token-goat 2.9.9 → 2.9.11

package/dist/{token-goat-chunk-P5SQX2VK.mjs → token-goat-chunk-MKITQ5RY.mjs}

@@ -1,5 +1,10 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
+import {
+  canRunWrappedShell,
+  clipToDeliveryCap,
+  deliveredOutputBytes
+} from "./token-goat-chunk-FDURVZQD.mjs";
 import {
   DEFAULT_RECONCILE_BUDGET_MS,
   HOOK_EVENTS,
@@ -10,7 +15,6 @@ import {
   getWebOutput,
   isReconcileClean,
   lineMayCarryResidentSignal,
-  normalizePayload,
   readStdinJson,
   readTranscriptTail,
   reconcileProject,
@@ -18,7 +22,7 @@ import {
   storeWebOutput,
   summarizeResidentContext,
   taskListPruneHint
-} from "./token-goat-chunk-QCHD2ENV.mjs";
+} from "./token-goat-chunk-V53Z47ZH.mjs";
 import {
   BASH_OUTPUT_SUBDIR,
   GENERIC_SERVED_OUTPUT_KEY,
@@ -38,10 +42,10 @@ import {
   countSymbols,
   enqueueDirtyPathSafe,
   ensureWorkerAlive,
-  estimateTokens,
   extractCompactFromMarker,
   extractMarkdownHeadings,
   fenceUntrusted,
+  fenceUntrustedSpans,
   fenceWithMatches,
   foldDelivery,
   foldDetail,
@@ -90,6 +94,7 @@ import {
   planMarkdownOutline,
   planServedElisions,
   planSourceSkeleton,
+  preToolPathDeclined,
   probeImageMeta,
   recordBashOutput,
   recordBashRerun,
@@ -122,68 +127,51 @@ import {
   takePendingLargeFileHint,
   visionTokens,
   visionTokensSaved,
+  vscodePathAllowed,
   wasCliReadThisSession,
   wasFileReadThisSession,
   wasHintShown
-} from "./token-goat-chunk-BYDDWQ2T.mjs";
-import {
-  bashOutputCapBytes,
-  canRunWrappedShell,
-  deliveredOutputBytes
-} from "./token-goat-chunk-OBDTBOQA.mjs";
+} from "./token-goat-chunk-SY7WTZMW.mjs";
 import {
   BODY_FIRST_TOOL_RESPONSE_KEYS,
-  ENV_KEYS,
-  IDENTICAL_READ_MIN_BODY_BYTES,
   OUTPUT_FIRST_TOOL_RESPONSE_KEYS,
-  PER_FILE_COUNTERFACTUAL_CEILING,
-  UNTRUSTED_TOOL_TAG,
-  VERSION,
   compressOutput,
-  containsLineRun,
   contextOutput,
-  countNoun,
   dedupeConsecutive,
   denyOutput,
   detectFromCommand,
   detectHarness,
   detectLanguage,
-  displaySafePath,
-  displaySafeText,
   emitRewrite,
   emitRewriteIfChanged,
   envBool,
   envInt,
-  extractErrorMessage,
+  estimateTokens,
   extractToolResponseField,
   extractToolResultText,
-  fenceUntrustedFileContent,
   filterByName,
   findProject,
-  foldPath,
   getCwd,
   getDb,
   getFilePath,
   getHarnessName,
   getToolInput,
   getToolName,
-  globalDbPath,
   hasBareBackgroundOrNewline,
   hasUnquotedOperator,
   isMcpErrorResponse,
   isRewriteWorthwhile,
   isUnderSystemTemp,
+  languageHasFlag,
   loadConfig,
   makeDedupHintHandlers,
-  neutralizeSpokenMarkers,
-  normalizePath,
+  normalizePayload,
   passOutput,
+  readCopilotHooksOwners,
   recordStat,
   redactSecrets,
   registerHook,
-  resolveIndexPath,
   resolveMinNetSavingsBytes,
-  runGit,
   runHook,
   savedTokensFromBytes,
   serializeOutput,
@@ -191,10 +179,35 @@ import {
   shlexSplit,
   shortFingerprint,
   splitOwnTrailingNotices,
-  stripAnsiEscapes,
+  stripAnsiEscapes
+} from "./token-goat-chunk-AAEYU2U2.mjs";
+import {
+  ENV_KEYS,
+  IDENTICAL_READ_MIN_BODY_BYTES,
+  PER_FILE_COUNTERFACTUAL_CEILING,
+  UNTRUSTED_TOOL_TAG,
+  VERSION,
+  atomicWriteText,
+  containsLineRun,
+  countNoun,
+  dataDir,
+  displaySafePath,
+  displaySafeText,
+  ensureDirSync,
+  escapesOntoNetworkThroughLinks,
+  extractErrorMessage,
+  fenceUntrustedFileContent,
+  foldPath,
+  globalDbPath,
+  hasCreatedConfig,
+  isInsideRoot,
+  neutralizeSpokenMarkers,
+  normalizePath,
+  resolveIndexPath,
+  runGit,
   toDisplayPath,
   toKB
-} from "./token-goat-chunk-KIEOFWLL.mjs";
+} from "./token-goat-chunk-YCKCFYTM.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -244,6 +257,120 @@ function stripUnsafeSuggestions(text) {
   }
 }
 
+// src/vscode_duplicate.ts
+init_define_import_meta_env();
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+var VSCODE_HOOKS_DIR_ENV = "TOKEN_GOAT_VSCODE_HOOKS_DIR";
+var MARKER_MAX_AGE_MS = 60 * 60 * 1e3;
+var PRUNE_INTERVAL_MS = 5 * 60 * 1e3;
+function markerDir() {
+  return path.join(dataDir(), "vscode-dedupe");
+}
+function foldDir(p) {
+  const forward = p.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? forward.toLowerCase() : forward;
+}
+function shimHooksDir() {
+  const raw = process.env[VSCODE_HOOKS_DIR_ENV];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+function userHooksDir() {
+  return path.join(os.homedir(), ".copilot", "hooks");
+}
+function userScopeCopyIsRedundant(event) {
+  const hooksDir = shimHooksDir();
+  if (hooksDir === void 0) return false;
+  if (foldDir(hooksDir) !== foldDir(userHooksDir())) return false;
+  const cwd = getCwd(event);
+  if (cwd === void 0 || cwd === "") return false;
+  const projectHooksDir = path.join(cwd, ".github", "hooks");
+  if (!vscodePathAllowed(projectHooksDir, cwd)) return false;
+  if (!readCopilotHooksOwners(projectHooksDir).has("vscode")) return false;
+  return hasCreatedConfig(path.join(projectHooksDir, "token-goat.json"));
+}
+function logStandDown(reason, event) {
+  if (process.env["TOKEN_GOAT_LOG"] === void 0 || process.env["TOKEN_GOAT_LOG"] === "") return;
+  try {
+    process.stderr.write(displaySafeText(`token-goat: vscode hook stood down (${reason}) event=${event.eventName} cwd=${getCwd(event) ?? "<none>"}`) + "\n");
+  } catch {
+  }
+}
+function markerName(sessionId, eventName, timestamp) {
+  const raw = `${sessionId}\0${eventName}\0${timestamp}`;
+  let h1 = 2166136261;
+  let h2 = 16777619;
+  for (let i = 0; i < raw.length; i++) {
+    h1 = Math.imul(h1 ^ raw.charCodeAt(i), 16777619) >>> 0;
+    h2 = Math.imul(h2 + raw.charCodeAt(i), 2246822507) >>> 0;
+  }
+  return `${h1.toString(16).padStart(8, "0")}${h2.toString(16).padStart(8, "0")}`;
+}
+function pruneMarkers(dir) {
+  const stamp = path.join(dir, ".pruned");
+  try {
+    const last = fs.statSync(stamp).mtimeMs;
+    if (Date.now() - last < PRUNE_INTERVAL_MS) return;
+  } catch {
+  }
+  try {
+    atomicWriteText(stamp, "");
+  } catch {
+  }
+  const cutoff = Date.now() - MARKER_MAX_AGE_MS;
+  let entries;
+  try {
+    entries = fs.readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry === ".pruned") continue;
+    const full = path.join(dir, entry);
+    try {
+      if (fs.statSync(full).mtimeMs < cutoff) fs.rmSync(full, { force: true });
+    } catch {
+    }
+  }
+}
+function alreadyClaimed(sessionId, eventName, timestamp) {
+  const dir = markerDir();
+  try {
+    ensureDirSync(dir);
+  } catch {
+    return false;
+  }
+  const marker = path.join(dir, markerName(sessionId, eventName, timestamp));
+  try {
+    fs.closeSync(fs.openSync(marker, "wx"));
+  } catch (e) {
+    if (e.code === "EEXIST") return true;
+    return false;
+  }
+  pruneMarkers(dir);
+  return false;
+}
+function shouldSuppressDuplicateVscodeHook(event, harness) {
+  if (harness !== "vscode") return false;
+  try {
+    if (userScopeCopyIsRedundant(event)) {
+      logStandDown("a project-scope install owns this workspace", event);
+      return true;
+    }
+    if (getFilePath(event) !== void 0) return false;
+    const sessionId = event.sessionId;
+    if (typeof sessionId !== "string" || sessionId === "") return false;
+    const timestamp = event.raw["timestamp"];
+    if (typeof timestamp !== "string" || timestamp === "") return false;
+    if (!alreadyClaimed(sessionId, event.eventName, timestamp)) return false;
+    logStandDown("another copy already claimed this event", event);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/hooks_grep.ts
 init_define_import_meta_env();
 function grepIntInput(toolInput, key) {
@@ -258,7 +385,7 @@ function grepIntInput(toolInput, key) {
 function grepSignature(toolInput) {
   const pattern = toolInput["pattern"];
   if (typeof pattern !== "string" || pattern === "") return null;
-  const path3 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
+  const path4 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
   const outputMode = typeof toolInput["output_mode"] === "string" ? toolInput["output_mode"] : "files_with_matches";
   const glob = typeof toolInput["glob"] === "string" ? toolInput["glob"] : "";
   const type = typeof toolInput["type"] === "string" ? toolInput["type"] : "";
@@ -273,7 +400,7 @@ function grepSignature(toolInput) {
   const offset = grepIntInput(toolInput, "offset");
   return JSON.stringify([
     pattern,
-    path3,
+    path4,
     outputMode,
     glob,
     type,
@@ -356,7 +483,6 @@ function foldGrepContentHandler(event) {
   }
 }
 var DOC_EXT_RE = /\.(?:md|mdx|rst|txt)$/i;
-var SOURCE_EXT_RE = /\.(?:java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj|css|scss|sass|less)$/i;
 var STRUCTURAL_DOC_PATTERN_RE = /^(?:\^)?#+\s*/;
 var STRUCTURAL_SOURCE_PATTERN_RE = /^(?:\^|\s)*(?:def|class|function|async\s+def|async\s+function|export\s+(?:default\s+)?(?:class|function|interface|type|const|enum)|func|fn|struct|interface|impl|type)\b/i;
 function extractGrepStructuralSearch(toolInput) {
@@ -375,7 +501,7 @@ function extractGrepStructuralSearch(toolInput) {
   if (DOC_EXT_RE.test(rawPath) && STRUCTURAL_DOC_PATTERN_RE.test(pattern)) {
     return { filePath: rawPath, isDoc: true, isSource: false };
   }
-  if (SOURCE_EXT_RE.test(rawPath) && STRUCTURAL_SOURCE_PATTERN_RE.test(pattern)) {
+  if (languageHasFlag(detectLanguage(rawPath), "grepSource") && STRUCTURAL_SOURCE_PATTERN_RE.test(pattern)) {
     return { filePath: rawPath, isDoc: false, isSource: true };
   }
   return null;
@@ -418,8 +544,8 @@ function isBroadCatchAllGlob(pattern, pathArg) {
 function globSignature(toolInput) {
   const pattern = toolInput["pattern"];
   if (typeof pattern !== "string" || pattern === "") return null;
-  const path3 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
-  return JSON.stringify([pattern, path3]);
+  const path4 = typeof toolInput["path"] === "string" ? toolInput["path"] : "";
+  return JSON.stringify([pattern, path4]);
 }
 var { post: postGlobHandler, pre: preGlobDedupHandler } = makeDedupHintHandlers({
   toolName: "Glob",
@@ -451,8 +577,8 @@ registerHook("post_tool_use", postGlobHandler, { toolName: "Glob" });
 
 // src/hooks_edit.ts
 init_define_import_meta_env();
-import * as path from "node:path";
-import { statSync } from "node:fs";
+import * as path2 from "node:path";
+import { statSync as statSync2 } from "node:fs";
 function postEditHandlerInner(event) {
   const filePath = getFilePath(event);
   if (filePath === void 0) return passOutput();
@@ -479,11 +605,11 @@ function postEditHandlerInner(event) {
   if (loadConfig().hints.stable_doc_compacts) {
     markCompactStale(compactPathFor(normalized));
   }
-  const editedBasename = path.basename(normalized);
+  const editedBasename = path2.basename(normalized);
   if (/\.(md|mdx|markdown|rst)$/i.test(editedBasename)) {
     let editedSize = Infinity;
     try {
-      editedSize = statSync(normalized).size;
+      editedSize = statSync2(normalized).size;
     } catch {
     }
     if (meetsSavingsFloor(editedSize)) {
@@ -505,7 +631,7 @@ registerHook("post_tool_use", postEditHandler, { toolName: "NotebookEdit" });
 
 // src/hooks_write.ts
 init_define_import_meta_env();
-import { readFileSync, statSync as statSync2 } from "node:fs";
+import { readFileSync, statSync as statSync3 } from "node:fs";
 var MAX_LINES_FOR_DIFF = 4e3;
 var MAX_OLD_FILE_BYTES_FOR_DIFF = 4 * 1024 * 1024;
 function splitLines(text) {
@@ -533,11 +659,12 @@ function preWriteRewriteHandler(event) {
     if (getToolName(event) !== "Write") return passOutput();
     const filePath = getFilePath(event);
     if (filePath === void 0) return passOutput();
+    if (preToolPathDeclined(event, filePath)) return passOutput();
     const newContent = getToolInput(event)["content"];
     if (typeof newContent !== "string") return passOutput();
     let stat;
     try {
-      stat = statSync2(filePath);
+      stat = statSync3(filePath);
     } catch {
       return passOutput();
     }
@@ -600,13 +727,15 @@ function mergeManifestFiles(parent, siblingFiles) {
       byPath.set(key, f);
       continue;
     }
+    const mergedSymbols = [.../* @__PURE__ */ new Set([...prev.symbols_read ?? [], ...f.symbols_read ?? []])];
     byPath.set(key, {
       path: prev.path,
       readCount: Math.max(prev.readCount, f.readCount),
       lastReadAt: Math.max(prev.lastReadAt, f.lastReadAt),
       wasEdited: prev.wasEdited || f.wasEdited,
       sizeBytes: f.lastReadAt >= prev.lastReadAt ? f.sizeBytes : prev.sizeBytes,
-      ...prev.wasTruncated || f.wasTruncated ? { wasTruncated: true } : {}
+      ...prev.wasTruncated || f.wasTruncated ? { wasTruncated: true } : {},
+      ...mergedSymbols.length > 0 ? { symbols_read: mergedSymbols } : {}
     });
   }
   return Array.from(byPath.values());
@@ -693,14 +822,14 @@ function buildSafeToDiscardSection(files) {
     if (id === void 0) continue;
     const entry = getBashOutput(id);
     if (entry === null) continue;
-    const flatCommand = entry.command.replace(/[\t\r\n]+/g, " ");
+    const flatCommand = neutralizeSpokenMarkers(entry.command.replace(/[\t\r\n]+/g, " "));
     rerunRows.push("- `" + flatCommand + "` \u2014 an older run of this exact command was superseded; recall the surviving copy with `bash-output " + id + " --full`");
   }
   const supersededReadRows = [];
   for (const f of files) {
     if (f.readCount > 1 || f.wasEdited) {
       const reason = f.wasEdited ? "edited after being read" : "re-read " + f.readCount + "x";
-      supersededReadRows.push("- " + f.path + " (" + reason + " \u2014 only the latest content already in context is current)");
+      supersededReadRows.push("- " + displaySafePath(f.path) + " (" + reason + " \u2014 only the latest content already in context is current)");
     }
   }
   const cachedOutputRows = [];
@@ -708,7 +837,7 @@ function buildSafeToDiscardSection(files) {
     if (rerunHashSet.has(hash)) continue;
     const entry = getBashOutput(id);
     if (entry === null) continue;
-    const flatCommand = entry.command.replace(/[\t\r\n]+/g, " ");
+    const flatCommand = neutralizeSpokenMarkers(entry.command.replace(/[\t\r\n]+/g, " "));
     cachedOutputRows.push("- `" + flatCommand + "` \u2014 recallable via `bash-output " + id + " --full`");
   }
   const total = rerunRows.length + supersededReadRows.length + cachedOutputRows.length;
@@ -798,7 +927,7 @@ init_define_import_meta_env();
 var TRACKED_SKILL = "token-goat";
 var MAX_COMMANDS_SHOWN = 8;
 async function currentCommandNames() {
-  const { buildProgram } = await import("./token-goat-chunk-DRH4CVGF.mjs");
+  const { buildProgram } = await import("./token-goat-chunk-HDL77BN3.mjs");
   return flattenCommandNames(buildCommandManifest(buildProgram()));
 }
 async function recordSkillVersionSnapshot(sessionId, skillName) {
@@ -852,7 +981,7 @@ async function checkSkillVersionDrift(sessionId) {
 
 // src/pending_context.ts
 init_define_import_meta_env();
-import { readFileSync as readFileSync2, rmSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 var PENDING_SUFFIX = ".pending-context.txt";
 var MAX_PENDING_CONTEXT_BYTES = 4096;
@@ -866,7 +995,7 @@ function queuePendingContext(sessionId, text) {
     const merged = existing === null ? trimmed : `${existing}
 ${trimmed}`;
     const capped = merged.length <= MAX_PENDING_CONTEXT_BYTES ? merged : merged.slice(merged.length - MAX_PENDING_CONTEXT_BYTES);
-    mkdirSync(dirname(target), { recursive: true });
+    ensureDirSync(dirname(target));
     writeFileSync(target, capped, "utf8");
   } catch {
   }
@@ -876,7 +1005,7 @@ function drainPendingContext(sessionId) {
   if (target === null) return null;
   const text = readPending(target);
   try {
-    rmSync(target, { force: true });
+    rmSync2(target, { force: true });
   } catch {
   }
   return text;
@@ -1016,6 +1145,19 @@ async function userPromptSubmitHandler(event) {
 }
 var CLAIMED_CHANGE_VERBS_RE = /\b(fix(?:ed|es|ing)?|implement(?:ed|s|ing)?|add(?:ed|s|ing)?|creat(?:e|ed|es|ing)|writ(?:e|ten|es|ing)|refactor(?:ed|s|ing)?|updat(?:e|ed|es|ing)|chang(?:e|ed|es|ing)|edit(?:ed|s|ing)?|modif(?:y|ied|ies|ying)|delet(?:e|ed|es|ing)|remov(?:e|ed|es|ing)|patch(?:ed|es|ing)?|resolv(?:e|ed|es|ing)|replac(?:e|ed|es|ing)|improv(?:e|ed|es|ing)|appl(?:y|ied|ies|ying))\b/i;
 var CLAIMED_COMMIT_VERBS_RE = /\b(commit(?:ted|s|ting)?|push(?:ed|es|ing)?)\b/i;
+var NEGATION_RE = /\b(no|not|n't|never|none|nothing|without)\b/i;
+function claimsUnnegatedChange(message) {
+  const clauses = message.split(/[.;\n]+/);
+  return clauses.some((clause) => {
+    const match = CLAIMED_CHANGE_VERBS_RE.exec(clause);
+    if (!match) {
+      return false;
+    }
+    const wordsBefore = clause.slice(0, match.index).trim().split(/\s+/).filter(Boolean);
+    const nearbyWords = wordsBefore.slice(-4).join(" ");
+    return !NEGATION_RE.test(nearbyWords);
+  });
+}
 function subagentStopHandler(event) {
   try {
     if (!event.sessionId) {
@@ -1031,7 +1173,7 @@ function subagentStopHandler(event) {
         const gitOutput = result.stdout.trim();
         if (!gitOutput) {
           const lastAssistantMessage = event.raw["last_assistant_message"] || "";
-          const claimsChanges = CLAIMED_CHANGE_VERBS_RE.test(lastAssistantMessage);
+          const claimsChanges = claimsUnnegatedChange(lastAssistantMessage);
           const claimsCommitted = CLAIMED_COMMIT_VERBS_RE.test(lastAssistantMessage);
           if (claimsChanges && !claimsCommitted) {
             console.warn(
@@ -1073,7 +1215,7 @@ function reconcileNote(cwd, indexed) {
   try {
     const budgetMs = envInt(ENV_KEYS.RECONCILE_BUDGET_MS, DEFAULT_RECONCILE_BUDGET_MS, 0, 6e4);
     const result = reconcileProject({ cwd, budgetMs });
-    if (isReconcileClean(result)) return null;
+    if (isReconcileClean(result) && !result.budgetExhausted) return null;
     const parts = [];
     if (result.changed.length > 0) parts.push(`${result.changed.length} changed`);
     if (result.added.length > 0) parts.push(`${result.added.length} new`);
@@ -1081,6 +1223,9 @@ function reconcileNote(cwd, indexed) {
     const breakdown = parts.length > 1 ? ` (${parts.join(", ")})` : "";
     const truncated = result.budgetExhausted ? ` (sweep stopped at its time budget with ${countNoun(result.unscanned, "file")} unchecked, so there may be more)` : "";
     const total = result.changed.length + result.added.length + result.removed.length;
+    if (total === 0) {
+      return `token-goat: index drift check${truncated} found nothing in the part it had time to scan. Symbol lookups may be briefly stale.`;
+    }
     return `token-goat: reindexing ${countNoun(total, "file")} that changed outside this session${breakdown}${truncated}. Symbol lookups may be briefly stale.`;
   } catch {
     return null;
@@ -1693,11 +1838,11 @@ function mapInner(r, f) {
 function mapOuter(r, f) {
   return r.matched ? f(r) : r;
 }
-function ab(pa, pb, join2) {
-  return (data, i) => mapOuter(pa(data, i), (ma) => mapInner(pb(data, ma.position), (vb, j) => join2(ma.value, vb, data, i, j)));
+function ab(pa, pb, join3) {
+  return (data, i) => mapOuter(pa(data, i), (ma) => mapInner(pb(data, ma.position), (vb, j) => join3(ma.value, vb, data, i, j)));
 }
-function abc(pa, pb, pc, join2) {
-  return (data, i) => mapOuter(pa(data, i), (ma) => mapOuter(pb(data, ma.position), (mb) => mapInner(pc(data, mb.position), (vc, j) => join2(ma.value, mb.value, vc, data, i, j))));
+function abc(pa, pb, pc, join3) {
+  return (data, i) => mapOuter(pa(data, i), (ma) => mapOuter(pb(data, ma.position), (mb) => mapInner(pc(data, mb.position), (vc, j) => join3(ma.value, mb.value, vc, data, i, j))));
 }
 function ahead(p) {
   return (data, i) => mapOuter(p(data, i), (m1) => ({
@@ -5674,8 +5819,8 @@ function trimCharacterEnd(str, char) {
 function unicodeEscape(str) {
   return str.replace(/[\s\S]/g, (c) => "\\u" + c.charCodeAt().toString(16).padStart(4, "0"));
 }
-function get(obj, path3) {
-  for (const key of path3) {
+function get(obj, path4) {
+  for (const key of path4) {
     if (!obj) {
       return void 0;
     }
@@ -6876,8 +7021,8 @@ function withBrackets(str, brackets) {
   const rbr = typeof brackets[1] === "string" ? brackets[1] : "]";
   return lbr + str + rbr;
 }
-function pathRewrite(path3, rewriter, baseUrl, metadata, elem) {
-  const modifiedPath = typeof rewriter === "function" ? rewriter(path3, metadata, elem) : path3;
+function pathRewrite(path4, rewriter, baseUrl, metadata, elem) {
+  const modifiedPath = typeof rewriter === "function" ? rewriter(path4, metadata, elem) : path4;
   return modifiedPath[0] === "/" && baseUrl ? trimCharacterEnd(baseUrl, "/") + modifiedPath : modifiedPath;
 }
 function formatImage(elem, walk, builder, formatOptions) {
@@ -7201,9 +7346,9 @@ function handleDeprecatedOptions(options) {
     options.selectors.push(...tagDefinitions);
     options.selectors = mergeDuplicatesPreferLast(options.selectors, ((s) => s.selector));
   }
-  function set(obj, path3, value) {
-    const valueKey = path3.pop();
-    for (const key of path3) {
+  function set(obj, path4, value) {
+    const valueKey = path4.pop();
+    for (const key of path4) {
       let nested = obj[key];
       if (!nested) {
         nested = {};
@@ -7493,7 +7638,7 @@ registerHook("post_tool_use", postSkillHandler, { toolName: "Skill" });
 
 // src/hooks_bash.ts
 init_define_import_meta_env();
-import { statSync as statSync3, existsSync, openSync, readSync, closeSync } from "node:fs";
+import { statSync as statSync4, existsSync, openSync as openSync2, readSync, closeSync as closeSync2 } from "node:fs";
 var CD_PREFIX_RE = /^(?:cd\s+(?:"[^"]*"|'[^']*'|\S+)[ \t]*(?:&&|;|\r?\n)\s*)+/;
 function stripCdPrefix(cmd) {
   const stripped = cmd.replace(CD_PREFIX_RE, "");
@@ -7747,7 +7892,7 @@ function workingTreeStatusPaths(gitDir) {
 function enqueueRewrittenPath(absPath) {
   if (/(?:^|[/\\])(?:NUL|nul)$/.test(absPath) || absPath.replace(/\\/g, "/").endsWith("/dev/null")) return;
   try {
-    if (!statSync3(absPath).isFile()) return;
+    if (!statSync4(absPath).isFile()) return;
   } catch {
     return;
   }
@@ -7772,7 +7917,11 @@ function enqueueNonHeadMovingRewrites(cmd, rawCmd, cwd) {
 }
 function isTempPath(fp) {
   const norm = fp.replace(/\\/g, "/");
-  return /^\/tmp\//i.test(norm) || /\/var\/folders\//i.test(norm) || /AppData\/Local\/Temp\//i.test(norm) || norm.startsWith("/c/Users/") && norm.includes("/AppData/Local/Temp/") || isUnderSystemTemp(fp);
+  return /^\/tmp\//i.test(norm) || /\/var\/folders\//i.test(norm) || // Anchored to a local drive root on purpose. Unanchored, this clause said yes to
+  // `//host/share/AppData/Local/Temp/x.md`, and the caller's answer to yes is to stat the path --
+  // which on Windows opens an SMB session to whatever host a command named. A temp directory is
+  // somewhere on a local volume; nothing that starts with two separators is one.
+  /^[a-z]:\/(?:[^/]+\/)*AppData\/Local\/Temp\//i.test(norm) || norm.startsWith("/c/Users/") && norm.includes("/AppData/Local/Temp/") || isUnderSystemTemp(fp);
 }
 function isOrchestratorStateFile(filePath) {
   const basename3 = (filePath.includes("/") ? filePath.split("/").at(-1) : filePath.split("\\").at(-1)) ?? filePath;
@@ -7832,12 +7981,16 @@ var PS_FILE_METHOD_RE = /\[(?:System\.)?IO\.File\]::(?:ReadAllText|ReadAllLines|
 var PS_TEMP_READ_FLOOD_BYTES = 16 * 1024;
 function isLargeFileOnDisk(filePath, floor) {
   try {
-    return statSync3(filePath).size >= floor;
+    return statSync4(filePath).size >= floor;
   } catch {
     return false;
   }
 }
-function extractPowerShellWrappedGetContent(cmd) {
+function commandPathIsTouchable(filePath, event) {
+  if (event === void 0) return !escapesOntoNetworkThroughLinks(filePath);
+  return !preToolPathDeclined(event, filePath);
+}
+function extractPowerShellWrappedGetContent(cmd, event) {
   const w = POWERSHELL_WRAP_RE.exec(cmd);
   if (!w) return null;
   const inner = (w[1] ?? w[2] ?? "").trim();
@@ -7848,10 +8001,13 @@ function extractPowerShellWrappedGetContent(cmd) {
   if (filePath === void 0) return null;
   const flags = classifyFileExtensions(filePath);
   if (flags === null) return null;
-  if (isTempPath(filePath) && !isLargeFileOnDisk(filePath, PS_TEMP_READ_FLOOD_BYTES)) return null;
+  if (isTempPath(filePath)) {
+    if (!commandPathIsTouchable(filePath, event)) return null;
+    if (!isLargeFileOnDisk(filePath, PS_TEMP_READ_FLOOD_BYTES)) return null;
+  }
   return { filePath, ...flags };
 }
-function extractPowerShellFileMethodRead(cmd) {
+function extractPowerShellFileMethodRead(cmd, event) {
   let inner = cmd.trim();
   const w = POWERSHELL_WRAP_RE.exec(inner);
   if (w) {
@@ -7861,13 +8017,16 @@ function extractPowerShellFileMethodRead(cmd) {
   if (!m?.[1]) return null;
   const filePath = m[1];
   if (isOrchestratorStateFile(filePath)) return null;
-  if (isTempPath(filePath) && !isLargeFileOnDisk(filePath, PS_TEMP_READ_FLOOD_BYTES)) return null;
+  if (isTempPath(filePath)) {
+    if (!commandPathIsTouchable(filePath, event)) return null;
+    if (!isLargeFileOnDisk(filePath, PS_TEMP_READ_FLOOD_BYTES)) return null;
+  }
   const flags = classifyFileExtensions(filePath);
   if (flags === null) {
     const { isDoc, isConfig, isSql } = classifyDocConfig(filePath);
-    return { filePath, isDoc, isConfig, isSql };
+    return { filePath, isDoc, isEnv: false, isConfig, isSql };
   }
-  return { filePath, isDoc: flags.isDoc, isConfig: flags.isConfig, isSql: flags.isSql };
+  return { filePath, isDoc: flags.isDoc, isEnv: flags.isEnv, isConfig: flags.isConfig, isSql: flags.isSql };
 }
 function extractRgSymbolSearch(cmd) {
   if (!/^(?:rg|grep)\s+/.test(cmd)) return null;
@@ -8190,36 +8349,6 @@ function extractLineRangeReadsCompound(cmd) {
   }
   return [...merged.values()];
 }
-var SYMBOL_BEARING_LANGUAGES = /* @__PURE__ */ new Set([
-  "python",
-  "typescript",
-  "javascript",
-  "rust",
-  "go",
-  "c",
-  "cpp",
-  "ruby",
-  "java",
-  "csharp",
-  "php",
-  "kotlin",
-  "swift",
-  "scala",
-  "lua",
-  "elixir",
-  "dart",
-  "zig",
-  "r",
-  "sql",
-  "graphql",
-  "proto",
-  "terraform",
-  "bash",
-  "powershell",
-  "apex",
-  "salesforce_metadata",
-  "salesforce_markup"
-]);
 function sedRangeHint(filePath, ranges, tool) {
   const lang = detectLanguage(filePath);
   const rangeReads = ranges.map(([s, e]) => '`token-goat read "' + filePath + "@" + s + "-" + e + '"`');
@@ -8231,7 +8360,7 @@ function sedRangeHint(filePath, ranges, tool) {
   if (lang === "toml" || lang === "json" || lang === "yaml" || lang === "ini") {
     return prefix + 'For config, `token-goat config-get "' + filePath + '" <key>` or `token-goat section "' + filePath + '::<block>"` extracts one value; or ' + allReads + " for exactly those lines.";
   }
-  if (SYMBOL_BEARING_LANGUAGES.has(lang)) {
+  if (languageHasFlag(lang, "symbolBearing")) {
     return prefix + 'For a whole function/class, `token-goat symbol <name>` or `token-goat read "' + filePath + '::<Symbol>"` is robust to line shifts; or ' + allReads + " for exactly those lines.";
   }
   return prefix + "Use " + allReads + " to read exactly those lines.";
@@ -8308,7 +8437,7 @@ function extractGetContentTail(cmd) {
   if (n <= 10) return null;
   const getnMatch = /^(Get-Content|gc)\s+/i.exec(cmd);
   if (!getnMatch) return null;
-  const afterCmd = cmd.slice(getnMatch[0].length);
+  const afterCmd = cmd.slice(getnMatch[0].length).replace(/-Path\s+/i, "");
   const beforeTail = afterCmd.split(/-Tail/i)[0]?.trim() ?? "";
   const afterTail = afterCmd.split(/-Tail\s+\d+/i)[1]?.trim() ?? "";
   const filePath = (beforeTail || afterTail).replace(/^["']|["']$/g, "");
@@ -8321,7 +8450,7 @@ function extractGetContentTail(cmd) {
 function extractGetContentSelectFirst(cmd) {
   const m = /^(Get-Content|gc)\s+([^|]+)\s*\|\s*(Select-Object|select)\s+(-First\s+(\d+))/i.exec(cmd);
   if (!m) return null;
-  const filePath = (m[2]?.trim() ?? "").replace(/^["']|["']$/g, "");
+  const filePath = (m[2]?.trim() ?? "").replace(/^-Path\s+/i, "").replace(/^["']|["']$/g, "");
   const n = parseInt(m[5] ?? "0", 10);
   if (n <= 10) return null;
   if (!filePath) return null;
@@ -8333,7 +8462,7 @@ function extractGetContentSelectFirst(cmd) {
 function taskOutputIsJsonlTranscript(outPath) {
   let fd = null;
   try {
-    fd = openSync(normalizePath(outPath), "r");
+    fd = openSync2(normalizePath(outPath), "r");
     const buf = Buffer.alloc(64);
     const read = readSync(fd, buf, 0, buf.length, 0);
     return buf.subarray(0, read).toString("utf-8").trim().startsWith("{");
@@ -8342,7 +8471,7 @@ function taskOutputIsJsonlTranscript(outPath) {
   } finally {
     if (fd !== null) {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {
       }
     }
@@ -8698,14 +8827,14 @@ function shellQuoteSingle(s) {
 }
 function isCompressibleSingleCommand(cmd) {
   if (!cmd || cmd.length > 65536) return false;
-  if (["&&", "||", "$(", "`"].some((op) => cmd.includes(op))) return false;
-  if (cmd.includes("|") || cmd.includes(";")) return false;
-  if (/[<>]/.test(cmd)) return false;
+  if (["$(", "`"].some((op) => cmd.includes(op))) return false;
+  if (hasUnquotedOperator(cmd, ["&&", "||", "|", ";", "<", ">"])) return false;
   if (hasBareBackgroundOrNewline(cmd)) return false;
   return true;
 }
 function maybeCompressRewrite(event, rawCmd, cmd) {
   if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
+  if (event.raw["_tg_harness"] === "vscode") return null;
   let cfg;
   try {
     cfg = loadConfig().bash_compress;
@@ -8833,18 +8962,24 @@ function elideServedShellLines(cmd, output, priorIds, unknownLineNumbers = false
   }
   const cuts = planServedElisions(rows, bodies);
   if (cuts.length === 0) return null;
-  const out = [];
+  const spans = [];
+  const push = (text, own) => {
+    const sep = spans.length === 0 ? "" : "\n";
+    const prev = spans[spans.length - 1];
+    if (prev !== void 0 && prev.own === true === own) spans[spans.length - 1] = { text: prev.text + sep + text, own };
+    else spans.push({ text: sep + text, own });
+  };
   let at = 0;
   for (const cut of cuts) {
-    for (let i = at; i < cut.start; i++) out.push(rows[i]?.raw ?? "");
+    for (let i = at; i < cut.start; i++) push(rows[i]?.raw ?? "", false);
     const first2 = rows[cut.start];
     const last = rows[cut.start + cut.len - 1];
     if (first2 === void 0 || last === void 0) return null;
-    out.push(servedRunNotice(first2.no, last.no, cut.id, cut.len));
+    push(servedRunNotice(first2.no, last.no, cut.id, cut.len), true);
     at = cut.start + cut.len;
   }
-  for (let i = at; i < rows.length; i++) out.push(rows[i]?.raw ?? "");
-  return out.join("\n");
+  for (let i = at; i < rows.length; i++) push(rows[i]?.raw ?? "", false);
+  return spans;
 }
 function foldShellReadBodies(cmd, output, fileKey, cwd) {
   if (!foldingEnabled()) return null;
@@ -8876,7 +9011,7 @@ function foldShellReadStructure(cmd, filePath, output, fileKey, cwd) {
   const originalBytes = Buffer.byteLength(output, "utf-8");
   let onDisk;
   try {
-    onDisk = statSync3(fileKey).size;
+    onDisk = statSync4(fileKey).size;
   } catch {
     return null;
   }
@@ -8892,6 +9027,23 @@ function foldShellReadStructure(cmd, filePath, output, fileKey, cwd) {
   if (!isStructuralRewriteAccepted(originalBytes, Buffer.byteLength(text, "utf-8"), fold.ratioCap)) return null;
   return { text, kind: fold.kind === "read:markdown_outline" ? "bash_compress:markdown-outline" : "bash_compress:source-skeleton", detail: fold.detail };
 }
+var REWRITE_CLIP_NOTE = "\n[token-goat: rewrite clipped to the harness delivery cap; the pointer above recalls the untouched output]";
+function fenceRewriteWithinCap(spans) {
+  const joined = spans.map((s) => s.text).join("");
+  const fenced = fenceUntrustedSpans(spans, UNTRUSTED_TOOL_TAG);
+  if (fenced === joined) return joined;
+  const overhead = Buffer.byteLength(fenced, "utf-8") - Buffer.byteLength(joined, "utf-8") + Buffer.byteLength(REWRITE_CLIP_NOTE, "utf-8");
+  const cut = clipToDeliveryCap(joined, overhead);
+  if (!cut.clipped) return fenced;
+  const kept = [];
+  let left2 = cut.text.length;
+  for (const s of spans) {
+    if (left2 <= 0) break;
+    kept.push(s.text.length <= left2 ? s : { ...s, text: s.text.slice(0, left2) });
+    left2 -= s.text.length;
+  }
+  return fenceUntrustedSpans(kept, UNTRUSTED_TOOL_TAG) + REWRITE_CLIP_NOTE;
+}
 async function maybeCollapseIdenticalRead(cmd, rawCmd, output, exitCode, cwd, cacheMinBytes) {
   if (process.env["TOKEN_GOAT_BASH_COMPRESS"] === "0") return null;
   if (exitCode !== null && exitCode !== 0) return null;
@@ -8918,7 +9070,8 @@ async function maybeCollapseIdenticalRead(cmd, rawCmd, output, exitCode, cwd, ca
     const priced = (text) => isRewriteWorthwhile({ originalBytes, rewrittenBytes: Buffer.byteLength(text, "utf-8"), noticeBytes: 0, minNetSavingsBytes: resolveMinNetSavingsBytes() });
     let rewrite = null;
     if (elided !== null) {
-      if (priced(elided)) rewrite = { text: elided, reason: "already-served file lines withheld", kind: "bash_compress:served-elide" };
+      const fenced = fenceRewriteWithinCap(elided);
+      if (priced(fenced)) rewrite = { text: fenced, reason: "already-served file lines withheld", kind: "bash_compress:served-elide" };
     } else {
       const structural = foldShellReadStructure(cmd, filePath, output, fileKey, cwd);
       if (structural !== null && priced(structural.text)) {
@@ -8926,7 +9079,10 @@ async function maybeCollapseIdenticalRead(cmd, rawCmd, output, exitCode, cwd, ca
       }
       if (rewrite === null) {
         const folded = foldShellReadBodies(cmd, output, fileKey, cwd);
-        if (folded !== null && priced(folded.text)) rewrite = { text: folded.text, reason: "code bodies folded", kind: "bash_compress:body-fold", detail: foldDetail(fileKey, folded.folds) };
+        if (folded !== null) {
+          const fenced = fenceRewriteWithinCap([{ text: folded.text }]);
+          if (priced(fenced)) rewrite = { text: fenced, reason: "code bodies folded", kind: "bash_compress:body-fold", detail: foldDetail(fileKey, folded.folds) };
+        }
       }
     }
     const storedId = await storeBashOutput(cmd, rewrite?.text ?? output, exitCode ?? 0, cwd);
@@ -8950,8 +9106,9 @@ async function maybeElideServedGenericOutput(cmd, output, exitCode, cwd, cacheMi
   let rewrittenText = null;
   if (priorIds.length > 0) {
     const elided = elideServedShellLines(cmd, output, priorIds, true);
-    if (elided !== null && isRewriteWorthwhile({ originalBytes, rewrittenBytes: Buffer.byteLength(elided, "utf-8"), noticeBytes: 0, minNetSavingsBytes: resolveMinNetSavingsBytes() })) {
-      rewrittenText = elided;
+    const fenced = elided === null ? null : fenceRewriteWithinCap(elided);
+    if (fenced !== null && isRewriteWorthwhile({ originalBytes, rewrittenBytes: Buffer.byteLength(fenced, "utf-8"), noticeBytes: 0, minNetSavingsBytes: resolveMinNetSavingsBytes() })) {
+      rewrittenText = fenced;
     }
   }
   const storedId = await storeBashOutput(cmd, rewrittenText ?? output, exitCode ?? 0, cwd);
@@ -9037,17 +9194,10 @@ function maybeFoldCurlHtml(cmd, output, id) {
 `;
   const noticeBytes = Buffer.byteLength(notice, "utf-8");
   const clipNote = "\n[token-goat: cleaned text clipped to the harness delivery cap; the notice at the top of this output recalls the full raw markup]";
-  const cap = bashOutputCapBytes();
   const fenceOverhead = Buffer.byteLength(fenceUntrusted(cleaned, UNTRUSTED_TOOL_TAG), "utf-8") - Buffer.byteLength(cleaned, "utf-8");
-  const room = cap === null ? null : cap - noticeBytes - fenceOverhead - Buffer.byteLength(clipNote, "utf-8");
-  let body = cleaned;
-  let clipped = "";
-  if (room !== null && room > 0 && Buffer.byteLength(cleaned, "utf-8") > room) {
-    const sliced = Buffer.from(cleaned, "utf-8").subarray(0, room).toString("utf-8");
-    const lastNewline = sliced.lastIndexOf("\n");
-    body = lastNewline > 0 ? sliced.slice(0, lastNewline) : sliced;
-    clipped = clipNote;
-  }
+  const cut = clipToDeliveryCap(cleaned, noticeBytes + fenceOverhead + Buffer.byteLength(clipNote, "utf-8"));
+  const body = cut.text;
+  const clipped = cut.clipped ? clipNote : "";
   const fenced = fenceUntrusted(body, UNTRUSTED_TOOL_TAG) + clipped;
   if (!isRewriteWorthwhile({
     originalBytes,
@@ -9307,6 +9457,20 @@ function preBashHandlerInner(event) {
     }
     return contextOutput(hints.join(" "));
   }
+  const gcTailResult = extractGetContentTail(cmd);
+  if (gcTailResult !== null) {
+    const { filePath, isDoc, isConfig, isSql } = gcTailResult;
+    const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
+    recordStat("session_hint", 0, 0);
+    return contextOutput("`Get-Content -Tail` bypasses read hooks. " + surgicalHintForConfigDoc(hintPath, isConfig, isDoc, isSql));
+  }
+  const gcSelectResult = extractGetContentSelectFirst(cmd);
+  if (gcSelectResult !== null) {
+    const { filePath, isDoc, isConfig, isSql, n } = gcSelectResult;
+    const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
+    recordStat("session_hint", 0, 0);
+    return contextOutput(leadingLinesHint("`Select-Object -First` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql }, preHookCwd));
+  }
   const catJsonPipe = extractCatJsonPipe(cmd);
   if (catJsonPipe !== null) {
     const { filePath } = catJsonPipe;
@@ -9341,7 +9505,7 @@ function preBashHandlerInner(event) {
     const msg = "`" + cmd0 + "` on multiple files loads them all into context. Read each surgically instead:\n" + perPath.join("\n");
     return cdStripped ? contextOutput(msg) : denyOutput(msg);
   }
-  const psGetContentResult = extractPowerShellWrappedGetContent(cmd);
+  const psGetContentResult = extractPowerShellWrappedGetContent(cmd, event);
   if (psGetContentResult !== null) {
     const { filePath, isDoc, isEnv, isConfig, isSql } = psGetContentResult;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
@@ -9402,20 +9566,6 @@ function preBashHandlerInner(event) {
     recordStat("session_hint", 0, 0);
     return contextOutput(leadingLinesHint("`head` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql }, preHookCwd));
   }
-  const gcTailResult = extractGetContentTail(cmd);
-  if (gcTailResult !== null) {
-    const { filePath, isDoc, isConfig, isSql } = gcTailResult;
-    const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
-    recordStat("session_hint", 0, 0);
-    return contextOutput("`Get-Content -Tail` bypasses read hooks. " + surgicalHintForConfigDoc(hintPath, isConfig, isDoc, isSql));
-  }
-  const gcSelectResult = extractGetContentSelectFirst(cmd);
-  if (gcSelectResult !== null) {
-    const { filePath, isDoc, isConfig, isSql, n } = gcSelectResult;
-    const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
-    recordStat("session_hint", 0, 0);
-    return contextOutput(leadingLinesHint("`Select-Object -First` bypasses read hooks. ", hintPath, 1, n, { isConfig, isDoc, isSql }, preHookCwd));
-  }
   const nodeRead = extractNodeFileRead(cmd);
   if (nodeRead !== null) {
     const { filePath, isDoc, isConfig, isSql } = nodeRead;
@@ -9429,16 +9579,16 @@ function preBashHandlerInner(event) {
     recordStat("session_hint", 0, 0);
     return cdStripped ? contextOutput(lead + hint) : denyOutput(lead + hint);
   }
-  const psMethodRead = extractPowerShellFileMethodRead(cmd);
+  const psMethodRead = extractPowerShellFileMethodRead(cmd, event);
   if (psMethodRead !== null) {
-    const { filePath, isDoc, isConfig, isSql } = psMethodRead;
+    const { filePath, isDoc, isEnv, isConfig, isSql } = psMethodRead;
     const hintPath = displaySafePath(cdStripped ? resolveCdHintPath(rawCmd, filePath, hintCwd) : filePath);
     const lead = "PowerShell `[IO.File]::ReadAllText()` bypasses read hooks. ";
     if (isSql) {
       recordStat("session_hint", 0, 0);
       return contextOutput(lead + 'Use `token-goat section "' + hintPath + '::table_name"` to pull one CREATE TABLE / CREATE TYPE block.');
     }
-    const hint = isDoc ? 'Use `token-goat section "' + hintPath + '::SectionHeading"` to read one section.' : isConfig ? 'Use `token-goat config-get "' + hintPath + '" KEY_NAME` or `token-goat section "' + hintPath + '::sectionName"` to read a specific value.' : 'Use `token-goat read "' + hintPath + '::SymbolName"` to extract a specific symbol.';
+    const hint = surgicalHintFor(hintPath, isEnv, isConfig, isDoc);
     recordStat("session_hint", 0, 0);
     return cdStripped ? contextOutput(lead + hint) : denyOutput(lead + hint);
   }
@@ -9499,10 +9649,10 @@ function preBashHandlerInner(event) {
   const curlDl = extractCurlDownload(cmd);
   if (curlDl !== null) {
     const prevPath = getCurlDownloadPath(curlDl.url);
-    const prevResolvedPath = prevPath !== null ? resolveIndexPath(prevPath, preHookCwd ?? process.cwd()) : null;
+    const prevResolvedPath = prevPath !== null && commandPathIsTouchable(prevPath, event) ? resolveIndexPath(prevPath, preHookCwd ?? process.cwd()) : null;
     if (prevPath !== null && prevResolvedPath !== null && !existsSync(prevResolvedPath)) {
       clearCurlDownload(curlDl.url);
-    } else if (prevPath !== null && prevResolvedPath !== null && statSync3(prevResolvedPath).size >= loadConfig().hints.bash_dedup_min_bytes) {
+    } else if (prevPath !== null && prevResolvedPath !== null && statSync4(prevResolvedPath).size >= loadConfig().hints.bash_dedup_min_bytes) {
       recordStat("session_hint", 0, 0);
       return denyOutput(
         "Already downloaded to " + prevPath + " earlier this session. Use `rg '<pattern>' " + prevPath + '` to search it, or `token-goat read "' + prevPath + '::SectionName"` to read a part of it.'
@@ -9636,55 +9786,55 @@ function buildGhApiHint(cmd, stdout, exitCode) {
   return hints.length > 0 ? hints.join(" ") : null;
 }
 function recordBashFileReadsForSessionCache(cmd, cwd) {
-  const resolve = (p) => resolveIndexPath(p, cwd ?? process.cwd());
+  const resolve2 = (p) => resolveIndexPath(p, cwd ?? process.cwd());
   const gcTail = extractGetContentTail(cmd);
   if (gcTail !== null) {
-    markFileTruncated(resolve(gcTail.filePath));
+    markFileTruncated(resolve2(gcTail.filePath));
     return;
   }
   const tail = extractTailFile(cmd);
   if (tail !== null) {
-    markFileTruncated(resolve(tail.filePath));
+    markFileTruncated(resolve2(tail.filePath));
     return;
   }
   const gcSelect = extractGetContentSelectFirst(cmd);
   if (gcSelect !== null) {
-    recordFileLineRange(resolve(gcSelect.filePath), 1, gcSelect.n);
+    recordFileLineRange(resolve2(gcSelect.filePath), 1, gcSelect.n);
     return;
   }
   const head = extractHeadFile(cmd);
   if (head !== null) {
-    recordFileLineRange(resolve(head.filePath), 1, head.n);
+    recordFileLineRange(resolve2(head.filePath), 1, head.n);
     return;
   }
   const cat = extractCatFile(cmd);
   if (cat !== null) {
-    recordFileRead(resolve(cat.filePath));
+    recordFileRead(resolve2(cat.filePath));
     return;
   }
   const catMulti = extractCatFilesMulti(cmd);
   if (catMulti !== null) {
-    for (const r of catMulti) recordFileRead(resolve(r.filePath));
+    for (const r of catMulti) recordFileRead(resolve2(r.filePath));
     return;
   }
   const wslCat = extractWslCatFile(cmd);
   if (wslCat !== null) {
-    recordFileRead(resolve(wslCat.filePath));
+    recordFileRead(resolve2(wslCat.filePath));
     return;
   }
   const nodeRead = extractNodeFileRead(cmd);
   if (nodeRead !== null) {
-    recordFileRead(resolve(nodeRead.filePath));
+    recordFileRead(resolve2(nodeRead.filePath));
     return;
   }
   const psMethod = extractPowerShellFileMethodRead(cmd);
   if (psMethod !== null) {
-    recordFileRead(resolve(psMethod.filePath));
+    recordFileRead(resolve2(psMethod.filePath));
     return;
   }
   const pyRead = extractPythonFileRead(cmd);
   if (pyRead !== null && !pyRead.isOutputFile) {
-    recordFileRead(resolve(pyRead.filePath));
+    recordFileRead(resolve2(pyRead.filePath));
     return;
   }
 }
@@ -9994,7 +10144,7 @@ registerHook("post_tool_use", postTaskOutputHandler, { toolName: "TaskOutput" })
 
 // src/hooks_tool_failure.ts
 init_define_import_meta_env();
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync5, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, relative } from "node:path";
 var FAILURE_SUFFIX = ".tool-failures.json";
 var MAX_TRACKED_FAILURES = 64;
@@ -10036,7 +10186,7 @@ function readLedger(target) {
 }
 function writeLedger(target, ledger) {
   try {
-    mkdirSync2(dirname2(target), { recursive: true });
+    ensureDirSync(dirname2(target));
     writeFileSync2(target, JSON.stringify(ledger), "utf8");
   } catch {
   }
@@ -10063,7 +10213,7 @@ function diagnoseEditFailure(event, errorText) {
   const absPath = normalizePath(filePath);
   if (!existsSync2(absPath)) return null;
   try {
-    const stat = statSync4(absPath);
+    const stat = statSync5(absPath);
     if (stat.size > MAX_EDIT_DIAGNOSE_BYTES) return null;
     const fileContent = readFileSync3(absPath, "utf8");
     const relDisplay = displaySafeText(relative(process.cwd(), absPath).replace(/\\/g, "/") || absPath);
@@ -10118,7 +10268,7 @@ function postToolUseFailureHandler(event) {
     const target = ledgerPath(event.sessionId);
     if (target === null) return passOutput();
     const toolName = getToolName(event);
-    const signature = failureSignature(toolName, errorText);
+    const signature = failureSignature(toolName, redactSecrets(errorText).text);
     const ledger = readLedger(target);
     const priorState = ledger.seen[signature];
     const editDiagnostic = diagnoseEditFailure(event, errorText);
@@ -10222,7 +10372,7 @@ function mcpOutputId(sessionId, hash) {
 }
 function mcpInputPreview(toolInput) {
   try {
-    return JSON.stringify(toolInput).slice(0, 120);
+    return redactSecrets(JSON.stringify(toolInput)).text.slice(0, 120);
   } catch {
     return "";
   }
@@ -10611,7 +10761,7 @@ function postMcpHandler(event) {
     id = storeMcpOutput(event.sessionId, toolName, toolInput, resultText);
   }
   if (resultText.length >= MCP_COMPRESS_MIN_BYTES && process.env["TOKEN_GOAT_MCP_COMPRESS"] !== "0") {
-    const compressed = compressMcpResultWithPacks(toolName, resultText) ?? compressMcpResult(resultText);
+    const compressed = compressMcpResultWithPacks(toolName, redactedResult.text) ?? compressMcpResult(redactedResult.text);
     if (compressed !== null) {
       if (id === null) id = storeMcpOutput(event.sessionId, toolName, toolInput, resultText);
       if (id !== null) {
@@ -10840,9 +10990,9 @@ registerHook("post_tool_use", postBrowserImageHandler, { toolPattern: "^mcp__" }
 // src/hooks_agent_spawn.ts
 init_define_import_meta_env();
 import { createHash as createHash2 } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path2 from "node:path";
+import * as fs2 from "node:fs";
+import * as os2 from "node:os";
+import * as path3 from "node:path";
 var BRIEFING_TARGET_TOKENS = 550;
 function buildSubagentBriefing() {
   try {
@@ -10928,7 +11078,7 @@ function preAgentHandler(event) {
     const briefing = buildSubagentBriefing();
     const advisory = duplicateOf ? `
 
-[token-goat] A similar subagent spawn already appears to be outstanding this session (prompt starts: "${truncateForWarning(duplicateOf, 80)}"). This is advisory only -- proceeding is fine if intentional.` : "";
+&#91;token-goat] A similar subagent spawn already appears to be outstanding this session (prompt starts: "${neutralizeSpokenMarkers(truncateForWarning(duplicateOf, 80))}"). This is advisory only -- proceeding is fine if intentional.` : "";
     if (!briefing && !advisory) return passOutput();
     const updatedPrompt = prompt + briefing + advisory;
     const updatedInput = { ...toolInput, prompt: updatedPrompt };
@@ -11067,53 +11217,75 @@ function parseAgentDefinition(text, fallbackName) {
   return { name: name2, restricted: false };
 }
 function findRestrictedAgentNames(roots) {
-  const scanRoots = roots ?? [path2.join(os.homedir(), ".claude", "agents"), path2.join(process.cwd(), ".claude", "agents")];
+  const projectAgentsRoot = path3.join(process.cwd(), ".claude", "agents");
+  const scanRoots = roots ?? [path3.join(os2.homedir(), ".claude", "agents"), projectAgentsRoot];
   const names = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   let filesSeen = 0;
-  const walk = (dir, depth) => {
+  const walk = (dir, depth, confineTo) => {
     if (depth > ROSTER_WALK_MAX_DEPTH || filesSeen >= ROSTER_WALK_MAX_FILES) return;
     let real;
     try {
-      real = fs.realpathSync(dir);
+      real = fs2.realpathSync(dir);
     } catch {
       return;
     }
+    if (confineTo !== null && !isInsideRoot(real, confineTo)) return;
     const key = process.platform === "win32" ? real.toLocaleLowerCase() : real;
     if (visited.has(key)) return;
     visited.add(key);
     let entries;
     try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (filesSeen >= ROSTER_WALK_MAX_FILES) return;
-      const full = path2.join(dir, entry.name);
+      const full = path3.join(dir, entry.name);
       let stat;
       try {
-        stat = fs.statSync(full);
+        stat = fs2.statSync(full);
       } catch {
         continue;
       }
       if (stat.isDirectory()) {
-        walk(full, depth + 1);
+        walk(full, depth + 1, confineTo);
         continue;
       }
       if (!stat.isFile() || !entry.name.toLowerCase().endsWith(".md")) continue;
       filesSeen++;
       let text;
       try {
-        text = fs.readFileSync(full, "utf-8");
+        text = fs2.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
-      const parsed = parseAgentDefinition(text, path2.basename(entry.name, path2.extname(entry.name)));
+      const parsed = parseAgentDefinition(text, path3.basename(entry.name, path3.extname(entry.name)));
       if (parsed !== null && parsed.restricted) names.add(parsed.name);
     }
   };
-  for (const root of scanRoots) walk(root, 0);
+  for (const root of scanRoots) {
+    const isProjectRoot = roots === void 0 && path3.resolve(root) === path3.resolve(projectAgentsRoot);
+    if (!isProjectRoot) {
+      walk(root, 0, null);
+      continue;
+    }
+    let rootIsLink;
+    try {
+      rootIsLink = fs2.lstatSync(root).isSymbolicLink();
+    } catch {
+      continue;
+    }
+    if (rootIsLink) continue;
+    let confineTo;
+    try {
+      confineTo = fs2.realpathSync(root);
+    } catch {
+      continue;
+    }
+    walk(root, 0, confineTo);
+  }
   return Array.from(names).sort();
 }
 function buildUnrestrictedSpawnAdvisory(toolInput) {
@@ -11216,6 +11388,7 @@ function harnessForNormalization() {
   if (detected === "kimi") return "kimi";
   if (detected === "qwen") return "qwen";
   if (detected === "copilot_cli") return "copilot_cli";
+  if (detected === "vscode") return "vscode";
   return "claude";
 }
 function safeSuggestions(output) {
@@ -11231,6 +11404,7 @@ async function relayInProcess(eventName, rawPayload) {
     const harness = detectHarness();
     const payload = eventName === "pre_tool_use" || eventName === "post_tool_use" ? normalizePayload(rawPayload, harnessForNormalization()) : rawPayload;
     const event = buildEvent(eventName, payload);
+    if (shouldSuppressDuplicateVscodeHook(event, harness)) return "{}";
     if (!process.env["CLAUDE_CODE_SESSION_ID"] && event.sessionId) {
       process.env["CLAUDE_CODE_SESSION_ID"] = event.sessionId;
     }