token-goat 2.9.6 → 2.9.8

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-EIZYCVBM.mjs";
-import "./token-goat-chunk-7GJBID7S.mjs";
-import "./token-goat-chunk-3HJQR4OO.mjs";
-import "./token-goat-chunk-LXIC7MTW.mjs";
-import "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-XYLPMQ6I.mjs";
+import "./token-goat-chunk-VEEHPNBV.mjs";
+import "./token-goat-chunk-TXZY7C24.mjs";
+import "./token-goat-chunk-REHUP2OE.mjs";
+import "./token-goat-chunk-JZYJH76S.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-J7LGMKF3.mjs";
-import "./token-goat-chunk-46VKOCUH.mjs";
-import "./token-goat-chunk-7GJBID7S.mjs";
-import "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-2SBHUPBF.mjs";
+import "./token-goat-chunk-6RAUVAKW.mjs";
+import "./token-goat-chunk-VEEHPNBV.mjs";
+import "./token-goat-chunk-TXZY7C24.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-JZYJH76S.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/docs/install.md

@@ -223,6 +223,68 @@ To upgrade cleanly:
 
 **AI agents handling an upgrade:** complete all three steps in sequence. After step 3, confirm no `token_goat` entries remain in `settings.json` before reporting the upgrade done.
 
+### Command auto-approval and permissions
+
+By default, `token-goat install` configures hook triggers only. It never writes permission entries into your environment. If your setup requires confirmation for shell commands, an approval prompt can appear whenever file names, line numbers, or arguments change.
+
+You can add wildcard rules to avoid repeated prompts for routine queries:
+
+#### Claude Code (`~/.claude/settings.json`)
+
+To allow all `token-goat` commands without prompting:
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "Bash(token-goat *)",
+      "Bash(token-goat:*)"
+    ]
+  }
+}
+```
+
+To limit auto-approval strictly to read-only queries:
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "Bash(token-goat read *)",
+      "Bash(token-goat symbol *)",
+      "Bash(token-goat section *)",
+      "Bash(token-goat outline *)",
+      "Bash(token-goat skeleton *)",
+      "Bash(token-goat brief *)",
+      "Bash(token-goat json-query *)",
+      "Bash(token-goat yaml-query *)",
+      "Bash(token-goat xml-query *)",
+      "Bash(token-goat map *)",
+      "Bash(token-goat refs *)",
+      "Bash(token-goat deps *)"
+    ]
+  }
+}
+```
+
+#### Codex CLI (`~/.codex/config.toml`)
+
+Running `token-goat install --codex` automatically computes and writes `trusted_hash` into `[hooks.state]` so Codex trusts the hooks. To allow automatic command execution, set `approval_policy` in `~/.codex/config.toml`:
+
+```toml
+approval_policy = "never"
+```
+
+#### Copilot and VS Code MCP
+
+For VS Code using the token-goat MCP server (`token-goat install --vscode`), enable MCP auto-approval in your VS Code `settings.json`:
+
+```json
+{
+  "chat.mcp.autoApprove": true
+}
+```
+
 ## What gets installed?
 
 `token-goat install` writes the following on your machine — nothing else, anywhere. Every entry is reversed by `token-goat uninstall`. Integrations for other harnesses are additive on the way out as well as in, so a plain uninstall does not touch one you installed with `--codex`, `--copilot`, or a sibling flag: rather than undo something you did not ask about, it names each one still present and the flag that removes it. Run `token-goat doctor` at any time to see which of these are currently present.

package/docs/security.md

@@ -20,7 +20,7 @@ Outbound network is reserved to these explicit cases:
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.
 
-**A repository cannot reconfigure the security controls.** A project-root `.token-goat.toml` layers on top of your global config, which is what it is for: hint thresholds, indexing settings, compression tuning. But that file arrives with the repository, so whoever wrote the repository wrote it. Seven whole sections are therefore off limits to it, and come from your global config or the environment only: `injection` (prompt-injection fencing), `webfetch` (the fetch allow and deny lists), `gdrive` (the Google Drive integration), `mcp` (root confinement and the allowed-roots list), `network` (offline mode), `redaction` (the secret-redaction rules), and `screenshot` (the headless browser). Twelve individual keys inside otherwise-overridable sections are locked the same way. Five decide what gets indexed at all: `indexing.cross_project_symbols`, `indexing.skip_dirs`, `indexing.skip_files`, `indexing.large_file_skip_kb` and `indexing.large_file_symbol_only_kb`, which matter because an unindexed file answers `symbol`, `read` and `semantic` in the same words a name that never existed does. Five more are the switches that decide whether a large file arrives folded rather than whole: `hints.fold_code_bodies`, `hints.fold_comment_blocks`, `hints.fold_prose_paragraphs`, `hints.outline_large_documents` and `hints.skeleton_large_sources`. The last two are `image_shrink.max_image_pixels`, the decompression-bomb cap, and `worker.blocked_roots`, the folders you have kept out of the index. A project file that sets one of them is ignored, and token-goat prints a line naming what it dropped. Everything else stays project-overridable.
+**A repository cannot reconfigure the security controls.** A project-root `.token-goat.toml` layers on top of your global config, which is what it is for: hint thresholds, indexing settings, compression tuning. But that file arrives with the repository, so whoever wrote the repository wrote it. Seven whole sections are therefore off limits to it, and come from your global config or the environment only: `injection` (prompt-injection fencing), `webfetch` (the fetch allow and deny lists), `gdrive` (the Google Drive integration), `mcp` (root confinement and the allowed-roots list), `network` (offline mode), `redaction` (the secret-redaction rules), and `screenshot` (the headless browser). Thirteen individual keys inside otherwise-overridable sections are locked the same way. Five decide what gets indexed at all: `indexing.cross_project_symbols`, `indexing.skip_dirs`, `indexing.skip_files`, `indexing.large_file_skip_kb` and `indexing.large_file_symbol_only_kb`, which matter because an unindexed file answers `symbol`, `read` and `semantic` in the same words a name that never existed does. Five more are the switches that decide whether a large file arrives folded rather than whole: `hints.fold_code_bodies`, `hints.fold_comment_blocks`, `hints.fold_prose_paragraphs`, `hints.outline_large_documents` and `hints.skeleton_large_sources`. The last three are `image_shrink.max_image_pixels`, the decompression-bomb cap, `worker.blocked_roots`, the folders you have kept out of the index, and `compact_assist.summary_budget_chars`, the length target token-goat hands to whoever writes your compaction summary, which a repository must not be able to set low enough to erase the session. A project file that sets one of them is ignored, and token-goat prints a line naming what it dropped. Everything else stays project-overridable.
 
 **The lock covers the config file, not the environment.** These settings still read a `TOKEN_GOAT_*` environment variable, and a repository has ways to set one: a `.envrc` for direnv, a `terminal.integrated.env.*` block in a committed `.vscode/settings.json`, a `containerEnv` entry in a devcontainer. Refusing environment overrides would break the operator who exports a variable in their own shell, which is the legitimate case and the common one, so token-goat reports instead of refusing: `token-goat doctor` prints a `Security config overrides` line naming every locked security setting the environment is currently deciding, and the variable to unset. It covers all twenty locked keys that read an environment variable, and it derives that set from the same two tables that define what a project config may not write, rather than from a list kept alongside them. Settings with a safe side (booleans) are reported when the environment holds them open; settings without one (lists, sizes) are reported whenever the environment supplies a value at all, since there is nothing to compare against. A default install, where nothing is set, prints a single ok line.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.6",
+  "version": "2.9.8",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",