token-goat 2.9.9 → 2.9.10

package/dist/{token-goat-chunk-K5GKX6ND.mjs → token-goat-chunk-2TJBY5RD.mjs}

@@ -4,14 +4,14 @@ import {
   buildEvent,
   relay,
   relayInProcess
-} from "./token-goat-chunk-P5SQX2VK.mjs";
+} from "./token-goat-chunk-ZQODJQTP.mjs";
 import {
   MAX_STDIN_BYTES,
   readStdinJson
-} from "./token-goat-chunk-QCHD2ENV.mjs";
-import "./token-goat-chunk-BYDDWQ2T.mjs";
-import "./token-goat-chunk-OBDTBOQA.mjs";
-import "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
+import "./token-goat-chunk-ATVQ6IIT.mjs";
+import "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-PNMGVJ4C.mjs → token-goat-chunk-7ALFFPJW.mjs}

@@ -86,7 +86,7 @@ import {
   runZipRead,
   symbolNamesInFile,
   upsertNote
-} from "./token-goat-chunk-L6Q2XM5X.mjs";
+} from "./token-goat-chunk-YFXFUG3L.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   GEMINI_TOOL_NAME_MAP,
@@ -108,7 +108,7 @@ import {
   runReconcile,
   storeWebOutput,
   summarizeResidentContext
-} from "./token-goat-chunk-QCHD2ENV.mjs";
+} from "./token-goat-chunk-SLGOIXKF.mjs";
 import {
   AGENT_SALT_MARKER,
   BASH_OUTPUT_SUBDIR,
@@ -238,7 +238,7 @@ import {
   visionTokensSavedByText,
   walkProject,
   writeCompact
-} from "./token-goat-chunk-BYDDWQ2T.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   C,
   CONFIG_KEY_ENV_OVERRIDES,
@@ -372,7 +372,7 @@ import {
   withFileLock,
   withRetryOnLock,
   writeJsonSettings
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   __export,
   init_define_import_meta_env
@@ -15761,7 +15761,7 @@ async function cmdMcpServe() {
   let StdioServerTransport;
   try {
     ;
-    ({ createMcpServer } = await import("./token-goat-chunk-LQ3SGWIW.mjs"));
+    ({ createMcpServer } = await import("./token-goat-chunk-DCYHAUW3.mjs"));
     ({ StdioServerTransport } = await import("./token-goat-chunk-EVC4TOLE.mjs"));
   } catch (err2) {
     process.stderr.write(
@@ -15786,7 +15786,7 @@ async function cmdHook(event, opts) {
   if (typeof opts.harness === "string" && opts.harness.length > 0) {
     process.env[ENV_KEYS.HARNESS_OVERRIDE] = opts.harness;
   }
-  const { relay } = await import("./token-goat-chunk-K5GKX6ND.mjs");
+  const { relay } = await import("./token-goat-chunk-2TJBY5RD.mjs");
   await relay(event);
 }
 async function cmdInstall(opts) {
@@ -16719,7 +16719,7 @@ function emitExtraFileArgsNote(command, first, extras, opts = {}) {
 }
 async function cmdCompress(opts) {
   try {
-    const bashRunner = await import("./token-goat-chunk-WBPVYAEO.mjs");
+    const bashRunner = await import("./token-goat-chunk-JS44SRAX.mjs");
     if (opts.compress === false) {
       process.exitCode = bashRunner.runRaw(opts.cmd, parseTimeout(opts.timeout, bashRunner.DEFAULT_TIMEOUT_SECONDS));
       return;

package/dist/{token-goat-chunk-OBDTBOQA.mjs → token-goat-chunk-ATVQ6IIT.mjs}

@@ -2,7 +2,7 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   detectHarness
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";

package/dist/{token-goat-chunk-LQ3SGWIW.mjs → token-goat-chunk-DCYHAUW3.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-L6Q2XM5X.mjs";
+} from "./token-goat-chunk-YFXFUG3L.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-BYDDWQ2T.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   ENV_KEYS,
   VERSION,
@@ -48,7 +48,7 @@ import {
   recordStat,
   resolveProjectRoot,
   savedTokensFromBytes
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/{token-goat-chunk-DRH4CVGF.mjs → token-goat-chunk-DSHYDU53.mjs}

@@ -7,11 +7,11 @@ import {
   expandGlobs,
   leftoverIntegrations,
   run
-} from "./token-goat-chunk-PNMGVJ4C.mjs";
-import "./token-goat-chunk-L6Q2XM5X.mjs";
-import "./token-goat-chunk-QCHD2ENV.mjs";
-import "./token-goat-chunk-BYDDWQ2T.mjs";
-import "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-7ALFFPJW.mjs";
+import "./token-goat-chunk-YFXFUG3L.mjs";
+import "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
+import "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import "./token-goat-chunk-A37V4PBF.mjs";
 export {

package/dist/{token-goat-chunk-WBPVYAEO.mjs → token-goat-chunk-JS44SRAX.mjs}

@@ -3,7 +3,7 @@ const require = __cjsRequire(import.meta.url);
 import {
   deliveredOutputBytes,
   wrappedShell
-} from "./token-goat-chunk-OBDTBOQA.mjs";
+} from "./token-goat-chunk-ATVQ6IIT.mjs";
 import {
   ToolFilter,
   capTokens,
@@ -15,7 +15,7 @@ import {
   recordStat,
   selectFilter,
   shlexSplit
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/{token-goat-chunk-BYDDWQ2T.mjs → token-goat-chunk-PA5UXNOT.mjs}

@@ -101,7 +101,7 @@ import {
   toDisplayPath,
   toKB,
   withFileLock
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";
@@ -10277,7 +10277,8 @@ async function copyFromSharedCache(shared, file, target) {
   const source = path7.join(shared, file.name);
   const temp = `${target}.${process.pid}.shared`;
   try {
-    if (!fs11.existsSync(source)) return false;
+    const info = fs11.lstatSync(source, { throwIfNoEntry: false });
+    if (!info?.isFile() || info.size !== file.bytes) return false;
     fs11.copyFileSync(source, temp);
     if (await sha256Of(temp) !== file.sha256) {
       fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
@@ -10297,12 +10298,15 @@ async function copyFromSharedCache(shared, file, target) {
 function publishToSharedCache(shared, file, target) {
   const destination = path7.join(shared, file.name);
   const temp = `${destination}.${process.pid}.partial`;
+  let created = false;
   try {
     if (fs11.existsSync(destination)) return;
     fs11.mkdirSync(path7.dirname(destination), { recursive: true });
-    fs11.copyFileSync(target, temp);
+    fs11.copyFileSync(target, temp, fs11.constants.COPYFILE_EXCL);
+    created = true;
     fs11.renameSync(temp, destination);
   } catch {
+    if (!created) return;
     try {
       fs11.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
     } catch {

package/dist/{token-goat-chunk-QCHD2ENV.mjs → token-goat-chunk-SLGOIXKF.mjs}

@@ -9,7 +9,7 @@ import {
   isBlobStale,
   loadBlob,
   storeBlob
-} from "./token-goat-chunk-BYDDWQ2T.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   copilotCliMcpToolsDir,
@@ -25,7 +25,7 @@ import {
   resolveIndexPath,
   shortFingerprint,
   toDisplayPath
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-KIEOFWLL.mjs → token-goat-chunk-VCEK77ED.mjs}

@@ -12,7 +12,7 @@ init_define_import_meta_env();
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.9.9";
+    return "2.9.10";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");

package/dist/{token-goat-chunk-L6Q2XM5X.mjs → token-goat-chunk-YFXFUG3L.mjs}

@@ -67,7 +67,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-chunk-BYDDWQ2T.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   Database,
   PER_FILE_COUNTERFACTUAL_CEILING,
@@ -125,7 +125,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-EEIDFMEM.mjs";

package/dist/{token-goat-chunk-P5SQX2VK.mjs → token-goat-chunk-ZQODJQTP.mjs}

@@ -18,7 +18,7 @@ import {
   storeWebOutput,
   summarizeResidentContext,
   taskListPruneHint
-} from "./token-goat-chunk-QCHD2ENV.mjs";
+} from "./token-goat-chunk-SLGOIXKF.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GENERIC_SERVED_OUTPUT_KEY,
@@ -125,12 +125,12 @@ import {
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-BYDDWQ2T.mjs";
+} from "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   bashOutputCapBytes,
   canRunWrappedShell,
   deliveredOutputBytes
-} from "./token-goat-chunk-OBDTBOQA.mjs";
+} from "./token-goat-chunk-ATVQ6IIT.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
   ENV_KEYS,
@@ -194,7 +194,7 @@ import {
   stripAnsiEscapes,
   toDisplayPath,
   toKB
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -798,7 +798,7 @@ init_define_import_meta_env();
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-DRH4CVGF.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-DSHYDU53.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {

package/dist/token-goat-hook.mjs

@@ -2,11 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   relayInProcess
-} from "./token-goat-chunk-P5SQX2VK.mjs";
-import "./token-goat-chunk-QCHD2ENV.mjs";
-import "./token-goat-chunk-BYDDWQ2T.mjs";
-import "./token-goat-chunk-OBDTBOQA.mjs";
-import "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-ZQODJQTP.mjs";
+import "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
+import "./token-goat-chunk-ATVQ6IIT.mjs";
+import "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/dist/token-goat.core.mjs

@@ -2,13 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   run
-} from "./token-goat-chunk-PNMGVJ4C.mjs";
-import "./token-goat-chunk-L6Q2XM5X.mjs";
-import "./token-goat-chunk-QCHD2ENV.mjs";
-import "./token-goat-chunk-BYDDWQ2T.mjs";
+} from "./token-goat-chunk-7ALFFPJW.mjs";
+import "./token-goat-chunk-YFXFUG3L.mjs";
+import "./token-goat-chunk-SLGOIXKF.mjs";
+import "./token-goat-chunk-PA5UXNOT.mjs";
 import {
   installEpipeGuard
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-VCEK77ED.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
 import {
   init_define_import_meta_env

package/docs/security.md

@@ -15,7 +15,7 @@ Outbound network is reserved to these explicit cases:
 - Google Drive API calls, only if you already authorized Drive in Claude Code. Token-goat never prompts for its own auth.
 - Image fetches from URLs: either explicit via `token-goat fetch-image <url>`, or when the AI agent issues a WebFetch call that returns image content — the hook intercepts and shrinks the image. The URL always originates from the agent's work, not from token-goat itself.
 - `token-goat screenshot <url>` navigates a headless browser to the URL you give it, subject to the target restrictions described below.
-- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Setting `TOKEN_GOAT_MODEL_CACHE_DIR` adds one more place to look before the network: a directory you name that outlives any single data root, which is how a continuous-integration job stops refetching the weights once per worker. A file taken from there is checked against the same recorded digest as a downloaded one and dropped from the shared directory if it fails, so a tampered copy costs a download and cannot substitute different weights. It is an environment variable only, so no project config file can point it anywhere. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
+- The first `token-goat semantic` run on a machine downloads the embedding model from `huggingface.co`, pinned to an immutable commit rather than a mutable branch and checked against a recorded SHA-256 and byte length before it is used, and only once `onnxruntime-node` has been installed (see below — it is not part of a default install). Subsequent runs use the local cache, re-verify it, and make no network call. Setting `TOKEN_GOAT_MODEL_CACHE_DIR` adds one more place to look before the network: a directory you name that outlives any single data root, which is how a continuous-integration job stops refetching the weights once per worker. A file taken from there is checked against the same recorded digest as a downloaded one and dropped from the shared directory if it fails, and an entry that is not a plain file of the expected size is passed over without being read at all, so a tampered copy costs a download and cannot substitute different weights, stall the read, or fill the disk. Token-goat also writes there, and treats the directory as somebody else's: it creates its temporary file exclusively rather than through whatever is already sitting at that name, and removes only what it created. Point it at a directory you control all the same, since nothing token-goat does can stop another writer filling it with entries that will simply be rejected. It is an environment variable only, so no project config file can point it anywhere. Skip the download entirely by setting `indexing.embeddings_enabled = false` (it is on by default), in which case `semantic` falls back to full-text search.
 - The first optical-character read of an image downloads the English language data (about 4 MB) from `cdn.jsdelivr.net`, at a fixed version path. Subsequent reads use the local cache. This happens for an explicit `token-goat image-text`, and also for the automatic text extraction the image-shrink hook performs when the agent reads a screenshot; turn the automatic one off with `image_shrink.ocr_enabled = false`.
 
 **One switch for all of it.** Set `network.offline = true` (env `TOKEN_GOAT_OFFLINE`) and every one of the paths above refuses instead of connecting, saying so rather than failing quietly. Anything already cached keeps working: a machine that has the embedding model still runs `semantic`, and one that has the language data still reads text out of images. This is one of the settings a per-project config file may not touch, so cloning a repository cannot switch it back off.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-goat",
-  "version": "2.9.9",
+  "version": "2.9.10",
   "description": "Surgical token-reduction companion for Claude Code and other AI coding agents",
   "type": "module",
   "main": "./dist/token-goat.mjs",