anolisa-tokenless 0.7.13 → 0.7.14

package/adapters/tokenless/common/hooks/compress_response_hook.py

@@ -1,20 +1,16 @@
 #!/usr/bin/env python3
 """Tokenless response compression hook for Cosh-NG, Claude Code, Qoder, and OpenCode.
 
-Reads a PostToolUse JSON from stdin, compresses the tool response
-via ``tokenless compress-response``, then optionally re-encodes to TOON
-format via ``tokenless compress-toon`` for additional token savings.
-
-Pipeline: Env Attribution -> Layered dispatch -> Compression -> TOON Encoding
-  1. If tool_response contains errors, classify as environment vs logic issue
-     and inject "Skip retry" guidance for LLM
-  2. 3-layer tool dispatch:
-     - Content retrieval (Read/Glob/Grep) -> skip all compression
-     - Shell/exec (Bash/Shell) -> moderate truncation (64K strings)
-     - Other tools -> zero-truncation compress-response + TOON
-  3. Strip debug fields, nulls, empty values (no truncation risk)
-  4. If the compressed result is still valid JSON, encode to TOON format
-  5. Stats are recorded automatically by tokenless CLI commands.
+Reads a PostToolUse JSON from stdin, forwards the model-visible tool
+response to the unified ``tokenless compress`` entry point (protocol v1,
+roadmap §5.4), and translates the CompressionResponse into the host's
+envelope. JSON detection, tool threshold selection, TOON selection, and
+final acceptance all live behind the entry point; this hook only parses the
+host object, declares capabilities, and builds envelopes (§4.5).
+
+One Tokenless subprocess per invocation (§5.6). Environment-error
+attribution stays hook-side: it is genuinely additive diagnostics, not a
+compression decision.
 
 Hook point: **PostToolUse**
 
@@ -29,18 +25,17 @@ Output contract per agent:
   - qoder-cli: the compressed payload replaces the response via the string
     field ``hookSpecificOutput.updatedToolOutput``. Structured responses are
     serialized as compact JSON because Qoder rejects object and array values.
-    Qoder supports replacement for every tool, so compressed data is never
-    appended beside the original.
   - opencode: the adapter translates ``updatedToolOutput`` to OpenCode's
-    mutable ``tool.execute.after`` output. ``additionalContext`` remains
-    reserved for additive readiness and environment diagnostics.
+    mutable ``tool.execute.after`` output.
   - cosh-ng: the compressed payload replaces the response via
     ``hookSpecificOutput.updatedToolResponse``.  Extract only ``llmContent``
-    from wrapped responses; never include ``returnDisplay``.  Keep
-    environment/error attribution in ``additionalContext`` (additive).
-    Unsupported Cosh-NG versions fail open with compression disabled.
-  - other agents: the compressed payload is injected via
-    ``additionalContext`` per each runtime's hook contract.
+    from wrapped responses; never include ``returnDisplay``.  Unsupported
+    Cosh-NG versions fail open with compression disabled.
+  - other agents (additionalContext-only hosts): passthrough. Additive
+    injection would append the compressed copy beside the still-visible
+    original — a net token increase — so hosts without true output
+    replacement remain passthrough (roadmap §7). Environment attribution is
+    still injected: it is additive by design.
 
 The agent ID is read from the TOKENLESS_AGENT_ID environment variable
 (set by the install action script).  When running under Cosh-NG, the
@@ -62,30 +57,33 @@ from hook_utils import (
     _TOKENLESS_LOCAL_LIB,
     _TOKENLESS_LOCAL_SHARE,
     SKIP_TOOLS,
+    build_compression_request,
     classify_env_error,
     detect_cosh_ng_runtime,
-    get_thresholds,
     is_skill_file,
     parse_version,
     resolve_agent_id,
     resolve_binary,
     resolve_tool_call_id,
+    run_compress,
     secure_write_text,
     skip,
     try_parse_json,
-    unwrap_string_json,
     warn,
 )
 
 # -- constants ---------------------------------------------------------------
 
+# Spawn-avoidance mirror of the entry point's 200-char gate. The authority
+# lives in Rust; skipping here only saves the subprocess for content the
+# entry would pass through anyway (normalization never grows the char
+# count, so raw < 200 implies normalized < 200).
 _MIN_RESPONSE_CHARS = 200
 
-# Minimum payload size for the TOON encoding step. TOON on small JSON
-# saves only a few characters (observed ~0.3% below ~500 chars) while the
-# per-event encode cost stays the same, so payloads under this threshold
-# keep the response-compressed form and skip the TOON pass entirely.
-_MIN_TOON_CHARS = 500
+# Below the qwen/cosh extension manifests' 10 s host wrapper so a
+# pathological input is killed here (fail-open skip) before the host kills
+# the whole hook.
+_COMPRESS_TIMEOUT = 8
 
 # Claude Code added hookSpecificOutput.updatedToolOutput (normal-path tool
 # output replacement for all tools) in v2.1.121. Older versions only support
@@ -106,17 +104,6 @@ _CLAUDE_VERSION_CACHE = os.path.join(
 # -- helpers -------------------------------------------------------------------
 
 
-def _build_additional_context(
-    content: str,
-    env_attribution: str = "",
-) -> str:
-    parts = []
-    if env_attribution:
-        parts.append(env_attribution)
-    parts.append(content)
-    return "\n".join(parts)
-
-
 def _emit(output: dict) -> None:
     print(json.dumps(output, ensure_ascii=False))
 
@@ -181,8 +168,8 @@ def _cached_claude_version(claude_bin: str) -> tuple | None:
 def _claude_supports_replacement() -> bool:
     """Whether the running Claude Code supports updatedToolOutput (>= 2.1.121).
 
-    Returns False when the version cannot be determined; the caller then
-    fails open by disabling compression, so unknown versions never receive a
+    Returns False when the version cannot be determined; the hook then
+    declares no replacement capability, so unknown versions never receive a
     duplicate compressed payload through additionalContext.
     """
     claude_bin = resolve_binary("claude")
@@ -192,74 +179,9 @@ def _claude_supports_replacement() -> bool:
     return ver is not None and ver >= _CLAUDE_MIN_REPLACE_VERSION
 
 
-def _restore_dropped_schema_fields(original: dict, compressed: dict) -> dict:
-    """Restore top-level keys dropped by compression when originally empty.
-
-    compress-response drops nulls, empty values ("" / {} / []) and configured
-    debug fields. Built-in Claude Code tools expect a stable output schema
-    (e.g. Bash: stdout/stderr/interrupted/isImage), so cheap empty fields are
-    restored for updatedToolOutput; intentionally dropped non-empty debug
-    payloads stay dropped.
-    """
-    restored = dict(compressed)
-    for key, value in original.items():
-        if key in restored:
-            continue
-        if value is None or value == "" or value == {} or value == []:
-            restored[key] = value
-    return restored
-
-
-def _build_replacement_output(
-    tool_response_raw: object,
-    tool_response: str,
-    compressed: str,
-    final_output: str,
-    used_resp_compression: bool,
-) -> tuple[bool, object]:
-    """Build a schema-safe replacement for runtimes that support one."""
-    if not isinstance(tool_response_raw, (dict, list)):
-        return True, final_output
-
-    # TOON text cannot replace a structured response without changing the
-    # host tool schema, so this path requires a real JSON compression win.
-    if not used_resp_compression:
-        return False, None
-
-    compressed_parsed = try_parse_json(compressed)
-    if isinstance(tool_response_raw, dict) and isinstance(compressed_parsed, dict):
-        updated_output = _restore_dropped_schema_fields(
-            tool_response_raw, compressed_parsed
-        )
-    elif compressed_parsed is not None:
-        updated_output = compressed_parsed
-    else:
-        return False, None
-
-    # Restoring empty schema fields can cancel out a marginal win.
-    # ensure_ascii=False keeps the size comparison in Unicode characters,
-    # consistent with the non-escaped normalization below.
-    serialized = json.dumps(
-        updated_output, separators=(",", ":"), ensure_ascii=False
-    )
-    if len(serialized) >= len(tool_response):
-        return False, None
-    return True, updated_output
-
-
 # -- main --------------------------------------------------------------------
 
 
-def _warn_subprocess(label: str, proc: subprocess.CompletedProcess) -> None:
-    """Log a non-zero subprocess exit with truncated stderr."""
-    detail = (proc.stderr or "").strip()[:200]
-    warn(
-        f"{label} exited {proc.returncode}: {detail}"
-        if detail
-        else f"{label} exited {proc.returncode} with empty stderr"
-    )
-
-
 def main() -> None:
     # 1. Detect runtime (Cosh-NG vs copilot-shell)
     cosh_ng_version = detect_cosh_ng_runtime()
@@ -288,15 +210,12 @@ def main() -> None:
         warn("failed to read PostToolUse payload. Passing through unchanged.")
         skip()
 
-    # 5. Extract tool_name (skip-tools handled after attribution)
     tool_name = input_data.get("tool_name", "unknown")
-
-    # 6. Extract tool_response
     tool_response_raw = input_data.get("tool_response", "")
     if not tool_response_raw or tool_response_raw == "{}":
         skip()
 
-    # 7. For Cosh-NG, extract only llmContent from the wrapped response.
+    # 5. For Cosh-NG, extract only llmContent from the wrapped response.
     #    Never include returnDisplay in the provider-visible replacement.
     llm_content = None
     if isinstance(tool_response_raw, dict):
@@ -304,201 +223,141 @@ def main() -> None:
         if llm_content is None:
             llm_content = tool_response_raw.get("returnDisplay")
     elif isinstance(tool_response_raw, str):
-        # Try to parse as the {llmContent, returnDisplay} wrapper
         parsed_wrapper = try_parse_json(tool_response_raw)
         if isinstance(parsed_wrapper, dict) and "llmContent" in parsed_wrapper:
             llm_content = parsed_wrapper["llmContent"]
 
-    # The model-visible content we will compress
+    # The model-visible content we will send for compression
     model_visible_before = llm_content if llm_content is not None else tool_response_raw
 
-    # 8. Skip skill files (YAML frontmatter)
+    # 6. Skip skill files (YAML frontmatter). Spawn avoidance only: they are
+    # never JSON, so the entry point would pass them through anyway.
     if isinstance(model_visible_before, str) and is_skill_file(model_visible_before):
         skip()
 
-    # 9. Normalize response
+    # 7. Copy the model-visible value into the request content (§4.5).
+    # ensure_ascii=False matches the entry point's normalization, so size
+    # gates measure Unicode characters on both sides.
     if isinstance(model_visible_before, str):
-        unwrapped = unwrap_string_json(model_visible_before)
-        if not unwrapped:
-            skip()  # Plain text, not JSON
-        tool_response = unwrapped
+        content = model_visible_before
     elif isinstance(model_visible_before, (dict, list)):
-        # ensure_ascii=False: size gates below must count Unicode
-        # characters (code points), not \uXXXX escape sequences, so
-        # structured payloads are measured the same way as JSON string
-        # inputs and the OpenClaw adapter.
-        tool_response = json.dumps(
+        content = json.dumps(
             model_visible_before, separators=(",", ":"), ensure_ascii=False
         )
     else:
         skip()
 
-    # 10. Validate it's JSON (needed for attribution on skip-tools too)
-    parsed = try_parse_json(tool_response)
-    if parsed is None:
-        skip()
-
-    # 11. Extract caller context
+    # 8. Extract caller context
     session_id = input_data.get("session_id", "")
     tool_use_id = resolve_tool_call_id(agent_id, input_data)
 
-    # 12. Environment attribution analysis
+    # 9. Environment attribution analysis — additive diagnostics, computed
+    # hook-side. Only structured payloads are classified (with the same
+    # string-unwrap the entry point applies): plain text never reached
+    # attribution in the two-subprocess hook and still does not.
+    if isinstance(model_visible_before, dict):
+        attr_subject = model_visible_before
+    else:
+        parsed = try_parse_json(content)
+        if isinstance(parsed, str):
+            parsed = try_parse_json(parsed)
+        attr_subject = parsed if isinstance(parsed, (dict, list)) else None
     env_attribution = ""
-    attr_category, attr_fix_hint = classify_env_error(parsed)
+    attr_category, attr_fix_hint = classify_env_error(attr_subject)
     if attr_category:
         env_attribution = (
             f"[tokenless:env] {tool_name} failed: "
             f"{attr_category} ({attr_fix_hint}). Skip retry."
         )
 
-    # 13. Content retrieval -- skip entirely (preserve integrity)
-    if tool_name in SKIP_TOOLS:
-        _emit_attribution_or_skip(env_attribution)
-
-    # 14. All other tools -- skip small responses, but still inject
-    # env attribution for error cases (small size doesn't mean the
-    # error classification is unimportant to the agent).
-    if len(tool_response) < _MIN_RESPONSE_CHARS:
-        _emit_attribution_or_skip(env_attribution)
-
-    # 15. Step 1: Response compression with 3-layer thresholds
-    compressed = tool_response
-    used_resp_compression = False
-
-    if isinstance(parsed, (dict, list)):
-        thresholds = get_thresholds(tool_name)
-        cmd = [
-            tokenless_bin, "compress-response",
-            "--agent-id", agent_id,
-            "--truncate-strings-at", str(thresholds[0]),
-            "--truncate-arrays-at", str(thresholds[1]),
-            "--max-depth", str(thresholds[2]),
-        ]
-        if session_id:
-            cmd.extend(["--session-id", session_id])
-        if tool_use_id:
-            cmd.extend(["--tool-use-id", tool_use_id])
-
-        try:
-            proc = subprocess.run(
-                cmd,
-                input=tool_response,
-                capture_output=True, text=True, timeout=3,
-            )
-            if proc.returncode == 0 and proc.stdout.strip():
-                candidate = proc.stdout.strip()
-                # Compare against actual model-visible before size
-                if len(candidate) < len(tool_response):
-                    compressed = candidate
-                    used_resp_compression = True
-            elif proc.returncode != 0:
-                _warn_subprocess("compress-response", proc)
-        except Exception as e:
-            warn(f"Response compression error: {e}")
-
-    # 16. Step 2: TOON encoding — only for payloads at or above the
-    # minimum threshold; small JSON gains near-zero chars from TOON but
-    # would still pay the full encode cost on every PostToolUse event.
-    toon_output = ""
-
-    if tokenless_bin and len(compressed) >= _MIN_TOON_CHARS:
-        toon_parsed = try_parse_json(compressed)
-        if toon_parsed is not None:
-            toon_cmd = [tokenless_bin, "compress-toon", "--agent-id", agent_id]
-            if session_id:
-                toon_cmd.extend(["--session-id", session_id])
-            if tool_use_id:
-                toon_cmd.extend(["--tool-use-id", tool_use_id])
-            try:
-                proc = subprocess.run(
-                    toon_cmd,
-                    input=compressed,
-                    capture_output=True, text=True, timeout=1,
-                )
-                if proc.returncode == 0 and proc.stdout.strip():
-                    candidate = proc.stdout.strip()
-                    if len(candidate) < len(compressed):
-                        toon_output = candidate
-                elif proc.returncode != 0:
-                    _warn_subprocess("compress-toon", proc)
-            except Exception as e:
-                warn(f"TOON encoding error: {e}")
-
-    # Determine final output
-    final_output = toon_output if toon_output else compressed
-
-    # Nothing shrank — pass the original through untouched instead of
-    # emitting a same-size duplicate of the response (applies to all agents).
-    if not used_resp_compression and not toon_output:
-        _emit_attribution_or_skip(env_attribution)
-
-    # 17. Build response — dispatch by agent runtime.
-    #
-    # Claude Code, Qoder, and OpenCode support real tool-output replacement. Keep
-    # additionalContext for additive diagnostics only; using it for compressed
-    # data would leave the original result in context and increase token use.
-    if agent_id in {_CLAUDE_AGENT_ID, _QODER_AGENT_ID, _OPENCODE_AGENT_ID}:
-        if agent_id == _CLAUDE_AGENT_ID and not _claude_supports_replacement():
+    # 10. Capability declaration (§4.5): what can this host actually do?
+    if cosh_ng_detected:
+        can_replace = True
+        replace_with_text = True  # updatedToolResponse accepts any text
+    elif agent_id in {_QODER_AGENT_ID, _OPENCODE_AGENT_ID}:
+        can_replace = True
+        replace_with_text = not isinstance(tool_response_raw, (dict, list))
+    elif agent_id == _CLAUDE_AGENT_ID:
+        can_replace = _claude_supports_replacement()
+        replace_with_text = not isinstance(tool_response_raw, (dict, list))
+        if not can_replace:
             warn(
                 "Claude Code < 2.1.121 (or version unknown): "
                 "updatedToolOutput unsupported, response compression disabled."
             )
-            _emit_attribution_or_skip(env_attribution)
-
-        replace, updated_output = _build_replacement_output(
-            tool_response_raw,
-            tool_response,
-            compressed,
-            final_output,
-            used_resp_compression,
-        )
-        if not replace:
-            _emit_attribution_or_skip(env_attribution)
+    else:
+        # additionalContext-only hosts have no true replacement: passthrough
+        # (additive injection would duplicate the original — see module doc).
+        can_replace = False
+        replace_with_text = True
+
+    # 11. Spawn-avoidance prefilters. The entry point re-checks all three
+    # authoritatively; skipping here just saves the exec. SKIP_TOOLS reads
+    # the same tool_categories.json the entry point embeds, so content
+    # retrieval — the hottest PostToolUse traffic — never pays a spawn.
+    if not can_replace:
+        _emit_attribution_or_skip(env_attribution)
+    if tool_name in SKIP_TOOLS:
+        _emit_attribution_or_skip(env_attribution)
+    if len(content) < _MIN_RESPONSE_CHARS:
+        _emit_attribution_or_skip(env_attribution)
 
-        # Qoder validates updatedToolOutput as a string even when the original
-        # tool response is structured. Preserve the compact schema as JSON text.
-        if agent_id == _QODER_AGENT_ID and not isinstance(updated_output, str):
-            updated_output = json.dumps(
-                updated_output, separators=(",", ":"), ensure_ascii=False
-            )
+    # 12. The one Tokenless subprocess: the unified entry point decides.
+    request = build_compression_request(
+        content,
+        agent_id,
+        "post_tool",
+        session_id=session_id,
+        tool_use_id=tool_use_id,
+        tool_name=tool_name,
+        replace_output=True,
+        publish_retrieve_tool=True,
+        replace_with_text=replace_with_text,
+    )
+    response = run_compress(tokenless_bin, request, _COMPRESS_TIMEOUT)
+    if response is None or response.get("disposition") != "applied":
+        _emit_attribution_or_skip(env_attribution)
 
-        hook_output = {
-            "hookEventName": "PostToolUse",
-            "updatedToolOutput": updated_output,
-        }
-        if env_attribution:
-            hook_output["additionalContext"] = env_attribution
-        _emit({"suppressOutput": True, "hookSpecificOutput": hook_output})
-        return
+    output_text = response.get("output")
+    if not isinstance(output_text, str) or not output_text:
+        warn("tokenless compress returned no output. Passing through unchanged.")
+        _emit_attribution_or_skip(env_attribution)
 
-    # Cosh-NG: use updatedToolResponse for response replacement.
-    # Skip compression if it doesn't reduce model-visible size.
+    # 13. Envelope construction — dispatch by agent runtime.
     if cosh_ng_detected:
-        if len(final_output) >= len(tool_response):
-            _emit_attribution_or_skip(env_attribution)
-
         hook_specific = {
             "hookEventName": "PostToolUse",
-            "updatedToolResponse": final_output,
+            "updatedToolResponse": output_text,
         }
         if env_attribution:
             hook_specific["additionalContext"] = env_attribution
         _emit({"suppressOutput": True, "hookSpecificOutput": hook_specific})
         return
 
-    # Other agents: inject via additionalContext per their hook contracts.
-    context = _build_additional_context(
-        final_output,
-        env_attribution=env_attribution,
-    )
+    if replace_with_text:
+        updated_output = output_text
+    else:
+        # Structured slot: the entry point guarantees schema-stable JSON for
+        # an applied response. A parse failure means the subprocess boundary
+        # was violated — fail open.
+        updated_output = try_parse_json(output_text)
+        if updated_output is None:
+            warn("tokenless compress returned non-JSON for a structured slot.")
+            _emit_attribution_or_skip(env_attribution)
 
-    _emit({
-        "suppressOutput": True,
-        "hookSpecificOutput": {
-            "hookEventName": "PostToolUse",
-            "additionalContext": context,
-        },
-    })
+    # Qoder validates updatedToolOutput as a string even when the original
+    # tool response is structured. The entry point's compact serialization
+    # is exactly that string.
+    if agent_id == _QODER_AGENT_ID and not isinstance(updated_output, str):
+        updated_output = output_text
+
+    hook_output = {
+        "hookEventName": "PostToolUse",
+        "updatedToolOutput": updated_output,
+    }
+    if env_attribution:
+        hook_output["additionalContext"] = env_attribution
+    _emit({"suppressOutput": True, "hookSpecificOutput": hook_output})
 
 
 if __name__ == "__main__":

package/adapters/tokenless/common/hooks/compress_schema_hook.py

@@ -1,9 +1,12 @@
 #!/usr/bin/env python3
 """Tokenless schema compression hook.
 
-Reads a BeforeModel JSON from stdin, extracts the tools array,
-invokes ``tokenless compress-schema --batch`` via subprocess, and
-writes a HookOutput JSON to stdout.
+Reads a BeforeModel JSON from stdin, extracts the tools array, forwards it
+to the unified ``tokenless compress`` entry point (protocol v1, seam
+``before_model``, roadmap §5.4), and writes a HookOutput JSON to stdout.
+The entry point returns the original array on no-savings, which this hook
+wraps exactly like a compressed one — the historical behavior of the
+``compress-schema`` flow it replaces.
 
 Hook point: **BeforeModel**
 
@@ -16,7 +19,6 @@ from __future__ import annotations
 import contextlib
 import json
 import os
-import subprocess
 import sys
 
 try:  # POSIX hosts (cosh / Cosh-NG) — the platforms these hooks target.
@@ -30,9 +32,11 @@ from hook_utils import (
     _TOKENLESS_FALLBACK,
     _TOKENLESS_LOCAL_LIB,
     _TOKENLESS_LOCAL_SHARE,
+    build_compression_request,
     resolve_agent_id,
     resolve_binary,
     resolve_tool_call_id,
+    run_compress,
     secure_write_text,
     skip,
     warn,
@@ -42,6 +46,11 @@ from hook_utils import (
 
 _AGENT_ID = resolve_agent_id()
 
+# Below the extension manifests' 10 s host wrapper, so a pathological batch
+# is killed here (fail-open skip) instead of racing the host's kill of the
+# whole hook (the old subprocess timeout was 10 s against a 10 s wrapper).
+_COMPRESS_TIMEOUT = 8
+
 # One marker file holds the session keys that already emitted the "no tool
 # declarations" warning — one key per line, most recent last — so the warning
 # repeats at most once per session even though BeforeModel fires on every
@@ -272,36 +281,31 @@ def main() -> None:
     session_id = input_data.get("session_id", "")
     tool_use_id = resolve_tool_call_id(_AGENT_ID, input_data)
 
-    # 5. Compress schemas via tokenless compress-schema --batch
-    cmd = [tokenless_bin, "compress-schema", "--batch", "--agent-id", _AGENT_ID]
-    if session_id:
-        cmd.extend(["--session-id", session_id])
-    if tool_use_id:
-        cmd.extend(["--tool-use-id", tool_use_id])
-
-    try:
-        proc = subprocess.run(
-            cmd,
-            input=tools_json,
-            capture_output=True,
-            text=True,
-            timeout=10,
-        )
-    except Exception:
+    # 5. Compress schemas via the unified entry point (one subprocess).
+    request = build_compression_request(
+        tools_json,
+        _AGENT_ID,
+        "before_model",
+        session_id=session_id,
+        tool_use_id=tool_use_id,
+        replace_output=True,
+        publish_retrieve_tool=True,
+    )
+    response = run_compress(tokenless_bin, request, _COMPRESS_TIMEOUT)
+    if response is None:
         warn("Schema compression subprocess failed. Passing through unchanged.")
         skip()
-
-    if proc.returncode != 0:
-        detail = (proc.stderr or "").strip()[:200]
-        warn(
-            f"Schema compression failed with exit code {proc.returncode}: {detail}"
-            if detail
-            else f"Schema compression failed with exit code {proc.returncode}. Passing through unchanged."
-        )
+    if response.get("disposition") in {"error", "timeout"}:
+        warn("Schema compression failed. Passing through unchanged.")
         skip()
-
-    compressed = proc.stdout.strip()
-    if not compressed or not _is_json_array(compressed):
+    if response.get("disposition") == "reversibility_unavailable":
+        # Savings existed but the stash could not record the originals;
+        # the entry point returned the uncompressed schemas. Surface the
+        # distinction from "nothing to compress" (envelope unchanged).
+        warn("Schema stash unavailable; truncated descriptions would be lossy.")
+
+    compressed = response.get("output")
+    if not isinstance(compressed, str) or not _is_json_array(compressed):
         warn(
             "Schema compression returned invalid JSON. Passing through unchanged."
         )

package/adapters/tokenless/common/hooks/compress_toon_hook.py

@@ -43,6 +43,9 @@ _AGENT_ID = resolve_agent_id()
 # Minimum payload size for TOON encoding. TOON on small JSON saves only a
 # few characters (observed ~0.3% below ~500 chars) while the per-event
 # encode cost stays the same, so smaller responses pass through untouched.
+# This early check avoids the subprocess spawn; the compress-toon CLI
+# enforces the same threshold by default (tokenless-runtime MIN_TOON_CHARS),
+# so keep the two values in sync.
 _MIN_TOON_CHARS = 500