token-goat 2.9.8 → 2.9.10

package/README.md

@@ -37,7 +37,7 @@ Restart your AI sessions. Run `token-goat stats` a couple of minutes after your
 
 > **Built and continually improved, free, by one person. If it saves you tokens, drop a ⭐️ at the top of this page. One click. Makes my day. Also, if you'd like anything added, [drop me a line](mailto:token-goat@dfkhelper.com).**
 
-[Install](docs/install.md) · [CLI](docs/cli.md) · [What gets installed?](docs/install.md#what-gets-installed) · [Stats](#stats-display) · [Security & uninstall](docs/security.md)
+[Install](docs/install.md) · [CLI](docs/cli.md) · [Architecture Q&A](docs/architecture-qa.html) · [What gets installed?](docs/install.md#what-gets-installed) · [Stats](#stats-display) · [Security & uninstall](docs/security.md)
 
 ---
 
@@ -323,7 +323,7 @@ corpus of captured shell output through the real compression path and reports ho
 result got, alongside a count of the lines each case is not allowed to lose. Deleting output makes
 the first number look better, so the second one is what keeps the first honest.
 
-Every command, with its flags, its output, and the comparison workflows that chain them: **[CLI reference](docs/cli.md)**.
+Every command, with its flags, its output, and the comparison workflows that chain them: **[CLI reference](docs/cli.md)**. For architectural analysis, empirical evaluations, and technical answers to common engineering questions: **[Architecture & Technical Q&A](docs/architecture-qa.html)**.
 
 ## MCP server
 

package/SECURITY.md

@@ -101,7 +101,7 @@ For a scanner that ingests a bill of materials rather than a lockfile, `npm run
 
 ## Verifying what you installed
 
-Every published version is built and pushed by one workflow, [`.github/workflows/publish.yml`](.github/workflows/publish.yml), which runs only when a GitHub release is published (or manually, and then only from `main`). It publishes with npm provenance, so npm holds a signed attestation tying the tarball to the commit and workflow run that produced it. Nothing is ever published from a laptop.
+Every published version is built and pushed by one workflow, [`.github/workflows/publish.yml`](.github/workflows/publish.yml), which runs only when a GitHub release is published (or manually, and then only from `main`). It publishes with npm provenance, so npm holds a signed attestation tying the tarball to the commit and workflow run that produced it. Nothing is ever published from a developer workstation.
 
 To check a copy you already have:
 

package/dist/{token-goat-chunk-Q4VCAIBR.mjs → token-goat-chunk-2TJBY5RD.mjs}

@@ -4,14 +4,14 @@ import {
   buildEvent,
   relay,
   relayInProcess
-} from "./token-goat-chunk-XYLPMQ6I.mjs";
+} from "./token-goat-chunk-ZQODJQTP.mjs";
 import {
   MAX_STDIN_BYTES,
   readStdinJson
-} from "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
-import "./token-goat-chunk-REHUP2OE.mjs";
-import "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
+import "./token-goat-chunk-ATVQ6IIT.mjs";
+import "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-2SBHUPBF.mjs → token-goat-chunk-7ALFFPJW.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-6RAUVAKW.mjs";
+} from "./token-goat-chunk-YFXFUG3L.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
@@ -108,7 +108,7 @@ import {
   runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-VEEHPNBV.mjs";
+} from "./token-goat-chunk-SLGOIXKF.mjs";
 import {
   AGENT_SALT_MARKER,
   BASH_OUTPUT_SUBDIR,
@@ -238,7 +238,7 @@ import {
   visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -372,7 +372,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   __export,
   init_define_import_meta_env
@@ -15761,7 +15761,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-EZZ7IJYM.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-DCYHAUW3.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-EVC4TOLE.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -15786,7 +15786,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-Q4VCAIBR.mjs");
+  const { relay } = await import("./token-goat-chunk-2TJBY5RD.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -16719,7 +16719,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-WT5OLTT6.mjs");
+    const bashRunner = await import("./token-goat-chunk-JS44SRAX.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;

package/dist/{token-goat-chunk-REHUP2OE.mjs → token-goat-chunk-ATVQ6IIT.mjs}

@@ -2,7 +2,7 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   detectHarness
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";

package/dist/{token-goat-chunk-EZZ7IJYM.mjs → token-goat-chunk-DCYHAUW3.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-6RAUVAKW.mjs";
+} from "./token-goat-chunk-YFXFUG3L.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   ENV_KEYS,
   VERSION,
@@ -48,7 +48,7 @@ import {
   recordStat,
   resolveProjectRoot,
   savedTokensFromBytes
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/{token-goat-chunk-3YANZKER.mjs → token-goat-chunk-DSHYDU53.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-2SBHUPBF.mjs";
-import "./token-goat-chunk-6RAUVAKW.mjs";
-import "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
-import "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-7ALFFPJW.mjs";
+import "./token-goat-chunk-YFXFUG3L.mjs";
+import "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
+import "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-WT5OLTT6.mjs → token-goat-chunk-JS44SRAX.mjs}

@@ -3,7 +3,7 @@ const require = __cjsRequire(import.meta.url);
 import {
   deliveredOutputBytes,
   wrappedShell
-} from "./token-goat-chunk-REHUP2OE.mjs";
+} from "./token-goat-chunk-ATVQ6IIT.mjs";
 import {
   ToolFilter,
   capTokens,
@@ -15,7 +15,7 @@ import {
   recordStat,
   selectFilter,
   shlexSplit
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/{token-goat-chunk-TXZY7C24.mjs → token-goat-chunk-PA5UXNOT.mjs}

@@ -101,7 +101,7 @@ import {
   toDisplayPath,
   toKB,
   withFileLock
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";
@@ -10268,6 +10268,51 @@ function modelDir() {
 function downloadUrl(file) {
   return `https://huggingface.co/${DEFAULT_MODEL}/resolve/${PINNED_MODEL_REVISION}/${file.name}`;
 }
+function sharedModelCacheDir() {
+  const raw = process.env["TOKEN_GOAT_MODEL_CACHE_DIR"]?.trim();
+  if (!raw) return null;
+  return path7.join(raw, ...DEFAULT_MODEL.split("/"), PINNED_MODEL_REVISION);
+}
+async function copyFromSharedCache(shared, file, target) {
+  const source = path7.join(shared, file.name);
+  const temp = `${target}.${process.pid}.shared`;
+  try {
+    const info = fs11.lstatSync(source, { throwIfNoEntry: false });
+    if (!info?.isFile() || info.size !== file.bytes) return false;
+    fs11.copyFileSync(source, temp);
+    if (await sha256Of(temp) !== file.sha256) {
+      fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+      fs11.rmSync(source, { force: true, maxRetries: 20, retryDelay: 25 });
+      return false;
+    }
+    fs11.renameSync(temp, target);
+    return true;
+  } catch {
+    try {
+      fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+    } catch {
+    }
+    return false;
+  }
+}
+function publishToSharedCache(shared, file, target) {
+  const destination = path7.join(shared, file.name);
+  const temp = `${destination}.${process.pid}.partial`;
+  let created = false;
+  try {
+    if (fs11.existsSync(destination)) return;
+    fs11.mkdirSync(path7.dirname(destination), { recursive: true });
+    fs11.copyFileSync(target, temp, fs11.constants.COPYFILE_EXCL);
+    created = true;
+    fs11.renameSync(temp, destination);
+  } catch {
+    if (!created) return;
+    try {
+      fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+    } catch {
+    }
+  }
+}
 var _ort = null;
 var _ortError = null;
 var _ortLoadAttempted = false;
@@ -10363,6 +10408,7 @@ async function ensureModelFiles(modelName = DEFAULT_MODEL) {
   ensureDataDirPrivate();
   const dir = modelDir();
   const offline = loadConfig().network.offline;
+  const shared = sharedModelCacheDir();
   for (const file of MODEL_FILES) {
     const target = path7.join(dir, file.name);
     if (fs11.existsSync(target)) {
@@ -10370,6 +10416,10 @@ async function ensureModelFiles(modelName = DEFAULT_MODEL) {
       if (digest === file.sha256) continue;
       fs11.rmSync(target, { force: true });
     }
+    if (shared) {
+      fs11.mkdirSync(path7.dirname(target), { recursive: true });
+      if (await copyFromSharedCache(shared, file, target)) continue;
+    }
     if (offline) {
       throw new Error(
         `Offline mode is on (network.offline): refusing to download ${file.name} for the embedding model. Copy the pinned files into ${dir} on a connected machine to use semantic search here.`
@@ -10380,6 +10430,7 @@ async function ensureModelFiles(modelName = DEFAULT_MODEL) {
       `Downloading the embedding model, once (${file.name}, ${Math.round(file.bytes / 1024 / 1024)} MB) into ${dir}`
     );
     await download(file, target);
+    if (shared) publishToSharedCache(shared, file, target);
   }
   return dir;
 }
@@ -20023,6 +20074,41 @@ function readIntToolInput(event, key) {
   }
   return void 0;
 }
+function readRequestedSliceWindow(event) {
+  const rawOffset = readIntToolInput(event, "offset");
+  const rawLimit = readIntToolInput(event, "limit");
+  if (rawOffset !== void 0 || rawLimit !== void 0) {
+    return {
+      offset: rawOffset !== void 0 && rawOffset >= 1 ? Math.floor(rawOffset) : 1,
+      limit: rawLimit !== void 0 && rawLimit > 0 ? Math.floor(rawLimit) : void 0,
+      isExplicitSlice: true
+    };
+  }
+  const rawRange = event.toolInput["view_range"] ?? event.toolInput["lines"] ?? event.toolInput["range"];
+  if (Array.isArray(rawRange) && rawRange.length >= 1) {
+    const rawStart = Number(rawRange[0]);
+    const startVal = Number.isFinite(rawStart) && rawStart >= 1 ? Math.floor(rawStart) : 1;
+    if (rawRange.length >= 2) {
+      const rawEnd = Number(rawRange[1]);
+      if (rawEnd === -1) {
+        return { offset: startVal, isExplicitSlice: true };
+      }
+      if (Number.isFinite(rawEnd) && rawEnd >= startVal) {
+        const lineCount = Math.floor(rawEnd - startVal + 1);
+        return { offset: startVal, limit: lineCount, isExplicitSlice: true };
+      }
+    }
+    return { offset: startVal, isExplicitSlice: true };
+  }
+  const startLine = readIntToolInput(event, "start_line") ?? readIntToolInput(event, "startLine") ?? readIntToolInput(event, "start");
+  const endLine = readIntToolInput(event, "end_line") ?? readIntToolInput(event, "endLine") ?? readIntToolInput(event, "end");
+  if (startLine !== void 0 || endLine !== void 0) {
+    const effectiveStart = startLine !== void 0 && startLine >= 1 ? Math.floor(startLine) : 1;
+    const effectiveLimit = endLine !== void 0 && endLine >= effectiveStart ? Math.floor(endLine - effectiveStart + 1) : void 0;
+    return { offset: effectiveStart, limit: effectiveLimit, isExplicitSlice: true };
+  }
+  return { isExplicitSlice: false };
+}
 function readStartLine(event) {
   const resp = event.raw["tool_response"];
   if (resp === null || typeof resp !== "object") return 1;
@@ -20086,11 +20172,10 @@ function scanRequestedSlice(absPath, offset, limit) {
   }
 }
 function estimateRequestedSlice(event, absPath) {
-  const offset = readIntToolInput(event, "offset");
-  const limit = readIntToolInput(event, "limit");
-  if (limit === void 0 || limit <= 0) return { kind: "unbounded" };
-  const effectiveOffset = offset !== void 0 && offset >= 1 ? offset : 1;
-  const scan = scanRequestedSlice(absPath, effectiveOffset, limit);
+  const window2 = readRequestedSliceWindow(event);
+  if (window2.limit === void 0 || window2.limit <= 0) return { kind: "unbounded" };
+  const effectiveOffset = window2.offset !== void 0 && window2.offset >= 1 ? window2.offset : 1;
+  const scan = scanRequestedSlice(absPath, effectiveOffset, window2.limit);
   if (scan === null) return { kind: "unbounded" };
   if (scan.nearSingleLine) return { kind: "nearSingleLine" };
   if (scan.trustworthy) return { kind: "bytes", bytes: scan.bytes };
@@ -20330,7 +20415,7 @@ function preReadHandlerInner(event) {
     } catch {
     }
   }
-  const compactUnrangedRead = readIntToolInput(event, "offset") === void 0 && readIntToolInput(event, "limit") === void 0;
+  const compactUnrangedRead = !readRequestedSliceWindow(event).isExplicitSlice;
   if (event.toolName !== "Grep" && compactUnrangedRead && loadConfig().hints.stable_doc_compacts && _isDocFile(normalized)) {
     const compactPath = compactPathFor(normalized);
     if (isCompactFresh(compactPath, normalized)) {
@@ -20413,7 +20498,7 @@ function preReadHandlerInner(event) {
           }
           return denyOutput(message);
         }
-        const unrangedRead = readIntToolInput(event, "offset") === void 0 && readIntToolInput(event, "limit") === void 0;
+        const unrangedRead = !readRequestedSliceWindow(event).isExplicitSlice;
         if (loadConfig().hints.subagent_markdown_first_read_deny && event.agentId !== void 0 && unrangedRead && SUBAGENT_MD_FIRST_READ_DENY_EXT_RE.test(basename12) && markdownSize !== null && markdownSize >= SUBAGENT_MD_FIRST_READ_DENY_BYTES) {
           recordStat("subagent_markdown_first_read_deny", 0, 0);
           return denyOutput(
@@ -20783,9 +20868,9 @@ function readWindowFromDisk(event, normalized) {
   const size = statSize(normalized);
   if (size === null || size > SLICE_ESTIMATE_SCAN_CAP_BYTES) return null;
   const text = decodeSource(fs21.readFileSync(normalized));
-  const limit = readIntToolInput(event, "limit");
-  const offset = readIntToolInput(event, "offset");
-  const start = offset !== void 0 && offset >= 1 ? offset : 1;
+  const window2 = readRequestedSliceWindow(event);
+  const start = window2.offset !== void 0 && window2.offset >= 1 ? window2.offset : 1;
+  const limit = window2.limit;
   if (start === 1 && (limit === void 0 || limit <= 0)) return text;
   const lines2 = text.split("\n");
   const from = start - 1;
@@ -20908,7 +20993,7 @@ function elideAlreadyServedLines(event, respText) {
 function structuralFoldInputs(event, respText) {
   const filePath = getFilePath(event);
   if (filePath === void 0) return null;
-  if (readIntToolInput(event, "offset") !== void 0 || readIntToolInput(event, "limit") !== void 0) return null;
+  if (readRequestedSliceWindow(event).isExplicitSlice) return null;
   if (isTruncatedReadDelivery(event, respText)) return null;
   if (redactSecrets(respText).count > 0) return null;
   const parsed = parseNumberedReadResult(respText, readStartLine(event));
@@ -20943,14 +21028,15 @@ function foldCodeBodies(event, respText) {
   if (filePath === void 0) return null;
   const normalized = normalizePath(filePath);
   if (isImagePath(normalized)) return null;
-  const requestedOffset = readIntToolInput(event, "offset");
+  const sliceWin = readRequestedSliceWindow(event);
+  const requestedOffset = sliceWin.offset;
   if (requestedOffset !== void 0 && readStartLine(event) !== requestedOffset) return null;
   if (isTruncatedReadDelivery(event, respText)) return null;
   if (redactSecrets(respText).count > 0) return null;
   const parsed = parseNumberedReadResult(respText, readStartLine(event));
   if (parsed === null) return null;
   const shown = displaySafePath(toDisplayPath(findProject(getCwd(event) ?? process.cwd())?.root, normalized));
-  const folded = foldDelivery(parsed.rows, normalized, shown, requestedOffset !== void 0 || readIntToolInput(event, "limit") !== void 0);
+  const folded = foldDelivery(parsed.rows, normalized, shown, sliceWin.isExplicitSlice);
   if (folded === null) return null;
   const rewritten = [...parsed.header, fenceUntrustedFileContent(folded.numbered.join("\n")), ...parsed.trailer].join("\n");
   const originalBytes = Buffer.byteLength(respText, "utf-8");

package/dist/{token-goat-chunk-VEEHPNBV.mjs → token-goat-chunk-SLGOIXKF.mjs}

@@ -9,7 +9,7 @@ import {
   isBlobStale,
   loadBlob,
   storeBlob
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   copilotCliMcpToolsDir,
@@ -25,7 +25,7 @@ import {
   resolveIndexPath,
   shortFingerprint,
   toDisplayPath
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-JZYJH76S.mjs → token-goat-chunk-VCEK77ED.mjs}

@@ -12,7 +12,7 @@ init_define_import_meta_env();
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.9.8";
+    return "2.9.10";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -9636,6 +9636,25 @@ function remapToolInput(copilotToolName, input) {
   if (idKey !== undefined && idKey in out) {
     out = Object.assign({}, out, { bash_id: out[idKey] })
   }
+  if (Array.isArray(out.view_range) && out.view_range.length >= 1) {
+    const rawStart = Number(out.view_range[0])
+    if (Number.isFinite(rawStart) && rawStart >= 1) {
+      const mapped = { offset: Math.floor(rawStart) }
+      if (out.view_range.length >= 2) {
+        const rawEnd = Number(out.view_range[1])
+        if (Number.isFinite(rawEnd) && rawEnd >= rawStart) {
+          mapped.limit = Math.floor(rawEnd - rawStart + 1)
+        }
+      }
+      out = Object.assign({}, out, mapped)
+    }
+  }
+  if ('old_str' in out && !('old_string' in out)) {
+    out = Object.assign({}, out, { old_string: out.old_str })
+  }
+  if ('new_str' in out && !('new_string' in out)) {
+    out = Object.assign({}, out, { new_string: out.new_str })
+  }
   return out
 }
 

package/dist/{token-goat-chunk-6RAUVAKW.mjs → token-goat-chunk-YFXFUG3L.mjs}

@@ -67,7 +67,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   Database,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -125,7 +125,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-XYLPMQ6I.mjs → token-goat-chunk-ZQODJQTP.mjs}

@@ -18,7 +18,7 @@ import {
   storeWebOutput,
   summarizeResidentContext,
   taskListPruneHint
-} from "./token-goat-chunk-VEEHPNBV.mjs";
+} from "./token-goat-chunk-SLGOIXKF.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GENERIC_SERVED_OUTPUT_KEY,
@@ -125,12 +125,12 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   bashOutputCapBytes,
   canRunWrappedShell,
   deliveredOutputBytes
-} from "./token-goat-chunk-REHUP2OE.mjs";
+} from "./token-goat-chunk-ATVQ6IIT.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   ENV_KEYS,
@@ -194,7 +194,7 @@ import {
   stripAnsiEscapes,
   toDisplayPath,
   toKB
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -798,7 +798,7 @@ init_define_import_meta_env();
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-3YANZKER.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-DSHYDU53.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -9994,8 +9994,8 @@ registerHook("post_tool_use", postTaskOutputHandler, { toolName: "TaskOutput" })
 
 // src/hooks_tool_failure.ts
 init_define_import_meta_env();
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, relative } from "node:path";
 var FAILURE_SUFFIX = ".tool-failures.json";
 var MAX_TRACKED_FAILURES = 64;
 var SIGNATURE_ERROR_CHARS = 200;
@@ -10045,6 +10045,71 @@ function repeatFailureNotice(toolName) {
   const tool = toolName === void 0 || toolName === "" ? "This tool" : displaySafeText(toolName);
   return `[token-goat] ${tool} just failed with the same error as an earlier call this session. Retrying it unchanged will fail the same way -- change the arguments, the tool, or the approach.`;
 }
+var MAX_EDIT_DIAGNOSE_BYTES = 10 * 1024 * 1024;
+function diagnoseEditFailure(event, errorText) {
+  const toolName = getToolName(event);
+  if (!toolName || !/^(edit|str_replace_editor)$/i.test(toolName)) {
+    return null;
+  }
+  const isMultiple = /multiple matches|not unique|found \d+ matches|matches \d+ times|more than one match/i.test(errorText);
+  const isNotFound = /no match|not found|could not find|zero matches|string to replace.*not found/i.test(errorText);
+  if (!isMultiple && !isNotFound) {
+    return null;
+  }
+  const filePath = getFilePath(event) ?? (typeof event.toolInput["path"] === "string" ? event.toolInput["path"] : void 0);
+  if (!filePath) return null;
+  const oldString = typeof event.toolInput["old_string"] === "string" ? event.toolInput["old_string"] : typeof event.toolInput["old_str"] === "string" ? event.toolInput["old_str"] : typeof event.toolInput["target"] === "string" ? event.toolInput["target"] : void 0;
+  if (oldString === void 0 || oldString === "") return null;
+  const absPath = normalizePath(filePath);
+  if (!existsSync2(absPath)) return null;
+  try {
+    const stat = statSync4(absPath);
+    if (stat.size > MAX_EDIT_DIAGNOSE_BYTES) return null;
+    const fileContent = readFileSync3(absPath, "utf8");
+    const relDisplay = displaySafeText(relative(process.cwd(), absPath).replace(/\\/g, "/") || absPath);
+    if (isMultiple) {
+      const matchLines = [];
+      let pos = 0;
+      while (pos < fileContent.length) {
+        const idx = fileContent.indexOf(oldString, pos);
+        if (idx === -1) break;
+        const line = fileContent.slice(0, idx).split("\n").length;
+        matchLines.push(line);
+        pos = idx + Math.max(1, oldString.length);
+      }
+      if (matchLines.length > 1) {
+        const lineList = matchLines.slice(0, 5).join(", ");
+        const overflow = matchLines.length > 5 ? ` (+${matchLines.length - 5} more)` : "";
+        return `[token-goat] Edit failed: string matched ${matchLines.length} times in ${relDisplay} on lines ${lineList}${overflow}. Include 2-3 lines of surrounding context to make old_str unique.`;
+      }
+    }
+    if (isNotFound) {
+      const normOld = oldString.replace(/\r\n/g, "\n");
+      const normFile = fileContent.replace(/\r\n/g, "\n");
+      if (normFile.includes(normOld)) {
+        return `[token-goat] Edit failed: string not found in ${relDisplay}, but matches with normalized line endings. Check CRLF vs LF line endings or whitespace.`;
+      }
+      const firstLine = oldString.split(/\r?\n/)[0]?.trim() ?? "";
+      if (firstLine.length >= 10) {
+        const fileLines = fileContent.split("\n");
+        const similarLines = [];
+        for (let i = 0; i < fileLines.length; i++) {
+          const lineText = fileLines[i];
+          if (lineText !== void 0 && lineText.includes(firstLine)) {
+            similarLines.push(i + 1);
+            if (similarLines.length >= 3) break;
+          }
+        }
+        if (similarLines.length > 0) {
+          return `[token-goat] Edit failed: string not found in ${relDisplay}. A similar line was found on line ${similarLines.join(", ")} \u2014 view that range to copy exact text.`;
+        }
+      }
+      return `[token-goat] Edit failed: string not found in ${relDisplay}. View the target lines to copy the exact current content and indentation.`;
+    }
+  } catch {
+  }
+  return null;
+}
 function postToolUseFailureHandler(event) {
   try {
     if (!event.sessionId) return passOutput();
@@ -10056,6 +10121,7 @@ function postToolUseFailureHandler(event) {
     const signature = failureSignature(toolName, errorText);
     const ledger = readLedger(target);
     const priorState = ledger.seen[signature];
+    const editDiagnostic = diagnoseEditFailure(event, errorText);
     if (priorState === void 0) {
       ledger.seen[signature] = false;
       ledger.order.push(signature);
@@ -10064,11 +10130,19 @@ function postToolUseFailureHandler(event) {
         if (evicted !== void 0) delete ledger.seen[evicted];
       }
       writeLedger(target, ledger);
+      if (editDiagnostic !== null) {
+        ledger.seen[signature] = true;
+        writeLedger(target, ledger);
+        return contextOutput(editDiagnostic);
+      }
       return passOutput();
     }
     if (priorState) return passOutput();
     ledger.seen[signature] = true;
     writeLedger(target, ledger);
+    if (editDiagnostic !== null) {
+      return contextOutput(editDiagnostic);
+    }
     return contextOutput(repeatFailureNotice(toolName));
   } catch {
     return passOutput();

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-XYLPMQ6I.mjs";
-import "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
-import "./token-goat-chunk-REHUP2OE.mjs";
-import "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-ZQODJQTP.mjs";
+import "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
+import "./token-goat-chunk-ATVQ6IIT.mjs";
+import "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-2SBHUPBF.mjs";
-import "./token-goat-chunk-6RAUVAKW.mjs";
-import "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-7ALFFPJW.mjs";
+import "./token-goat-chunk-YFXFUG3L.mjs";
+import "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/docs/security.md

@@ -15,7 +15,7 @@ Outbound network is reserved to these explicit cases:
 - Google Drive API calls, only if you already authorized Drive in Claude Code. Token-goat never prompts for its own auth.
 - Image fetches from URLs: either explicit via `token-goat fetch-image <url>`, or when the AI agent issues a WebFetch call that returns image content — the hook intercepts and shrinks the image. The URL always originates from the agent's work, not from token-goat itself.
 - `token-goat screenshot <url>` navigates a headless browser to the URL you give it, subject to the target restrictions described below.
-- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
+- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Setting `TOKEN_GOAT_MODEL_CACHE_DIR` adds one more place to look before the network: a directory you name that outlives any single data root, which is how a continuous-integration job stops refetching the weights once per worker. A file taken from there is checked against the same recorded digest as a downloaded one and dropped from the shared directory if it fails, and an entry that is not a plain file of the expected size is passed over without being read at all, so a tampered copy costs a download and cannot substitute different weights, stall the read, or fill the disk. Token-goat also writes there, and treats the directory as somebody else's: it creates its temporary file exclusively rather than through whatever is already sitting at that name, and removes only what it created. Point it at a directory you control all the same, since nothing token-goat does can stop another writer filling it with entries that will simply be rejected. It is an environment variable only, so no project config file can point it anywhere. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
 - The first optical-character read of an image downloads the English language data (about 4 MB) from `cdn.jsdelivr.net`, at a fixed version path. Subsequent reads use the local cache. This happens for an explicit `token-goat image-text`, and also for the automatic text extraction the image-shrink hook performs when the agent reads a screenshot; turn the automatic one off with `image_shrink.ocr_enabled = false`.
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.8",
+  "version": "2.9.10",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",