chisle 3.5.0 → 3.6.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "chisle",
-  "version": "3.5.0",
+  "version": "3.6.1",
   "description": "Maximum-efficiency dev mode. Zero-fluff prose combined with YAGNI/ladder-first code decisions. One persona: the senior dev who deletes code for fun and bills by the syllable.",
   "hooks": {
     "SessionStart": [

package/.clinerules/chisle.md

@@ -8,7 +8,8 @@ meaning survives. Causality as arrows (X → Y). Technical terms, code, API name
 errors: exact, verbatim. Terse ≠ incomplete: keep every decisive fact (the fix,
 the gotcha, the why); cut the words around them, never the facts. Structure is
 tokens, so answer at the question's altitude; no manufactured headings, bullet
-lists, or sections the question didn't ask for. "Summarize/compare X vs Y" is
+lists, numbered steps, or sections the question didn't ask for. Two tight
+paragraphs beat five headed sections. "Summarize/compare X vs Y" is
 the trap: skip headed pro/con bullet walls, name the decisive tradeoffs in
 prose, give the verdict, stop.
 

package/.cursor/rules/chisle.mdc

@@ -13,7 +13,8 @@ meaning survives. Causality as arrows (X → Y). Technical terms, code, API name
 errors: exact, verbatim. Terse ≠ incomplete: keep every decisive fact (the fix,
 the gotcha, the why); cut the words around them, never the facts. Structure is
 tokens, so answer at the question's altitude; no manufactured headings, bullet
-lists, or sections the question didn't ask for. "Summarize/compare X vs Y" is
+lists, numbered steps, or sections the question didn't ask for. Two tight
+paragraphs beat five headed sections. "Summarize/compare X vs Y" is
 the trap: skip headed pro/con bullet walls, name the decisive tradeoffs in
 prose, give the verdict, stop.
 

package/.github/copilot-instructions.md

@@ -8,7 +8,8 @@ meaning survives. Causality as arrows (X → Y). Technical terms, code, API name
 errors: exact, verbatim. Terse ≠ incomplete: keep every decisive fact (the fix,
 the gotcha, the why); cut the words around them, never the facts. Structure is
 tokens, so answer at the question's altitude; no manufactured headings, bullet
-lists, or sections the question didn't ask for. "Summarize/compare X vs Y" is
+lists, numbered steps, or sections the question didn't ask for. Two tight
+paragraphs beat five headed sections. "Summarize/compare X vs Y" is
 the trap: skip headed pro/con bullet walls, name the decisive tradeoffs in
 prose, give the verdict, stop.
 

package/.kiro/steering/chisle.md

@@ -12,7 +12,8 @@ meaning survives. Causality as arrows (X → Y). Technical terms, code, API name
 errors: exact, verbatim. Terse ≠ incomplete: keep every decisive fact (the fix,
 the gotcha, the why); cut the words around them, never the facts. Structure is
 tokens, so answer at the question's altitude; no manufactured headings, bullet
-lists, or sections the question didn't ask for. "Summarize/compare X vs Y" is
+lists, numbered steps, or sections the question didn't ask for. Two tight
+paragraphs beat five headed sections. "Summarize/compare X vs Y" is
 the trap: skip headed pro/con bullet walls, name the decisive tradeoffs in
 prose, give the verdict, stop.
 

package/.opencode/plugins/chisle.mjs

@@ -22,7 +22,7 @@
 // Tunables (shared with the Claude/Pi/Copilot compressor, see chisle-config):
 //   CHISLE_COMPRESS=0            kill switch
 //   CHISLE_DEFAULT_MODE=off      disable by default (env or ~/.config/chisle)
-//   CHISLE_COMPRESS_MAX_CHARS    outputs at/under this size are not elided
+//   CHISLE_COMPRESS_MAX_CHARS    elision threshold and final OpenCode bound
 //   CHISLE_COMPRESS_TOOLS=bash,… override the tool allowlist
 
 import { createRequire } from 'module';
@@ -52,12 +52,16 @@ const config = loadFrom([
 ]) || { getDefaultMode: () => 'on' };
 
 const compressForOpencode = core && core.compressForOpencode;
+const recordSavings = core && core.recordSavings;
 const getDefaultMode = config.getDefaultMode || (() => 'on');
+const getOpencodeDir = config.getOpencodeDir || (() => path.dirname(__dirname));
 
 // Already compressed: our elision marker. Skip such text so a second pass
 // (messages.transform after tool.execute.after already ran) never nests a
 // marker or eats an earlier salvage block. Keeps compression idempotent.
 const CHISLE_MARK = '[chisle:';
+const getOpencodeMaxChars = () =>
+  (core && core.limitsFor && core.limitsFor().maxChars) || 8000;
 
 export default async () => {
   return {
@@ -75,10 +79,19 @@ export default async () => {
         // MCP tools can hand back a content[] array rather than a string;
         // built-ins give a string. Only the string case is ours to touch.
         if (!output || typeof output.output !== 'string') return;
-        if (output.output.includes(CHISLE_MARK)) return;
-        const updated = compressForOpencode(input && input.tool, output.output, { mode: getDefaultMode() });
-        if (updated != null && updated.length < output.output.length) {
+        if (output.output.includes(CHISLE_MARK) && output.output.length <= getOpencodeMaxChars()) return;
+        const original = output.output;
+        const updated = compressForOpencode(input && input.tool, original, {
+          mode: getDefaultMode(),
+          sessionId: input && input.sessionID,
+          callId: input && input.callID,
+        });
+        if (updated != null && updated.length < original.length) {
           output.output = updated;
+          if (recordSavings) {
+            recordSavings(original.length - updated.length,
+              process.env.CHISLE_STATE_DIR || getOpencodeDir());
+          }
         }
       } catch (e) { /* keep the original output */ }
     },
@@ -102,7 +115,7 @@ export default async () => {
             if (!part || part.type !== 'tool') continue;
             const st = part.state;
             if (!st || st.status !== 'completed' || typeof st.output !== 'string') continue;
-            if (st.output.includes(CHISLE_MARK)) continue;
+            if (st.output.includes(CHISLE_MARK) && st.output.length <= getOpencodeMaxChars()) continue;
             const updated = compressForOpencode(part.tool, st.output, { mode });
             if (updated != null && updated.length < st.output.length) {
               st.output = updated;

package/.windsurf/rules/chisle.md

@@ -12,7 +12,8 @@ meaning survives. Causality as arrows (X → Y). Technical terms, code, API name
 errors: exact, verbatim. Terse ≠ incomplete: keep every decisive fact (the fix,
 the gotcha, the why); cut the words around them, never the facts. Structure is
 tokens, so answer at the question's altitude; no manufactured headings, bullet
-lists, or sections the question didn't ask for. "Summarize/compare X vs Y" is
+lists, numbered steps, or sections the question didn't ask for. Two tight
+paragraphs beat five headed sections. "Summarize/compare X vs Y" is
 the trap: skip headed pro/con bullet walls, name the decisive tradeoffs in
 prose, give the verdict, stop.
 

package/AGENTS.md

@@ -13,6 +13,11 @@ Drop articles, filler (just/really/basically/actually), pleasantries
 (sure/certainly/happy to), hedging. Fragments OK. Technical terms exact.
 Code blocks unchanged. Pattern: `[thing] [action] [reason].`
 
+Terse ≠ incomplete: keep every decisive fact (the fix, the gotcha, the why);
+cut the words around them. Structure is tokens: no headings, bullets,
+numbered steps or tables the question didn't ask for. Two tight paragraphs
+beat five headed sections.
+
 ## Code: the efficiency ladder
 
 Before writing anything, stop at the first rung that holds:

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <em>The only tool in this class that publishes the runs where it lost.</em>
+  <em>The only tool in this class that publishes the runs where it lost. <a href="https://jaypokale.me/writing/chisle-benchmarks-it-loses">Here's why.</a></em>
 </p>
 
 <p align="center">
@@ -22,7 +22,7 @@
 </p>
 
 <p align="center">
-  <strong>44% of a bare model's output tokens on coding prompts &middot; 11 agents &middot; zero dependencies &middot; one command</strong>
+  <strong>83% of a bare model's output, where caveman and ponytail land above 100% &middot; 11 agents &middot; zero dependencies &middot; one command</strong>
 </p>
 
 <p align="center">
@@ -153,15 +153,25 @@ That refreshes every agent that already has Chisle and installs it into none tha
 - **Plain `npx chisle` does not upgrade.** Every install path skips what is already present, so an upgrade run reports success and changes nothing. `--update` pairs the refresh with that check.
 - **`@latest` matters.** `npx chisle` can serve a cached copy of the package from a previous run, so the pin is what guarantees you get the new one.
 
-Per-agent equivalents, if you prefer the native tool:
+Update one agent at a time with `--only`:
 
 ```bash
-claude plugin update chisle@chisle    # Claude Code plugin install
-pi install npm:chisle                 # Pi package
-gemini extensions install https://github.com/JayPokale/Chisle
+npx chisle@latest --update --only claude     # or: claude plugin update chisle@chisle
+npx chisle@latest --update --only pi         # or: pi install npm:chisle
+npx chisle@latest --update --only gemini     # or: gemini extensions install https://github.com/JayPokale/Chisle
+npx chisle@latest --update --only codex
+npx chisle@latest --update --only opencode   # ruleset + skills + the compression plugin
+npx chisle@latest --update --only hermes
 ```
 
-Project-scoped agents (Cursor, Windsurf, Cline, Kiro, Copilot) keep their rule file inside the repo, so run the update once per project that has one.
+Cursor, Windsurf, Cline, Kiro and Copilot keep their rule file **inside the repo**, because that is how those agents load rules:
+
+```bash
+cd ~/code/my-project
+npx chisle@latest --update --only cursor
+```
+
+`--update` looks for that file in the current directory, so running it from `~` reports "Nothing to update" even when the project is set up correctly. Run it once per repo that has one. Full table, including what each agent's update actually refreshes: [INSTALL.md](./INSTALL.md#per-agent).
 
 Not sure what you are running? `npx chisle --list` prints the agents it detects, and `claude plugin list` shows the installed plugin and its version.
 
@@ -224,7 +234,21 @@ node benchmarks/replay-compress.js pi    # Pi; marginal over Pi's native truncat
 
 Nothing here is estimated. Every figure below is recomputed from committed raw data; the 2026-07-07 [verification writeup](benchmarks/results/2026-07-07-verify-rerun.md) re-derived the old claims from scratch, re-ran the whole suite against the competitors' **installed plugins**, and retired the one claim that didn't survive.
 
-### Output axis: vs caveman & ponytail, 20 live tasks
+### Output axis, re-measured 2026-10-01 (current)
+
+Re-run with the shipped ruleset, Claude Code 2.1.285 and the rivals' current plugins (caveman `ef6050c5e184`, ponytail 4.8.3): 13 live prompts × 2 seeds = 26 cells per arm on Haiku 4.5, billed output tokens vs the no-tool baseline ([writeup + raw cells](benchmarks/results/2026-10-01-live-rerun.md)):
+
+| | total bill | 95% CI | visible answer | worst cell | backfires |
+|---|--:|--:|--:|--:|--:|
+| caveman | 102% | 79–128% | 105% | 305% | 15 / 26 |
+| ponytail | 105% | 86–129% | 97% | 493% | 16 / 26 |
+| **Chisle** | **83%** | **69–95%** | **76%** | **170%** | **11 / 26** |
+
+Chisle is the only arm measurably below a bare model, by about a third of what the June table below claimed. It pays on long answers (77%) and coding prompts (76%); on short answers it breaks even (106%), on explanation prompts ponytail is leaner (86% vs 91%), and reasoning tokens are not cut (107%). Single cells swing hard between seeds (57% → 135% on one prompt), and the bare model "backfires" against itself on 13 of 26 cells, so read totals, not backfire counts ([control](benchmarks/results/2026-10-01-backfires.md)).
+
+**Why the June headline was retired.** Its 52% leaned on one cell: the June bare `cache` answer billed 4,910 tokens, while every later run of the same prompt billed 375–813. The ruleset also carried examples matching `cache` (from June 18) and `auth-bug` (from June 27), so four cells may have been primed; without them the June total was 70%. The tables below stay as what they were.
+
+### Output axis, June–July 2026 (superseded): vs caveman & ponytail, 20 live tasks
 
 **What this suite measures, and what it does not.** Every figure below is *billed output tokens on single-turn prompts with no tools available*. That isolates the ruleset's effect on how the model writes, which is what it was built to measure. It is not whole-session cost: a real agentic session is dominated by tool output and cached input, so a tool can win here and still fail to pay for itself end to end. The input axis below is measured separately, and against its own baseline.
 
@@ -316,10 +340,10 @@ SUITE=large bash benchmarks/run-live.sh <model> benchmarks/results/raw-large
 
 |  | prose | code judgment | input/context | worst-case guard | publishes failures |
 |---|:---:|:---:|:---:|:---:|:---:|
-| caveman | ✅ | ❌ | ❌ | ❌ 424% | ❌ |
-| ponytail | ❌ | ✅ | ❌ | ❌ 227% | ❌ |
+| caveman | ✅ | ❌ | ❌ | ❌ 305% | ❌ |
+| ponytail | ❌ | ✅ | ❌ | ❌ 493% | ❌ |
 | headroom | ❌ | ❌ | ✅ proxy | n/a | ❌ |
-| **Chisle** | ✅ | ✅ | ✅ hook | **173%, 1/20** | ✅ |
+| **Chisle** | ✅ | ✅ | ✅ hook | **170%** | ✅ |
 
 The row that matters is the last one. Every tool here looks good on its best day; the numbers above are the only ones in this class published alongside the run that went wrong. [Full comparison →](docs/comparison.md)
 
@@ -333,7 +357,7 @@ Measured over 171 real sessions ([receipts](benchmarks/results/2026-07-07-input-
 | **elide** | oversized output → head + tail, error-like lines salvaged from the cut | bounded, guarded |
 | **dedup** | byte-identical repeat of a tool's previous output (same session) → one-line marker | none, the copy is already in context |
 
-Replayed over the same 171 Claude Code sessions: **~61k tokens** saved one-shot, ~46% off every eligible output: a floor, not an estimate, since each saved byte also stops being re-sent on every later request. Correctness rules: allowlist only (`Bash`, `Agent`, `WebFetch`, `WebSearch`, `Grep`, `Glob`, `mcp__*`), never `Read`/`Edit`, whose exact bytes feed later edits. Honest ledger: dedup scored **0 hits** on this corpus (rtk-filtered at source); it's kept for the test-rerun case, kill-switchable, and labeled speculative until it earns a number.
+Replayed over the same 171 Claude Code sessions: **~61k tokens** saved one-shot, ~46% off every eligible output: a floor, not an estimate, since each saved byte also stops being re-sent on every later request. Correctness rules: allowlist only (`Bash`, `Agent`, `WebFetch`, `WebSearch`, `Grep`, `Glob`, `mcp__*`), never `Read`/`Edit`, whose exact bytes feed later edits. Successful calls only: Claude Code sends a failed call (a non-zero `Bash` exit included) to `PostToolUseFailure`, whose output a hook can add to but not replace (checked on 2.1.285), so a failing test run reaches the model through Claude Code's own ~10k-char head + tail truncation instead; the replay counts those as unreachable. Honest ledger: dedup scored **0 hits** on this corpus (rtk-filtered at source); it's kept for the test-rerun case, kill-switchable, and labeled speculative until it earns a number.
 
 Pi already truncates built-in output at 50KB/2,000 lines. Replay over 8,044 persisted Pi results measured the compressor's **marginal** saving after that truncation: **27.4% of tool-output chars** ([receipt + raw live Pi arm](benchmarks/results/2026-09-11-pi.md)). Pi compresses `bash`, `powershell`, `grep`, `find`, `ls`, MCP, and explicitly allowlisted extension-tool results; `read`/`edit`/`write` remain untouched. `CHISLE_COMPRESS_TOOLS` supplies the same explicit override for runtime and replay. Runtime dedup only compares earlier turns, so concurrently completed sibling calls cannot dedup one another.
 
@@ -460,8 +484,8 @@ govern prose, so only the prose section yields.
 
 Detection reads the `outputStyle` key across Claude Code's own settings precedence
 (`.claude/settings.local.json`, where `/output-style` writes, then `.claude/settings.json`, then
-`~/.claude/settings.json`). Claude Code and Pi only; Pi has no output-style mechanism, so nothing
-changes there.
+`~/.claude/settings.json`). Claude Code only — Pi and OpenCode have no output-style mechanism, so
+there is nothing to detect and nothing changes for them.
 
 **Suppress a rule group manually.** The same `sections` key gives explicit control, and it always
 beats detection — set `prose: true` to keep Chisle's prose rules even with a style active:
@@ -501,12 +525,12 @@ Chisle borrows the best published token-saving techniques and implements the one
 
 ## Multi-agent
 
-Ships to eleven agents: Claude Code and Pi get both axes, live `/chisle` toggling, and a status badge; Cursor, Windsurf, Cline, Kiro, Codex, Gemini, and Copilot get the always-on ruleset; OpenCode gets the global fenced ruleset plus on-demand skills; Hermes gets the skills as `/chisle` commands. Per-agent static copies come from `scripts/build-rules.js`; Pi uses its package extension plus the Agent Skills standard. See [`docs/agent-portability.md`](./docs/agent-portability.md).
+Ships to eleven agents: Claude Code and Pi get both axes, live `/chisle` toggling, and a status badge; OpenCode gets both axes too — the global fenced ruleset, on-demand skills, and a native compression plugin — but no live toggle; Cursor, Windsurf, Cline, Kiro, Codex, Gemini, and Copilot get the always-on ruleset; Hermes gets the skills as `/chisle` commands. Per-agent static copies come from `scripts/build-rules.js`; Pi uses its package extension plus the Agent Skills standard. See [`docs/agent-portability.md`](./docs/agent-portability.md).
 
 ## FAQ
 
 **Doesn't injecting a persona every turn cost tokens?**
-Claude Code uses a ruleset at session start (~1.6k tokens) plus a ~50-token reminder per turn. Pi injects one persistent rules message only when project `AGENTS.md` does not already provide it; resume/reload does not duplicate it, and compaction restores it only if removed.
+Claude Code uses a ruleset at session start (~900 tokens) plus a ~50-token reminder per turn. Pi injects one persistent rules message only when project `AGENTS.md` does not already provide it; resume/reload does not duplicate it, and compaction restores it only if removed.
 
 Worth reading the dissent before you take that on faith: [@enc0ded](https://github.com/enc0ded) measured 173 of their own sessions ([#2](https://github.com/JayPokale/Chisle/issues/2)) and found the injection overhead roughly cancelling the compressor's savings, because the ruleset was being re-sent on every resume and clear, not just at startup. That re-injection is fixed, which removes most of the overhead they measured, but their wider point stands: prose is only ~25% of what the model emits, so the ceiling on the output axis is lower than the headline suggests, and on a one-line throwaway prompt the overhead still exceeds the saving.
 
@@ -536,6 +560,16 @@ Built by [Jay Pokale](https://github.com/JayPokale) with [Claude](https://claude
 npm test    # 67 tests: flag safety, tracker, settings merge, installer, compressor
 ```
 
+## Star History
+
+<a href="https://www.star-history.com/?repos=JayPokale%2FChisle&type=date&legend=top-left">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=JayPokale/Chisle&type=date&legend=top-left&theme=dark">
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=JayPokale/Chisle&type=date&legend=top-left">
+    <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=JayPokale/Chisle&type=date&legend=top-left">
+  </picture>
+</a>
+
 ## License
 
 [MIT](LICENSE). The shortest license that works.

package/bin/install.js

@@ -709,7 +709,7 @@ function uninstall(ctx) {
       const dst = path.join(ocPlugins, rel);
       if (fs.existsSync(dst)) { if (!opts.dryRun) fs.rmSync(dst, { recursive: true, force: true }); note('  removed ' + dst); touched++; }
     }
-    for (const f of ['chisle-spill', '.chisle-compress-stats.json', '.chisle-compress-last.json']) {
+    for (const f of ['chisle-spill', 'chisle-dedup', '.chisle-compress-stats.json', '.chisle-compress-last.json']) {
       const p = path.join(homeDir(), '.config', 'opencode', f);
       if (fs.existsSync(p)) { if (!opts.dryRun) fs.rmSync(p, { recursive: true, force: true }); note('  removed ' + p); touched++; }
     }

package/hooks/chisle-activate.js

@@ -58,7 +58,7 @@ async function latestVersion(cachePath) {
 // SessionStart fires on startup, resume, clear and compact. Only a genuinely
 // new session needs the whole ruleset: on the other three the conversation
 // already carries it, and the UserPromptSubmit reminder re-states the active
-// behaviour every turn anyway. Re-sending ~1.6k tokens each time was the bulk
+// behaviour every turn anyway. Re-sending the full ruleset each time was the bulk
 // of the plugin's own overhead and piled standing instructions on top of what
 // the user actually asked for. Measured and reported by @enc0ded (#2).
 const FULL_INJECT_SOURCES = new Set(['startup']);

package/hooks/chisle-compress-output.js

@@ -88,6 +88,46 @@ const SALVAGE_RE = /\b(error|err!|fail(ed|ure|ing)?|exception|traceback|panic|fa
 const MAX_SALVAGED = 12;      // error lines rescued from the elided middle
 const MAX_SALVAGE_LINE = 300; // per-line char cap on salvaged lines
 
+function splitsSurrogatePair(text, index) {
+  if (index <= 0 || index >= text.length) return false;
+  const before = text.charCodeAt(index - 1);
+  const after = text.charCodeAt(index);
+  return before >= 0xD800 && before <= 0xDBFF && after >= 0xDC00 && after <= 0xDFFF;
+}
+
+function safePrefix(text, maxChars) {
+  let end = Math.max(0, Math.min(text.length, maxChars));
+  if (splitsSurrogatePair(text, end)) end -= 1;
+  return text.slice(0, end);
+}
+
+function safeSuffix(text, maxChars) {
+  let start = Math.max(0, text.length - Math.max(0, maxChars));
+  if (splitsSurrogatePair(text, start)) start += 1;
+  return text.slice(start);
+}
+
+function safeSlice(text, start, end) {
+  let safeStart = Math.max(0, Math.min(text.length, start));
+  let safeEnd = Math.max(safeStart, Math.min(text.length, end));
+  if (splitsSurrogatePair(text, safeStart)) safeStart += 1;
+  if (splitsSurrogatePair(text, safeEnd)) safeEnd -= 1;
+  return text.slice(safeStart, Math.max(safeStart, safeEnd));
+}
+
+function salvageLine(line) {
+  const match = SALVAGE_RE.exec(line.replace(/error-like/gi, 'diagnostic'));
+  if (!match) return null;
+  if (line.length <= MAX_SALVAGE_LINE) return line;
+  const contentLimit = MAX_SALVAGE_LINE - 2;
+  const start = Math.max(0, Math.min(
+    match.index - Math.floor((contentLimit - match[0].length) / 2),
+    line.length - contentLimit,
+  ));
+  const end = start + contentLimit;
+  return (start > 0 ? '…' : '') + safeSlice(line, start, end) + (end < line.length ? '…' : '');
+}
+
 function toolAllowed(name) {
   if (!name || typeof name !== 'string') return false;
   if (NEVER_COMPRESS.includes(name.toLowerCase())) return false;
@@ -107,28 +147,54 @@ function copilotToolAllowed(name) {
   return list.includes(name);
 }
 
-// OpenCode runtime tool names are lowercase (bash, grep, glob, webfetch, ...)
-// and MCP tools are `server_tool` (an underscore), not Claude's mcp__ prefix.
+// OpenCode runtime tool names are lowercase (bash, grep, glob, webfetch, ...).
+// MCP tools use `server_tool`, not Claude's mcp__ prefix; their names do not
+// establish read-only safety, so they require explicit allowlisting.
 // read/edit/write/patch are excluded on purpose: their output feeds exact-match
 // edits, exactly as SAFE_TOOLS omits Read/Edit/Write.
-const SAFE_TOOLS_OPENCODE = ['bash', 'grep', 'glob', 'webfetch', 'websearch', 'task', 'list'];
-const UNSAFE_TOOLS_OPENCODE = ['read', 'edit', 'write', 'patch', 'todowrite', 'todoread'];
+const SAFE_TOOLS_OPENCODE = ['bash', 'grep', 'glob', 'webfetch', 'websearch', 'list'];
+const UNSAFE_TOOLS_OPENCODE = [
+  'read', 'edit', 'write', 'patch', 'apply_patch', 'multiedit',
+  'notebookedit', 'notebookread', 'notebook_write', 'notebook_edit',
+  'create', 'str_replace', 'insert', 'todowrite', 'todoread',
+];
 
 function opencodeToolAllowed(name) {
   if (!name || typeof name !== 'string') return false;
   const lower = name.toLowerCase();
-  // read/edit/write/patch are never compressed, even via CHISLE_COMPRESS_TOOLS:
-  // their output feeds exact-match edits (the invariant INSTALL.md promises).
+  // Source-bearing and mutating tools are never compressed, even via
+  // CHISLE_COMPRESS_TOOLS: their output feeds exact-match edits, an invariant
+  // INSTALL.md promises rather than an overridable default.
   if (UNSAFE_TOOLS_OPENCODE.includes(lower)) return false;
   if (process.env.CHISLE_COMPRESS_TOOLS) {
     return process.env.CHISLE_COMPRESS_TOOLS
       .split(',').map(s => s.trim()).filter(Boolean).includes(name);
   }
-  if (SAFE_TOOLS_OPENCODE.includes(lower)) return true;
-  // Heuristic: underscore = MCP `server_tool`, treated as read-only info tool
-  // like SAFE_TOOLS' mcp__ clause. Set CHISLE_COMPRESS_TOOLS to override if a
-  // custom underscore-named tool ever needs protecting.
-  return name.includes('_');
+  return SAFE_TOOLS_OPENCODE.includes(lower);
+}
+
+function boundForOpencode(text, spillPath, maxChars) {
+  const outputLimit = maxChars || THRESHOLDS.maxChars;
+  if (text.length <= outputLimit) return text;
+  if (outputLimit < 7) return safePrefix(text, outputLimit);
+  const recover = spillPath ? ' Full output: ' + spillPath + ' (grep it, do not re-run)' : '';
+  let marker = '... [chisle: rebound compressed output to ' +
+    outputLimit.toLocaleString('en-US') + ' chars.' + recover + '] ...';
+  if (marker.length > outputLimit - 2) marker = safePrefix(marker, outputLimit - 7) + '] ...';
+  const middle = [marker];
+  // Keep head/tail context without excluding diagnostics under small bounds.
+  const contextReserve = Math.min(2050, Math.floor(outputLimit / 4));
+  for (const line of text.split('\n')) {
+    if (middle.length > MAX_SALVAGED) break;
+    const candidate = salvageLine(line);
+    if (!candidate) continue;
+    if (middle.join('\n').length + candidate.length + 1 > outputLimit - contextReserve) break;
+    if (!middle.includes(candidate)) middle.push(candidate);
+  }
+  const center = middle.join('\n');
+  const remaining = Math.max(0, outputLimit - center.length - 2);
+  const headChars = Math.ceil(remaining / 2);
+  return safePrefix(text, headChars) + '\n' + center + '\n' + safeSuffix(text, Math.floor(remaining / 2));
 }
 
 // One OpenCode tool_result → replacement string, or null to keep the original.
@@ -149,7 +215,19 @@ function compressForOpencode(toolName, text, opts) {
   if (!opencodeToolAllowed(toolName)) return null;
   if (typeof text !== 'string' || !text) return null;
   const stateDir = opts.stateDir || process.env.CHISLE_STATE_DIR || getOpencodeDir();
-  return transform(text, limitsFor(), toolName, stateDir);
+  const limits = limitsFor();
+  const dup = dedupCheck(toolName, text, opts.sessionId, opts.callId, stateDir, true);
+  if (dup != null && dup.length < text.length) return boundForOpencode(dup, null, limits.maxChars);
+  if (text.length <= SCRUB_MIN && text.length <= limits.maxChars) return null;
+  const spillPath = text.length > limits.maxChars && toolName ? spill(text, toolName, stateDir) : null;
+  let updated = process.env.CHISLE_COMPRESS_SCRUB === '0' ? text : scrub(text);
+  if (updated.length > limits.maxChars && updated.split('\n').length > limits.headLines + limits.tailLines) {
+    const elided = compress(updated, limits, spillPath);
+    if (elided != null) updated = elided;
+  }
+  updated = boundForOpencode(updated, spillPath, limits.maxChars);
+  if (text.length > limits.maxChars) return updated;
+  return text.length - updated.length >= MIN_WIN ? updated : null;
 }
 
 // Copilot CLI's postToolUse payload is flat and camelCase:
@@ -240,26 +318,103 @@ function duplicateMarker(toolName, text, reference = 'previous') {
   const lines = text.split('\n');
   const prior = reference === 'previous' ? 'the previous' : 'an earlier';
   const preview = lines.slice(0, 5)
-    .map(l => l.length > MAX_SALVAGE_LINE ? l.slice(0, MAX_SALVAGE_LINE) + '…' : l);
+    .map(l => l.length > MAX_SALVAGE_LINE ? safePrefix(l, MAX_SALVAGE_LINE - 1) + '…' : l);
   return '[chisle: output byte-identical to ' + prior + ' ' + toolName + ' result — ' +
     text.length.toLocaleString('en-US') + ' chars / ' + lines.length +
     ' lines, unchanged. First lines:]\n' + preview.join('\n');
 }
 
-// `stateDir` defaults to getClaudeDir() so every existing Claude/Pi call site
-// and test (none of which pass a third argument) keeps its exact prior
-// behaviour. Copilot's caller (processPayload, below) passes getCopilotDir().
-function dedupCheck(toolName, text, sessionId, toolUseId, stateDir) {
+const DEDUP_SESSION_KEEP = 20;
+const DEDUP_DIR = 'chisle-dedup';
+
+function readDedupFile(p) {
+  let st;
+  try { st = fs.lstatSync(p); }
+  catch (e) { return { state: null, unsafe: e.code !== 'ENOENT' }; }
+  if (st.isSymbolicLink() || !st.isFile()) return { state: null, unsafe: true };
+  const noFollow = typeof fs.constants.O_NOFOLLOW === 'number' ? fs.constants.O_NOFOLLOW : 0;
+  let fd;
+  let raw;
+  try {
+    fd = fs.openSync(p, fs.constants.O_RDONLY | noFollow);
+    raw = fs.readFileSync(fd, 'utf8');
+  } catch (e) {
+    return { state: null, unsafe: true };
+  } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch (e) {} }
+  }
+  try { return { state: JSON.parse(raw) || null, unsafe: false }; }
+  catch (e) { return { state: null, unsafe: false }; }
+}
+
+function dedupStateDir(stateDir) {
+  const dir = path.join(stateDir || getClaudeDir(), DEDUP_DIR);
+  try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch (e) { return null; }
+  try {
+    const st = fs.lstatSync(dir);
+    return st.isDirectory() && !st.isSymbolicLink() ? dir : null;
+  } catch (e) { return null; }
+}
+
+function writeDedupState(p, state) {
+  const tmp = p + '.' + process.pid + '.' + crypto.randomBytes(6).toString('hex') + '.tmp';
+  const noFollow = typeof fs.constants.O_NOFOLLOW === 'number' ? fs.constants.O_NOFOLLOW : 0;
+  const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | noFollow;
+  let fd;
+  try {
+    fd = fs.openSync(tmp, flags, 0o600);
+    fs.writeFileSync(fd, JSON.stringify(state));
+    try { fs.fchmodSync(fd, 0o600); } catch (e) {}
+    fs.closeSync(fd);
+    fd = undefined;
+    fs.renameSync(tmp, p);
+  } catch (e) {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch (closeError) {} }
+    try { fs.unlinkSync(tmp); } catch (unlinkError) {}
+    throw e;
+  }
+}
+
+function pruneDedupSessions(dir) {
+  try {
+    const files = fs.readdirSync(dir)
+      .filter(name => /^[a-f0-9]{64}\.json$/.test(name))
+      .map(name => {
+        const p = path.join(dir, name);
+        const st = fs.lstatSync(p);
+        return st.isFile() || st.isSymbolicLink() ? { p, t: st.mtimeMs } : null;
+      })
+      .filter(Boolean)
+      .sort((a, b) => b.t - a.t || a.p.localeCompare(b.p));
+    for (const file of files.slice(DEDUP_SESSION_KEEP)) {
+      try { fs.unlinkSync(file.p); } catch (e) {}
+    }
+  } catch (e) {}
+}
+
+// `stateDir` defaults to getClaudeDir() so existing Claude/Pi callers keep
+// their prior storage path. Copilot passes getCopilotDir(); OpenCode passes
+// getOpencodeDir() and opts into per-session files for interleaved sessions.
+function dedupCheck(toolName, text, sessionId, toolUseId, stateDir, perSession) {
   if (process.env.CHISLE_COMPRESS_DEDUP === '0') return null;
   if (!sessionId || typeof sessionId !== 'string') return null;
   if (text.length < DEDUP_MIN) return null;
   try {
-    const dir = stateDir || getClaudeDir();
-    const p = path.join(dir, '.chisle-compress-last.json');
-    try { if (fs.lstatSync(p).isSymbolicLink()) return null; } catch (e) { if (e.code !== 'ENOENT') return null; }
-    let state = {};
-    try { state = JSON.parse(fs.readFileSync(p, 'utf8')) || {}; } catch (e) {}
-    if (state.session !== sessionId) state = { session: sessionId, tools: {} };
+    const dir = perSession ? dedupStateDir(stateDir) : stateDir || getClaudeDir();
+    if (!dir) return null;
+    const p = path.join(dir, perSession
+      ? crypto.createHash('sha256').update(sessionId).digest('hex') + '.json'
+      : '.chisle-compress-last.json');
+    let state;
+    if (perSession) {
+      const loaded = readDedupFile(p);
+      if (loaded.unsafe) return null;
+      state = loaded.state;
+    } else {
+      try { if (fs.lstatSync(p).isSymbolicLink()) return null; } catch (e) { if (e.code !== 'ENOENT') return null; }
+      try { state = JSON.parse(fs.readFileSync(p, 'utf8')) || {}; } catch (e) {}
+    }
+    if (!state || state.session !== sessionId) state = { session: sessionId, tools: {} };
     if (!state.tools || typeof state.tools !== 'object') state.tools = {};
     const hash = crypto.createHash('sha256').update(text).digest('hex');
     // A second hook invocation for the SAME tool call is not the model seeing
@@ -274,10 +429,15 @@ function dedupCheck(toolName, text, sessionId, toolUseId, stateDir) {
     const sameCall = !!(toolUseId && rec.id && rec.id === toolUseId);
     const dup = rec.hash === hash && !sameCall;
     state.tools[toolName] = { hash, id: toolUseId || rec.id || null };
-    fs.mkdirSync(dir, { recursive: true });
-    const tmp = p + '.' + process.pid + '.tmp';
-    fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
-    fs.renameSync(tmp, p);
+    if (perSession) {
+      writeDedupState(p, state);
+      pruneDedupSessions(dir);
+    } else {
+      fs.mkdirSync(dir, { recursive: true });
+      const tmp = p + '.' + process.pid + '.tmp';
+      fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+      fs.renameSync(tmp, p);
+    }
     return dup ? duplicateMarker(toolName, text) : null;
   } catch (e) { return null; }
 }
@@ -336,9 +496,9 @@ function compress(text, limits, spillPath) {
     const keep = Math.floor(maxChars / 2);
     const elided = text.length - 2 * keep;
     if (elided <= 0) return null;
-    return text.slice(0, keep) +
+    return safePrefix(text, keep) +
       '\n... [chisle: elided ' + elided.toLocaleString('en-US') + ' chars from the middle.' + recover + '] ...\n' +
-      text.slice(-keep);
+      safeSuffix(text, keep);
   }
 
   const head = lines.slice(0, headLines);
@@ -348,7 +508,8 @@ function compress(text, limits, spillPath) {
   const salvaged = [];
   for (const line of middle) {
     if (salvaged.length >= MAX_SALVAGED) break;
-    if (SALVAGE_RE.test(line)) salvaged.push(line.length > MAX_SALVAGE_LINE ? line.slice(0, MAX_SALVAGE_LINE) + '…' : line);
+    const candidate = salvageLine(line);
+    if (candidate) salvaged.push(candidate);
   }
 
   const marker = '... [chisle: elided ' + middle.length.toLocaleString('en-US') +
@@ -513,5 +674,6 @@ module.exports = {
   isCopilotPayload, copilotToolAllowed, SAFE_TOOLS_COPILOT, NEVER_COMPRESS_COPILOT,
   // OpenCode-specific additions (plugin uses tool.execute.after +
   // experimental.chat.messages.transform):
-  opencodeToolAllowed, compressForOpencode, SAFE_TOOLS_OPENCODE,
+  opencodeToolAllowed, compressForOpencode, SAFE_TOOLS_OPENCODE, UNSAFE_TOOLS_OPENCODE,
+  boundForOpencode, recordSavings,
 };

package/hooks/chisle-config.js

@@ -103,7 +103,6 @@ function getDefaultMode() {
 const PROSE_HEADINGS = [
   'Prose: Maximum Signal Per Token',
   'Output Format',
-  'What it sounds like',
 ];
 const CODE_HEADINGS = [
   'Code: The Efficiency Ladder',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chisle",
-  "version": "3.5.0",
+  "version": "3.6.1",
   "description": "Maximum-efficiency dev mode for AI coding agents. Zero-fluff prose, YAGNI-first code, and safe tool-output compression.",
   "keywords": [
     "claude-code",

package/skills/chisle/SKILL.md

@@ -1,142 +1,75 @@
 ---
 name: chisle
 description: >
-  Maximum-efficiency dev mode. Terse, precise prose with zero fluff combined with
-  YAGNI/ladder-first code decisions. One persona: the senior dev who deletes code
-  for fun and bills by the syllable. Trigger: /chisle.
+  Maximum-efficiency dev mode: terse zero-fluff prose + YAGNI/ladder-first code.
+  Use when user says "chisle mode", "activate chisle", "chislify", "be efficient",
+  "be minimal", "no fluff", "yagni", or invokes /chisle.
   Deactivate: "stop chisle" / "normal mode".
-  Use when user says "chisle mode", "activate chisle", "chislify", "be efficient", "be minimal",
-  "no fluff", "yagni", or invokes /chisle.
 ---
 
 # Chisle
 
-Maximum signal. Minimum noise. Write less. Ship less. Mean more.
+Maximum signal. Minimum noise.
 
 ## Persistence
 
-ACTIVE EVERY RESPONSE. No drift back to verbose over-building. Still active if unsure.
-Off only: "stop chisle" / "normal mode" / `/chisle off`. One mode, no levels to pick.
+Active every response, even if unsure. Off only: "stop chisle" / "normal mode" / `/chisle off`.
 
 ## Prose: Maximum Signal Per Token
 
-Default to fragments. Drop: articles (a/an/the), filler (just/really/basically/actually/
-simply), pleasantries (sure/certainly/of course/happy to), hedging, and linking verbs
-where meaning survives. One word over a phrase. Short synonyms (big not extensive). Show
-causality with arrows (X → Y) instead of "because/therefore/which means". Standard
-acronyms fine (DB/API/HTTP); never invent new ones. Technical terms, code, API names,
-error strings: exact, verbatim, never abbreviated. Code blocks unchanged.
+Fragments. Drop articles, filler, pleasantries, hedging. Causality as arrows (X → Y). Technical terms, code, API names, errors: exact, verbatim. Code blocks unchanged.
 
-**Terse ≠ incomplete. This is the whole game.** Keep every decisive fact: the fix, the
-gotcha, the caveat, the why. Cut the words *around* the facts, never the facts. A 3-word
-answer that omits the fix loses to a 12-word one that keeps it. This is the edge: say
-everything that matters, in the fewest tokens that still say it.
+**Terse ≠ incomplete.** Keep every decisive fact: the fix, the gotcha, the caveat, the why. Cut words around facts, never facts.
 
-**Structure is tokens.** Answer at the question's altitude. No manufactured `##` headings,
-bullet lists, numbered steps, "Pick A if / B if" scaffolding, recaps, or decorative
-tables/emoji the question didn't ask for. Two tight paragraphs beat five headed sections.
-"Summarize/compare X vs Y" is the trap: headed pro/con bullet walls triple the size
-(measured: one such answer ran 173% of a no-tool baseline). Name the two or three
-decisive tradeoffs in prose, give the verdict, stop.
+**Structure is tokens.** Answer at the question's altitude: no headings, bullets, numbered steps, tables or recaps it didn't ask for. Two tight paragraphs beat five headed sections. "Compare X vs Y": decisive tradeoffs in prose, verdict, stop. Never announce the mode.
 
-No self-reference. Never announce the mode. Output only, no normal answer plus recap.
-
-Not: "Sure! I'd be happy to help. The issue you're experiencing is likely caused by..."
-Yes: "Bug in auth middleware. Expiry check uses `<`, needs `<=`. Fix:"
-Not: "A deadlock is a situation where two or more threads are each waiting..."
-Yes: "Deadlock: two threads each hold a lock the other needs → both wait forever. Fix: consistent lock order."
+Not: "Sure! I'd be happy to help. The issue you're seeing is likely caused by..."
+Yes: "Timestamp off by hours: `toISOString()` is UTC, UI wants local. Fix:"
+Not: "A content delivery network is a geographically distributed group of servers that..."
+Yes: "CDN: copies of static files on servers near users → shorter round trips, less origin load. Cost: stale content, so set cache headers."
 
 ## Code: The Efficiency Ladder
 
-Stop at first rung that holds:
-
-1. **Does this need to exist at all?** Speculative need = skip it, say so in one line. (YAGNI)
-2. **Already in this codebase?** Reuse it. Look before writing; re-implementing what's nearby is most common slop.
-3. **Stdlib does it?** Use it.
-4. **Native platform feature covers it?** `<input type="date">` over picker lib, CSS over JS, DB constraint over app code.
-5. **Already-installed dependency solves it?** Use it. Never add new dep for what few lines can do.
-6. **Can it be one line?** One line.
-7. **Only then:** minimum code that works.
+Stop at the first rung that holds:
 
-Ladder runs *after* understanding problem, not instead. Read fully, then be lazy.
+1. Needs to exist at all? No → skip, say so in one line.
+2. Already in this codebase? Reuse.
+3. Stdlib does it?
+4. Native platform feature? CSS over JS, DB constraint over app code.
+5. Installed dependency? Use it. Never add a dep for a few lines.
+6. One line?
+7. Only then: minimum code that works.
 
-**Bug fix = root cause, not symptom.** Grep every caller before editing. One guard in shared function beats guard in every caller.
+Ladder runs after understanding the problem, never instead. Bug fix = root cause, not symptom.
 
 ## Thinking Is Billed Too
 
-Reasoning tokens cost the same as written ones. Every rule above trims what you write; this one trims what you spend getting there.
-
-The ladder is a stopping rule, not a checklist to walk aloud. Stop at the first rung that holds and do not re-derive the rungs above it, weigh alternatives already excluded, or draft an answer twice to pick the shorter. Obvious fix → give it. Match deliberation to the stakes: a one-line change does not get a design review.
-
-This is the ladder's own exception, unchanged: never think less about *understanding* the problem. Root-cause a bug, read what you are about to edit, resolve genuine ambiguity. Depth where the problem is actually hard, nowhere else.
+Reasoning costs the same as output. The ladder is a stopping rule, not a checklist to walk aloud: don't re-derive excluded rungs or draft twice. Obvious fix → give it. Never think less about understanding: root-cause bugs, read what you edit.
 
 ## Code Rules
 
-- No unrequested abstractions: no interface with one implementation, no factory for one product.
-- No boilerplate "for later". Later can scaffold for itself.
-- Deletion over addition. Boring over clever.
-- Fewest files possible. Shortest working diff wins.
-- Complex request? Ship lazy version, question it. "Did X; Y covers it. Need full X? Say so."
-- Mark deliberate simplifications: `// chisle: global lock, per-account locks if throughput matters`.
-- Non-trivial logic leaves ONE runnable check: smallest thing that fails if logic breaks. No frameworks unless asked.
+- No unrequested abstractions, no boilerplate "for later". Deletion over addition, boring over clever.
+- Fewest files, shortest working diff.
+- Big request, unproven need → ship the lazy version, ask before building the full one.
+- Mark deliberate shortcuts: `// chisle: global lock; per-account if throughput matters`.
+- Non-trivial logic leaves one runnable check, smallest that fails if the logic breaks.
 
 ## Context Diet: Read Less Into the Window
 
-Tool output you pull in is billed on every later turn. Fetch the slice, not the file:
-
-- Grep/search for the symbol first; Read only the matching region (offset/limit), not the whole file. Whole-file reads only when the whole file is the task.
-- Narrow at the source: `ls dir` not `ls -R`, `git log --oneline -10` not `git log`, pipe long output through `| tail -50` / `| grep pattern`.
-- Never re-read a file already in context unless it changed.
-- Big-output commands (builds, test suites, installs): filter to failures/summary, not full logs.
-
-Exception, same as the ladder: never skim what you're about to edit or debug. Diet trims *transport*, never *understanding*.
+Tool output re-bills every later turn. Grep for the symbol, then Read with offset/limit; whole file only when the whole file is the task. Narrow at the source (`ls dir`, `git log --oneline -10`, `| tail -50`). Builds, tests, installs: failures and summary only. Never re-read an unchanged file. Never skim what you're about to edit.
 
 ## Output Format
 
-Code first. Then at most three short lines: what skipped, when to add it.
-Pattern: `[code] → skipped: [X], add when [Y].`
-
-No essays. No feature tours. No design notes. Explanation longer than code → delete explanation.
-
-## What it sounds like
-
-Example: "Why does this React component re-render?"
-> New object ref each render. Inline object prop = new ref = re-render. `useMemo`.
-
-Example: "Add a cache for API responses."
-> `@lru_cache(maxsize=1000)` on the fetch fn. Skipped a custom cache class; add one when `lru_cache` measurably falls short.
-
-Example: "Summarize the tradeoffs between REST and GraphQL."
-> GraphQL: one round trip, client picks fields → fewer over-fetches, harder caching + N+1 risk. REST: dumb caching that works, more round trips. New API, unknown clients → REST until a client actually needs field selection.
+Code first, then at most three short lines: `skipped: X, add when Y`. Explanation longer than the code → cut it.
 
 ## Auto-Clarity
 
-Drop compression when:
-- Security warnings
-- Irreversible action confirmations
-- Multi-step sequences where fragment order risks misread
-- Compression creates technical ambiguity
-- User asks to clarify or repeats question
-
-Resume after clear part done.
-
-Example, destructive op:
-> **Warning:** This will permanently delete all rows in the `users` table and cannot be undone.
-> ```sql
-> DROP TABLE users;
-> ```
-> Verify backup exist first.
+Write in full for security warnings, irreversible actions, order-sensitive steps, anything compression makes ambiguous, or a repeated question. Then resume.
 
 ## When NOT to be lazy
 
-Never simplify away: input validation at trust boundaries, error handling preventing
-data loss, security measures, accessibility basics, anything explicitly requested.
-User insists on full version → build it, no re-arguing.
-
-Never lazy about understanding. Ladder shortens solution, never the reading.
+Never simplify away: validation at trust boundaries, error handling that prevents data loss, security, accessibility, anything explicitly requested. User insists on the full version → build it, no re-arguing.
 
 ## Boundaries
 
-Code/commits/PRs: write normal. "stop chisle" or "normal mode": revert. Level persists until changed or session end.
-
-Shortest path to done. Fewest words to say it.
+Code, commits, PRs: write normal. "stop chisle" / "normal mode": revert.