat-chunk-3HJQR4OO.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -249,11 +244,15 @@ import {
   FILTERS,
   LOCK_WAIT_MS_HARDENED,
   MATERIALIZE_SHRUNK_IMAGE_JS,
+  PACKAGE_NAME,
   PROJECT_LOCKED_KEYS,
   PROJECT_LOCKED_SECTIONS,
   RESET,
   TOOL_FILTERS,
   ToolFilter,
+  UNTRUSTED_FILE_TAG,
+  UNTRUSTED_TOOL_TAG,
+  UNTRUSTED_WEB_TAG,
   VERSION,
   _useRichStats,
   anchoredMarkerPattern,
@@ -283,6 +282,8 @@ import {
   envBool,
   escapeRegExp,
   extractErrorMessage,
+  fenceUntrustedContent,
+  fenceUntrustedOcrText,
   fg,
   fileIsAbsent,
   findProject,
@@ -337,6 +338,7 @@ import {
   requirePositiveStrictInt,
   resolveConfigKeyLayer,
   resolveIndexPath,
+  resolveOnPath,
   resolveProjectRoot,
   runGit,
   safeSlice,
@@ -366,7 +368,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-3ZR4NLB3.mjs";
+} from "./token-goat-chunk-T2OE7MYM.mjs";
 import {
   __export,
   init_define_import_meta_env
@@ -5952,6 +5954,7 @@ function statsJsonPayload(summary) {
     by_command: summary.by_command,
     by_source: summary.by_source,
     by_harness: summary.by_harness,
+    by_pricing_version: summary.by_pricing_version,
     counts: summary.counts,
     window_days: summary.window_days
   };
@@ -5989,7 +5992,7 @@ init_define_import_meta_env();
 import * as fs12 from "fs";
 import * as os8 from "os";
 import * as path12 from "path";
-import { execSync, spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 function globalMcpConfigPath() {
   const copilotHome = process.env["COPILOT_HOME"];
   const root = copilotHome !== void 0 && copilotHome.trim() !== "" ? path12.resolve(copilotHome) : path12.join(os8.homedir(), ".copilot");
@@ -6076,12 +6079,16 @@ function checkMcpProcessHealth(processes) {
 }
 function runProcessListCommand() {
   const command = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress";
-  return execSync(`powershell.exe -NoProfile -NonInteractive -Command "${command}"`, {
+  const systemRoot = process.env["SystemRoot"] ?? process.env["windir"] ?? "C:\\Windows";
+  const shell = path12.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const result = spawnSync2(fs12.existsSync(shell) ? shell : "powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], {
     encoding: "utf8",
     timeout: 2e4,
     maxBuffer: 10 * 1024 * 1024,
     windowsHide: true
   });
+  if (result.error !== void 0) throw result.error;
+  return result.stdout ?? "";
 }
 function readWindowsProcesses(runCommand = runProcessListCommand) {
   if (process.platform !== "win32") return [];
@@ -6286,20 +6293,14 @@ function checkDirtyQueueHealth(dataDir2) {
   return { name: "Dirty queue", status: "ok", message: `${pendingCount} file(s) pending, worker actively draining` };
 }
 function checkInstall() {
-  try {
-    const output = execSync("token-goat --version", { encoding: "utf-8" });
-    return {
-      name: "Installation",
-      status: "ok",
-      message: output.trim()
-    };
-  } catch {
-    return {
-      name: "Installation",
-      status: "fail",
-      message: "token-goat command not found; run: npm install -g token-goat-ts"
-    };
+  const resolved = resolveOnPath("token-goat");
+  if (resolved !== null) {
+    const isBatch = /\.(?:cmd|bat)$/i.test(resolved);
+    const comspec = path12.join(process.env["SystemRoot"] ?? process.env["windir"] ?? "C:\\Windows", "System32", "cmd.exe");
+    const result = isBatch ? spawnSync2(fs12.existsSync(comspec) ? comspec : "cmd.exe", ["/d", "/s", "/c", resolved, "--version"], { encoding: "utf-8", timeout: 15e3, windowsHide: true }) : spawnSync2(resolved, ["--version"], { encoding: "utf-8", timeout: 15e3, windowsHide: true });
+    if (result.status === 0) return { name: "Installation", status: "ok", message: (result.stdout ?? "").trim() };
   }
+  return { name: "Installation", status: "fail", message: `token-goat command not found; run: npm install -g ${PACKAGE_NAME}` };
 }
 function checkTsCompiler() {
   if (isAvailable2()) {
@@ -6488,7 +6489,9 @@ var LOCKED_BOOLEAN_SAFE_VALUE = {
   "screenshot.block_private_targets": true,
   "network.offline": true,
   "indexing.cross_project_symbols": false,
-  "hints.fold_code_bodies": false,
+  // `hints.fold_code_bodies` is deliberately absent for the same reason as `hints.fold_prose_paragraphs` below: it now ships on. Its cost was the thing keeping it off, and that cost is now measured rather than assumed -- 6.6 points of recovery reads beyond what the same symbols draw anyway, against a fold that withholds a whole function body. It remains project-locked, so the environment deciding it is still reported by the value-replacement arm.
+  // `hints.fold_prose_paragraphs` is deliberately absent: it now ships on, so neither direction is a weakening. Setting it true restates the shipped default, and setting it false shows the reader MORE of a document, so warning on either would break this file's own rule that a default install stays quiet. It remains project-locked, so the environment deciding it is still worth reporting, which is what the value-replacement arm below does.
+  // The three remaining hints keys, fold_comment_blocks and outline_large_documents and skeleton_large_sources, are absent for exactly the same reason and just as deliberately: each ships on, so neither direction of an override is a weakening, and a false entry here would make a default install warn about itself. All three stay project-locked, so the environment deciding one is still reported by the value-replacement arm below.
   "webfetch.compress_bodies": true
 };
 function lockedEnvOverridableKeys() {
@@ -6555,9 +6558,15 @@ function checkSecurityPosture(cfg, dataDirPath) {
     cfg.mcp.confine_reads_to_project_root ? {
       name: "Security mcp roots",
       status: "ok",
-      message: extraRoots === 0 ? "reads are confined to the project root" : `reads are confined to the project root plus ${extraRoots} configured root${extraRoots === 1 ? "" : "s"}`
+      // Two separate controls, and reporting only the first read as a guarantee about the second. `confine_reads_to_project_root` keeps a read inside the root the caller named; `mcp.allowed_roots` decides which roots may be named at all, and empty means any of them (assertRootAllowed returns early). Saying "confined to the project root" while the caller picks that root overstates the confinement, so the empty case now names itself.
+      message: extraRoots === 0 ? "reads are confined to the project root the caller names, but mcp.allowed_roots is empty, so an MCP caller may name any root on this machine" : `reads are confined to the project root, and callers may name only the ${extraRoots} root${extraRoots === 1 ? "" : "s"} in mcp.allowed_roots`
     } : { name: "Security mcp roots", status: "warn", message: "confinement is off (mcp.confine_reads_to_project_root): a read can leave the project" }
   );
+  results.push({
+    name: "Security symbol scope",
+    status: "ok",
+    message: cfg.indexing.cross_project_symbols ? "symbol lookups can resolve into other projects in the machine-wide index (indexing.cross_project_symbols = false confines them to this project)" : "symbol lookups are confined to this project"
+  });
   const overridden = envOverriddenSecuritySettings();
   const weakened = overridden.filter((o) => o.kind === "weakened");
   const replaced = overridden.filter((o) => o.kind === "replaced");
@@ -14093,15 +14102,15 @@ var READ_DIVERT_MARKER_RE = /(?:was already read this session|Already read |You'
 var READ_DIVERT_MAX_BYTES = 2500;
 var READ_FULL_SERVE_MIN_BYTES = 10240;
 var DENY_TEMPLATES = [
-  { kind: "node_modules_deny", re: /node_modules is typically noise/ },
-  { kind: "lock_file_deny", re: /Lock files are rarely useful to read in full/ },
-  { kind: "tsbuildinfo_deny", re: /TypeScript incremental build cache file/ },
-  { kind: "generated_build_deny", re: /Generated\/build artifact — read the source file instead\./ },
-  { kind: "compact_sidecar_served", re: /Serving the extractive compact sidecar in place of the full file/ },
-  { kind: "notebook_sidecar_served", re: /Serving the output-stripped notebook in place of the full file/ },
+  { kind: "node_modules_deny", re: /node_modules is typically noise/, tool: "Read" },
+  { kind: "lock_file_deny", re: /Lock files are rarely useful to read in full/, tool: "Read" },
+  { kind: "tsbuildinfo_deny", re: /TypeScript incremental build cache file/, tool: "Read" },
+  { kind: "generated_build_deny", re: /Generated\/build artifact — read the source file instead\./, tool: "Read" },
+  { kind: "compact_sidecar_served", re: /Serving the extractive compact sidecar in place of the full file/, tool: "Read" },
+  { kind: "notebook_sidecar_served", re: /Serving the output-stripped notebook in place of the full file/, tool: "Read" },
   // Must stay ABOVE markdown_heading_tree_deny: this deny's message embeds the same "Large markdown file (N headings)" guidance block, so the generic alternative would swallow it and the new intervention would be uncountable. DENY_TEMPLATES is scanned with `.find`, so the more specific wording has to come first.
-  { kind: "subagent_markdown_first_read_deny", re: /Subagent first read of a large markdown file/ },
-  { kind: "markdown_heading_tree_deny", re: /Large markdown file \(\d+ headings\)/ },
+  { kind: "subagent_markdown_first_read_deny", re: /Subagent first read of a large markdown file/, tool: "Read" },
+  { kind: "markdown_heading_tree_deny", re: /Large markdown file \(\d+ headings\)/, tool: "Read" },
   // The first alternative is a wording hooks_read.ts no longer emits (it claimed a compact-manifest
   // section that never existed, reworded in 3d044feb). It stays because this table classifies a
   // historical corpus, not just today's output: transcripts written before the rewording still
@@ -14109,24 +14118,32 @@ var DENY_TEMPLATES = [
   // 30 -- 41% of its history -- with a green suite. A superseded alternative is only removable
   // once no transcript contains it, which source code cannot tell you. See the superseded-wording
   // test in tests/deny_outcomes.test.ts.
-  { kind: "memory_md_reread_deny", re: /MEMORY\.md was read this session\. Its content is in the compact manifest|already read this session\. Memory files rarely change mid-session/ },
-  { kind: "improve_state_reread_deny", re: /Orchestrator state already read this session/ },
-  { kind: "env_reread_deny", re: /Environment files rarely change mid-session/ },
-  { kind: "session_artifact_truncated_deny", re: /File was truncated on last read\. Use `token-goat bash-output/ },
-  { kind: "session_artifact_unchanged_deny", re: /is unchanged since last read\. Use `token-goat bash-output/ },
-  { kind: "session_artifact_diff_deny", re: /Content changed since last read of [\s\S]*?bash-output --file/ },
-  { kind: "session_artifact_large_deny", re: /(?:Session transcript|Tool-result file) is large \(/ },
-  { kind: "session_artifact_generic_reread_deny", re: /already read this session\. Use `token-goat bash-output --file/ },
-  { kind: "truncated_read_deny", re: /File was truncated on last read \(>33K tokens\)/ },
-  { kind: "doc_unchanged_deny", re: /is unchanged since last read\. Use `token-goat (?:section|read)/ },
-  { kind: "doc_diff_deny", re: /Content changed since last read of [\s\S]*?Use `token-goat (?:section|read)/ },
-  { kind: "read_served_deny", re: /was already served in this session, byte for byte/ },
-  { kind: "markdown_already_read_deny", re: /Markdown file already read this session\. Use `token-goat section/ },
-  { kind: "read_count_deny", re: /Read this file \d+ times already/ },
-  { kind: "generic_reread_deny", re: /was already read this session \(\d+ read/ },
-  { kind: "large_file_deny", re: /is very large \(\d+(?:\.\d+)?KB\)\./ },
-  { kind: "file_type_handler_deny", re: /too large to preview \(exceeds the in-hook scan cap\)|cannot be read as text\.|Read cannot return spreadsheet content|Read cannot return slide content|Read cannot return document content|Use Read with offset and limit parameters to read specific line ranges/ }
+  { kind: "memory_md_reread_deny", re: /MEMORY\.md was read this session\. Its content is in the compact manifest|already read this session\. Memory files rarely change mid-session/, tool: "Read" },
+  { kind: "improve_state_reread_deny", re: /Orchestrator state already read this session/, tool: "Read" },
+  { kind: "env_reread_deny", re: /Environment files rarely change mid-session/, tool: "Read" },
+  { kind: "session_artifact_truncated_deny", re: /File was truncated on last read\. Use `token-goat bash-output/, tool: "Read" },
+  { kind: "session_artifact_unchanged_deny", re: /is unchanged since last read\. Use `token-goat bash-output/, tool: "Read" },
+  { kind: "session_artifact_diff_deny", re: /Content changed since last read of [\s\S]*?bash-output --file/, tool: "Read" },
+  { kind: "session_artifact_large_deny", re: /(?:Session transcript|Tool-result file) is large \(/, tool: "Read" },
+  { kind: "session_artifact_generic_reread_deny", re: /already read this session\. Use `token-goat bash-output --file/, tool: "Read" },
+  { kind: "truncated_read_deny", re: /File was truncated on last read \(>33K tokens\)/, tool: "Read" },
+  { kind: "doc_unchanged_deny", re: /is unchanged since last read\. Use `token-goat (?:section|read)/, tool: "Read" },
+  { kind: "doc_diff_deny", re: /Content changed since last read of [\s\S]*?Use `token-goat (?:section|read)/, tool: "Read" },
+  { kind: "read_served_deny", re: /was already served in this session, byte for byte/, tool: "Read" },
+  { kind: "markdown_already_read_deny", re: /Markdown file already read this session\. Use `token-goat section/, tool: "Read" },
+  { kind: "read_count_deny", re: /Read this file \d+ times already/, tool: "Read" },
+  { kind: "generic_reread_deny", re: /was already read this session \(\d+ read/, tool: "Read" },
+  { kind: "large_file_deny", re: /is very large \(\d+(?:\.\d+)?KB\)\./, tool: "Read" },
+  { kind: "file_type_handler_deny", re: /too large to preview \(exceeds the in-hook scan cap\)|cannot be read as text\.|Read cannot return spreadsheet content|Read cannot return slide content|Read cannot return document content|Use Read with offset and limit parameters to read specific line ranges/, tool: "Read" },
+  // Skill-tool denies from src/hooks_skill.ts's preSkillHandler -- kind names prefixed skill_ so they read as a family, distinct from the Read-deny kinds above. The two heading-tree wordings share the prose around them ("...its heading tree...instead of the full body. Use `token-goat skill-section NAME '<heading>'`...") but each anchors on an infix the other never emits -- truncated always says "shows N of M headings below" (no "inlined"), complete always says "(N headings) is inlined below" (no "shows") -- so neither regex can match the other's text; skill_heading_tree_truncated_deny is still listed first on the same specific-before-generic principle as markdown_heading_tree_deny above, in case a future rewording narrows the gap.
+  { kind: "skill_already_loaded_deny", re: /was already loaded this session and is cached/, tool: "Skill" },
+  { kind: "skill_compact_slice_deny", re: /has a compact slice available/, tool: "Skill" },
+  // The compact slice has two outcomes and they are separate kinds because they cost different things: the pointer above withholds the slice behind a command, this one inlines the slice and withholds only the rest of the body. Its "(N bytes) is inlined below" cannot collide with the heading-tree wording below, which requires "heading tree (N headings) is inlined below".
+  { kind: "skill_compact_slice_inlined_deny", re: /compact slice \(\d+ bytes\) is inlined below instead of the full body/, tool: "Skill" },
+  { kind: "skill_heading_tree_truncated_deny", re: /heading tree shows \d+ of \d+ headings below instead of the full body/, tool: "Skill" },
+  { kind: "skill_heading_tree_complete_deny", re: /heading tree \(\d+ headings\) is inlined below instead of the full body/, tool: "Skill" }
 ];
+var DENY_TEMPLATE_KINDS = DENY_TEMPLATES.map((t) => t.kind);
 var DENY_KINDS_WITH_SIZE = /* @__PURE__ */ new Set(["large_file_deny", "session_artifact_large_deny", "file_type_handler_deny"]);
 var DENY_SIZE_RE = /(\d+(?:\.\d+)?)\s*(B|KB|MB|GB|TB)\b/;
 function parseWithheldBytes(kind, text) {
@@ -14396,9 +14413,8 @@ async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneOb
             s.editErrorBaseline.totalErrors += 1;
             editErrorById.set(id, true);
           }
-          if (name === "Read") {
-            s.readInterception.readResults += 1;
-            const denyTemplate = DENY_TEMPLATES.find((t) => t.re.test(text));
+          if (name === "Read" || name === "Skill") {
+            const denyTemplate = DENY_TEMPLATES.find((t) => t.tool === name && t.re.test(text));
             if (denyTemplate !== void 0) {
               const path31 = readPathById.get(id) ?? "";
               const lastSlash = path31.lastIndexOf("/");
@@ -14413,6 +14429,9 @@ async function auditOneFile(filePath, s, toolMap, attachmentMap, hookMap, laneOb
                 toolCalls: []
               });
             }
+          }
+          if (name === "Read") {
+            s.readInterception.readResults += 1;
             if (bytes < READ_DIVERT_MAX_BYTES && READ_DIVERT_MARKER_RE.test(text)) {
               s.readInterception.divertedByMarker += 1;
               s.readInterception.divertedBytes += bytes;
@@ -14942,7 +14961,7 @@ function analyzeMcpCache() {
     const metrics = serverMetrics.get(toolName);
     metrics.callCount += 1;
     metrics.totalBytes += sizeBytes;
-    metrics.perCallEstimate = Math.floor(metrics.totalBytes / metrics.callCount / 3) + 1;
+    metrics.perCallEstimate = estimateTokensFromLength(metrics.totalBytes / metrics.callCount);
   }
   return serverMetrics;
 }
@@ -15711,7 +15730,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-OZAEJQ7L.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-C7LLUVUT.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-EVC4TOLE.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -15736,7 +15755,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-EQKNR7CN.mjs");
+  const { relay } = await import("./token-goat-chunk-TX64YIIV.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -16278,23 +16297,22 @@ async function cmdPdfLocate(file, pattern, opts) {
   if (opts.maxMatches !== void 0) locateOpts.maxMatches = requirePositiveInt("--max-matches", opts.maxMatches);
   if (opts.context !== void 0) locateOpts.context = requirePositiveInt("--context", opts.context);
   if (opts.pages !== void 0) locateOpts.pages = opts.pages;
-  const matches2 = await runPdfLocate(file, pattern, locateOpts);
+  const { matches: matches2, truncated } = await runPdfLocate(file, pattern, locateOpts);
   const pages = matches2.map((m) => m.page);
   let printed;
   if (opts.json === true) {
     const fencedMatches = matches2.map((m) => ({ ...m, snippet: fenceFileFieldIfMatched(m.snippet) }));
-    printed = JSON.stringify({ file, pattern, matchCount: fencedMatches.length, pages, matches: fencedMatches }, null, 2);
+    printed = JSON.stringify({ file, pattern, matchCount: fencedMatches.length, truncated, pages, matches: fencedMatches }, null, 2);
     out(printed);
   } else if (matches2.length === 0) {
     printed = "(no matches)";
     out(printed);
   } else {
     const lines = matches2.map((m) => `p${m.page}: ${m.snippet}`);
-    printed = fenceFileText(
-      `${lines.join("\n")}
+    const summary = truncated ? `at least ${countNoun(matches2.length, "match", "matches")} across at least ${countNoun(pages.length, "page")}; scan stopped at --max-matches, raise it for more` : `${countNoun(matches2.length, "match", "matches")} across ${countNoun(pages.length, "page")}`;
+    printed = fenceFileText(`${lines.join("\n")}
 
-${countNoun(matches2.length, "match", "matches")} across ${countNoun(pages.length, "page")}`
-    );
+${summary}`);
     out(printed);
   }
   const fullSourceBytes = fileSizeOrZero(file);
@@ -16670,7 +16688,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-5BHXZEOI.mjs");
+    const bashRunner = await import("./token-goat-chunk-UJORWTI4.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;

package/dist/{token-goat-chunk-EPX5DWGM.mjs → token-goat-chunk-LXIC7MTW.mjs}

@@ -2,7 +2,7 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   detectHarness
-} from "./token-goat-chunk-3ZR4NLB3.mjs";
+} from "./token-goat-chunk-T2OE7MYM.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -78,6 +78,7 @@ function canRunWrappedShell() {
 }
 
 export {
+  bashOutputCapBytes,
   deliveredOutputBytes,
   wrappedShell,
   canRunWrappedShell