v2.6.35 — in-house xlsx reader, real block spans, compound-output compaction

What's new in 2.6.35

Changed

• Reading .xlsx no longer needs ExcelJS. A default install drops from 301 to 246 packages and every deprecated package in the tree is gone. Spreadsheets are now read the same way .docx and .pptx already were, with fflate and fast-xml-parser. xlsx-sheets, xlsx-head, xlsx-range, and xlsx-query output is unchanged.
• Symbols in the eleven line-based languages (the ones without a tree-sitter grammar) now get their real block span instead of just their signature line, so read, outline, and skeleton return the whole body.

Added

• Output from compound and piped shell commands is now compacted the same way single-command output already was, with a --full recall pointer. A command that reported a failure exit is passed through in full so its diagnostics reach you on the first read.
• A short tg alias for the token-goat command.

Fixed

Fourteen fixes this cycle, including: a dash-prefixed git ref could overwrite a file; four MCP tools ignored mcp.allowed_roots; passwords were only half-redacted in some shapes; a cloned config re-added an excluded folder; a bad embedding could top search results; stray worker daemons; an Apex file could stall the worker for ~30 minutes; a curl header URL cache collision; an apostrophe triggered a false unclosed-quote warning; an unknown hook event failed silently; and three sources of test-suite flakiness.

Full detail in the changelog.