chamnan 1.36.1 — real usage on the dashboard, two fixes from testing 1.36.0

A patch with three fixes. Two were found by testing 1.36.0 against other tools in the same space: a guard that refused a harmless macOS edit, and one slow pattern in chamnan-schedule. The third makes the dashboard answer its own first question with real usage.

What was measured	1.36.0	1.36.1
sed -i '' 's/…\.env/…/' notes.md (a macOS in-place edit whose script names .env)	refused as a read of .env	runs
A duration with 100 spaces before a stray character, through chamnan-schedule	1.2 s (200 spaces: over 20 s)	milliseconds at 5,000
The dashboard's opening panel on a repository that never used a local model	0 saved, two identical bars	sessions before the plugin against sessions since, from real usage

What you will notice

• The dashboard compares your own sessions before the plugin with those since. Page 1 splits this repository's days at the first day the plugin's logs show it running, compares weighted tokens per request on each side, and prices the chosen month at both rates. Page 4 shows the same figures. It used to price only what a local model read, so a repository that never used one showed nothing saved.
• A macOS in-place sed edit is no longer refused for what its script says. BSD sed -i takes the backup suffix as the next word; the empty one was read as the script and the script as a file.
• chamnan-schedule answers at once whatever spacing it is given. Five optional whitespace runs could all claim the same spaces; each now has one owner.

Under the hood

The new dashboard comparison is computed by the builder from the transcripts' own usage blocks, the same per-day sums every other panel uses, so it cannot disagree with them. The panel states what it cannot separate: anything else that changed between the two periods, such as the work or the model, is in the numbers too. A credential file given to sed as its real file argument is still refused.

Research

Between v1.36.0 and v1.36.1 no new research round was dispatched; 6 defects were fixed, 2 tied to an earlier round and 4 found by chamnan's own testing. The two defects in this patch came from re-running chamnan against other tools in its space with two new probes: every Python pattern chamnan compiles, fired at in CPython with 2,000-character whitespace runs (it finds four of the patterns 1.36.0 fixed when pointed at 1.35.1), and chamnan's real PreToolUse hook given 21 read and command events. The citations from code back to rounds are in the attached INDEX_CITED_IN_CODE.md.

Verification

Checks	Gotcha
6,988/6,988	2/2,587 — 2 recorded since v1.36.0, 2,587 in total

6,988/6,988 on the release gate (macOS), and CI green on all five legs — macOS · Linux · Windows on Python 3.9 and 3.13 — on the same code. Each fix carries a check that fails without it (520, 521, 522). The count went from 5,847 to 5,856 check( calls in the source: 3 sections added, none removed. The corpus gate passed again (608 files, 0 leaked) and the redactor is unchanged: recall 99.0%, precision 100.0%, boundary 97.9%.

Known limitations

• The command guard recognises a short list of commands that dump secrets; an indirect form — a script, an alias, another interpreter — is not stopped, and the guard does not redact what a command prints.
• The dashboard's before-and-since comparison needs sessions from before the plugin; a repository where every recorded session ran with it shows no figure, and says why.
• The redactor still misses a bare AWS secret access key with no name beside it (98 of 99 corpus shapes caught).
• Windows behaviour is verified on CI, not on a Windows machine here.

Upgrade

/plugin update chamnan. The dashboard picks up the comparison the next time it is built.