token-goat 2.9.8 → 2.9.9

package/README.md

@@ -37,7 +37,7 @@ Restart your AI sessions. Run `token-goat stats` a couple of minutes after your
 
 > **Built and continually improved, free, by one person. If it saves you tokens, drop a ⭐️ at the top of this page. One click. Makes my day. Also, if you'd like anything added, [drop me a line](mailto:token-goat@dfkhelper.com).**
 
-[Install](docs/install.md) · [CLI](docs/cli.md) · [What gets installed?](docs/install.md#what-gets-installed) · [Stats](#stats-display) · [Security & uninstall](docs/security.md)
+[Install](docs/install.md) · [CLI](docs/cli.md) · [Architecture Q&A](docs/architecture-qa.html) · [What gets installed?](docs/install.md#what-gets-installed) · [Stats](#stats-display) · [Security & uninstall](docs/security.md)
 
 ---
 
@@ -323,7 +323,7 @@ corpus of captured shell output through the real compression path and reports ho
 result got, alongside a count of the lines each case is not allowed to lose. Deleting output makes
 the first number look better, so the second one is what keeps the first honest.
 
-Every command, with its flags, its output, and the comparison workflows that chain them: **[CLI reference](docs/cli.md)**.
+Every command, with its flags, its output, and the comparison workflows that chain them: **[CLI reference](docs/cli.md)**. For architectural analysis, empirical evaluations, and technical answers to common engineering questions: **[Architecture & Technical Q&A](docs/architecture-qa.html)**.
 
 ## MCP server
 

package/SECURITY.md

@@ -101,7 +101,7 @@ For a scanner that ingests a bill of materials rather than a lockfile, `npm run
 
 ## Verifying what you installed
 
-Every published version is built and pushed by one workflow, [`.github/workflows/publish.yml`](.github/workflows/publish.yml), which runs only when a GitHub release is published (or manually, and then only from `main`). It publishes with npm provenance, so npm holds a signed attestation tying the tarball to the commit and workflow run that produced it. Nothing is ever published from a laptop.
+Every published version is built and pushed by one workflow, [`.github/workflows/publish.yml`](.github/workflows/publish.yml), which runs only when a GitHub release is published (or manually, and then only from `main`). It publishes with npm provenance, so npm holds a signed attestation tying the tarball to the commit and workflow run that produced it. Nothing is ever published from a developer workstation.
 
 To check a copy you already have:
 

package/dist/{token-goat-chunk-TXZY7C24.mjs → token-goat-chunk-BYDDWQ2T.mjs}

@@ -101,7 +101,7 @@ import {
   toDisplayPath,
   toKB,
   withFileLock
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";
@@ -10268,6 +10268,47 @@ function modelDir() {
 function downloadUrl(file) {
   return `https://huggingface.co/${DEFAULT_MODEL}/resolve/${PINNED_MODEL_REVISION}/${file.name}`;
 }
+function sharedModelCacheDir() {
+  const raw = process.env["TOKEN_GOAT_MODEL_CACHE_DIR"]?.trim();
+  if (!raw) return null;
+  return path7.join(raw, ...DEFAULT_MODEL.split("/"), PINNED_MODEL_REVISION);
+}
+async function copyFromSharedCache(shared, file, target) {
+  const source = path7.join(shared, file.name);
+  const temp = `${target}.${process.pid}.shared`;
+  try {
+    if (!fs11.existsSync(source)) return false;
+    fs11.copyFileSync(source, temp);
+    if (await sha256Of(temp) !== file.sha256) {
+      fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+      fs11.rmSync(source, { force: true, maxRetries: 20, retryDelay: 25 });
+      return false;
+    }
+    fs11.renameSync(temp, target);
+    return true;
+  } catch {
+    try {
+      fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+    } catch {
+    }
+    return false;
+  }
+}
+function publishToSharedCache(shared, file, target) {
+  const destination = path7.join(shared, file.name);
+  const temp = `${destination}.${process.pid}.partial`;
+  try {
+    if (fs11.existsSync(destination)) return;
+    fs11.mkdirSync(path7.dirname(destination), { recursive: true });
+    fs11.copyFileSync(target, temp);
+    fs11.renameSync(temp, destination);
+  } catch {
+    try {
+      fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+    } catch {
+    }
+  }
+}
 var _ort = null;
 var _ortError = null;
 var _ortLoadAttempted = false;
@@ -10363,6 +10404,7 @@ async function ensureModelFiles(modelName = DEFAULT_MODEL) {
   ensureDataDirPrivate();
   const dir = modelDir();
   const offline = loadConfig().network.offline;
+  const shared = sharedModelCacheDir();
   for (const file of MODEL_FILES) {
     const target = path7.join(dir, file.name);
     if (fs11.existsSync(target)) {
@@ -10370,6 +10412,10 @@ async function ensureModelFiles(modelName = DEFAULT_MODEL) {
       if (digest === file.sha256) continue;
       fs11.rmSync(target, { force: true });
     }
+    if (shared) {
+      fs11.mkdirSync(path7.dirname(target), { recursive: true });
+      if (await copyFromSharedCache(shared, file, target)) continue;
+    }
     if (offline) {
       throw new Error(
         `Offline mode is on (network.offline): refusing to download ${file.name} for the embedding model. Copy the pinned files into ${dir} on a connected machine to use semantic search here.`
@@ -10380,6 +10426,7 @@ async function ensureModelFiles(modelName = DEFAULT_MODEL) {
       `Downloading the embedding model, once (${file.name}, ${Math.round(file.bytes / 1024 / 1024)} MB) into ${dir}`
     );
     await download(file, target);
+    if (shared) publishToSharedCache(shared, file, target);
   }
   return dir;
 }
@@ -20023,6 +20070,41 @@ function readIntToolInput(event, key) {
   }
   return void 0;
 }
+function readRequestedSliceWindow(event) {
+  const rawOffset = readIntToolInput(event, "offset");
+  const rawLimit = readIntToolInput(event, "limit");
+  if (rawOffset !== void 0 || rawLimit !== void 0) {
+    return {
+      offset: rawOffset !== void 0 && rawOffset >= 1 ? Math.floor(rawOffset) : 1,
+      limit: rawLimit !== void 0 && rawLimit > 0 ? Math.floor(rawLimit) : void 0,
+      isExplicitSlice: true
+    };
+  }
+  const rawRange = event.toolInput["view_range"] ?? event.toolInput["lines"] ?? event.toolInput["range"];
+  if (Array.isArray(rawRange) && rawRange.length >= 1) {
+    const rawStart = Number(rawRange[0]);
+    const startVal = Number.isFinite(rawStart) && rawStart >= 1 ? Math.floor(rawStart) : 1;
+    if (rawRange.length >= 2) {
+      const rawEnd = Number(rawRange[1]);
+      if (rawEnd === -1) {
+        return { offset: startVal, isExplicitSlice: true };
+      }
+      if (Number.isFinite(rawEnd) && rawEnd >= startVal) {
+        const lineCount = Math.floor(rawEnd - startVal + 1);
+        return { offset: startVal, limit: lineCount, isExplicitSlice: true };
+      }
+    }
+    return { offset: startVal, isExplicitSlice: true };
+  }
+  const startLine = readIntToolInput(event, "start_line") ?? readIntToolInput(event, "startLine") ?? readIntToolInput(event, "start");
+  const endLine = readIntToolInput(event, "end_line") ?? readIntToolInput(event, "endLine") ?? readIntToolInput(event, "end");
+  if (startLine !== void 0 || endLine !== void 0) {
+    const effectiveStart = startLine !== void 0 && startLine >= 1 ? Math.floor(startLine) : 1;
+    const effectiveLimit = endLine !== void 0 && endLine >= effectiveStart ? Math.floor(endLine - effectiveStart + 1) : void 0;
+    return { offset: effectiveStart, limit: effectiveLimit, isExplicitSlice: true };
+  }
+  return { isExplicitSlice: false };
+}
 function readStartLine(event) {
   const resp = event.raw["tool_response"];
   if (resp === null || typeof resp !== "object") return 1;
@@ -20086,11 +20168,10 @@ function scanRequestedSlice(absPath, offset, limit) {
   }
 }
 function estimateRequestedSlice(event, absPath) {
-  const offset = readIntToolInput(event, "offset");
-  const limit = readIntToolInput(event, "limit");
-  if (limit === void 0 || limit <= 0) return { kind: "unbounded" };
-  const effectiveOffset = offset !== void 0 && offset >= 1 ? offset : 1;
-  const scan = scanRequestedSlice(absPath, effectiveOffset, limit);
+  const window2 = readRequestedSliceWindow(event);
+  if (window2.limit === void 0 || window2.limit <= 0) return { kind: "unbounded" };
+  const effectiveOffset = window2.offset !== void 0 && window2.offset >= 1 ? window2.offset : 1;
+  const scan = scanRequestedSlice(absPath, effectiveOffset, window2.limit);
   if (scan === null) return { kind: "unbounded" };
   if (scan.nearSingleLine) return { kind: "nearSingleLine" };
   if (scan.trustworthy) return { kind: "bytes", bytes: scan.bytes };
@@ -20330,7 +20411,7 @@ function preReadHandlerInner(event) {
     } catch {
     }
   }
-  const compactUnrangedRead = readIntToolInput(event, "offset") === void 0 && readIntToolInput(event, "limit") === void 0;
+  const compactUnrangedRead = !readRequestedSliceWindow(event).isExplicitSlice;
   if (event.toolName !== "Grep" && compactUnrangedRead && loadConfig().hints.stable_doc_compacts && _isDocFile(normalized)) {
     const compactPath = compactPathFor(normalized);
     if (isCompactFresh(compactPath, normalized)) {
@@ -20413,7 +20494,7 @@ function preReadHandlerInner(event) {
           }
           return denyOutput(message);
         }
-        const unrangedRead = readIntToolInput(event, "offset") === void 0 && readIntToolInput(event, "limit") === void 0;
+        const unrangedRead = !readRequestedSliceWindow(event).isExplicitSlice;
         if (loadConfig().hints.subagent_markdown_first_read_deny && event.agentId !== void 0 && unrangedRead && SUBAGENT_MD_FIRST_READ_DENY_EXT_RE.test(basename12) && markdownSize !== null && markdownSize >= SUBAGENT_MD_FIRST_READ_DENY_BYTES) {
           recordStat("subagent_markdown_first_read_deny", 0, 0);
           return denyOutput(
@@ -20783,9 +20864,9 @@ function readWindowFromDisk(event, normalized) {
   const size = statSize(normalized);
   if (size === null || size > SLICE_ESTIMATE_SCAN_CAP_BYTES) return null;
   const text = decodeSource(fs21.readFileSync(normalized));
-  const limit = readIntToolInput(event, "limit");
-  const offset = readIntToolInput(event, "offset");
-  const start = offset !== void 0 && offset >= 1 ? offset : 1;
+  const window2 = readRequestedSliceWindow(event);
+  const start = window2.offset !== void 0 && window2.offset >= 1 ? window2.offset : 1;
+  const limit = window2.limit;
   if (start === 1 && (limit === void 0 || limit <= 0)) return text;
   const lines2 = text.split("\n");
   const from = start - 1;
@@ -20908,7 +20989,7 @@ function elideAlreadyServedLines(event, respText) {
 function structuralFoldInputs(event, respText) {
   const filePath = getFilePath(event);
   if (filePath === void 0) return null;
-  if (readIntToolInput(event, "offset") !== void 0 || readIntToolInput(event, "limit") !== void 0) return null;
+  if (readRequestedSliceWindow(event).isExplicitSlice) return null;
   if (isTruncatedReadDelivery(event, respText)) return null;
   if (redactSecrets(respText).count > 0) return null;
   const parsed = parseNumberedReadResult(respText, readStartLine(event));
@@ -20943,14 +21024,15 @@ function foldCodeBodies(event, respText) {
   if (filePath === void 0) return null;
   const normalized = normalizePath(filePath);
   if (isImagePath(normalized)) return null;
-  const requestedOffset = readIntToolInput(event, "offset");
+  const sliceWin = readRequestedSliceWindow(event);
+  const requestedOffset = sliceWin.offset;
   if (requestedOffset !== void 0 && readStartLine(event) !== requestedOffset) return null;
   if (isTruncatedReadDelivery(event, respText)) return null;
   if (redactSecrets(respText).count > 0) return null;
   const parsed = parseNumberedReadResult(respText, readStartLine(event));
   if (parsed === null) return null;
   const shown = displaySafePath(toDisplayPath(findProject(getCwd(event) ?? process.cwd())?.root, normalized));
-  const folded = foldDelivery(parsed.rows, normalized, shown, requestedOffset !== void 0 || readIntToolInput(event, "limit") !== void 0);
+  const folded = foldDelivery(parsed.rows, normalized, shown, sliceWin.isExplicitSlice);
   if (folded === null) return null;
   const rewritten = [...parsed.header, fenceUntrustedFileContent(folded.numbered.join("\n")), ...parsed.trailer].join("\n");
   const originalBytes = Buffer.byteLength(respText, "utf-8");

package/dist/{token-goat-chunk-3YANZKER.mjs → token-goat-chunk-DRH4CVGF.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-2SBHUPBF.mjs";
-import "./token-goat-chunk-6RAUVAKW.mjs";
-import "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
-import "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-PNMGVJ4C.mjs";
+import "./token-goat-chunk-L6Q2XM5X.mjs";
+import "./token-goat-chunk-QCHD2ENV.mjs";
+import "./token-goat-chunk-BYDDWQ2T.mjs";
+import "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-Q4VCAIBR.mjs → token-goat-chunk-K5GKX6ND.mjs}

@@ -4,14 +4,14 @@ import {
   buildEvent,
   relay,
   relayInProcess
-} from "./token-goat-chunk-XYLPMQ6I.mjs";
+} from "./token-goat-chunk-P5SQX2VK.mjs";
 import {
   MAX_STDIN_BYTES,
   readStdinJson
-} from "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
-import "./token-goat-chunk-REHUP2OE.mjs";
-import "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-QCHD2ENV.mjs";
+import "./token-goat-chunk-BYDDWQ2T.mjs";
+import "./token-goat-chunk-OBDTBOQA.mjs";
+import "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-JZYJH76S.mjs → token-goat-chunk-KIEOFWLL.mjs}

@@ -12,7 +12,7 @@ init_define_import_meta_env();
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.9.8";
+    return "2.9.9";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -9636,6 +9636,25 @@ function remapToolInput(copilotToolName, input) {
   if (idKey !== undefined && idKey in out) {
     out = Object.assign({}, out, { bash_id: out[idKey] })
   }
+  if (Array.isArray(out.view_range) && out.view_range.length >= 1) {
+    const rawStart = Number(out.view_range[0])
+    if (Number.isFinite(rawStart) && rawStart >= 1) {
+      const mapped = { offset: Math.floor(rawStart) }
+      if (out.view_range.length >= 2) {
+        const rawEnd = Number(out.view_range[1])
+        if (Number.isFinite(rawEnd) && rawEnd >= rawStart) {
+          mapped.limit = Math.floor(rawEnd - rawStart + 1)
+        }
+      }
+      out = Object.assign({}, out, mapped)
+    }
+  }
+  if ('old_str' in out && !('old_string' in out)) {
+    out = Object.assign({}, out, { old_string: out.old_str })
+  }
+  if ('new_str' in out && !('new_string' in out)) {
+    out = Object.assign({}, out, { new_string: out.new_str })
+  }
   return out
 }
 

package/dist/{token-goat-chunk-6RAUVAKW.mjs → token-goat-chunk-L6Q2XM5X.mjs}

@@ -67,7 +67,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   Database,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -125,7 +125,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-EZZ7IJYM.mjs → token-goat-chunk-LQ3SGWIW.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-6RAUVAKW.mjs";
+} from "./token-goat-chunk-L6Q2XM5X.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   ENV_KEYS,
   VERSION,
@@ -48,7 +48,7 @@ import {
   recordStat,
   resolveProjectRoot,
   savedTokensFromBytes
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/{token-goat-chunk-REHUP2OE.mjs → token-goat-chunk-OBDTBOQA.mjs}

@@ -2,7 +2,7 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   detectHarness
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";

package/dist/{token-goat-chunk-XYLPMQ6I.mjs → token-goat-chunk-P5SQX2VK.mjs}

@@ -18,7 +18,7 @@ import {
   storeWebOutput,
   summarizeResidentContext,
   taskListPruneHint
-} from "./token-goat-chunk-VEEHPNBV.mjs";
+} from "./token-goat-chunk-QCHD2ENV.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GENERIC_SERVED_OUTPUT_KEY,
@@ -125,12 +125,12 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   bashOutputCapBytes,
   canRunWrappedShell,
   deliveredOutputBytes
-} from "./token-goat-chunk-REHUP2OE.mjs";
+} from "./token-goat-chunk-OBDTBOQA.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   ENV_KEYS,
@@ -194,7 +194,7 @@ import {
   stripAnsiEscapes,
   toDisplayPath,
   toKB
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -798,7 +798,7 @@ init_define_import_meta_env();
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-3YANZKER.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-DRH4CVGF.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -9994,8 +9994,8 @@ registerHook("post_tool_use", postTaskOutputHandler, { toolName: "TaskOutput" })
 
 // src/hooks_tool_failure.ts
 init_define_import_meta_env();
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, relative } from "node:path";
 var FAILURE_SUFFIX = ".tool-failures.json";
 var MAX_TRACKED_FAILURES = 64;
 var SIGNATURE_ERROR_CHARS = 200;
@@ -10045,6 +10045,71 @@ function repeatFailureNotice(toolName) {
   const tool = toolName === void 0 || toolName === "" ? "This tool" : displaySafeText(toolName);
   return `[token-goat] ${tool} just failed with the same error as an earlier call this session. Retrying it unchanged will fail the same way -- change the arguments, the tool, or the approach.`;
 }
+var MAX_EDIT_DIAGNOSE_BYTES = 10 * 1024 * 1024;
+function diagnoseEditFailure(event, errorText) {
+  const toolName = getToolName(event);
+  if (!toolName || !/^(edit|str_replace_editor)$/i.test(toolName)) {
+    return null;
+  }
+  const isMultiple = /multiple matches|not unique|found \d+ matches|matches \d+ times|more than one match/i.test(errorText);
+  const isNotFound = /no match|not found|could not find|zero matches|string to replace.*not found/i.test(errorText);
+  if (!isMultiple && !isNotFound) {
+    return null;
+  }
+  const filePath = getFilePath(event) ?? (typeof event.toolInput["path"] === "string" ? event.toolInput["path"] : void 0);
+  if (!filePath) return null;
+  const oldString = typeof event.toolInput["old_string"] === "string" ? event.toolInput["old_string"] : typeof event.toolInput["old_str"] === "string" ? event.toolInput["old_str"] : typeof event.toolInput["target"] === "string" ? event.toolInput["target"] : void 0;
+  if (oldString === void 0 || oldString === "") return null;
+  const absPath = normalizePath(filePath);
+  if (!existsSync2(absPath)) return null;
+  try {
+    const stat = statSync4(absPath);
+    if (stat.size > MAX_EDIT_DIAGNOSE_BYTES) return null;
+    const fileContent = readFileSync3(absPath, "utf8");
+    const relDisplay = displaySafeText(relative(process.cwd(), absPath).replace(/\\/g, "/") || absPath);
+    if (isMultiple) {
+      const matchLines = [];
+      let pos = 0;
+      while (pos < fileContent.length) {
+        const idx = fileContent.indexOf(oldString, pos);
+        if (idx === -1) break;
+        const line = fileContent.slice(0, idx).split("\n").length;
+        matchLines.push(line);
+        pos = idx + Math.max(1, oldString.length);
+      }
+      if (matchLines.length > 1) {
+        const lineList = matchLines.slice(0, 5).join(", ");
+        const overflow = matchLines.length > 5 ? ` (+${matchLines.length - 5} more)` : "";
+        return `[token-goat] Edit failed: string matched ${matchLines.length} times in ${relDisplay} on lines ${lineList}${overflow}. Include 2-3 lines of surrounding context to make old_str unique.`;
+      }
+    }
+    if (isNotFound) {
+      const normOld = oldString.replace(/\r\n/g, "\n");
+      const normFile = fileContent.replace(/\r\n/g, "\n");
+      if (normFile.includes(normOld)) {
+        return `[token-goat] Edit failed: string not found in ${relDisplay}, but matches with normalized line endings. Check CRLF vs LF line endings or whitespace.`;
+      }
+      const firstLine = oldString.split(/\r?\n/)[0]?.trim() ?? "";
+      if (firstLine.length >= 10) {
+        const fileLines = fileContent.split("\n");
+        const similarLines = [];
+        for (let i = 0; i < fileLines.length; i++) {
+          const lineText = fileLines[i];
+          if (lineText !== void 0 && lineText.includes(firstLine)) {
+            similarLines.push(i + 1);
+            if (similarLines.length >= 3) break;
+          }
+        }
+        if (similarLines.length > 0) {
+          return `[token-goat] Edit failed: string not found in ${relDisplay}. A similar line was found on line ${similarLines.join(", ")} \u2014 view that range to copy exact text.`;
+        }
+      }
+      return `[token-goat] Edit failed: string not found in ${relDisplay}. View the target lines to copy the exact current content and indentation.`;
+    }
+  } catch {
+  }
+  return null;
+}
 function postToolUseFailureHandler(event) {
   try {
     if (!event.sessionId) return passOutput();
@@ -10056,6 +10121,7 @@ function postToolUseFailureHandler(event) {
     const signature = failureSignature(toolName, errorText);
     const ledger = readLedger(target);
     const priorState = ledger.seen[signature];
+    const editDiagnostic = diagnoseEditFailure(event, errorText);
     if (priorState === void 0) {
       ledger.seen[signature] = false;
       ledger.order.push(signature);
@@ -10064,11 +10130,19 @@ function postToolUseFailureHandler(event) {
         if (evicted !== void 0) delete ledger.seen[evicted];
       }
       writeLedger(target, ledger);
+      if (editDiagnostic !== null) {
+        ledger.seen[signature] = true;
+        writeLedger(target, ledger);
+        return contextOutput(editDiagnostic);
+      }
       return passOutput();
     }
     if (priorState) return passOutput();
     ledger.seen[signature] = true;
     writeLedger(target, ledger);
+    if (editDiagnostic !== null) {
+      return contextOutput(editDiagnostic);
+    }
     return contextOutput(repeatFailureNotice(toolName));
   } catch {
     return passOutput();

package/dist/{token-goat-chunk-2SBHUPBF.mjs → token-goat-chunk-PNMGVJ4C.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-6RAUVAKW.mjs";
+} from "./token-goat-chunk-L6Q2XM5X.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
@@ -108,7 +108,7 @@ import {
   runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-VEEHPNBV.mjs";
+} from "./token-goat-chunk-QCHD2ENV.mjs";
 import {
   AGENT_SALT_MARKER,
   BASH_OUTPUT_SUBDIR,
@@ -238,7 +238,7 @@ import {
   visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -372,7 +372,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   __export,
   init_define_import_meta_env
@@ -15761,7 +15761,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-EZZ7IJYM.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-LQ3SGWIW.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-EVC4TOLE.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -15786,7 +15786,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-Q4VCAIBR.mjs");
+  const { relay } = await import("./token-goat-chunk-K5GKX6ND.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -16719,7 +16719,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-WT5OLTT6.mjs");
+    const bashRunner = await import("./token-goat-chunk-WBPVYAEO.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;

package/dist/{token-goat-chunk-VEEHPNBV.mjs → token-goat-chunk-QCHD2ENV.mjs}

@@ -9,7 +9,7 @@ import {
   isBlobStale,
   loadBlob,
   storeBlob
-} from "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   copilotCliMcpToolsDir,
@@ -25,7 +25,7 @@ import {
   resolveIndexPath,
   shortFingerprint,
   toDisplayPath
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-WT5OLTT6.mjs → token-goat-chunk-WBPVYAEO.mjs}

@@ -3,7 +3,7 @@ const require = __cjsRequire(import.meta.url);
 import {
   deliveredOutputBytes,
   wrappedShell
-} from "./token-goat-chunk-REHUP2OE.mjs";
+} from "./token-goat-chunk-OBDTBOQA.mjs";
 import {
   ToolFilter,
   capTokens,
@@ -15,7 +15,7 @@ import {
   recordStat,
   selectFilter,
   shlexSplit
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-XYLPMQ6I.mjs";
-import "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
-import "./token-goat-chunk-REHUP2OE.mjs";
-import "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-P5SQX2VK.mjs";
+import "./token-goat-chunk-QCHD2ENV.mjs";
+import "./token-goat-chunk-BYDDWQ2T.mjs";
+import "./token-goat-chunk-OBDTBOQA.mjs";
+import "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-2SBHUPBF.mjs";
-import "./token-goat-chunk-6RAUVAKW.mjs";
-import "./token-goat-chunk-VEEHPNBV.mjs";
-import "./token-goat-chunk-TXZY7C24.mjs";
+} from "./token-goat-chunk-PNMGVJ4C.mjs";
+import "./token-goat-chunk-L6Q2XM5X.mjs";
+import "./token-goat-chunk-QCHD2ENV.mjs";
+import "./token-goat-chunk-BYDDWQ2T.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-JZYJH76S.mjs";
+} from "./token-goat-chunk-KIEOFWLL.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/docs/security.md

@@ -15,7 +15,7 @@ Outbound network is reserved to these explicit cases:
 - Google Drive API calls, only if you already authorized Drive in Claude Code. Token-goat never prompts for its own auth.
 - Image fetches from URLs: either explicit via `token-goat fetch-image <url>`, or when the AI agent issues a WebFetch call that returns image content — the hook intercepts and shrinks the image. The URL always originates from the agent's work, not from token-goat itself.
 - `token-goat screenshot <url>` navigates a headless browser to the URL you give it, subject to the target restrictions described below.
-- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
+- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Setting `TOKEN_GOAT_MODEL_CACHE_DIR` adds one more place to look before the network: a directory you name that outlives any single data root, which is how a continuous-integration job stops refetching the weights once per worker. A file taken from there is checked against the same recorded digest as a downloaded one and dropped from the shared directory if it fails, so a tampered copy costs a download and cannot substitute different weights. It is an environment variable only, so no project config file can point it anywhere. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
 - The first optical-character read of an image downloads the English language data (about 4 MB) from `cdn.jsdelivr.net`, at a fixed version path. Subsequent reads use the local cache. This happens for an explicit `token-goat image-text`, and also for the automatic text extraction the image-shrink hook performs when the agent reads a screenshot; turn the automatic one off with `image_shrink.ocr_enabled = false`.
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.8",
+  "version": "2.9.9",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",