claude-code-plugins
A spend limit an agent cannot lift, and six subagents pinned to the cheapest model that holds.
Problem
An agent that is looping does not announce it. It reads a file, tries a fix, runs the test, reads the file again, and the only thing that tells you is the bill. The second cost is quieter: the default move is to send every task to the best model available, so renaming a variable is priced like a migration plan.
Approach
Two plugins, Node standard library only, no telemetry and no network calls. `governor` is a PreToolUse hook that tallies output tokens off the session transcript and speaks at three gates: burn rate first, because spending fast is a worse sign than spending a lot, then a soft warning, then a hard deny. `crew` is six subagents, each pinned to a tier, whose published descriptions are the whole routing mechanism. Both were shipped against measurements rather than intuition: a four-task A/B for the routing, and the gate replayed over every session transcript on the machine.
Outcome
- Four identical tasks, routed against unrouted: 298,615 tokens versus 921,297, and $0.40 versus $1.28, so 68% cheaper with every result verified by execution rather than taken from the agents’ own reports.
- The gate replayed over 395 real sessions (27.7M output tokens, $690 of spend) would have stopped 6.1% of them, and no others.
- A dispatcher given only the six published descriptions and no repo access routed 18 of 18 tasks correctly, and still 18 of 18 after the descriptions were compressed 31%.
- The whole always-on context cost is roughly 400 tokens. Hooks run outside the model’s context entirely, so the gate itself costs nothing per session.
- Every executable ships a `--selftest` covering incremental transcript reads, duplicate streaming lines, transcript truncation, each gate firing, a tampered state file and a hostile catalog response.
The design decision worth reading is where the budget lives. At the hard gate every tool call is denied, which is the point: it forces a stop and a replan instead of a quiet overrun. But a gate that blocks everything also blocks the edit that would raise the budget, stranding the session with no way to ask for more. So editing the project config stays allowed, and that doubles as the escape hatch: a cornered model can hand itself more budget and carry on, up to a ceiling only the user can move. The project file decides when the gate speaks; whether it stops at all is not the project file’s to decide.
That split was not true in 0.3.0. A project file could set `"enabled": false` or push the hard ratio past any real session, and the ceiling became decoration, because the model could disable its own limit. Fixed in 0.4.0 with the bypass pinned down by a test, because a boundary without a test for the bypass is a boundary until someone tries it.
The benchmark found two things the README had got wrong. Subagent spend is invisible to the gate: those turns land in a separate transcript the hook never reads, so the eight benchmark runs spent about 1.2M tokens the budget never saw. And output tokens turned out to be 5% of what these runs actually cost. On one task, 168 output tokens against 322,512 cache reads, making output 1.2% of the bill. The stated rationale was that output tokens drive cost; that holds for a session that writes and fails for one that reads. Addressed in 0.5.0 with an opt-in weighted tally. Both are written down as gaps rather than quietly absorbed.
The routing result matters more than the cost table, because misrouting a third of the time to the expensive tier would erase most of the 68%. What makes it work is the refusals: an agent handed work below its tier names the right agent and hands back instead of doing it anyway. Three probes tested that and one failed: the cheap tier was told to find something and searched rather than handing back. The answer was correct and still cheap, but it is the honest reading: a refusal is an instruction to a model, not a mechanism.
- −68%
- Cost on a measured A/B
- 395
- Sessions replayed through the gate
- ~400 tokens
- Always-on context cost