token-goat 2.9.6 → 2.9.9

package/dist/{token-goat-chunk-J7LGMKF3.mjs → token-goat-chunk-PNMGVJ4C.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-46VKOCUH.mjs";
+} from "./token-goat-chunk-L6Q2XM5X.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
@@ -108,7 +108,7 @@ import {
   runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-7GJBID7S.mjs";
+} from "./token-goat-chunk-QCHD2ENV.mjs";
 import {
   AGENT_SALT_MARKER,
   BASH_OUTPUT_SUBDIR,
@@ -190,6 +190,7 @@ import {
   isParseSkipEligible,
   isRecallCacheType,
   isSuppressionCategory,
+  isTreeSitterAvailable,
   isWorkerRunning,
   listBlobs,
   listOutputs,
@@ -230,12 +231,14 @@ import {
   storeCompact,
   storeOutput,
   tokenGoatHome,
+  treeSitterCoreAvailable,
+  treeSitterCoreLoadError,
   trimToBudget,
   urlPolicyDenialReason,
   visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -346,6 +349,7 @@ import {
   savedTokensFromBytes,
   sleepSync,
   stripAnsi,
+  stripLower,
   stripOwnHooksFromMap,
   stripStaleGroupHooks,
   suggestPackageNames,
@@ -368,7 +372,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   __export,
   init_define_import_meta_env
@@ -6313,6 +6317,29 @@ function checkTsCompiler() {
     message: err2 !== null ? `unavailable: ${extractErrorMessage(err2)}` : "unavailable (not attempted)"
   };
 }
+var TREE_SITTER_LANGUAGES = ["typescript", "javascript", "python", "go", "rust", "ruby", "java", "c", "cpp"];
+function checkTreeSitter() {
+  const name = "Tree-sitter";
+  if (!treeSitterCoreAvailable()) {
+    const err2 = treeSitterCoreLoadError();
+    const cause = err2 !== null ? `: ${extractErrorMessage(err2)}` : " (not attempted)";
+    return {
+      name,
+      status: "warn",
+      message: "unavailable -- the source skeleton fold, the code body fold's disk-parse fallback, and tree-sitter indexing are all disabled; likely cause: the optional native dependency `tree-sitter` is not installed, or is not resolvable from the bundle's location" + cause
+    };
+  }
+  const available = TREE_SITTER_LANGUAGES.filter((lang) => isTreeSitterAvailable(lang));
+  if (available.length === TREE_SITTER_LANGUAGES.length) {
+    return { name, status: "ok", message: `available (${available.length}/${TREE_SITTER_LANGUAGES.length} grammars)` };
+  }
+  const missing = TREE_SITTER_LANGUAGES.filter((lang) => !available.includes(lang));
+  return {
+    name,
+    status: "warn",
+    message: `partially available (${available.length}/${TREE_SITTER_LANGUAGES.length} grammars); missing: ${missing.join(", ")}`
+  };
+}
 function checkEmbeddings(config) {
   const name = "Embeddings";
   if ((config.indexing?.embeddings_enabled ?? true) === false) {
@@ -6688,6 +6715,7 @@ function runDoctor(dataDir2, configPath2, rootDir, processes) {
   const actualDataDir = dataDir2 || dataDir();
   results.push(checkInstall());
   results.push(checkTsCompiler());
+  results.push(checkTreeSitter());
   results.push(checkStrayClaudeMdBlocks());
   results.push(checkWorkerRunning(actualDataDir) ? { name: "Worker", status: "ok", message: "running" } : { name: "Worker", status: "warn", message: "not running" });
   results.push(checkDbExists(actualDataDir));
@@ -14937,11 +14965,14 @@ function readClaudeJsonConfig(claudeJsonPath, projectRoot) {
 function discoverMcpConfig(projectRoot, home) {
   const mcpJsonPath = path28.join(projectRoot, ".mcp.json");
   const claudeJsonPath = path28.join(home, ".claude.json");
-  const sourcesChecked = [mcpJsonPath, claudeJsonPath];
+  const copilotJsonPath = path28.join(home, ".copilot", "mcp-config.json");
+  const sourcesChecked = [mcpJsonPath, claudeJsonPath, copilotJsonPath];
   const fromMcpJson = readMcpJsonFile(mcpJsonPath);
   if (fromMcpJson !== null) return { servers: fromMcpJson, sourcePath: mcpJsonPath, sourcesChecked };
   const fromClaudeJson = readClaudeJsonConfig(claudeJsonPath, projectRoot);
   if (fromClaudeJson !== null) return { servers: fromClaudeJson, sourcePath: claudeJsonPath, sourcesChecked };
+  const fromCopilotJson = readMcpJsonFile(copilotJsonPath);
+  if (fromCopilotJson !== null) return { servers: fromCopilotJson, sourcePath: copilotJsonPath, sourcesChecked };
   return { servers: null, sourcePath: null, sourcesChecked };
 }
 function analyzeMcpCache() {
@@ -15730,7 +15761,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-C7LLUVUT.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-LQ3SGWIW.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-EVC4TOLE.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -15755,7 +15786,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-TX64YIIV.mjs");
+  const { relay } = await import("./token-goat-chunk-K5GKX6ND.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -16688,7 +16719,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-UJORWTI4.mjs");
+    const bashRunner = await import("./token-goat-chunk-WBPVYAEO.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;
@@ -16961,8 +16992,12 @@ async function cmdSkillSection(nameHeading, headingArg) {
   const body = decodeSource(fs29.readFileSync(filePath));
   const extracted = extractNamedSection(body, heading);
   if (!extracted) {
-    const messages = [`Section '${heading}' not found in skill '${skillName}'`];
     const allHeadings = listSections(filePath);
+    const wanted = stripLower(heading);
+    if (allHeadings.some((h) => stripLower(h) === wanted)) {
+      throw new CliError(`Section '${heading}' in skill '${skillName}' is present but empty`);
+    }
+    const messages = [`Section '${heading}' not found in skill '${skillName}'`];
     const available = filterSimilarHeadings(allHeadings, heading);
     if (available.length > 0) messages.push(didYouMean(available));
     else if (allHeadings.length === 0) messages.push(`skill '${skillName}' has no headings`);

package/dist/{token-goat-chunk-7GJBID7S.mjs → token-goat-chunk-QCHD2ENV.mjs}

@@ -9,11 +9,12 @@ import {
   isBlobStale,
   loadBlob,
   storeBlob
-} from "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   copilotCliMcpToolsDir,
   countNoun,
+  displaySafeText,
   extractErrorMessage,
   fingerprintFile,
   foldPath,
@@ -24,7 +25,7 @@ import {
   resolveIndexPath,
   shortFingerprint,
   toDisplayPath
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";
@@ -840,8 +841,9 @@ function repeatedSkillBodyHint(injections) {
   const worst = injections[0];
   if (worst === void 0) return null;
   if (worst.count < SKILL_BODY_REPEAT_THRESHOLD || worst.bytes < LARGE_SKILL_BODY_BYTES) return null;
+  const skill = displaySafeText(worst.skill);
   const tokens = formatTokenEstimate(estimateTokensFromLength(worst.bytes));
-  return `The \`${worst.skill}\` skill body has been injected ${worst.count} times this session (${formatBytes(worst.bytes)} total, ~${tokens} tok est). Slash expansion and the Skill tool both send the whole body every time, and no hook can intercept either. If it is already loaded, work from it instead of re-invoking; to reread one part, use \`token-goat skill-section ${worst.skill} '<heading>'\`.`;
+  return `The \`${skill}\` skill body has been injected ${worst.count} times this session (${formatBytes(worst.bytes)} total, ~${tokens} tok est). Slash expansion and the Skill tool both send the whole body every time, and no hook can intercept either. If it is already loaded, work from it instead of re-invoking; to reread one part, use \`token-goat skill-section ${skill} '<heading>'\`.`;
 }
 function readTranscriptTail(transcriptPath, maxBytes = RESIDENT_TAIL_MAX_BYTES) {
   let fd = null;

package/dist/{token-goat-chunk-UJORWTI4.mjs → token-goat-chunk-WBPVYAEO.mjs}

@@ -3,7 +3,7 @@ const require = __cjsRequire(import.meta.url);
 import {
   deliveredOutputBytes,
   wrappedShell
-} from "./token-goat-chunk-LXIC7MTW.mjs";
+} from "./token-goat-chunk-OBDTBOQA.mjs";
 import {
   ToolFilter,
   capTokens,
@@ -15,7 +15,7 @@ import {
   recordStat,
   selectFilter,
   shlexSplit
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-EIZYCVBM.mjs";
-import "./token-goat-chunk-7GJBID7S.mjs";
-import "./token-goat-chunk-3HJQR4OO.mjs";
-import "./token-goat-chunk-LXIC7MTW.mjs";
-import "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-P5SQX2VK.mjs";
+import "./token-goat-chunk-QCHD2ENV.mjs";
+import "./token-goat-chunk-BYDDWQ2T.mjs";
+import "./token-goat-chunk-OBDTBOQA.mjs";
+import "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-J7LGMKF3.mjs";
-import "./token-goat-chunk-46VKOCUH.mjs";
-import "./token-goat-chunk-7GJBID7S.mjs";
-import "./token-goat-chunk-3HJQR4OO.mjs";
+} from "./token-goat-chunk-PNMGVJ4C.mjs";
+import "./token-goat-chunk-L6Q2XM5X.mjs";
+import "./token-goat-chunk-QCHD2ENV.mjs";
+import "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-T2OE7MYM.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/docs/install.md

@@ -223,6 +223,68 @@ To upgrade cleanly:
 
 **AI agents handling an upgrade:** complete all three steps in sequence. After step 3, confirm no `token_goat` entries remain in `settings.json` before reporting the upgrade done.
 
+### Command auto-approval and permissions
+
+By default, `token-goat install` configures hook triggers only. It never writes permission entries into your environment. If your setup requires confirmation for shell commands, an approval prompt can appear whenever file names, line numbers, or arguments change.
+
+You can add wildcard rules to avoid repeated prompts for routine queries:
+
+#### Claude Code (`~/.claude/settings.json`)
+
+To allow all `token-goat` commands without prompting:
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "Bash(token-goat *)",
+      "Bash(token-goat:*)"
+    ]
+  }
+}
+```
+
+To limit auto-approval strictly to read-only queries:
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "Bash(token-goat read *)",
+      "Bash(token-goat symbol *)",
+      "Bash(token-goat section *)",
+      "Bash(token-goat outline *)",
+      "Bash(token-goat skeleton *)",
+      "Bash(token-goat brief *)",
+      "Bash(token-goat json-query *)",
+      "Bash(token-goat yaml-query *)",
+      "Bash(token-goat xml-query *)",
+      "Bash(token-goat map *)",
+      "Bash(token-goat refs *)",
+      "Bash(token-goat deps *)"
+    ]
+  }
+}
+```
+
+#### Codex CLI (`~/.codex/config.toml`)
+
+Running `token-goat install --codex` automatically computes and writes `trusted_hash` into `[hooks.state]` so Codex trusts the hooks. To allow automatic command execution, set `approval_policy` in `~/.codex/config.toml`:
+
+```toml
+approval_policy = "never"
+```
+
+#### Copilot and VS Code MCP
+
+For VS Code using the token-goat MCP server (`token-goat install --vscode`), enable MCP auto-approval in your VS Code `settings.json`:
+
+```json
+{
+  "chat.mcp.autoApprove": true
+}
+```
+
 ## What gets installed?
 
 `token-goat install` writes the following on your machine — nothing else, anywhere. Every entry is reversed by `token-goat uninstall`. Integrations for other harnesses are additive on the way out as well as in, so a plain uninstall does not touch one you installed with `--codex`, `--copilot`, or a sibling flag: rather than undo something you did not ask about, it names each one still present and the flag that removes it. Run `token-goat doctor` at any time to see which of these are currently present.

package/docs/security.md

@@ -15,12 +15,12 @@ Outbound network is reserved to these explicit cases:
 - Google Drive API calls, only if you already authorized Drive in Claude Code. Token-goat never prompts for its own auth.
 - Image fetches from URLs: either explicit via `token-goat fetch-image <url>`, or when the AI agent issues a WebFetch call that returns image content — the hook intercepts and shrinks the image. The URL always originates from the agent's work, not from token-goat itself.
 - `token-goat screenshot <url>` navigates a headless browser to the URL you give it, subject to the target restrictions described below.
-- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
+- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Setting `TOKEN_GOAT_MODEL_CACHE_DIR` adds one more place to look before the network: a directory you name that outlives any single data root, which is how a continuous-integration job stops refetching the weights once per worker. A file taken from there is checked against the same recorded digest as a downloaded one and dropped from the shared directory if it fails, so a tampered copy costs a download and cannot substitute different weights. It is an environment variable only, so no project config file can point it anywhere. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
 - The first optical-character read of an image downloads the English language data (about 4 MB) from `cdn.jsdelivr.net`, at a fixed version path. Subsequent reads use the local cache. This happens for an explicit `token-goat image-text`, and also for the automatic text extraction the image-shrink hook performs when the agent reads a screenshot; turn the automatic one off with `image_shrink.ocr_enabled = false`.
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.
 
-**A repository cannot reconfigure the security controls.** A project-root `.token-goat.toml` layers on top of your global config, which is what it is for: hint thresholds, indexing settings, compression tuning. But that file arrives with the repository, so whoever wrote the repository wrote it. Seven whole sections are therefore off limits to it, and come from your global config or the environment only: `injection` (prompt-injection fencing), `webfetch` (the fetch allow and deny lists), `gdrive` (the Google Drive integration), `mcp` (root confinement and the allowed-roots list), `network` (offline mode), `redaction` (the secret-redaction rules), and `screenshot` (the headless browser). Twelve individual keys inside otherwise-overridable sections are locked the same way. Five decide what gets indexed at all: `indexing.cross_project_symbols`, `indexing.skip_dirs`, `indexing.skip_files`, `indexing.large_file_skip_kb` and `indexing.large_file_symbol_only_kb`, which matter because an unindexed file answers `symbol`, `read` and `semantic` in the same words a name that never existed does. Five more are the switches that decide whether a large file arrives folded rather than whole: `hints.fold_code_bodies`, `hints.fold_comment_blocks`, `hints.fold_prose_paragraphs`, `hints.outline_large_documents` and `hints.skeleton_large_sources`. The last two are `image_shrink.max_image_pixels`, the decompression-bomb cap, and `worker.blocked_roots`, the folders you have kept out of the index. A project file that sets one of them is ignored, and token-goat prints a line naming what it dropped. Everything else stays project-overridable.
+**A repository cannot reconfigure the security controls.** A project-root `.token-goat.toml` layers on top of your global config, which is what it is for: hint thresholds, indexing settings, compression tuning. But that file arrives with the repository, so whoever wrote the repository wrote it. Seven whole sections are therefore off limits to it, and come from your global config or the environment only: `injection` (prompt-injection fencing), `webfetch` (the fetch allow and deny lists), `gdrive` (the Google Drive integration), `mcp` (root confinement and the allowed-roots list), `network` (offline mode), `redaction` (the secret-redaction rules), and `screenshot` (the headless browser). Thirteen individual keys inside otherwise-overridable sections are locked the same way. Five decide what gets indexed at all: `indexing.cross_project_symbols`, `indexing.skip_dirs`, `indexing.skip_files`, `indexing.large_file_skip_kb` and `indexing.large_file_symbol_only_kb`, which matter because an unindexed file answers `symbol`, `read` and `semantic` in the same words a name that never existed does. Five more are the switches that decide whether a large file arrives folded rather than whole: `hints.fold_code_bodies`, `hints.fold_comment_blocks`, `hints.fold_prose_paragraphs`, `hints.outline_large_documents` and `hints.skeleton_large_sources`. The last three are `image_shrink.max_image_pixels`, the decompression-bomb cap, `worker.blocked_roots`, the folders you have kept out of the index, and `compact_assist.summary_budget_chars`, the length target token-goat hands to whoever writes your compaction summary, which a repository must not be able to set low enough to erase the session. A project file that sets one of them is ignored, and token-goat prints a line naming what it dropped. Everything else stays project-overridable.
 
 **The lock covers the config file, not the environment.** These settings still read a `TOKEN_GOAT_*` environment variable, and a repository has ways to set one: a `.envrc` for direnv, a `terminal.integrated.env.*` block in a committed `.vscode/settings.json`, a `containerEnv` entry in a devcontainer. Refusing environment overrides would break the operator who exports a variable in their own shell, which is the legitimate case and the common one, so token-goat reports instead of refusing: `token-goat doctor` prints a `Security config overrides` line naming every locked security setting the environment is currently deciding, and the variable to unset. It covers all twenty locked keys that read an environment variable, and it derives that set from the same two tables that define what a project config may not write, rather than from a list kept alongside them. Settings with a safe side (booleans) are reported when the environment holds them open; settings without one (lists, sizes) are reported whenever the environment supplies a value at all, since there is nothing to compare against. A default install, where nothing is set, prints a single ok line.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.6",
+  "version": "2.9.9",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",