anolisa-tokenless 0.7.7

package/adapters/tokenless/common/hooks/rewrite_hook.py

@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+"""Tokenless command rewriting hook via rtk.
+
+Reads a PreToolUse JSON from stdin, extracts the shell command,
+invokes ``rtk rewrite`` via subprocess, and writes a HookOutput
+JSON to stdout.
+
+Hook point: **PreToolUse** — matcher: ``Shell``
+
+The agent ID is read from the TOKENLESS_AGENT_ID environment variable
+(set by the install action script).  Fallback paths follow the ANOLISA
+FHS spec: /usr/libexec/anolisa/tokenless/rtk.
+"""
+
+import json
+import os
+import shlex
+import subprocess
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from hook_utils import (
+    _RTK_FALLBACK,
+    _RTK_LOCAL_LIB,
+    _RTK_LOCAL_SHARE,
+    _TOKENLESS_FALLBACK,
+    _TOKENLESS_LOCAL_LIB,
+    _TOKENLESS_LOCAL_SHARE,
+    forward_stderr,
+    parse_version,
+    resolve_agent_id,
+    resolve_binary,
+    resolve_tool_call_id,
+    skip,
+    warn,
+    write_context,
+)
+
+# -- constants ---------------------------------------------------------------
+
+_MIN_RTK_VERSION = (0, 35, 0)
+_AGENT_ID = resolve_agent_id()
+
+# Shell connectives that terminate a command-list / pipeline segment.
+# A bare `rtk` wrapper can appear at command start or right after one.
+_SEGMENT_OPS = frozenset({"&&", "||", ";", "|", "&"})
+
+
+def _is_env_assignment(token: str) -> bool:
+    """Return True for a leading shell variable assignment (NAME=value)."""
+    name, sep, _ = token.partition("=")
+    if not sep or not name:
+        return False
+    if not (name[0].isalpha() or name[0] == "_"):
+        return False
+    return all(c.isalnum() or c == "_" for c in name)
+
+
+def _anchor_rtk_prefix(rewritten: str, rtk_bin: str) -> str:
+    """Replace bare `rtk` wrapper tokens with the resolved binary path.
+
+    rtk prints rewrites with a literal `rtk` prefix, which only resolves
+    when the shell executing the tool call has the rtk location on its
+    PATH. Agent runtimes with a trimmed PATH (e.g. IDE tool environments
+    without ~/.local/bin) would fail every rewritten command with exit
+    127 even though the hook resolved rtk successfully. Anchoring makes
+    the rewritten command self-contained.
+
+    The pass swaps the first unquoted `rtk` token of each segment — at
+    command start or right after `&&` / `||` / `;` / `|` / `&`,
+    optionally behind leading environment assignments or wrappers such
+    as `sudo`. It lexes with `posix=False` and no punctuation splitting,
+    so every token keeps its original surface: quoted patterns like
+    `grep -E 'foo|rtk bar'` are never modified, unquoted globs like
+    `*.txt` are not re-quoted into literals, fd redirections (`2>&1`,
+    `2>/dev/null`) and command substitutions (`$(date)`) stay intact,
+    and comment stripping is disabled so a `#` argument cannot truncate
+    the command. Connectives are recognized as whitespace-delimited
+    tokens; an unspaced `cmd1;cmd2` is not split, which only leaves
+    that segment's `rtk` unanchored (conservative, never corrupts).
+    Unparseable input is returned untouched.
+
+    Known limitation: a bare `rtk` token that is another command's
+    argument (e.g. `echo rtk done`) is indistinguishable from a wrapper
+    position inside the rtk-rewrite output domain and gets anchored.
+    Real rtk rewrites do not produce that shape, so this is accepted.
+    """
+    lexer = shlex.shlex(rewritten, posix=False)
+    lexer.whitespace_split = True
+    lexer.commenters = ""
+    try:
+        tokens = list(lexer)
+    except ValueError:
+        return rewritten
+
+    quoted = shlex.quote(rtk_bin)
+    result = list(tokens)
+    wrapped = False
+    for i, token in enumerate(tokens):
+        if token in _SEGMENT_OPS:
+            wrapped = False
+            continue
+        if _is_env_assignment(token):
+            continue
+        if not wrapped and token == "rtk":
+            result[i] = quoted
+            wrapped = True
+
+    return " ".join(result)
+
+
+# -- main --------------------------------------------------------------------
+
+
+def main() -> None:
+    # 1. Resolve rtk binary
+    rtk_bin = resolve_binary(
+        "rtk", _RTK_FALLBACK, _RTK_LOCAL_SHARE, _RTK_LOCAL_LIB
+    )
+    if not rtk_bin:
+        warn("rtk is not installed or not in PATH. Hook disabled.")
+        skip()
+
+    # 2. Version guard
+    try:
+        result = subprocess.run(
+            [rtk_bin, "--version"],
+            capture_output=True,
+            text=True,
+            timeout=3,
+        )
+        ver = parse_version(result.stdout)
+        if ver and ver < _MIN_RTK_VERSION:
+            warn(f"rtk {result.stdout.strip()} is too old (need >= 0.35.0).")
+            skip()
+    except Exception as e:
+        warn(f"rtk version check failed: {e}")
+
+    # 3. Check tokenless binary (for stats)
+    if not resolve_binary(
+        "tokenless",
+        _TOKENLESS_FALLBACK,
+        _TOKENLESS_LOCAL_SHARE,
+        _TOKENLESS_LOCAL_LIB,
+    ):
+        warn("tokenless is not installed. Hook disabled.")
+        skip()
+
+    # 4. Read stdin JSON
+    try:
+        input_data = json.load(sys.stdin)
+    except (json.JSONDecodeError, EOFError, ValueError):
+        skip()
+
+    # 5. Extract command
+    tool_input = input_data.get("tool_input", {})
+    cmd = tool_input.get("command", "")
+    if not cmd:
+        skip()
+
+    # 6. Rewrite via rtk
+    env = os.environ.copy()
+    env["TOKENLESS_AGENT_ID"] = _AGENT_ID
+    session_id = input_data.get("session_id", "")
+    tool_use_id = resolve_tool_call_id(_AGENT_ID, input_data)
+    if session_id:
+        env["TOKENLESS_SESSION_ID"] = session_id
+    if tool_use_id:
+        env["TOKENLESS_TOOL_USE_ID"] = tool_use_id
+
+    write_context(_AGENT_ID, session_id, tool_use_id)
+
+    try:
+        proc = subprocess.run(
+            [rtk_bin, "rewrite", cmd],
+            capture_output=True,
+            text=True,
+            timeout=5,
+            env=env,
+        )
+    except Exception as e:
+        warn(f"rtk rewrite subprocess failed: {e}")
+        skip()
+
+    # Exit code protocol (from rtk rewrite_cmd.rs):
+    #   0 = rewrite available, Allow verdict (auto-allow by permission rule)
+    #   1 = no RTK equivalent (passthrough)
+    #   2 = deny rule matched (let hook handle)
+    #   3 = Ask/Default verdict (rewrite available but permission model requires
+    #       user confirmation; in non-interactive hook context, treat as valid
+    #       rewrite since the intent is token optimization, not permission gating)
+    if proc.returncode not in (0, 1, 2, 3):
+        forward_stderr(proc)
+        warn(f"rtk rewrite exited with unexpected code {proc.returncode}")
+        skip()
+    if proc.returncode in (1, 2):
+        skip()
+    rewritten = proc.stdout.strip()
+    if not rewritten or rewritten == cmd:
+        skip()
+
+    rewritten = _anchor_rtk_prefix(rewritten, rtk_bin)
+
+    # 7. Build response
+    # Emit both formats for runtime compatibility:
+    # - ``tool_input``: Cosh-NG partial patch (merges with original params)
+    # - ``updatedInput``: copilot-shell full replacement (legacy)
+    updated_input = dict(tool_input)
+    updated_input["command"] = rewritten
+
+    output = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "tool_input": {"command": rewritten},
+            "updatedInput": updated_input,
+        },
+    }
+    print(json.dumps(output))
+
+
+if __name__ == "__main__":
+    main()

package/adapters/tokenless/common/hooks/run-hook.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# run-hook.sh — Locate and exec a shared tokenless hook script.
+#
+# Prefer hooks from the wrapper's own adapter tree so concurrent RPM, Makefile,
+# and raw installations cannot cross-load another version. Hosts that copy the
+# wrapper into a detached cache still use the historical FHS fallbacks.
+#
+# Usage:    run-hook.sh <hook-script-basename> [args...]
+# Examples: run-hook.sh rewrite_hook.py
+#           run-hook.sh compress_response_hook.py
+#           run-hook.sh tool_ready_hook.sh
+#
+# Fail-open contract: any not-found / missing-interpreter condition emits
+# an empty JSON object on stdout and exits 0, so the host never blocks
+# on us.
+#
+# PreToolUse matcher overlap is by design: hooks.json registers both a
+# Bash-specific entry (rewrite) and a catch-all entry (tool-ready). Bash
+# tool calls therefore fire both — the host evaluates each matching
+# matcher independently, so this is the documented way to attach a
+# tool-specific hook alongside a global one. The timeout values are
+# upper bounds; observed runtimes are well under them.
+set -euo pipefail
+
+SCRIPT_DIR="$(CDPATH='' cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+SCRIPT="${1:?usage: run-hook.sh <hook-script-basename> [args...]}"
+shift
+
+fail_open() { echo "{}"; exit 0; }
+
+# Reject anything but a bare basename. Practical risk is low — hooks.json is
+# RPM-installed root:root 0644 and unwritable at runtime — but a defense-in-
+# depth check costs one line and stops any future caller from smuggling a
+# traversal segment through this argument.
+case "$SCRIPT" in
+    */*|"") fail_open ;;
+esac
+
+CANDIDATES=(
+    "${SCRIPT_DIR}/../../common/hooks/${SCRIPT}"
+    "/usr/local/share/anolisa/adapters/tokenless/common/hooks/${SCRIPT}"
+    "/usr/share/anolisa/adapters/tokenless/common/hooks/${SCRIPT}"
+    "${HOME}/.local/share/anolisa/adapters/tokenless/common/hooks/${SCRIPT}"
+)
+
+for candidate in "${CANDIDATES[@]}"; do
+    [ -f "$candidate" ] || continue
+    case "$candidate" in
+        *.py)
+            command -v python3 >/dev/null 2>&1 || fail_open
+            exec python3 "$candidate" "$@"
+            ;;
+        *.sh)
+            exec bash "$candidate" "$@"
+            ;;
+        *)
+            fail_open
+            ;;
+    esac
+done
+
+fail_open

package/adapters/tokenless/common/hooks/tool_categories.json

@@ -0,0 +1,99 @@
+{
+  "_meta": {
+    "version": "1.1",
+    "description": "Unified tool categorization for both tool-ready and compression strategies",
+    "purpose": "Single source of truth for tool classification and compression thresholds across all adapters",
+    "_aliases_note": "The '_aliases' section below is a reference mapping only — not consumed by code. It documents canonical tool name normalization for human readers."
+  },
+
+  "layer_1_skip": {
+    "_description": "Layer 1: Skip all compression (preserve integrity for content retrieval)",
+    "_tool_ready_category": "Read",
+    "_rationale": "These tools return file content or search results that should not be truncated",
+    "tools": [
+      "Read",
+      "read",
+      "read_file",
+      "read_many_files",
+      "Glob",
+      "glob",
+      "search_file",
+      "list_directory",
+      "list_dir",
+      "Grep",
+      "grep",
+      "grep_code",
+      "grep_search",
+      "search_files",
+      "Lsp",
+      "lsp",
+      "NotebookRead",
+      "notebook_read",
+      "notebookread"
+    ]
+  },
+
+  "layer_2_shell": {
+    "_description": "Layer 2: Moderate truncation for shell/exec tools",
+    "_tool_ready_category": "Shell",
+    "_rationale": "Shell commands produce text output that can be safely truncated if too long",
+    "tools": [
+      "Bash",
+      "bash",
+      "Shell",
+      "shell",
+      "exec",
+      "terminal",
+      "run_shell_command",
+      "run_in_terminal",
+      "get_terminal_output",
+      "execute_command",
+      "process"
+    ],
+    "thresholds": {
+      "truncate_strings_at": 65536,
+      "truncate_arrays_at": 128,
+      "max_depth": 8
+    }
+  },
+
+  "layer_3_api": {
+    "_description": "Layer 3: Zero-truncation for API/structured tools (default for tools not in layer_1 or layer_2)",
+    "_tool_ready_categories": ["WebFetch", "Write"],
+    "_rationale": "API responses and structured data should not be truncated; tools in this layer are implicit — any tool not in layer_1_skip or layer_2_shell falls here",
+    "thresholds": {
+      "truncate_strings_at": 1048576,
+      "truncate_arrays_at": 65536,
+      "max_depth": 32
+    }
+  },
+
+  "_aliases": {
+    "_description": "Canonical name mappings (reference only — not consumed by code)",
+    "bash": "Bash",
+    "shell": "Shell",
+    "grep": "Grep",
+    "grep_code": "Grep",
+    "grep_search": "Grep",
+    "search_files": "Grep",
+    "glob": "Glob",
+    "search_file": "Glob",
+    "list_dir": "Read",
+    "read": "Read",
+    "read_file": "Read",
+    "web_fetch": "WebFetch",
+    "fetch_content": "WebFetch",
+    "web_search": "WebSearch",
+    "search_web": "WebSearch",
+    "write": "Write",
+    "write_file": "Write",
+    "create_file": "Write",
+    "edit": "Edit",
+    "edit_file": "Edit",
+    "search_replace": "Edit",
+    "delete_file": "Write",
+    "run_in_terminal": "Bash",
+    "get_terminal_output": "Bash",
+    "notebook_read": "NotebookRead"
+  }
+}