Sando

Context-management plugin for Claude Code and Codex. It bounds what a tool result costs before that result reaches the model.

Large output is truncated to a cap set by the kind of content it is, the full bytes are kept on disk with a verified hash, and the lines that answer the question — error lines, test totals — are pulled out of the part that was cut. The default path is deterministic and local; the optional TypeSafe shadow judge is measurement-only and never changes the request.

Expected savings

These are output reductions, one tool result at a time. What a session costs also depends on prompt-cache economics, which these numbers do not model. Results from external mcp__* tools pass through untouched and are excluded. Method and per-corpus variation: docs/measurements.md.

Install

Requirements: Claude Code or Codex, and Node.js >=22.22.0 <23 with node on PATH (node --version). Each marketplace source ships its hooks and bundles, so there is no build step.

Claude Code — run in the session:

/plugin marketplace add yuzushi-dev/yuzushi-plugins
/plugin install sando@yuzushi

Codex:

codex plugin marketplace add yuzushi-dev/yuzushi-plugins

Then open /plugins, select sando, and install/enable it. Start a new session if Codex was already open.

On Codex the PostToolUse hook cannot rewrite output at all, so Sando bounds shell output by rewriting the command before it runs. That is on by default; SANDO_CLI_ROUTING=0 switches it off. What the rewrite preserves is measured rather than assumed: exit codes, death by signal, standard input, stderr and the resulting working tree all match the unwrapped run across 1,290 recorded commands, and binary output is withheld rather than bounded. See docs/measurements.md. Approval is untouched — Codex handles that through a separate PermissionRequest event.

What you get

• Bounded tool results. Every result is capped by content kind before the model sees it.
• Nothing is lost. Full bytes go to a content-addressed store with a verified hash; the bounded result carries the command to fetch back whatever was cut.
• The answer survives the cut. npm test here prints 595 test results across two summary blocks, 120 KB in total. Bounded, the model sees 4 KB and still answers 585 passed, 0 failed, because the totals are salvaged out of the elided middle. Before that salvage existed, the same model read the surviving block and answered 100 passed, with nothing to mark the omission.
• Secrets redacted first, with project-local detectors in .sando/redaction.json.
• Composes, doesn't compete. It acts on tool results only, so it stacks with output filters or scope rules.
• Accounting you can check. Provider-reported tokens and mechanical trimming are recorded separately; mechanical reduction is never turned into a provider-billing claim.

Architecture in brief

host (Claude PostToolUse hook | Codex shell routing)
        │  tool result
        ▼
   redaction ──► bound to a per-kind cap ──► salvage errors + totals
        │                                          │
        ▼                                          ▼
  artifact store (sha256, on disk)          preview to the model
        │                                     + recovery handle
        └──► sando artifact get / sando_artifact_get (MCP)

• Three bundles, one per host surface: adapters/claude/sando, adapters/codex/sando, plugins/sando. Each carries hooks/, mcp/, bin/, lib/. The lib/ trees are synced from the single source in packages/sando/src by scripts/sync-bundles.mjs.
• MCP server exposes read-only artifact recovery, plus optional Slice symbol tools when a natively built engine is configured.
• Each host wires only what its manifest declares: the hooks and the MCP surfaces. The provider proxy and the Lazy MCP Gateway are separate processes that no host starts — you launch them yourself or they never run. The CLI, audit, artifact recovery, statusline, metrics and accounting launchers are likewise manual entrypoints. Sando changes no Claude or Codex global configuration, and telemetry is off until you choose.

Release notes: Sando 0.7.0. Development branch: main. Telemetry is off by default — see the full disclosure.

Slice connects Sando's MCP to a separately built native symbol engine. Build the tested engine from a Sando source checkout with Bash, Git, Make, CMake 3.24+ and GCC 13+ (C and C++ compilers). The verified target is Ubuntu 24.04 on Linux x86-64; other operating systems, architectures and toolchains are not verified by Sando.

# Run from the Sando checkout. The destination must not already exist.
bash scripts/build-slice.sh "$HOME/sando-slice"

The script fetches upstream source at commit d90acb2cb3295da8ca0fd33a88e81cb51a8575fb, checks the revision and builds with vendored dependencies and CMake downloads disabled. It retains the source and its licenses, refuses an existing destination, and leaves a failed build in place for diagnosis. Expect several minutes of compilation, several GB of RAM, and space for the source and build tree. It does not install hooks, modify host configuration or install a binary globally.

Build on the machine where the MCP server runs: the executable uses that system's C/C++ runtime libraries. This is a pinned source build, not a promise of identical binary bytes across compilers or portability to older distributions. The native engine is Apache-2.0, with dependency notices in its THIRD_PARTY.md and third_party/ license files; Sando's JavaScript remains MIT. Keep those notices with any redistributed native artifact. The plugin and npm library contain no native executable.

Configure the MCP server environment with the resulting absolute executable path and a canonical workspace directory:

SANDO_SLICE_BINARY=/absolute/path/to/sando-slice/build/ripwire
SANDO_SLICE_ROOT=/absolute/path/to/workspace
SANDO_SLICE_WRITE=1

Without a valid binary and root, no Slice tools are advertised. Omit SANDO_SLICE_WRITE for read-only use. Codex runs the engine inside the host's managed restricted sandbox; missing sandbox metadata is refused.

Read tools are sando_slice_for, sando_slice_find_symbol, sando_slice_find_referencing_symbols, and sando_slice_fetch_body (at most 400 body-relative lines per call). Writes are sando_slice_replace_symbol_body and sando_slice_insert_after_symbol.

Find the symbol, fetch its body, then pass its sym#…@… identifier as the write's handle. Plain names are not accepted for writes. Replacement covers exactly the fetched definition span: preserve modifiers such as export that sit outside it instead of adding them again. Stale handles are refused; read again and reconsider the edit. Insertion before a definition is not exposed.

Slice applies Sando's project redaction rules to results and errors. Redacted source is marked as non-round-trippable and its handle cannot be used for replacement. The engine's handles, freshness metadata, and edit receipts are otherwise preserved. post_check provides static feedback, not a test run; run project tests after editing. If a write is interrupted or loses its response, inspect the file before retrying: cancellation does not imply rollback.

Native integration checks use temporary workspaces. The Codex cases additionally require the Codex CLI on PATH and a working host sandbox (Bubblewrap on Linux); they are skipped when Codex is absent. CI provides both and runs every native case:

SANDO_SLICE_TEST_BINARY="$HOME/sando-slice/build/ripwire" npm test

Bash previews also remove ANSI formatting and retain bounded error diagnostics from omitted output, prioritizing failures over warnings. Full admitted artifacts retain the original redacted output; ANSI formatting is also removed there when necessary to redact a credential split by escape sequences.

Recover a bounded byte or line range from an installed workspace artifact:

/path/to/installed/sando/bin/sando artifact get --root . --ref sando:sha256:... --start-line 1 --end-line 40 --json
# Claude bundle: node /path/to/installed/sando/artifact.mjs artifact get --root . --ref sando:sha256:... --json

From inside a session, the MCP server exposes the same reco