Every plugin in this category tells you it reduces context cost. None of them let you check on your own code first, so I built the page that does, and it is the first thing chamnan 1.23.1 ships. arcticfox2029.github.io/chamnan-measure Paste a public GitHub repository URL. The page downloads the source into your browser tab, runs chamnan's actual modules over it through Pyodide — mapper, rollup, the redactor, not a re-implementation of any of them — and reports what would be injected into an agent's context each session, what the redactor would alter, and a fifty-turn simulation over that repository's own files. No server. No upload. No API key. The source is deleted the moment the numbers exist. It works in five languages. What the numbers say, and what they do not Thirteen repositories are measured on the page already: repository language source injected ratio chalk/chalk JavaScript 56 KB 2,449 B 24:1 psf/requests Python 392 KB 6,345 B 63:1 rails/rails Ruby 1,550 KB 6,537 B 243:1 django/django Python 2,209 KB 6,245 B 362:1 torvalds/linux C 3,028 KB 6,603 B 470:1 vuejs/core TypeScript 3,782 KB 6,250 B 620:1 The interesting column is not the ratio. It is that the source grows nearly seventy-fold down that table and the injected block stays between 6.2 and 6.7 KB. That is a bound, not compression — the index is rolled up to a token budget, so a bigger repository buys you a coarser map rather than a bigger bill. The ratio is a consequence of the bound, which is why quoting it alone would be the flattering version. A 25.4x figure on the published corpus is the honest headline for compression; the same measurement on a corpus padded with binary attachments produces 223x, and this project's own README records the time that number was corrected for choosing the flattering corpus. The release itself is one defect, found in fourteen places Not fourteen unrelated bugs. One shape, repeated: a rule applied to some members of a set and forgotten in the identical ones beside it. They were written months apart, found by separate research rounds, and naming them together is the only way the pattern is visible. A few of them: Path.glob raises NotImplementedError — not ValueError, not OSError — for a pattern beginning with /. One committed rule file reading **Check:** absent `X` in every `/etc/*` ended the injected context block where it stood: the last session's handoff, open threads, the tools index, all silently absent, every session, under a message that never named the rule. A rule file arrives with a clone, so this needed no local access at all. A committed tools index with "runs": "12" instead of 12 crashed the same hook through sort(key=lambda t: -(t.get("runs") or 0)). The name in that file was validated, because a name becomes a path. A sort key is exactly where an untrusted field turns into arithmetic. All three context-injecting hooks failed to strip zero-width characters, each differently. Two bypassed the sanitiser with a raw write; the third called it faithfully on the finished JSON, by which point json.dumps has escaped every smuggled code point to \uXXXX text no character filter matches and the model decodes straight back. Reproduced end to end: 44 Unicode Tag characters in, an instruction back out. Eleven places wrapped a repository-derived name in backticks. POSIX permits a backtick in a filename, and one closes the code span — after which the repository's data renders as the tool's own voice. A report named two of them; the sweep found nine more. What I would do differently, since that is the more useful half The Windows column of the CI matrix caught five things a Mac could not, and I spent an evening learning them one push at a time. Four of the five were findable locally and I did not look: a #!/bin/sh test fixture Windows cannot execute, a path compared without normalising separators, a /nonexistent-… path that Windows resolves against the current drive and happily creates, and a subprocess spawn added to the session-start path that took CI from 4m16s to 9m25s. The fifth was a real concurrency defect, and it is the one worth writing down. The file lock gave a waiter a fixed two seconds and then let the caller write unguarded. Four hundred turns through one lock drain inside two seconds only if a turn is cheap; on Windows it is not, and the counter came back 41 of 400 — lost, silently, on a running total nothing recomputes. I reproduced it on macOS in thirty seconds by shrinking the ceiling to 0.05 s instead of finding a Windows machine. Squeezing a constant is the same experiment as slowing the disk, and it runs where you are already sitting. That squeeze is a permanent check now, on every platform. The rest MIT. Standard library only — no dependency step in CI, and if it ever needs one, that is the change to reject rather than the workflow to fix. 21 languages parsed, 23 adapters, tested on Ubuntu, macOS and Windows across Python 3.8 and 3.13. github.com/ArcticFox2029/chamnan