Sando 0.8.0 — Codex and OpenAI compatibility

Sando 0.8.0 — Codex and OpenAI compatibility

• Bound external MCP results on Codex with disclosure and hash-verified artifact recovery. Preserve structured content, error state, and tool semantics while bounding model-visible text.
• Add Codex compatibility checks for the stock client and a synthetic loopback provider. The authenticated subscription probe remains separate from offline checks.
• Include the 0.7.1 provider-accounting and artifact-safety updates, plus versioned GPT-6.1 Sol and GPT-6 Luna Standard API price profiles.
• Pilot gpt-6-luna at high reasoning through the ChatGPT subscription on an isolated local Codex prototype: 12 attempts produced 12 correct observed answers; 11 runs passed every persisted gate, and five complete pairs averaged 3,629.8 fewer input tokens (13.85%). The six treatment runs reduced transformed text by 74.35% on average.

Evidence boundary

One control attempt is incomplete because its original process exit status, timeout/overflow state, and hook gate were not retained. It is excluded from paired comparisons and was not retried. These figures are a small descriptive pilot, not a general savings claim; measured runner time includes local setup and is not provider-only latency. Subscription quota was consumed; no API-billed request was made.

The Codex model-output transform was verified on a local prototype. Stock Codex 0.160.0 does not provide that host capability; this release does not claim otherwise.

Sando 0.7.0 — opt-in adoption telemetry

Sando 0.7.0 — Optional adoption and retention telemetry

• Add separate, default-off installation-activity telemetry. Existing anonymous
  telemetry consent does not enable it.
• After explicit opt-in, record a random per-host/profile installation ID,
  activity date and plugin version. No account, hardware fingerprint, prompts,
  paths or tool-output content is included.
• Support observed active installations, latest active versions, weekly
  retention, 30-day inactivity and reactivation through a private reducer and
  aggregate dashboard. These are opt-in observations, not total users or
  confirmed uninstall counts.
• Respect DO_NOT_TRACK, consent revocation and disable/re-enable during
  retries. Disabling clears local IDs and queued observations; it does not
  delete server history already received.
• Enforce consent on existing F1/F4 telemetry and preserve original event
  timestamps. Keep explicitly configured local diagnostic files separate.

Enable or disable

For npm installations:

node node_modules/sandoichi/src/adoption-cli.mjs status
node node_modules/sandoichi/src/adoption-cli.mjs enable
node node_modules/sandoichi/src/adoption-cli.mjs disable

For Claude/Codex marketplace installations, use lib/adoption-cli.mjs inside
the installed Sando plugin directory. Enabling requires an interactive prompt.
See TELEMETRY.md
for retention, privacy and control details. New metrics are not backfilled from
older anonymous telemetry.

Sando 0.6.1 — hotfix

Changelog: 0.6.1

0.6.1 — hotfix

• Fixes partial redaction of quoted credentials, escaped or truncated values, and Authorization headers. Custom assignment rules receive the same protections.
• Preserves original shell behavior for grep/rg searches, cat display flags, compound commands, newlines, and empty arguments. Commands that cannot be safely rewritten use the shell wrapper or remain untouched when wrapping is disabled.
• Returns exit status 1 for explicit CLI searches with no matches and preserves literal operands after --.
• Hardens artifact reuse across CLI, hooks, and history storage: existing symlinks, hardlinks, and non-regular files are rejected before content reads or permission changes.
• Restricts the experimental shadow compactor to complete lines from the redacted source in their original order, including cached results. This checks extractive grounding, not preservation of every omitted fact; it does not change live request traffic.

Validation: 634 tests passed with the pinned native Slice backend enabled, zero failures or skips, plus 27 independent acceptance checks. JavaScript syntax and bundle parity checks passed. No new provider-savings claim is made.

Sando 0.6.0-jev

Changelog: 0.6.0-jev

0.6.0-jev (Parallel Edition)

• TypeSafe Jev Integration: Adds intelligent semantic guards powered by TypeSafe AI (System One model jev-latest) alongside Sando's high-speed deterministic token compression.
• DoneGuard (Anti-Deception): Anchored to session telemetry (testsPassedAfterLastEdit). Intercepts premature or unverified completion claims when code files were modified without a passing test suite run.
• StuckGuard (Loop Prevention): Two-tier architecture:
  • Tier 1: Zero-latency, zero-cost local deterministic check for identical command failures.
  • Tier 2: Semantic Jev evaluation for syntactic drift and varying failure loops.
• Strict Fail-Open Guarantee: Guards operate with bounded timeouts (1500ms + 200ms hard ceiling with unref) and an offline deterministic heuristic fallback. Host execution never crashes or hangs if the network or API key is unavailable.
• Privacy & Security First (Option B): Zero plaintext credentials in repos or transcripts. Supports standard XDG storage in ~/.config/typesafe/auth.json (mode 0600) with automatic bidirectional scrubbing of tokens and secrets.

Sando 0.6.0

Changelog: 0.6.0

0.6.0

• Adds an optional TypeSafe/Jev shadow judge for bounded, redacted historical-result samples. It is enabled only with SANDO_TYPESAFE_SHADOW=1, fails open, and is disabled when the optional package or key is unavailable.
• Adds a provider-neutral offline semantic gate covering Anthropic Messages, OpenAI Chat Completions, and OpenAI Responses. It can restore a deterministic preview only when an injected judge marks likely semantic loss above the configured threshold.
• Adds redaction, request bounds, timeout, cache, and request-budget protections around shadow judging. Cached judge results are whitelisted and carry no request or text payloads.
• Keeps the live proxy measurement-only: the shadow judge never changes the forwarded request, and the offline gate is not wired into live traffic.
• Adds provider-free semantic-quality tests for loss, preservation, fail-open behavior, and threshold handling. These tests validate gate mechanics, not TypeSafe model accuracy.

No new provider-savings claim is made. Existing reduction benchmarks and the deterministic live path remain unchanged.

Sando 0.5.0

Upgrading from 0.4.x on Codex: shell-command routing is now on by default, where it
previously required SANDO_CLI_ROUTING=1. An existing install picks this up on update without
being asked, so commands that used to run untouched are now wrapped to bound their output. What
the wrap preserves is measured in docs/measurements.md; SANDO_CLI_ROUTING=0 restores the
previous behaviour.

• Added Slice symbol reads and opt-in symbol-body writes through the separately built native engine. The README documents the pinned source build, supported CI target, runtime requirements, and native license notices.

• Claude provider usage collection now deduplicates repeated assistant events by message identity and uses a complete final result usage record when available. Missing or unverified billing provenance remains explicit.

• Accounting reports distinguish host-reported cost from provider-attested cost and expose coverage; weighted cost units remain diagnostic.

• Statusline percentages apply to mechanical estimates only. Provider-supplied savings are not accepted from untrusted hook input and are not shown with a mismatched percentage denominator.

• CI builds the pinned native engine on Ubuntu 24.04 and runs the native integration suite alongside package and bundle checks.

• Recoverable history now skips eligible results smaller than 3,072 bytes by default. Same-transcript Codex and Claude provider replays provide conditional input-reduction evidence, while natural pilots remain explicitly workload-dependent.

• The Codex CLI now prints the artifact disclosure as the last line of stdout instead of the first. A cat rewritten to sando read reports the file's own first line, and the artifact handle still reaches the model on the stream it reads.

• sando read now forwards the file path to the source-class router, so a .log gets the 4 KB bulk cap and a .json the 8 KB structured-data cap instead of the 32 KB source fallback every read previously received. A read of an 81 KB log through the Codex CLI drops from 32,831 to 4,159 inline bytes. Files under the smaller caps that used to arrive whole are now bounded, with the full content recoverable from the artifact.

• mcp-tools.mjs, artifacts.mjs, coverage.mjs and codex-capabilities.mjs are maintained by hand in two bundles with no canonical copy in packages/sando/src. A parity gate now fails when a fix lands in one bundle only.

• Added scripts/bench-reduction.mjs: it measures per-result reduction over the tracked files of any git checkout, so a published figure is reproducible at a commit instead of taken on a synthetic fixture. Reduction across five repositories ranged from 40% to 82% of read tokens, with the median file unchanged in three of them.

• Extended the Codex CLI shell router to classify natural reader commands: cat with display flags (-n, -b, -s, -v, -e, -t, -A, -E, -T), grep/rg in natural argument order with common search flags, sed -n 'A,Bp' targeted line ranges, and bounded head/tail.

• Compound shell commands (cd <dir> && ..., export ...; ...) are now segmented and routed when the terminal segment is a reader whose output arrives directly at the model. Any segment that feeds a pipe or writes to a file redirect is strictly bypassed so bounded reads never silently truncate downstream pipeline inputs.

• enforcement.mjs is now included in the hand-maintained bundle parity test alongside mcp-tools.mjs, ensuring the Codex adapter and plugin copies remain identical.

• The Codex shell router now recognises natural reader forms (cat with display flags, grep/rg with ordinary argument order, sed -n 'A,Bp', head -n N) and the leading segment of a compound command, skipping cd/export prefixes. A segment whose output feeds a pipe or a redirect is never routed: bounding it there would change the result instead of the context. head and sed carry their line range through to the read, so a request for twenty lines returns twenty lines; tail stays unrouted because a range counted from the end cannot yet be expressed.

• sando_read accepts startLine/endLine, and the CLI --start-line/--end-line, to read an inclusive line range instead of the whole file.

• Every shell command Codex runs is now routed through sando exec, instead of only the read shapes the classifier recognises. Set SANDO_SHELL_WRAP=0 to go back to selective routing. The command text is handed to a shell unchanged, so pipelines, redirects and && keep their meaning and only the captured output is bounded. Over 12,852 recorded commands this moves coverage from 0.33% to 99.49%, and over 40,491 recorded Codex results it bounds 78.5M tokens of output down to 7.2M. EXEC_TIMEOUT_MS rises to 15 minutes so a long build is not killed, and a command already routed to sando read/sando grep keeps that route. This changes how every command executes: a command now depends on the plugin being able to run, where before a broken plugin only cost the reduction.

• sando exec now forwards the command to the source-class router, unwrapping a bash -lc wrapper first. Without this a wrapped cat app.mjs was scored as process-output and capped at 4 KB rather than the 32 KB its source class allows.

• Middle elision now salvages test-runner totals alongside error lines. A runner that prints one summary block per suite leaves the first block's counts in the middle of its output, where eliding them left a model reading the surviving block and reporting it as the whole run: npm test was answered as 100 tests where 573 had run, with nothing marking the omission. Headline counters (# tests, # pass, # fail, test result:, Tests:) take priority over the per-suite noise, so the quota is not spent on cancelled and todo.

• Added scripts/bench-codex-shell.mjs, which measures the shell surface of a real ~/.codex/sessions corpus: how many tokens its results carry and how many survive bounding. The figure the README quotes for SANDO_SHELL_WRAP is reproducible against your own rollouts rather than asserted.

• Telemetry adds a coverage_summary row: how many shell commands were routed, how many were bypassed, the bucketed share that was routed, and the leading bypass reason from the classifier's own closed list. Counts alone could not answer it, since 1,276 routed against 43,945 bypassed and the reverse both fall in gt_100. Reduction was already reported and coverage was not, so a day that bounded heavily on the small share of commands the classifier recognised looked the same on the wire as a day that bounded nearly everything.

• runPreToolUse now passes its environment to the shell classifier. It read process.env instead, so a caller handing it an explicit environment had SANDO_SHELL_WRAP ignored.

• Turns Codex CLI routing on by default. On Codex the PostToolUse hook cannot rewrite output, so rewriting the command before it runs is the only channel there is, and with routing off the plugin bounded nothing on its main surface. SANDO_CLI_ROUTING=0 opts out, and a control experiment arm still bypasses routing. permissionDecision: allow reports that the hook rewrote the input; Codex handles approval through a separate PermissionRequest event, which Sando does not implement.

• Fixes two ways the wrap diverged from the command it wraps: a child killed by a signal reported exit 1 instead of 128 + signum, making an OOM kill and a timeout indistinguishable from an ordinary failure, and standard input was not passed through, so a command reading stdin saw EOF. Both are covered by regression tests against the CLI entrypoint.

• Adds scripts/bench-wrap-divergence.mjs, which compares wrapped and native runs of 1,290 recorded commands on exit code, signal death, working tree and output reachability. Results are in docs/measurements.md.

Benchmark runs remain exploratory evidence for this release and do not establish a general provider-billing or end-to-end savings claim.

---

Install: /plugin install sando@yuzushi (Claude Code), or sando from the
yuzushi-dev/yuzushi-plugins marketplace in Codex. Both hosts are served this tag.

Measurements and method: docs/measurements.md.

Sando 0.4.2

Changelog: 0.4.2

0.4.2

This release keeps the public surface focused on deterministic local routing, bounded output, and honest provider accounting.

Added

• F1 context-footprint audit with explicit categories, provenance, and unavailable results when the host body is not observable.
• F3 result disclosure with redaction, bounded inline output, artifact handles, and bounded recovery where an artifact was admitted.
• F4 lazy MCP gateway with an explicit allowlist, local catalog and call surface, and a kill switch.
• Provider-proxy capture for supported initial context bodies and bounded provider usage evidence.

Changed

• Claude, Codex, and plugin bundles now share the same generated implementation for the supported surfaces.
• Telemetry events use the v2 schema. Mechanical estimates and provider-reported usage remain separate.
• Already queued v1 aggregate rows are preserved and drained during the v2 rollout.

Fixed

• Oversized redacted results stay within the inline byte limit when artifact admission fails.
• Result and history disclosures identify what was elided and whether recovery is available.
• MCP artifact recovery stays read-only and bounded.

Boundaries

• F4 stays disabled unless an operator supplies an explicit configuration.

Sando v0.4.1

Sando v0.4.1

• Statusline Claude/Codex aggiornata per mostrare i token di contesto evitati e la percentuale di riduzione.
• Le stime sono marcate con ~; i risparmi provider-reported senza tilde.
• Bundle Claude, Codex e plugin sincronizzati.
• Marketplace pin­nato al tag v0.4.1.