token-goat 2.9.6 → 2.9.8

package/README.md

@@ -129,7 +129,7 @@ The fastest way to reduce AI token costs is fixing these five, not writing short
 | `claude-in-chrome`'s `computer`/`browser_batch` return a raw, full-resolution base64 screenshot in-band, with no destination-file option to redirect through image-shrink | Inline screenshot blocks are shrunk via the same image-shrink pipeline in place, and a repeated `Tab Context:` listing (appended to nearly every call, often unchanged) collapses to a placeholder once seen unchanged this session |
 | Agent tool spawns a subagent with no orientation and no reuse hints | A `PreToolUse` handler appends a compact briefing pack to the prompt: a one-line project-map summary, 2-3 recent cached-output IDs, and a surgical-read reminder (~300 tokens) |
 | Subagent's own final report runs long and gets discarded once the parent moves on | Agent tool results ≥8000 characters get a recall pointer appended (`token-goat recall`); the original report always reaches the parent untouched |
-| Agent tool spawns with no `subagent_type` (or an explicit `general-purpose`), so the lane starts by paying for every tool and MCP schema on the machine | Once per session, a `PostToolUse` advisory names up to three `tools:`-restricted agent definitions found in `~/.claude/agents` and suggests passing one as `subagent_type` on a future spawn that fits. It fires only when at least one restricted definition exists, states outright that the observed spawn already ran and nothing was saved, and records a zero-credit stat |
+| Agent tool spawns with no `subagent_type` (or an explicit `general-purpose`), so the lane starts by paying for every tool and MCP schema on the machine | Once per session, a `PostToolUse` advisory names up to three `tools:`-restricted agent definitions found in `~/.claude/agents` or the current project's `.claude/agents` and suggests passing one as `subagent_type` on a future spawn that fits. It fires only when at least one restricted definition exists, states outright that the observed spawn already ran and nothing was saved, and records a zero-credit stat |
 | Large MCP tool result (≥2 KB) is a homogeneous array of objects, e.g. a list/search result | Deterministic structural compression: table-ified into one header row + tab-delimited rows, with columns constant across every row hoisted into a single `constant:` line instead of repeated per row; only applied when it saves ≥15%. Full original always recoverable via `token-goat bash-output <id>` (labeled `[token-goat: compressed, full via mcp-output <id>]`). Disable with `TOKEN_GOAT_MCP_COMPRESS=0` |
 | Large MCP tool result (≥2 KB) doesn't table-ify (an object-rooted config dump, a single-resource response, a nested settings tree) but most of its bytes are `null`/`""`/`[]`/`{}` | Deterministic empty-value pruning: recursively drops those four empty shapes to a fixed point (a container left empty by its own dropped children is dropped too) and renders the remainder as compact JSON with a trailing `dropped N empty value(s) (null, "", [], {})` summary line; `0` and `false` are never dropped; only applied when it saves ≥15%. Same full-recovery-by-id guarantee and `TOKEN_GOAT_MCP_COMPRESS=0` opt-out as the table pass |
 | GitHub MCP tool result (`list_pull_requests`, `list_issues`, `search_code`, `get_file_contents`, `pull_request_read`, …) carries dozens of boilerplate fields per object | GitHub compression pack strips `_links`, `node_id`, `gravatar_id`, `site_admin`, and every `*_url` field (`avatar_url`, `html_url`, `events_url`, `gists_url`, `followers_url`, …) except `download_url`/`git_url`/`clone_url`/`ssh_url`, before handing the shrunk JSON to the same table-ifying pass — same `TOKEN_GOAT_MCP_COMPRESS=0` opt-out and full-recovery-by-id guarantee |
@@ -169,6 +169,9 @@ The fastest way to reduce AI token costs is fixing these five, not writing short
 | Fetched web content lands raw in model context | Always wrapped in an untrusted-content fence; scanned for attack patterns, and a matched pattern name is written to the log and into the fence's notice |
 | Chatty log repeats the same error or event thousands of times | `token-goat logfold` collapses consecutive duplicates to `[Nx]` counts; same event logged with different timestamps or request IDs folds correctly — ~90–95% smaller on repetitive logs |
 | Reading poetry.lock or package-lock.json to find a pinned version | `token-goat lockdeps` returns a name/version table of direct dependencies; optional packages and transitive entries excluded |
+| Large SVG / diagram file (≥8 KB) read in full | Coordinate path flooding blocked; extracted layer/group IDs and title shown; redirects to `token-goat xml-outline` and `xml-query` |
+| Broad recursive Glob sweep (`*`, `**/*`) on root directory | Pre-Glob hook warns against tree-dumping and points at `token-goat map --compact` for fast, lightweight structure inspection |
+| Compound test/build pipeline (`npm run build && npm run typecheck && npm test`) | Post-Bash hook routes chained build/test/lint commands to `generic-ci` compression, dropping verbose passing steps and compiler noise |
 
 On a per-token API plan, 100K wasted tokens per session runs about $0.30. Five sessions a week is ~$450/year. AI coding cost reduction at that scale comes from fixing the waste, not from using the product less. Token-goat is free. And on subscription plans, it can result in limits feeling 10x higher.
 
@@ -422,7 +425,7 @@ never drift on where `mcp.json` lives or what key name it looks for.
 
 **What the index actually holds, in plain terms.** The point of a surgical read is returning a function body without the file around it, which means the database stores those bodies. `symbols.body` holds the source text of every indexed symbol, `symbols.docstring` its doc comment, `refs.context` the line around each reference, and `chunks.text` the passages that semantic search embeds. There is also a full-text index over the bodies and docstrings. So the database is not a list of names and line numbers: it is a substantial copy of your source, sitting in a plain unencrypted SQLite file outside the repository.
 
-The file-by-file table for each harness, and the path that file sits at: **[What gets installed](docs/install.md#what-gets-installed)**.
+The file-by-file table for each harness, and the path that file sits at: **[What gets installed](docs/install.md#what-gets-installed)** (see also **[Permissions & auto-approval](docs/install.md#command-auto-approval-and-permissions)**).
 
 ## Zero maintenance
 

package/dist/{token-goat-chunk-J7LGMKF3.mjs → token-goat-chunk-2SBHUPBF.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-46VKOCUH.mjs";
+} from "./token-goat-chunk-6RAUVAKW.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
@@ -108,7 +108,7 @@ import {
   runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-7GJBID7S.mjs";
+} from "./token-goat-chunk-VEEHPNBV.mjs";
 import {
   AGENT_SALT_MARKER,
   BASH_OUTPUT_SUBDIR,
@@ -190,6 +190,7 @@ import {
   isParseSkipEligible,
   isRecallCacheType,
   isSuppressionCategory,
+  isTreeSitterAvailable,
   isWorkerRunning,
   listBlobs,
   listOutputs,
@@ -230,12 +231,14 @@ import {
   storeCompact,
   storeOutput,
   tokenGoatHome,
+  treeSitterCoreAvailable,
+  treeSitterCoreLoadError,
   trimToBudget,
   urlPolicyDenialReason,
   visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-TXZY7C24.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -346,6 +349,7 @@ import {
   savedTokensFromBytes,
   sleepSync,
   stripAnsi,
+  stripLower,
   stripOwnHooksFromMap,
   stripStaleGroupHooks,
   suggestPackageNames,
@@ -368,7 +372,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-JZYJH76S.mjs";
 import {
   __export,
   init_define_import_meta_env
@@ -6313,6 +6317,29 @@ function checkTsCompiler() {
     message: err2 !== null ? `unavailable: ${extractErrorMessage(err2)}` : "unavailable (not attempted)"
   };
 }
+var TREE_SITTER_LANGUAGES = ["typescript", "javascript", "python", "go", "rust", "ruby", "java", "c", "cpp"];
+function checkTreeSitter() {
+  const name = "Tree-sitter";
+  if (!treeSitterCoreAvailable()) {
+    const err2 = treeSitterCoreLoadError();
+    const cause = err2 !== null ? `: ${extractErrorMessage(err2)}` : " (not attempted)";
+    return {
+      name,
+      status: "warn",
+      message: "unavailable -- the source skeleton fold, the code body fold's disk-parse fallback, and tree-sitter indexing are all disabled; likely cause: the optional native dependency `tree-sitter` is not installed, or is not resolvable from the bundle's location" + cause
+    };
+  }
+  const available = TREE_SITTER_LANGUAGES.filter((lang) => isTreeSitterAvailable(lang));
+  if (available.length === TREE_SITTER_LANGUAGES.length) {
+    return { name, status: "ok", message: `available (${available.length}/${TREE_SITTER_LANGUAGES.length} grammars)` };
+  }
+  const missing = TREE_SITTER_LANGUAGES.filter((lang) => !available.includes(lang));
+  return {
+    name,
+    status: "warn",
+    message: `partially available (${available.length}/${TREE_SITTER_LANGUAGES.length} grammars); missing: ${missing.join(", ")}`
+  };
+}
 function checkEmbeddings(config) {
   const name = "Embeddings";
   if ((config.indexing?.embeddings_enabled ?? true) === false) {
@@ -6688,6 +6715,7 @@ function runDoctor(dataDir2, configPath2, rootDir, processes) {
   const actualDataDir = dataDir2 || dataDir();
   results.push(checkInstall());
   results.push(checkTsCompiler());
+  results.push(checkTreeSitter());
   results.push(checkStrayClaudeMdBlocks());
   results.push(checkWorkerRunning(actualDataDir) ? { name: "Worker", status: "ok", message: "running" } : { name: "Worker", status: "warn", message: "not running" });
   results.push(checkDbExists(actualDataDir));
@@ -14937,11 +14965,14 @@ function readClaudeJsonConfig(claudeJsonPath, projectRoot) {
 function discoverMcpConfig(projectRoot, home) {
   const mcpJsonPath = path28.join(projectRoot, ".mcp.json");
   const claudeJsonPath = path28.join(home, ".claude.json");
-  const sourcesChecked = [mcpJsonPath, claudeJsonPath];
+  const copilotJsonPath = path28.join(home, ".copilot", "mcp-config.json");
+  const sourcesChecked = [mcpJsonPath, claudeJsonPath, copilotJsonPath];
   const fromMcpJson = readMcpJsonFile(mcpJsonPath);
   if (fromMcpJson !== null) return { servers: fromMcpJson, sourcePath: mcpJsonPath, sourcesChecked };
   const fromClaudeJson = readClaudeJsonConfig(claudeJsonPath, projectRoot);
   if (fromClaudeJson !== null) return { servers: fromClaudeJson, sourcePath: claudeJsonPath, sourcesChecked };
+  const fromCopilotJson = readMcpJsonFile(copilotJsonPath);
+  if (fromCopilotJson !== null) return { servers: fromCopilotJson, sourcePath: copilotJsonPath, sourcesChecked };
   return { servers: null, sourcePath: null, sourcesChecked };
 }
 function analyzeMcpCache() {
@@ -15730,7 +15761,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-C7LLUVUT.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-EZZ7IJYM.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-EVC4TOLE.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -15755,7 +15786,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-TX64YIIV.mjs");
+  const { relay } = await import("./token-goat-chunk-Q4VCAIBR.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -16688,7 +16719,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-UJORWTI4.mjs");
+    const bashRunner = await import("./token-goat-chunk-WT5OLTT6.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -16961,8 +16992,12 @@ async function cmdSkillSection(nameHeading, headingArg) {
   const body = decodeSource(fs29.readFileSync(filePath));
   const extracted = extractNamedSection(body, heading);
   if (!extracted) {
-    const messages = [`Section '${heading}' not found in skill '${skillName}'`];
     const allHeadings = listSections(filePath);
+    const wanted = stripLower(heading);
+    if (allHeadings.some((h) => stripLower(h) === wanted)) {
+      throw new CliError(`Section '${heading}' in skill '${skillName}' is present but empty`);
+    }
+    const messages = [`Section '${heading}' not found in skill '${skillName}'`];
     const available = filterSimilarHeadings(allHeadings, heading);
     if (available.length > 0) messages.push(didYouMean(available));
     else if (allHeadings.length === 0) messages.push(`skill '${skillName}' has no headings`);

package/dist/{token-goat-chunk-3ZAMYHQG.mjs → token-goat-chunk-3YANZKER.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-J7LGMKF3.mjs";
-import "./token-goat-chunk-46VKOCUH.mjs";
-import "./token-goat-chunk-7GJBID7S.mjs";
-import "./token-goat-chunk-3HJQR4OO.mjs";
-import "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-2SBHUPBF.mjs";
+import "./token-goat-chunk-6RAUVAKW.mjs";
+import "./token-goat-chunk-VEEHPNBV.mjs";
+import "./token-goat-chunk-TXZY7C24.mjs";
+import "./token-goat-chunk-JZYJH76S.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-46VKOCUH.mjs → token-goat-chunk-6RAUVAKW.mjs}

@@ -67,7 +67,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-TXZY7C24.mjs";
 import {
   Database,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -125,7 +125,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-JZYJH76S.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-C7LLUVUT.mjs → token-goat-chunk-EZZ7IJYM.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-46VKOCUH.mjs";
+} from "./token-goat-chunk-6RAUVAKW.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-TXZY7C24.mjs";
 import {
   ENV_KEYS,
   VERSION,
@@ -48,7 +48,7 @@ import {
   recordStat,
   resolveProjectRoot,
   savedTokensFromBytes
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-JZYJH76S.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env