d-strange

Stop burning tokens on trial-and-error.

Your agent commits to the first idea, hits a wall, and you pay for it.
D Strange makes it find the path that actually works, before it starts.

_{Named for the wizard who scanned 14,000,605 futures before committing to one. That is the whole trick: check the futures before you burn the tokens, not after.}

---

The problem

Give an agent an over-constrained problem, a hard cost ceiling, a "there has to be a way" ask, a decision with several plausible but expensive-to-verify approaches, and it tends to do one of two things.

It commits to the first plausible idea and only discovers the wall after you have already paid for the work built on top of it. Or, when you push back, it slides into a sycophantic workaround loop, inventing a new trick every time the last one failed, for something that may never have been possible in the first place.

Both burn your tokens. Neither one tells you what is actually true.

D Strange forces a third path: lay out the real options, check each one against real evidence before committing to any of them, say plainly what cannot be done, and converge on a recommended path, not a guess.

How it works

The hero skill, d-strange, runs a nine-step method. Small, cheap-to-try decisions bail out at step 0 in one line; the full ladder only runs when the decision is genuinely hard.

flowchart TD
    Q{"Reversible, cheap to try, or<br/>convention already decides it?"}
    Q -->|yes| BAIL["Bail. Answer in one line."]
    Q -->|no| EN["Enumerate every real option"]
    EN --> GR["Ground each in real evidence<br/>read a file, run a tool, fetch a source"]
    GR --> PR["Adversarially prune<br/>no evidence = UNVERIFIED, cannot be load-bearing"]
    PR --> CL["Classify each option<br/>WORKS / TRADEOFFS / RISKY / DEAD-END / IMPOSSIBLE"]
    CL --> WALL["Name the un-fixable wall<br/>what no trick beats"]
    WALL --> CONV["Converge on ONE recommended path<br/>plus the conditions that flip it"]

Many options in, evidence-pruned down to the one path that survives, with the wall named plainly. The full step table:

Step	What happens
0. Disqualifier gate	Is this reversible and cheap to try, or already decided by convention or the repo? If yes, answer in one line and stop.
1. Frame the wall	Restate the hard constraint and what "win" means, in terms you can falsify.
2. Enumerate	List the genuine candidate approaches. Aim wide, no padding.
3. Ground in evidence	For every candidate, produce the concrete proof, a real file read, tool call, or fetched source, that confirms or kills it. No citation means the candidate is UNVERIFIED and cannot be load-bearing.
4. Adversarially prune	Attack each survivor. Default to refuting. Kill anything not backed by evidence actually checked.
5. Classify	Per option: works yes, partly, or no, cost, risk, what it unlocks, exact failure mode.
6. Name the wall	State plainly what no trick beats, what must be paid for, accepted, or cannot be done. The headline output.
7. Converge	Recommend a path, usually a stack, plus the exact conditions under which that recommendation flips. Never "the one and only right way."
8. Honest caveat	What a real expert still has to confirm. This is research, not a guarantee.

Two tiers: inline (default, runs in the conversation, for roughly six or fewer real candidates) and hunt (a budget-capped parallel research fan-out for bigger option spaces, gated on your go-ahead before it spends anything).

Without D Strange, the agent commits to the first plausible option and the wall shows up after you have paid for the work built on top of it. With D Strange, the wall shows up first, before you start.

See it work

This is a condensed, illustrative worked run from references/examples.md. It uses an anonymized "Platform X" and example dollar figures on purpose: nothing below is a verified claim about a real vendor, and no number here is a benchmark you should reuse. It exists to show the shape of the method, options checked against evidence, a wall named, a recommendation with flip conditions, not to sell you a performance stat.

Request: Pull structured listing data from a large marketplace at 2,000,000 checks a day, capped at $2,000 a month total spend, without tripping the platform's terms of service.

Option	Grounded evidence	Verdict
Official API	Docs show a paid tier capped at 50,000 calls/day for $499/month, no seller-rating field	Dead end: roughly 40x short of the required volume
Self-built HTTP collector	Cheapest to run, but the platform's own terms explicitly prohibit automated collection outside the official API	Dead end: killed on terms of service, not on cost
Licensed commercial data vendor	Enterprise tier: $1,800/month for 3,000,000 records/day with a stated 99% completeness SLA	Works, with tradeoffs: consumes nearly the whole budget and adds vendor lock-in
SEO structured-data harvest	Cheap and scalable in principle, but whether it is terms-of-service safe for this specific platform was never actually checked in this run	Risky but survivable: the safety claim is unverified, so it cannot be the primary path yet

The wall: there is no option that clears scale, field completeness, cost, and a verified terms-of-service guarantee all at once without spending close to the entire budget on a licensed feed, or carrying a real legal question that this run did not itself resolve. No amount of engineering cleverness removes that; only an actual read of the platform's current terms, or a written agreement with the platform, closes the gap.

Recommendation: run the licensed vendor feed as the primary path, name its lock-in and thin remaining budget honestly, and treat the structured-data harvest as a fallback only after someone actually checks the terms-of-service question, not before. This is not the only right way; it flips if the required volume drops, if the terms question resolves favorably, or if the budget ceiling moves.

Read the full run, plus a one-line Step 0 bail, a d-strange-council panel that preserves a dissenting vote, and a d-strange-extract provenance table with a dropped, unverifiable claim, in references/examples.md.

Three tools, one brand

Skill	What it does	Use it when
d-strange	Lays out the real options for an over-constrained decision, grounds each in evidence, names the wall, converges on a recommended path.	You are picking between several hard, expensive-to-verify approaches and getting it wrong is costly. See it in action: Example 1, Example 2.
d-strange-council	Runs an adversarial panel of opposed reviewers (believer, skeptic, practitioner, market, or a swapped-in lens) against a plan, design, or claim, then synthesizes one verdict that preserves real dissent.	You are about to commit to a high-stakes plan and want it stress-tested before you ship it. See it in action: Example 3.
d-strange-extract	Turns a transcript, document, or article into a claim set where every surviving row traces to an exact quote in the source, and drops anything it cannot prove.	You need a claim set you can trust from a real source, not a summary from memory. See it in action: Example 4.

All three share the same rigor: ground every claim in real evidence, adversarially check it, and report honestly, including what did not survive. The inline tier of each works on any agent that can read a SKILL.md. The hunt and fan-out tiers use parallel sub-agent orchestration native to Claude Code's Workflow tool; on other hosts, run the same steps as a manual multi-pass instead.

Install

Claude Code installs D Strange as a plugin. Two prompts, sent separately (the marketplace has to register before the install can resolve it):

/plugin marketplace add divisingh19988-gif/d-strange

/plugin install d-strange@d-strange

That pulls in all three skills (d-strange, d-strange-council, d-strange-extract), their slash commands, and a small per-prompt hook. Exactly what that hook does and does not do is in Security below.

Every other agent installs by copying one generated file. Pick yours:

Codex (and other agents that read AGENTS.md)

Copy AGENTS.md into your project root, or point your agent's instructions at it directly.

Cursor

Copy .cursor/rules/d-strange.mdc into your project's .cursor/rules/ directory. Cursor only loads project rules from .mdc files that carry valid frontmatter, so this ships with description and alwaysApply: true already set, a plain .md file in that directory is silently ignored.

Windsurf

Copy .windsurf/rules/d-strange.md into your project's .windsurf/rules/ directory.

Cline

Copy .clinerules into your project root.

Gemini CLI

Copy gemini-extension.json into your project, or wherever your Gemini CLI setup reads extensions from. Gemini extensions have no skills field; this manifest instead points its contextFileName at AGENTS.md, which is how Gemini actually loads project context.

OpenCode

Nothing to copy beyond AGENTS.md above. OpenCode's config schema has no skills key, so this repo does not ship an opencode.json, an earlier version did, but it was inert. OpenCode auto-reads AGENTS.md from your project root, so having that file present is the whole install.

Every one of those generated files (all but the OpenCode entry above, which needs none) is generated from the same source (skills/*/SKILL.md) by node scripts/sync.mjs, so they never drift out of sync with each other.

Uninstall: on Claude Code, remove the plugin through /plugin, then run node scripts/uninstall.mjs to clear the local mode-state directory the hook reads (~/.config/d-strange/); it prints exactly what it removed. On every other agent, delete whichever file you copied in. That is the entire footprint.

Security

The honest target here is not "100% secure," that is not a real claim any software can make. The target is that the only executable surface is one small, dep-free, auditable hook, and every real dependency is declared and monitored.

What actually runs, stated plainly:

• On Claude Code, install registers a UserPromptSubmit hook (hooks/hooks.json) that runs hooks/inject-ruleset.mjs on every prompt. That is install-time and per-prompt execution, not zero execution. On every other agent this repo supports, install is still just copying files, nothing executes.
• hooks/inject-ruleset.mjs is the only executable install surface, and it is small on purpose: Node built-ins only, no third-party import, no network call, no reading of secrets or environment variables beyond one whitelisted state-dir override, no spawned process, no writes anywhere. Read it yourself in under a minute, it is about 30 lines. All it does is read a local mode file and print a slice of a bundled markdown ruleset to stdout for the host to inject.
• scripts/validate.mjs runs a checkHookSafety gate on every npm test that fails the build if hooks/*.mjs ever grows a third-party import, a network or process-spawn surface, a dynamic import(), or a stray process.env read. This is a lexical, regex-based gate, not full static analysis, it cannot catch string-concatenation obfuscation of a banned token ('impo' + 'rt()'). The trust model leans on that residual being small plus every commit touching hooks/*.mjs getting human PR review, not on the gate alone.
• Turn injection off with /d-strange-mode off (writes off to the local mode file; the hook still runs but prints nothing), or remove local state entirely with node scripts/uninstall.mjs. Removing the copied skill or plugin files themselves is your agent's own uninstall step beyond that.
• Real npm dependencies are declared: commander, js-yaml, and zod at runtime, vitest in dev. npm audit currently reports 0 vulnerabilities, and Dependabot is enabled on the repository to monitor that dependency graph going forward.
• No telemetry beyond the hook above: nothing here opens a socket or phones home on its own. The only other network activity happens inside the hunt, council, and extract fan-out tiers, only when you explicitly invoke them, using your own agent's tools.

A real, fresh scan backs the auditability half of this up. From the repo root:

$ semgrep --config auto .
Findings: 0 (0 blocking)
Rules run: 237
Targets scanned: 45

237 rules across 45 of this repo's 48 git-tracked files semgrep actually scans, zero findings; the remaining 3 tracked files are PNG logo assets, images have no code for a SAST scanner to parse. npm test runs the project's own validator (frontmatter, dash, obfuscation, template-parse, sync-drift, and hook-safety gates) on every push. Full posture, the 8-point threat mapping, named residual risk, and the two-minute audit steps live in SECURITY.md, including scans that were not run and why, honestly, rather than a fabricated verdict.

FAQ

Is this affiliated with Marvel or Disney? No. See the note below. The name is a metaphor for scanning many futures before committing to one, not a claim of any license, endorsement, or connection to the character.

Does d-strange guarantee it finds "the one right way"? No, and it deliberately does not claim to. Most decisions have several valid paths whose ranking flips with your constraints. What it always gives you is a recommended path, the conditions under which that recommendation changes, and the wall it could not get past.

What does the hunt tier cost? It is budget-capped and asks for your go-ahead before it spends anything. Use inline (the default) for anything with a small option space; reach for hunt only when the space is large or each candidate genuinely needs primary-source verification.

Which skill do I actually want? If you are choosing between approaches, use d-strange. If you already have a plan and want it stress-tested before you commit, use d-strange-council. If you have a source document and want only what it can actually prove, use d-strange-extract.

---

Not affiliated with Marvel, Disney, or the Doctor Strange character or films. "D Strange" is a fan-flavored metaphor for scanning many possible paths to find the one that works, not a claim of any license or endorsement.

Licensed under MIT.