anolisa-tokenless 0.7.13 → 0.8.0

package/adapters/tokenless/dsh/dist/index.js

@@ -1,51 +1,56 @@
 /**
  * Native Tokenless plugin for DeepSeek Harness (dsh).
  *
- * This entry intentionally has no dsh runtime imports.  dsh supplies the
+ * This entry intentionally has no dsh runtime imports. DSH supplies the
  * Cordis event types at runtime, while the only process boundary is the
- * installed Tokenless CLI.  Keeping the entry dependency-free lets ANOLISA
+ * installed Tokenless CLI. Keeping the entry dependency-free lets ANOLISA
  * install one self-contained bundle without running npm in $DSH_HOME.
  */
 import { execFile } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
+import {
+  accessSync,
+  appendFileSync,
+  constants,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs'
+import { delimiter, isAbsolute, join, resolve } from 'node:path'
 
 const PLUGIN_NAME = 'anolisa-tokenless'
 const DEFAULT_AGENT_ID = 'dsh'
 const DEFAULT_TIMEOUT_MS = 3000
 const DEFAULT_MAX_BUFFER = 2 * 1024 * 1024
+const DSH_TOKENLESS_DATA_DIR = 'DSH_TOKENLESS_DATA_DIR'
+const DSH_TOKENLESS_STATS_DB = 'DSH_TOKENLESS_STATS_DB'
+const DSH_TOKENLESS_STASH_DB = 'DSH_TOKENLESS_STASH_DB'
+const TOKENLESS_RETRIEVE_COMMAND_RE = /^[ \t]*(?:"tokenless"|'tokenless'|tokenless)[ \t]+retrieve[ \t]+(?:"(?:[0-9a-f]{24}|<<tokenless:[0-9a-f]{24}>>)"|'(?:[0-9a-f]{24}|<<tokenless:[0-9a-f]{24}>>)'|[0-9a-f]{24})[ \t]*$/i
 
-// Keep content-retrieval tools lossless.  These names mirror the shared
-// Tokenless adapter taxonomy; callers may extend or replace the list through
-// the dsh plugin config without changing this safety default.
-const DEFAULT_SKIP_TOOLS = new Set([
-  'Read',
+// DSH does not expose content origin, so map its built-in tool names at the
+// host boundary. Core owns every compression decision after this translation.
+const FILE_TOOLS = new Set([
   'read',
   'read_file',
   'read_many_files',
-  'Glob',
   'glob',
   'search_file',
   'list_directory',
   'list_dir',
-  'Grep',
   'grep',
   'grep_code',
   'grep_search',
   'search_files',
-  'Lsp',
   'lsp',
-  'NotebookRead',
-  'notebook_read',
   'notebookread',
+  'notebook_read',
 ])
 
-// These values are the same thresholds used by the shared hook adapter.  A
-// dsh profile can override them in its plugin config; the Tokenless CLI still
-// owns the actual compression algorithm and stats recording.
-const DEFAULT_SHELL_TOOLS = new Set([
-  'Bash',
+const COMMAND_TOOLS = new Set([
   'bash',
-  'Shell',
+  'pwsh',
   'shell',
   'exec',
   'terminal',
@@ -56,84 +61,7 @@ const DEFAULT_SHELL_TOOLS = new Set([
   'process',
 ])
 
-const DEFAULT_THRESHOLDS = {
-  shell: { strings: 65536, arrays: 128, depth: 8 },
-  api: { strings: 1048576, arrays: 65536, depth: 32 },
-}
-
-// Mirror common/hooks/hook_utils.py ENV_PATTERNS exactly.  The dsh bundle is
-// independently publishable, so changes to the canonical table must update
-// this dependency-free runtime copy and its tests together.
-const ENV_PATTERNS = [
-  [
-    [
-      /command not found/i,
-      /not installed/i,
-      /which:\s+no/i,
-      /no command\s/i,
-      /cannot execute/i,
-      /is not recognized/i,
-      /could not find/i,
-      /unable to locate/i,
-      /package not found/i,
-      /\/bin\/sh:.*: not found/i,
-      /command not found:/i,
-    ],
-    'ENV_DEPENDENCY_MISSING',
-    'Missing dependency detected. Install it or ask the user for guidance.',
-  ],
-  [
-    [
-      /permission denied/i,
-      /operation not permitted/i,
-      /eacces/i,
-      /access denied/i,
-      /cannot open .* for writing/i,
-    ],
-    'ENV_PERMISSION',
-    'Permission denied. Check file/directory permissions or run with appropriate access.',
-  ],
-  [
-    [
-      /no such file or directory/i,
-      /enoent/i,
-      /cannot find/i,
-      /file not found/i,
-      /does not exist/i,
-    ],
-    'ENV_FILE_MISSING',
-    'Required file or directory not found. Verify the path or create it.',
-  ],
-  [
-    [
-      /connection refused/i,
-      /could not resolve host/i,
-      /network is unreachable/i,
-      /curl: \(7\)/i,
-      /curl: \(6\)/i,
-      /failed to connect/i,
-      /name or service not known/i,
-      /couldn't resolve host/i,
-      /temporary failure in name resolution/i,
-      /econnrefused/i,
-      /etimedout/i,
-      /connection timed out/i,
-    ],
-    'ENV_NETWORK',
-    'Network connectivity issue. Check DNS, proxy, and firewall settings.',
-  ],
-  [
-    [
-      /modulenotfounderror/i,
-      /importerror/i,
-      /no module named/i,
-      /cannot import name/i,
-      /npm err! 404/i,
-    ],
-    'ENV_PACKAGE_MISSING',
-    'Required package or module is missing. Install the needed dependency.',
-  ],
-]
+const INTERRUPTED_CODES = new Set(['ABORTED', 'ABORTED_BEFORE_DISPATCH'])
 
 /** Return a plain config value or the supplied fallback. */
 function valueOr(config, key, fallback) {
@@ -142,80 +70,187 @@ function valueOr(config, key, fallback) {
     : fallback
 }
 
-/** Normalize a config tool list without allowing malformed values to widen it. */
-function toolSet(value, fallback) {
-  if (!Array.isArray(value)) return fallback
-  return new Set(value.filter((name) => typeof name === 'string' && name.length > 0))
-}
-
-/** Resolve the executable without ever installing or mutating a dsh profile. */
+/** Resolve the executable without installing or mutating a DSH profile. */
 function tokenlessBinary(config) {
   const configured = valueOr(config, 'tokenlessBin', undefined)
   if (typeof configured === 'string' && configured.length > 0) return configured
   return process.env.TOKENLESS_BIN || 'tokenless'
 }
 
-/** Extract text used only for error attribution; never stringify image blocks. */
-function errorText(result) {
-  if (!result || typeof result !== 'object') return ''
-  const error = result.error
-  if (error && typeof error.message === 'string') return error.message
-  return result.content
-    ?.filter((block) => block && block.type === 'text' && typeof block.text === 'string')
-    .map((block) => block.text)
-    .join('\n') || ''
+/** Keep Core and DSH's sandboxed shell on the same writable state directory. */
+function tokenlessDataDir(exec) {
+  const configured = process.env.TOKENLESS_DATA_DIR
+  if (typeof configured === 'string' && configured.length > 0) return configured
+  const sessionCwd = exec.agent?.session?.header?.cwd
+  const workspace = typeof sessionCwd === 'string' && isAbsolute(sessionCwd)
+    ? sessionCwd
+    : process.cwd()
+  return join(workspace, '.tokenless')
+}
+
+/** Prevent default workspace state from becoming a source-control candidate. */
+function prepareTokenlessDataDir(exec) {
+  const dataDir = tokenlessDataDir(exec)
+  if (typeof process.env.TOKENLESS_DATA_DIR === 'string'
+    && process.env.TOKENLESS_DATA_DIR.length > 0) return dataDir
+
+  mkdirSync(dataDir, { recursive: true, mode: 0o700 })
+  if (!lstatSync(dataDir).isDirectory()) {
+    throw new Error(`Tokenless state path is not a directory: ${dataDir}`)
+  }
+  const ignorePath = join(dataDir, '.gitignore')
+  try {
+    writeFileSync(ignorePath, '*\n', { encoding: 'utf8', flag: 'wx', mode: 0o600 })
+  } catch (error) {
+    if (error?.code !== 'EEXIST') throw error
+    const metadata = lstatSync(ignorePath)
+    if (!metadata.isFile() || metadata.isSymbolicLink()) {
+      throw new Error(`Tokenless state ignore file is unsafe: ${ignorePath}`)
+    }
+    const contents = readFileSync(ignorePath, 'utf8')
+    if (!contents.split(/\r?\n/).includes('*')) {
+      appendFileSync(
+        ignorePath,
+        `${contents.endsWith('\n') || contents.length === 0 ? '' : '\n'}*\n`,
+      )
+    }
+  }
+  return dataDir
 }
 
-/** Return an environment category and remediation hint for known failure text. */
-function classifyEnvironmentError(text) {
-  if (typeof text !== 'string') return undefined
-  if (!text) return undefined
-  for (const [patterns, category, hint] of ENV_PATTERNS) {
-    if (patterns.some((pattern) => pattern.test(text))) return { category, hint }
+/** Publish the state overrides that DSH strips from model shell commands. */
+function tokenlessShellEnvironment(exec) {
+  const environment = {
+    [DSH_TOKENLESS_DATA_DIR]: tokenlessDataDir(exec),
+  }
+  for (const [source, target] of [
+    ['TOKENLESS_STATS_DB', DSH_TOKENLESS_STATS_DB],
+    ['TOKENLESS_STASH_DB', DSH_TOKENLESS_STASH_DB],
+  ]) {
+    const value = process.env[source]
+    if (typeof value === 'string' && value.length > 0) environment[target] = value
+  }
+  return environment
+}
+
+/** Resolve one bare executable using the path inherited by DSH shell commands. */
+function executableOnPath(name) {
+  if (typeof process.env.PATH !== 'string') return undefined
+  for (const directory of process.env.PATH.split(delimiter)) {
+    // A future Marker call may use a different shell workdir, so a
+    // cwd-relative entry cannot establish a stable executable identity.
+    if (!isAbsolute(directory)) return undefined
+    const candidate = join(directory, name)
+    try {
+      accessSync(candidate, constants.X_OK)
+      if (statSync(candidate).isFile()) return candidate
+    } catch {
+      continue
+    }
   }
   return undefined
 }
 
-/** Extract attribution only when structured output explicitly reports failure. */
-function classifyStructuredEnvironmentError(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined
+/** Require compression and Marker recovery to invoke the same CLI file. */
+function tokenlessRetrieveCommandAvailable(config) {
+  const markerBinary = executableOnPath('tokenless')
+  if (markerBinary === undefined) return false
+  const selected = tokenlessBinary(config)
+  const selectedBinary = isAbsolute(selected)
+    ? selected
+    : (selected.includes('/') ? resolve(selected) : executableOnPath(selected))
+  if (selectedBinary === undefined) return false
+  try {
+    accessSync(selectedBinary, constants.X_OK)
+    const markerStat = statSync(markerBinary)
+    const selectedStat = statSync(selectedBinary)
+    return selectedStat.isFile()
+      && markerStat.dev === selectedStat.dev
+      && markerStat.ino === selectedStat.ino
+  } catch {
+    return false
+  }
+}
+
+/** Convert one process limit to a positive finite integer. */
+function positiveInteger(value, fallback) {
+  return Number.isInteger(value) && value > 0 ? value : fallback
+}
+
+/** Return the only DSH content shape that can be replaced without schema loss. */
+function singleText(content) {
+  if (!Array.isArray(content) || content.length !== 1) return undefined
+  const [block] = content
+  if (!block || block.type !== 'text' || typeof block.text !== 'string') return undefined
+  return block.text
+}
+
+/** Treat shell-shaped values as execution status only for known command tools. */
+function commandFailed(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
   const exitCode = value.exit_code ?? value.exitCode
-  const stringExitCode = typeof exitCode === 'string' ? exitCode.trim() : ''
-  const nonzeroExit = (typeof exitCode === 'number' && exitCode !== 0)
-    || (/^-?\d+$/.test(stringExitCode) && Number(stringExitCode) !== 0)
-  const timedOut = value.timed_out === true || value.timedOut === true
-  const failed = nonzeroExit
-    || timedOut
+  const numericExit = typeof exitCode === 'number'
+    ? exitCode
+    : (typeof exitCode === 'string' && /^-?\d+$/.test(exitCode.trim())
+        ? Number(exitCode)
+        : 0)
+  return numericExit !== 0
+    || (typeof value.signal === 'string' && value.signal.length > 0)
+    || value.timed_out === true
+    || value.timedOut === true
     || value.isError === true
     || value.success === false
     || value.ok === false
-  if (!failed) return undefined
-  const error = value.error
-  let errorValue = error
-  if (error && typeof error === 'object') {
-    if (typeof error.message === 'string') {
-      errorValue = error.message
-    } else {
+}
+
+/** Extract the failure payload while leaving diagnostic classification to Core. */
+function failureText(result, value) {
+  const parts = []
+  if (result?.isError === true && typeof result.error?.message === 'string') {
+    parts.push(result.error.message)
+  }
+  if (Array.isArray(result?.content)) {
+    parts.push(...result.content
+      .filter((block) => block?.type === 'text' && typeof block.text === 'string')
+      .map((block) => block.text))
+  }
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    const stderr = value.stderr
+    if (typeof stderr === 'string') {
+      parts.push(stderr)
+    } else if (stderr && typeof stderr.text === 'string') {
+      parts.push(stderr.text)
+    }
+    if (typeof value.error === 'string') {
+      parts.push(value.error)
+    } else if (value.error && typeof value.error.message === 'string') {
+      parts.push(value.error.message)
+    } else if (value.error && typeof value.error === 'object') {
+      let serialized
       try {
-        errorValue = JSON.stringify(error)
+        serialized = JSON.stringify(value.error)
       } catch {
-        errorValue = String(error)
+        serialized = String(value.error)
+      }
+      if (typeof serialized === 'string') parts.push(serialized)
+    }
+    if (typeof value.signal === 'string' && value.signal.length > 0) {
+      parts.push(`terminated by signal: ${value.signal}`)
+    }
+    if (!parts.some((part) => part.length > 0)) {
+      const stdout = value.stdout
+      if (typeof stdout === 'string') {
+        parts.push(stdout)
+      } else if (stdout && typeof stdout.text === 'string') {
+        parts.push(stdout.text)
       }
     }
   }
-  const streamText = (stream) => {
-    if (typeof stream === 'string') return stream
-    if (stream && typeof stream === 'object' && typeof stream.text === 'string') return stream.text
-    return undefined
-  }
-  const text = [streamText(value.stderr), errorValue]
-    .filter((part) => typeof part === 'string')
-    .join('\n')
-  return classifyEnvironmentError(text)
+  return parts.filter((part) => part.length > 0).join('\n')
 }
 
-/** Construct a valid plugin-owned user message without importing dsh modules. */
-function attributionContext(text) {
+/** Construct a valid plugin-owned user message without importing DSH modules. */
+function diagnosticContext(text) {
   return {
     id: randomUUID(),
     role: 'user',
@@ -229,171 +264,225 @@ function attributionContext(text) {
   }
 }
 
-/** Add an attribution context to a decision while preserving its shape. */
-function withAttribution(decision, attribution) {
-  if (!attribution) return decision
+/** Add Core's diagnostic to a decision while preserving waterfall output. */
+function withDiagnostic(decision, diagnostic) {
+  if (typeof diagnostic !== 'string' || diagnostic.length === 0) return decision
   return {
     ...decision,
     additionalContexts: [
       ...(Array.isArray(decision.additionalContexts) ? decision.additionalContexts : []),
-      attributionContext(attribution),
+      diagnosticContext(diagnostic),
     ],
   }
 }
 
-/** Safely read one text-only result projection. */
-function singleTextContent(result) {
-  if (!result || result.isError || !Array.isArray(result.content)) return undefined
-  if (result.content.length !== 1) return undefined
-  const [block] = result.content
-  if (!block || block.type !== 'text' || typeof block.text !== 'string') return undefined
-  return block.text
-}
-
-/** Convert one config threshold to a positive finite integer. */
-function positiveInteger(value, fallback) {
-  return Number.isInteger(value) && value > 0 ? value : fallback
+/** Map a DSH tool name to the explicit PostTool content origin. */
+function contentOrigin(toolName) {
+  const normalized = toolName.toLowerCase()
+  if (FILE_TOOLS.has(normalized)) return 'file_content'
+  if (COMMAND_TOOLS.has(normalized)) return 'command_output'
+  return 'api_response'
 }
 
-/** Build the Tokenless CLI argv for one dsh execution. */
-function compressionArgs(exec, config, shellTools) {
-  const selected = shellTools.has(exec.name) ? DEFAULT_THRESHOLDS.shell : DEFAULT_THRESHOLDS.api
-  const strings = positiveInteger(valueOr(config, 'truncateStringsAt', undefined), selected.strings)
-  const arrays = positiveInteger(valueOr(config, 'truncateArraysAt', undefined), selected.arrays)
-  const depth = positiveInteger(valueOr(config, 'maxDepth', undefined), selected.depth)
-  const args = [
-    'compress-response',
-    '--agent-id',
-    String(valueOr(config, 'agentId', DEFAULT_AGENT_ID)),
-    '--truncate-strings-at',
-    String(strings),
-    '--truncate-arrays-at',
-    String(arrays),
-    '--max-depth',
-    String(depth),
-  ]
-  const sessionId = exec.agent?.id
-  if (typeof sessionId === 'string' && sessionId.length > 0) {
-    args.push('--session-id', sessionId)
-  }
-  if (typeof exec.callId === 'string' && exec.callId.length > 0) {
-    args.push('--tool-use-id', exec.callId)
-  }
-  if (valueOr(config, 'noStash', false) === true) args.push('--no-stash')
-  return args
+/** Recognize the exact local recovery command emitted by Tokenless markers. */
+function isTokenlessRetrieveCommand(toolName, args) {
+  if (!COMMAND_TOOLS.has(toolName.toLowerCase())) return false
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return false
+  if (typeof args.command !== 'string') return false
+  return TOKENLESS_RETRIEVE_COMMAND_RE.test(args.command)
 }
 
 /** Execute a child process with bounded output and explicit stdin. */
-function runTokenless(binary, args, options, input) {
+function runTokenless(binary, request, options) {
   return new Promise((resolve, reject) => {
     let child
     try {
-      child = execFile(binary, args, options, (error, stdout, stderr) => {
+      child = execFile(binary, ['compress'], options, (error, stdout) => {
         if (error) {
-          error.stderr = stderr
           reject(error)
           return
         }
-        resolve({ stdout, stderr })
+        resolve(stdout)
       })
     } catch (error) {
       reject(error)
       return
     }
     child.stdin?.on('error', () => {})
-    try {
-      child.stdin?.end(input)
-    } catch (error) {
-      reject(error)
-    }
+    child.stdin?.end(JSON.stringify(request))
   })
 }
 
-/** Run Tokenless and return a strictly smaller JSON candidate, or undefined. */
-async function compressText(text, exec, config, shellTools) {
-  if (exec.signal?.aborted) return undefined
-  let parsed
-  try {
-    parsed = JSON.parse(text)
-  } catch {
-    return undefined
-  }
-  if (parsed === null || (typeof parsed !== 'object' && !Array.isArray(parsed))) return undefined
-  const binary = tokenlessBinary(config)
+/** Run one PostTool operation and reject malformed transport responses. */
+async function runPostTool(request, exec, config) {
   try {
-    const { stdout } = await runTokenless(binary, compressionArgs(exec, config, shellTools), {
+    const stdout = await runTokenless(tokenlessBinary(config), request, {
       timeout: positiveInteger(valueOr(config, 'timeoutMs', undefined), DEFAULT_TIMEOUT_MS),
       maxBuffer: positiveInteger(valueOr(config, 'maxBuffer', undefined), DEFAULT_MAX_BUFFER),
       encoding: 'utf8',
       windowsHide: true,
       signal: exec.signal,
-    }, text)
-    const candidate = typeof stdout === 'string' ? stdout.trim() : ''
-    // The host's original content is authoritative unless compression proves
-    // a real reduction.  This avoids duplicate payloads and preserves fail-open
-    // behavior when the CLI is unavailable, malformed, or no-op.
-    if (!candidate || candidate.length >= text.length) return undefined
-    JSON.parse(candidate)
-    return candidate
+      env: {
+        ...process.env,
+        TOKENLESS_DATA_DIR: prepareTokenlessDataDir(exec),
+      },
+    })
+    const response = JSON.parse(stdout)
+    if (!response || typeof response !== 'object' || Array.isArray(response)) return undefined
+    if (response.protocol_version !== 2 || response.operation !== 'post_tool') return undefined
+    const result = response.result
+    if (!result || typeof result !== 'object' || Array.isArray(result)) return undefined
+    return result
   } catch {
     return undefined
   }
 }
 
-/** Register native response compression on dsh's typed post-execute seam. */
+/** Build one operation request from the DSH execution boundary. */
+function postToolRequest(
+  exec,
+  config,
+  content,
+  status,
+  origin,
+  replaceOutput,
+  resultKind,
+  retrievalAvailable,
+) {
+  const attribution = {
+    agent_id: String(valueOr(config, 'agentId', DEFAULT_AGENT_ID)),
+  }
+  if (typeof exec.agent?.id === 'string' && exec.agent.id.length > 0) {
+    attribution.session_id = exec.agent.id
+  }
+  if (typeof exec.callId === 'string' && exec.callId.length > 0) {
+    attribution.tool_use_id = exec.callId
+  }
+  return {
+    protocol_version: 2,
+    operation: 'post_tool',
+    attribution,
+    input: {
+      result_kind: resultKind,
+      tool_name: exec.name,
+      content,
+      status,
+      content_origin: origin,
+      output_optimization: 'none',
+      capabilities: {
+        replace_output: replaceOutput,
+        recovery: { kind: retrievalAvailable ? "shell" : "none" },
+        replace_with_text: replaceOutput,
+      },
+    },
+  }
+}
+
+/** Register DSH's PostTool seam as a thin Tokenless lifecycle adapter. */
 export function apply(ctx, config = {}) {
-  const skipTools = toolSet(valueOr(config, 'skipTools', undefined), DEFAULT_SKIP_TOOLS)
-  const shellTools = toolSet(valueOr(config, 'shellTools', undefined), DEFAULT_SHELL_TOOLS)
-  const enabled = valueOr(config, 'responseCompressionEnabled', true) !== false
-  ctx.on('tools/post-execute', async (exec, result, next) => {
-    const envError = result?.isError === true
-      ? classifyEnvironmentError(errorText(result))
-      : undefined
-    const structuredError = result?.isError === false && shellTools.has(exec.name)
-      ? classifyStructuredEnvironmentError(result.value)
-      : undefined
-    // Attribution is independent of compression so disabled, skipped, and
-    // parented failures still tell the agent why blind retries are unsafe.
-    const originalAttribution = structuredError || envError
+  const compressionEnabled = valueOr(config, 'responseCompressionEnabled', true) !== false
+
+  ctx.shellEnv.register({
+    name: PLUGIN_NAME,
+    variables: {
+      [DSH_TOKENLESS_DATA_DIR]: {
+        description: 'Workspace-local Tokenless state used by Marker recovery.',
+      },
+      [DSH_TOKENLESS_STATS_DB]: {
+        description: 'Tokenless statistics database selected by the DSH host.',
+      },
+      [DSH_TOKENLESS_STASH_DB]: {
+        description: 'Tokenless Stash database selected by the DSH host.',
+      },
+    },
+    resolve: tokenlessShellEnvironment,
+  })
 
-    // DSH treats this seam as a waterfall.  Let downstream policies settle
-    // their decision before replacing only its accepted display content.
+  ctx.on('tools/post-execute', async (exec, result, next) => {
+    // DSH post-execute is a waterfall; later policies own the final projection.
     const decision = await next()
+    if (decision.kind !== 'accept' || exec.signal?.aborted) return decision
+
+    const toolName = exec.name.toLowerCase()
+    const isCommand = COMMAND_TOOLS.has(toolName)
     const replacesValue = Object.prototype.hasOwnProperty.call(decision, 'value')
-    // A downstream canonical value replaces the original result entirely, so
-    // any attribution must describe that value rather than the stale result.
-    const attribution = replacesValue
-      ? (shellTools.has(exec.name)
-          ? classifyStructuredEnvironmentError(decision.value)
-          : undefined)
-      : originalAttribution
-    const responseContext = attribution
-      ? `[tokenless:env] ${exec.name} failed: ${attribution.category} (${attribution.hint}). Skip retry.`
-      : undefined
-    const canCompress = enabled
-      && !skipTools.has(exec.name)
-      && exec.parent === undefined
-      && decision.kind === 'accept'
-      && !replacesValue
-    if (!canCompress) return withAttribution(decision, responseContext)
-
-    // Only a single text block is safe to replace.  Images, tool-call blocks,
-    // nested tool results, and mixed content remain untouched by design.
-    const contentResult = decision.content === undefined
-      ? result
-      : { ...result, content: decision.content }
-    const original = singleTextContent(contentResult)
-    if (original === undefined) return withAttribution(decision, responseContext)
+    const effectiveValue = replacesValue ? decision.value : result.value
+    const structuredFailure = isCommand && commandFailed(effectiveValue)
 
-    const candidate = await compressText(original, exec, config, shellTools)
-    if (!candidate) return withAttribution(decision, responseContext)
+    if (replacesValue) {
+      if (!structuredFailure) return decision
+      const content = failureText(undefined, effectiveValue)
+      const request = postToolRequest(
+        exec,
+        config,
+        content,
+        'error',
+        'command_output',
+        false,
+        'tool',
+        false,
+      )
+      const response = await runPostTool(request, exec, config)
+      const diagnostic = response?.disposition === 'tool_error'
+        ? response.additional_context
+        : undefined
+      return withDiagnostic(decision, diagnostic)
+    }
+
+    const abortCode = result?.isError === true ? result.error?.info?.code : undefined
+    const interrupted = INTERRUPTED_CODES.has(abortCode)
+    const failed = result?.isError === true || structuredFailure
+    const status = interrupted ? 'interrupted' : (failed ? 'error' : 'success')
 
-    return {
-      ...withAttribution(decision, responseContext),
-      content: [{ type: 'text', text: candidate }],
+    if (status === 'success') {
+      if (!compressionEnabled || exec.parent !== undefined) return decision
+      const effectiveContent = decision.content ?? result.content
+      const content = singleText(effectiveContent)
+      if (content === undefined) return decision
+      const retrieveResult = isTokenlessRetrieveCommand(exec.name, exec.arguments)
+      const request = postToolRequest(
+        exec,
+        config,
+        content,
+        status,
+        contentOrigin(exec.name),
+        true,
+        retrieveResult ? 'retrieve' : 'tool',
+        !retrieveResult && tokenlessRetrieveCommandAvailable(config),
+      )
+      const response = await runPostTool(request, exec, config)
+      if (response?.disposition !== 'applied' || typeof response.output !== 'string') {
+        return decision
+      }
+      return {
+        ...decision,
+        content: [{ type: 'text', text: response.output }],
+      }
     }
+
+    const effectiveResult = decision.content === undefined
+      ? result
+      : { ...result, content: decision.content }
+    const content = structuredFailure
+      ? failureText(undefined, effectiveValue)
+      : failureText(effectiveResult)
+    const request = postToolRequest(
+      exec,
+      config,
+      content,
+      status,
+      contentOrigin(exec.name),
+      false,
+      'tool',
+      false,
+    )
+    const response = await runPostTool(request, exec, config)
+    const diagnostic = response?.disposition === 'tool_error'
+      ? response.additional_context
+      : undefined
+    return withDiagnostic(decision, diagnostic)
   })
 }
 
 export const name = PLUGIN_NAME
-export const inject = ['tools']
+export const inject = ['tools', 'shellEnv']