# 1a. Estimate current CLAUDE.md token cost
echo "=== Global CLAUDE.md ===" && wc -l ~/.claude/CLAUDE.md 2>/dev/null || echo "No global CLAUDE.md"
echo "=== Project CLAUDE.md ===" && wc -l .claude/CLAUDE.md 2>/dev/null || echo "No project CLAUDE.md"

# 1b. Count all @imported files referenced in CLAUDE.md
grep -h "@" ~/.claude/CLAUDE.md .claude/CLAUDE.md 2>/dev/null | grep -v "^#" | grep -v "<!--"

# 1c. List all skills loaded at startup
echo "=== User skills ===" && ls ~/.claude/skills/ 2>/dev/null || echo "none"
echo "=== Project skills ===" && ls .claude/skills/ 2>/dev/null || echo "none"

# 1d. List all subagents
echo "=== User agents ===" && ls ~/.claude/agents/ 2>/dev/null || echo "none"
echo "=== Project agents ===" && ls .claude/agents/ 2>/dev/null || echo "none"

# 1e. Check model and effort level
cat ~/.claude/settings.json 2>/dev/null | python3 -c "
import json, sys
d = json.load(sys.stdin)
print('model:', d.get('model', 'not set'))
print('effortLevel:', d.get('effortLevel', 'not set'))
print('MAX_THINKING_TOKENS:', d.get('env', {}).get('MAX_THINKING_TOKENS', 'not set'))
" 2>/dev/null || echo "No ~/.claude/settings.json"

# 1f. Check project hooks
cat .claude/settings.json 2>/dev/null | python3 -c "
import json, sys
d = json.load(sys.stdin)
hooks = d.get('hooks', {})
print('Hooks configured:', list(hooks.keys()) if hooks else 'none')
" 2>/dev/null || echo "No .claude/settings.json"

# 1g. Estimate total startup token cost
python3 -c "
import os, glob

def tokens(path):
    try:
        with open(os.path.expanduser(path)) as f:
            return len(f.read()) // 4
    except:
        return 0

g = tokens('~/.claude/CLAUDE.md')
p = tokens('.claude/CLAUDE.md')
skills_startup = 0  # skills are on-demand
print(f'Startup context cost today: ~{g + p} tokens per session')
print(f'  Global CLAUDE.md : ~{g} tokens')
print(f'  Project CLAUDE.md: ~{p} tokens')
"

# Compact instructions
When compacting, preserve: modified file list, test commands, active task state, TODO markers.
Discard: exploration history, failed attempts, verbose tool output logs.

python3 -c "
import os

def tokens(path):
    try:
        with open(os.path.expanduser(path)) as f:
            return len(f.read()) // 4
    except:
        return 0

print(f'Global CLAUDE.md after: ~{tokens(\"~/.claude/CLAUDE.md\")} tokens')
print(f'Project CLAUDE.md after: ~{tokens(\".claude/CLAUDE.md\")} tokens')
"

---
name: pdf-to-context
description: Convert PDF or large document to token-efficient markdown before analysis.
  Triggers: "read this PDF", "analyze document", "summarize this file", any .pdf or .docx reference.
---

# PDF → Markdown Preprocessing

## ALWAYS do this before reading any PDF or large document into context

### Step 1: Extract text (never read raw PDF binary into context)
```bash
# Method A — pdftotext (fastest)
pdftotext "$FILE" - | head -c 50000

# Method B — pdfplumber (preserves tables)
python3 -c "
import pdfplumber, sys
with pdfplumber.open(sys.argv[1]) as pdf:
    text = '\n'.join(p.extract_text() or '' for p in pdf.pages)
    print(text[:50000])
" "$FILE"

python3 -c "import docx2txt, sys; print(docx2txt.process(sys.argv[1])[:50000])" "$FILE"

tail -100 logfile.log                        # Last 100 lines
grep -i "error\|warning\|fail" log.txt       # Errors only
grep -A3 "FAILED" test_output.txt            # Failed tests with context

---
name: context-manager
description: Manage context window health during long sessions.
  Triggers: "context getting big", "clear context", "start fresh", "compact session",
  long debugging sessions >30 min, Claude repeating mistakes.
---

# Context Window Management

## When to act
| Signal | Action |
|--------|--------|
| Session > 30 min active work | `/compact` |
| Switching to unrelated task | `/clear` (use `/rename` first) |
| Claude repeating mistakes / forgetting | `/compact` mandatory |
| Quick one-off question | `/btw [question]` — never enters context |

## Optimal /compact command

---
name: model-selector
description: Choose the right model and effort level per task to minimize cost.
  Triggers: "which model", "save tokens", "quick task", "simple fix", "complex architecture".
---

# Model & Effort Selection Matrix

| Task type | Model | Effort | Cost vs default |
|-----------|-------|--------|----------------|
| Typo fix, rename variable | haiku | low | ~10x cheaper |
| Write function, add test | sonnet | low | baseline |
| Debug complex bug | sonnet | medium | +30% |
| Architecture / design decision | sonnet high or opus | high | +3-5x, justified |
| Multi-file refactor | sonnet | medium | baseline |
| Subagent exploration tasks | haiku | low | ~10x cheaper |

## Session commands
```bash
/model          # Open model picker
/effort low     # Fast, cheap — routine tasks
/effort medium  # Default balanced (recommended)
/effort high    # Deep reasoning — justify the cost

---

model: haiku
effort: low

---

---
name: fetch-not-read
description: Use targeted Bash commands instead of full file reads to minimize context tokens.
  Triggers: before reading any file >100 lines, "show me the code", "read this file",
  "what does X do".
---

# Fetch-not-read Pattern

## Core principle
`Read(large_file.py)` dumps EVERYTHING into context.
Bash commands let you extract **exactly** what you need.

## Replacement patterns

### Structure overview (instead of reading whole file)
```bash
grep -n "^def \|^class " file.py          # All functions/classes with line numbers
grep -n "^export\|^const\|^function" file.ts

sed -n '/^def target_function/,/^def /p' file.py | head -60

head -30 file.py

grep -n -A10 "keyword" file.py
grep -rn "function_name" --include="*.py" | head -20

grep -E "FAILED|ERROR|passed [0-9]+" pytest_output.txt | tail -30
grep -A5 "FAILED" pytest_output.txt

find . -name "*.py" | head -20
grep -r "function_name" --include="*.py" -l   # Files containing it

python3 << 'EOF'
import json, os

path = os.path.expanduser("~/.claude/settings.json")
try:
    with open(path) as f:
        settings = json.load(f)
except FileNotFoundError:
    settings = {}

# Merge token-saving defaults
settings.setdefault("model", "claude-sonnet-4-6")
settings.setdefault("effortLevel", "medium")
settings.setdefault("env", {})
settings["env"]["MAX_THINKING_TOKENS"] = "8000"

# ── PERMISSIONS ─────────────────────────────────────────────
settings.setdefault("permissions", {})

# Allow: pre-approved safe commands (no confirmation prompt)
settings["permissions"].setdefault("allow", [])
allow_rules = [
    "Bash(git diff *)", "Bash(git log *)", "Bash(git status *)",
    "Bash(wc *)", "Bash(grep *)", "Bash(find *)",
    "Bash(head *)", "Bash(tail *)", "Bash(sed -n *)"
]
for rule in allow_rules:
    if rule not in settings["permissions"]["allow"]:
        settings["permissions"]["allow"].append(rule)

# Deny: hard block — Claude cannot execute these under any circumstances
settings["permissions"].setdefault("deny", [])
deny_rules = [
    # Protect secrets
    "Read(./.env)", "Read(./.env.*)",
    "Read(./secrets/**)", "Read(./.git/objects/**)",
    "Edit(.env)", "Edit(.env.*)",
    "Edit(./secrets/**)", "Edit(.git/**)",
    # Block destructive git operations
    "Bash(git push *)", "Bash(git push)",
    "Bash(git push --force *)",
    "Bash(git reset --hard *)",
    # Block destructive system commands
    "Bash(rm -rf *)",
    # Block network exfiltration
    "Bash(curl *)", "Bash(wget *)"
]
for rule in deny_rules:
    if rule not in settings["permissions"]["deny"]:
        settings["permissions"]["deny"].append(rule)

# Ask: Claude requests your confirmation before executing
settings["permissions"].setdefault("ask", [])
ask_rules = [
    "Bash(git commit *)",
    "Bash(git checkout *)",
    "Bash(git branch -d *)",
    "Bash(git stash *)"
]
for rule in ask_rules:
    if rule not in settings["permissions"]["ask"]:
        settings["permissions"]["ask"].append(rule)

# ── ATTRIBUTION ─────────────────────────────────────────────
# Remove Co-Authored-By: Claude from git commits and PRs
settings["attribution"] = {"commit": "", "pr": ""}

# ── GITIGNORE ───────────────────────────────────────────────
settings["respectGitignore"] = True

with open(path, "w") as f:
    json.dump(settings, f, indent=2)

print("~/.claude/settings.json updated")
print(f"   model          : {settings['model']}")
print(f"   effortLevel    : {settings['effortLevel']}")
print(f"   MAX_THINKING   : {settings['env']['MAX_THINKING_TOKENS']}")
print(f"   deny rules     : {len(settings['permissions']['deny'])}")
print(f"   ask rules      : {len(settings['permissions']['ask'])}")
print(f"   allow rules    : {len(settings['permissions']['allow'])}")
print(f"   attribution    : commit='{settings['attribution']['commit']}' pr='{settings['attribution']['pr']}'")
print(f"   respectGitignore: {settings['respectGitignore']}")
EOF

mkdir -p .claude/hooks

cat > .claude/hooks/guard-large-read.sh << 'HOOKEOF'
#!/bin/bash
# Block Read tool on files > 300 lines — enforce grep/sed extraction
set -euo pipefail

INPUT=$(cat)
FILE=$(echo "$INPUT" | python3 -c "
import json, sys
print(json.load(sys.stdin).get('tool_input', {}).get('file_path', ''))
" 2>/dev/null || echo "")

# Early exit: no file path or file doesn't exist
if [ -z "$FILE" ] || [ ! -f "$FILE" ]; then
  exit 0
fi

LINES=$(wc -l < "$FILE" 2>/dev/null || echo 0)
if [ "$LINES" -gt 300 ]; then
  python3 -c "
import json
print(json.dumps({
  'decision': 'block',
  'reason': (
    '$FILE has $LINES lines (~' + str($LINES * 5) + ' tokens). '
    'Use targeted extraction: '
    'grep -n \\"pattern\\" $FILE | head -20 '
    'or: sed -n \\"/^def target/,/^def /p\\" $FILE | head -50'
  )
}))
"
  exit 0
fi

exit 0
HOOKEOF

chmod +x .claude/hooks/guard-large-read.sh
echo "guard-large-read.sh created and made executable"

cat > .claude/hooks/validate-bash.sh << 'HOOKEOF'
#!/bin/bash
# validate-bash.sh — PreToolUse hook for Bash commands
# Blocks dangerous shell commands before Claude Code executes them.
# Exit code 2 = BLOCK, exit code 0 = ALLOW
set -euo pipefail

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | python3 -c "
import json, sys
data = json.load(sys.stdin)
print(data.get('tool_input', {}).get('command', ''))
" 2>/dev/null || echo "")

if [ -z "$COMMAND" ]; then
  exit 0
fi

# git push (any variant)
if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)git\s+push(\s|$)'; then
  echo '{"decision":"block","reason":"git push blocked. Push manually."}' >&2
  exit 2
fi

# git reset --hard
if echo "$COMMAND" | grep -qE 'git\s+reset\s+--hard'; then
  echo '{"decision":"block","reason":"git reset --hard blocked. Destructive operation."}' >&2
  exit 2
fi

# rm -rf (recursive force delete)
if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)rm\s+-[a-zA-Z]*r[a-zA-Z]*f|rm\s+-[a-zA-Z]*f[a-zA-Z]*r'; then
  echo '{"decision":"block","reason":"rm -rf blocked. Dangerous recursive delete."}' >&2
  exit 2
fi

# curl / wget (prevent network exfiltration)
if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)(curl|wget)\s'; then
  echo '{"decision":"block","reason":"curl/wget blocked. No unauthorized network requests."}' >&2
  exit 2
fi

# chmod 777 (overly permissive)
if echo "$COMMAND" | grep -qE 'chmod\s+777'; then
  echo '{"decision":"block","reason":"chmod 777 blocked. Overly permissive."}' >&2
  exit 2
fi

# Writing to system directories
if echo "$COMMAND" | grep -qE '(>|>>)\s*/(etc|usr|var|boot|sys)/'; then
  echo '{"decision":"block","reason":"Writing to system directory blocked."}' >&2
  exit 2
fi

exit 0
HOOKEOF

chmod +x .claude/hooks/validate-bash.sh
echo "validate-bash.sh created and made executable"

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/validate-bash.sh"
          }
        ]
      },
      {
        "matcher": "Read",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/guard-large-read.sh"
          }
        ]
      }
    ]
  }
}

mkdir -p .claude/agents

# Only create if not already present (don't overwrite customized versions)
if [ ! -f .claude/agents/code-explorer.md ]; then
cat > .claude/agents/code-explorer.md << 'AGENTEOF'
---
name: code-explorer
description: >
  Explore codebase structure and find relevant files/patterns.
  Use for: understanding how a system works, finding where X is implemented,
  mapping dependencies, surveying a module before editing it.
  Returns compact summary — keeps main context clean.
model: haiku
effort: low
maxTurns: 10
tools: Read, Bash, Glob, Grep
---

You are a fast, efficient code navigator. Explore, then summarize compactly.

## Exploration rules
- Use `grep -n "pattern" file` instead of reading entire files
- Use `grep -rn "symbol" src/ -l` to find files before reading them
- Stop when you have enough to answer — do not explore exhaustively
- Never read files > 200 lines in full without justification

## Response format (ALWAYS)
Return a JSON block:
```json
{
  "relevant_files": ["src/auth/middleware.ts:15-45"],
  "key_findings": ["JWT validation happens at line 23", "No refresh token logic found"],
  "recommended_approach": "Add refresh endpoint in src/auth/ alongside existing middleware",
  "files_read": 3,
  "grep_calls": 5
}

python3 << 'EOF'
import os, glob, json

def tokens(path):
    try:
        with open(os.path.expanduser(path)) as f:
            return len(f.read()) // 4
    except:
        return 0

def lines(path):
    try:
        with open(os.path.expanduser(path)) as f:
            return sum(1 for _ in f)
    except:
        return 0

print("=" * 60)
print("CLAUDE CODE TOKEN OPTIMIZATION — FINAL REPORT")
print("=" * 60)

# ── CLAUDE.md ─────────────────────────────────────────────
g_tokens = tokens("~/.claude/CLAUDE.md")
p_tokens = tokens(".claude/CLAUDE.md")
g_lines  = lines("~/.claude/CLAUDE.md")
p_lines  = lines(".claude/CLAUDE.md")

print(f"\nCLAUDE.md files (loaded every session)")
print(f"  Global  : {g_lines} lines — ~{g_tokens} tokens")
print(f"  Project : {p_lines} lines — ~{p_tokens} tokens")
print(f"  Total startup context: ~{g_tokens + p_tokens} tokens")

# ── Skills ────────────────────────────────────────────────
skill_files = glob.glob(".claude/skills/*/SKILL.md")
skill_tokens = sum(tokens(f) for f in skill_files)
print(f"\nSkills (on-demand — zero startup cost)")
for f in skill_files:
    t = tokens(f)
    print(f"  {os.path.basename(os.path.dirname(f))}: ~{t} tokens")
print(f"  Total skill content: ~{skill_tokens} tokens (loaded only when invoked)")

# ── Subagents ─────────────────────────────────────────────
agent_files = glob.glob(".claude/agents/*.md")
print(f"\nSubagents configured: {len(agent_files)}")
for f in agent_files:
    print(f"  {os.path.basename(f)}")

# ── Settings & Security ──────────────────────────────────
settings_path = os.path.expanduser("~/.claude/settings.json")
try:
    with open(settings_path) as f:
        s = json.load(f)
    perms = s.get('permissions', {})
    attr = s.get('attribution', {})
    print(f"\nSettings")
    print(f"  model            : {s.get('model', 'not set')}")
    print(f"  effortLevel      : {s.get('effortLevel', 'not set')}")
    print(f"  MAX_THINKING     : {s.get('env', {}).get('MAX_THINKING_TOKENS', 'not set')}")
    print(f"  respectGitignore : {s.get('respectGitignore', 'not set')}")
    print(f"  attribution      : commit='{attr.get('commit', 'not set')}' pr='{attr.get('pr', 'not set')}'")
    print(f"\nPermissions")
    print(f"  deny rules  : {len(perms.get('deny', []))}")
    for r in perms.get('deny', []):
        print(f"    ✗ {r}")
    print(f"  ask rules   : {len(perms.get('ask', []))}")
    for r in perms.get('ask', []):
        print(f"    ? {r}")
    print(f"  allow rules : {len(perms.get('allow', []))}")
    for r in perms.get('allow', []):
        print(f"    ✓ {r}")
except:
    print("\nCould not read settings.json")

# ── Hooks ─────────────────────────────────────────────────
hook_files = glob.glob(".claude/hooks/*.sh") + glob.glob(os.path.expanduser("~/.claude/hooks/*.sh"))
print(f"\nHooks installed: {len(hook_files)}")
for f in hook_files:
    print(f"  {f} — {'executable' if os.access(f, os.X_OK) else 'NOT executable [!]'}")

# ── Git safety check ──────────────────────────────────────
git_blocked = any('git push' in r for r in perms.get('deny', []))
rm_blocked = any('rm -rf' in r for r in perms.get('deny', []))
curl_blocked = any('curl' in r for r in perms.get('deny', []))
commit_ask = any('git commit' in r for r in perms.get('ask', []))

print(f"\nSecurity status")
print(f"  git push blocked     : {'[OK]' if git_blocked else '[FAIL] NOT PROTECTED'}")
print(f"  rm -rf blocked       : {'[OK]' if rm_blocked else '[FAIL] NOT PROTECTED'}")
print(f"  curl/wget blocked    : {'[OK]' if curl_blocked else '[FAIL] NOT PROTECTED'}")
print(f"  git commit requires confirmation : {'[OK]' if commit_ask else '[WARN] auto-allowed'}")
print(f"  attribution suppressed : {'[OK]' if attr.get('commit') == '' else '[WARN] Claude appears in commits'}")

print(f"\n{'=' * 60}")
print(f"OPTIMIZATION COMPLETE")
print(f"{'=' * 60}")
print(f"   Startup context      : ~{g_tokens + p_tokens} tokens (target ≤ 800)")
print(f"   Skills offloaded     : ~{skill_tokens} tokens (zero cost until invoked)")
print(f"   Large file hook      : active (blocks files > 300 lines)")
print(f"   Bash safety hook     : active (blocks git push, rm -rf, curl)")
print(f"   Thinking cap         : MAX_THINKING_TOKENS=8000")
print(f"   Cheap exploration    : haiku subagent at ~10x lower cost")
print(f"   Git safety           : deny push, ask commit, attribution suppressed")
EOF