token-optimizer-output

Use Token Optimizer only when the user invokes this skill. It does not run commands, add permissions or replace native compaction. If the user installed automatic mode (install.sh --devin --auto), eligible command output is already compressed by hooks and carries its own capture ID and recover command; this skill is the manual fallback for everything else.

Keep -I in every filter command. It is required from the first trusted Python startup; plain invocation and direct shebang execution are unsupported.

This is a finite captured-output workflow, not a transparent shell wrapper. Redirection can change buffering and isatty-dependent behavior; separate captures cannot preserve cross-stream timing/order. Use only completed non-interactive foreground commands. Never capture interactive prompts or background producers. Never rerun a command just to measure it.

Prepare an adapter-owned private capture directory first:

@PYTHON@ -I @FILTER@ prepare

Prepare creates stdout and stderr files inside the printed directory; redirect into exactly those two. Quote every path as one shell argument; do not build a shell string from untrusted text. If a path contains quotes or shell metacharacters, use your normal safe argv tooling rather than guessing escapes. Under umask 077, run the intended command in the native shell with normal permissions, redirect both streams into those prepared files, and save its exit status in the same shell call as the command (EC=$? right after it) — a separate shell call reads the wrong status. Await full foreground completion before sealing:

@PYTHON@ -I @FILTER@ seal --capture /absolute/prepared/capture --exit-code 0

Replace the path and code with their real values. Sealing hashes both files; the filter refuses appended/truncated/replaced files. A seal is an assertion that you waited for completion, not an independent observation of the producer. Do not display full successful stdout before filtering or claim reduction for output already sent to the model.