v2.9.31

Shell searches that walk a whole disk are now refused, and the routing text and MCP tool list token-goat sends to the model are smaller.

The pre-shell hook now refuses a command such as find / -name x that starts at a filesystem root or the home directory with no depth bound. A shell tool that times out kills its shell but not the find it started, and several orphaned searches burned about 90 CPU-hours. Output caps also now price Chinese, Japanese and Korean text at about 1.1 tokens per character, because the old estimate let CJK-heavy output through at up to three times the intended size.

The MCP server now offers seven tools by default instead of 18, which takes the tool list from 13,029 bytes to 5,293. Set TOKEN_GOAT_MCP_TOOLS to a comma-separated list to get the others back. The routing block written into CLAUDE.md, AGENTS.md and the Copilot instructions shrank from 4,879 bytes to 3,670.

New checks help catch bad edits. A Write or Edit that leaves a placeholder such as // rest of the code goes here, or drops lines the model never saw, is refused once. A failed Edit that was one invisible character off now names the exact lines on disk, and a path that does not exist comes back with the paths it was probably meant to be. You are also told when an agent stops with untested edits. read now accepts a line range given as a flag, such as --lines 1-5, and json-query and yaml-query filter by more than equality.

Security: the development tree is back to a clean npm audit. proxy-addr (critical) and source-map-js (high) are updated to the patched 2.0.8 and 1.2.2. Both were development-only and neither reaches an installed copy of token-goat.

The release also carries more than 220 fixes across the indexer, hooks, MCP server and output commands.

Upgrading reparses every indexed file once and re-embeds every already-embedded file once. Full details in the changelog.