plugin: add the cost-policy skill, two commands, and a Stop hook

README.md

@@ -449,6 +449,19 @@ After `/plugin install opik-cipx@opik-enterprise`:
 | Skill | Purpose |
 |---|---|
 | `/opik-cipx:opik-cipx` | How opik-cipx works — architecture, the CLI, state layout, enable/disable, privacy/telemetry, and how to read `opik-cipx status`. Claude pulls it in on its own when you ask about opik-cipx or when spans stop reaching Opik; you can also call it directly. |
+| `/opik-cipx:cost-intelligence-policy` | Which MCP servers your organization's cost policy denies for you, and how to turn one off or back on for yourself. Claude Code drops a denied server silently — it vanishes from `/mcp` and `claude mcp list` with no warning — so Claude pulls this in on its own when you ask where a server went. It reads the result of `opik-cipx mcp enable`/`disable` off the exit code, so a refusal is never reported back to you as a success. |
+
+## Commands (plugin)
+
+| Command | What it does |
+|---|---|
+| `/opik-cipx:cost-intelligence [thing]` | The receipt for "your Claude Code has been optimized". What cipx actually changed on this machine, what your organization's MCP policy actually blocks, what the last 30 days cost and where the tokens went, which cost policies are in effect and who set each one — and, for anything a policy turned off, the one route that turns it back on. Every figure is measured, none estimated. Pass an MCP server, skill, tool or settings key to ask about just that one thing instead. |
+| `/opik-cipx:cost-intelligence-mcp` | The MCP policy table on its own: which servers your organization blocks, which are active, and whether you can change it yourself. |
+
+Both commands and the `cost-intelligence-policy` skill call `opik-cipx` as a bare command on
+PATH, which the plugin supplies only from the release that adds the
+`bin/opik-cipx` dispatcher — on an earlier plugin version they fail with
+`command not found` or `unknown command`.
 
 ## Debugging
 

commands/cost-intelligence-mcp.md

@@ -0,0 +1,26 @@
+---
+description: Show which MCP servers your organization's cost policy blocks, and whether you can change it
+allowed-tools: Bash(opik-cipx mcp list)
+---
+
+Run `opik-cipx mcp list` and show its output.
+
+**Always show it. Every single time, without exception** — including when you
+showed the same table one message ago and nothing has changed since. The user
+ran this command to look at the table; "it is the same as before" is your
+judgement about what they need, not an answer to what they asked. Saying
+nothing changed and omitting it is the one failure this command cannot tolerate.
+
+Show the command's own output as it came back. Do not retype it, summarise it,
+re-sort it, count it, or wrap it in a code fence — a fence strips the colour
+that separates a blocked row from an active one at a glance, and retyping it
+breaks the column alignment and asks the user to trust your transcription of
+something they can already see.
+
+After the table you may add **one** short sentence, and only for something the
+table cannot say — a server failing to connect for reasons unrelated to policy,
+say. That sentence is an addition to the table, never a replacement for it. If
+there is nothing to add, add nothing; the table alone is a complete answer.
+
+If the command fails, say so in one line and quote its message. Never describe
+a policy you did not just read.