anolisa-tokenless 0.7.7

package/adapters/tokenless/openclaw/openclaw.plugin.json

@@ -0,0 +1,40 @@
+{
+  "id": "tokenless",
+  "name": "Tokenless",
+  "version": "0.7.7",
+  "description": "Unified RTK command rewriting + response/TOON compression + registered but hard-disabled Tool Ready. Wraps tokenless and rtk system binaries via child_process — this is expected and not malicious.",
+  "activation": {
+    "onCapabilities": ["hook"]
+  },
+  "configSchema": {
+    "type": "object",
+    "properties": {
+      "rtk_enabled": { "type": "boolean", "default": true },
+      "tool_ready_enabled": { "type": "boolean", "default": true },
+      "response_compression_enabled": { "type": "boolean", "default": true },
+      "skip_tools": {
+        "type": "array",
+        "items": { "type": "string" },
+        "default": [],
+        "description": "Layer 1: Tools that skip all compression (preserve integrity). Loaded from tool_categories.json if not specified."
+      },
+      "shell_tools": {
+        "type": "array",
+        "items": { "type": "string" },
+        "default": [],
+        "description": "Layer 2: Shell/exec tools with moderate truncation. Loaded from tool_categories.json if not specified."
+      },
+      "toon_compression_enabled": { "type": "boolean", "default": false },
+      "verbose": { "type": "boolean", "default": false }
+    }
+  },
+  "uiHints": {
+    "rtk_enabled": { "label": "Enable RTK command rewriting" },
+    "tool_ready_enabled": { "label": "Register Tool Ready hook (hard-disabled)" },
+    "response_compression_enabled": { "label": "Enable response compression" },
+    "skip_tools": { "label": "Tool names whose responses should not be compressed" },
+    "shell_tools": { "label": "Tool names treated as shell/exec (moderate truncation)" },
+    "toon_compression_enabled": { "label": "Enable TOON format compression" },
+    "verbose": { "label": "Verbose logging" }
+  }
+}

package/adapters/tokenless/openclaw/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@tokenless/openclaw-plugin",
+  "version": "0.7.7",
+  "description": "Unified OpenClaw plugin — RTK command rewriting + tokenless schema/response compression for 60-90% LLM token savings",
+  "type": "module",
+  "main": "dist/index.js",
+  "openclaw": {
+    "extensions": ["./dist/index.js"]
+  },
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "npm run clean && tsc --project tsconfig.json && cp ../common/hooks/tool_categories.json dist/"
+  },
+  "peerDependencies": {
+    "rtk": ">=0.35.0",
+    "tokenless": ">=0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": ">=22",
+    "typescript": "^5.8.0"
+  },
+  "files": ["dist/", "openclaw.plugin.json", "scripts/"],
+  "license": "Apache-2.0"
+}

package/adapters/tokenless/openclaw/scripts/detect.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# detect.sh — Inspect tokenless OpenClaw integration. Read-only.
+#
+# Reports OpenClaw CLI, tokenless plugin install state, runtime
+# artifact (dist/index.js), and adapter resource. Exits 0 when the OpenClaw
+# CLI and the tokenless plugin are both present; non-zero otherwise.
+set -euo pipefail
+
+COMPONENT="${ANOLISA_COMPONENT:-tokenless}"
+AGENT="${ANOLISA_TARGET:-openclaw}"
+ADAPTER_DIR="${ANOLISA_ADAPTER_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+OPENCLAW_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-$OPENCLAW_HOME}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR%/}"
+OPENCLAW_HOME="${OPENCLAW_HOME%/}"
+OPENCLAW_BIN="${OPENCLAW_BIN:-}"
+export PATH="$HOME/.local/bin:${OPENCLAW_STATE_DIR%/}/bin:/usr/local/bin:$PATH"
+
+PLUGIN_ID="tokenless"
+PLUGIN_SRC="$ADAPTER_DIR/openclaw"
+
+line()  { printf '[%s] %s\n' "$COMPONENT" "$*"; }
+field() { printf '[%s]   %-26s %s\n' "$COMPONENT" "$1" "$2"; }
+
+PREREQ_MISSING=()
+INSTALL_MISSING=()
+note_prereq_missing() { PREREQ_MISSING+=("$1"); }
+note_install_missing() { INSTALL_MISSING+=("$1"); }
+
+if [ -z "$OPENCLAW_BIN" ]; then
+    OPENCLAW_BIN="$(command -v openclaw 2>/dev/null || true)"
+fi
+
+line "${AGENT} detect"
+if [ -n "$OPENCLAW_BIN" ] && [ -x "$OPENCLAW_BIN" ]; then
+    field "openclaw CLI" "present (${OPENCLAW_BIN})"
+else
+    field "openclaw CLI" "missing"
+    note_prereq_missing "openclaw CLI"
+fi
+
+if [ -d "$OPENCLAW_STATE_DIR" ]; then
+    field "openclaw home" "present (${OPENCLAW_STATE_DIR})"
+else
+    field "openclaw home" "not installed (${OPENCLAW_STATE_DIR})"
+    note_install_missing "openclaw home"
+fi
+
+plugin_state="missing"
+plugin_detail="$PLUGIN_ID"
+if [ -n "$OPENCLAW_BIN" ] && [ -x "$OPENCLAW_BIN" ]; then
+    plugins_json="$(env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" plugins list --json 2>/dev/null || true)"
+    plugins_txt="$(env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" plugins list 2>/dev/null || true)"
+    if grep -qE "\"id\"[[:space:]]*:[[:space:]]*\"${PLUGIN_ID}\"" <<<"$plugins_json" \
+       || grep -qE "(^|[[:space:]])${PLUGIN_ID}([[:space:]]|$)" <<<"$plugins_txt"; then
+        plugin_state="listed"
+        plugin_detail="$PLUGIN_ID (openclaw plugins list)"
+    fi
+fi
+if [ "$plugin_state" = "missing" ] && [ -d "${OPENCLAW_STATE_DIR%/}/extensions/${PLUGIN_ID}" ]; then
+    plugin_state="installed"
+    plugin_detail="${OPENCLAW_STATE_DIR%/}/extensions/${PLUGIN_ID}"
+fi
+if [ "$plugin_state" != "missing" ]; then
+    field "${PLUGIN_ID} plugin" "${plugin_state} (${plugin_detail})"
+else
+    field "${PLUGIN_ID} plugin" "missing"
+    note_install_missing "${PLUGIN_ID} plugin"
+fi
+
+runtime_bin="$(command -v tokenless 2>/dev/null || true)"
+if [ -n "$runtime_bin" ]; then
+    field "tokenless binary" "present (${runtime_bin})"
+else
+    field "tokenless binary" "missing"
+    note_prereq_missing "tokenless binary"
+fi
+
+if [ -d "$PLUGIN_SRC" ]; then
+    field "adapter resource" "present (${PLUGIN_SRC})"
+else
+    field "adapter resource" "missing (${PLUGIN_SRC})"
+    note_prereq_missing "adapter resource"
+fi
+
+if [ -f "$PLUGIN_SRC/dist/index.js" ]; then
+    field "plugin build artifact" "present"
+else
+    field "plugin build artifact" "missing (${PLUGIN_SRC}/dist/index.js)"
+    note_prereq_missing "plugin build artifact"
+fi
+
+if [ ${#PREREQ_MISSING[@]} -gt 0 ]; then
+    line "${AGENT}: missing prerequisites (${PREREQ_MISSING[*]})"
+    exit 2
+fi
+if [ ${#INSTALL_MISSING[@]} -gt 0 ]; then
+    line "${AGENT}: not installed (ready to install)"
+    exit 1
+fi
+line "${AGENT}: ready"
+exit 0

package/adapters/tokenless/openclaw/scripts/install.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# install.sh — Deploy the tokenless OpenClaw plugin via the openclaw CLI.
+#
+# Responsibility boundary (mirrors sec-core/openclaw-plugin/scripts/deploy.sh):
+#   - This script ONLY deploys an already-built plugin.
+#   - Compilation (index.ts -> dist/index.js) is the Makefile's job:
+#       make -C src/tokenless build-openclaw-plugin
+#     which `make install` runs automatically before `install-adapter-resources`
+#     copies the result into $SHARE_DIR/openclaw.
+#   - If dist/index.js is missing, exit with a clear error pointing at the
+#     Makefile target. Do NOT compile here — adapters shouldn't invoke npm at
+#     deploy time.
+set -euo pipefail
+
+AGENT="${ANOLISA_TARGET:-openclaw}"
+COMPONENT="${ANOLISA_COMPONENT:-tokenless}"
+ADAPTER_DIR="${ANOLISA_ADAPTER_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+
+# Allow the orchestrator (or a packaging script) to inject a specific openclaw
+# binary. Defaults to whatever `openclaw` resolves to on PATH.
+OPENCLAW_BIN="${OPENCLAW_BIN:-openclaw}"
+OPENCLAW_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-$OPENCLAW_HOME}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR%/}"
+OPENCLAW_HOME="${OPENCLAW_HOME%/}"
+DRY_RUN="${ANOLISA_DRY_RUN:-0}"
+export PATH="$HOME/.local/bin:${OPENCLAW_STATE_DIR%/}/bin:/usr/local/bin:$PATH"
+
+PLUGIN_SRC="$ADAPTER_DIR/openclaw"
+
+echo "[${COMPONENT}] Installing ${AGENT} plugin..."
+
+if [ ! -d "$PLUGIN_SRC" ]; then
+    echo "[${COMPONENT}] Plugin source not found: $PLUGIN_SRC" >&2
+    exit 1
+fi
+
+if [ ! -f "$PLUGIN_SRC/dist/index.js" ]; then
+    echo "[${COMPONENT}] ERROR: $PLUGIN_SRC/dist/index.js is missing." >&2
+    echo "[${COMPONENT}]        Build the plugin first:" >&2
+    echo "[${COMPONENT}]            make -C src/tokenless build-openclaw-plugin" >&2
+    echo "[${COMPONENT}]        (run by 'make install' automatically; only an issue when" >&2
+    echo "[${COMPONENT}]         deploying a hand-assembled adapter directory)." >&2
+    exit 1
+fi
+
+if [ "$DRY_RUN" = "1" ]; then
+    echo "DRY-RUN: env -u OPENCLAW_HOME OPENCLAW_STATE_DIR=$OPENCLAW_STATE_DIR $OPENCLAW_BIN plugins install $PLUGIN_SRC --force --dangerously-force-unsafe-install"
+    exit 0
+fi
+
+if ! command -v "$OPENCLAW_BIN" &>/dev/null; then
+    echo "[${COMPONENT}] openclaw CLI not found (OPENCLAW_BIN=${OPENCLAW_BIN}) — skipping plugin installation."
+    echo "[${COMPONENT}] Install OpenClaw first, then run this script again."
+    exit 0
+fi
+
+# OpenClaw's built-in security scanner flags child_process imports as "dangerous
+# code patterns" and requires --dangerously-force-unsafe-install to proceed.
+# This is expected for the tokenless plugin: it delegates to tokenless and rtk
+# system binaries via execFileSync/spawnSync with fixed paths and timeouts.
+# No shell injection vector exists — all subprocess arguments are hardcoded or
+# come from resolveBinaryPath(), never from user input.
+echo "[${COMPONENT}] Note: --dangerously-force-unsafe-install is required because"
+echo "[${COMPONENT}]       this plugin wraps tokenless/rtk system binaries via child_process."
+echo "[${COMPONENT}]       See https://github.com/alibaba/anolisa for source."
+
+env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" plugins install "$PLUGIN_SRC" \
+    --force --dangerously-force-unsafe-install || {
+    echo "[${COMPONENT}] openclaw CLI install failed — check OpenClaw version >= 5.0.0" >&2
+    exit 1
+}
+
+echo "[${COMPONENT}] ${AGENT} plugin installed via openclaw CLI."
+echo "[${COMPONENT}] Run '${OPENCLAW_BIN} gateway restart' to activate."

package/adapters/tokenless/openclaw/scripts/uninstall.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# uninstall.sh — Remove tokenless plugin via OpenClaw official CLI.
+#
+# TODO(adapter-manifest): keep this explicit script while adapter actions are
+# invoked by component Makefile/build-all instead of a shared manifest runner.
+set -euo pipefail
+
+AGENT="${ANOLISA_TARGET:-openclaw}"
+COMPONENT="${ANOLISA_COMPONENT:-tokenless}"
+OPENCLAW_BIN="${OPENCLAW_BIN:-}"
+OPENCLAW_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-$OPENCLAW_HOME}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR%/}"
+OPENCLAW_HOME="${OPENCLAW_HOME%/}"
+DRY_RUN="${ANOLISA_DRY_RUN:-0}"
+export PATH="$HOME/.local/bin:${OPENCLAW_STATE_DIR%/}/bin:/usr/local/bin:$PATH"
+
+if [ -z "$OPENCLAW_BIN" ]; then
+    OPENCLAW_BIN="$(command -v openclaw 2>/dev/null || true)"
+fi
+
+echo "[${COMPONENT}] Removing ${AGENT} plugin..."
+
+if [ "$DRY_RUN" = "1" ]; then
+    if [ -n "$OPENCLAW_BIN" ]; then
+        echo "DRY-RUN: env -u OPENCLAW_HOME OPENCLAW_STATE_DIR=$OPENCLAW_STATE_DIR $OPENCLAW_BIN plugins uninstall tokenless --force"
+    else
+        echo "DRY-RUN: openclaw CLI not found; remove plugin files manually"
+    fi
+    echo "DRY-RUN: rm -rf ${OPENCLAW_STATE_DIR%/}/plugins/tokenless"
+    echo "DRY-RUN: rm -rf ${OPENCLAW_STATE_DIR%/}/extensions/tokenless"
+    exit 0
+fi
+
+if [ -z "$OPENCLAW_BIN" ]; then
+    echo "[${COMPONENT}] openclaw CLI not found — removing plugin files manually."
+    rm -rf "${OPENCLAW_STATE_DIR%/}/plugins/tokenless" 2>/dev/null || true
+    rm -rf "${OPENCLAW_STATE_DIR%/}/extensions/tokenless" 2>/dev/null || true
+    echo "[${COMPONENT}] Plugin files removed. Manually clean up openclaw.json if needed."
+    exit 0
+fi
+
+# Use openclaw CLI for proper removal (handles file cleanup + config update)
+env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" plugins uninstall tokenless --force || true
+
+echo "[${COMPONENT}] ${AGENT} plugin removed via openclaw CLI."

package/adapters/tokenless/openclaw/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "module": "Node16",
+    "moduleResolution": "Node16",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": false,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["index.ts"]
+}

package/adapters/tokenless/opencode/plugin.js

@@ -0,0 +1,246 @@
+/**
+ * Tokenless integration for OpenCode's local plugin API.
+ *
+ * The adapter translates OpenCode's in-process hooks to the shared Tokenless
+ * JSON hook protocol, keeping compression and readiness behavior consistent
+ * with the other agent integrations.
+ */
+
+import { spawn } from "node:child_process";
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const AGENT_ID = "opencode";
+const HOOK_TIMEOUT_MS = 15_000;
+const MAX_HOOK_OUTPUT_BYTES = 1024 * 1024;
+const MAX_CACHE_ENTRIES = 256;
+const PLUGIN_FILE = fileURLToPath(import.meta.url);
+const PLUGIN_DIR = dirname(realpathSync(PLUGIN_FILE));
+
+function isFile(path) {
+  try {
+    return existsSync(path) && statSync(path).isFile();
+  } catch {
+    // Hook discovery is fail-open so unreadable paths never block OpenCode startup.
+    return false;
+  }
+}
+
+function findHookRunner() {
+  const adapterDir = process.env.ANOLISA_ADAPTER_DIR;
+  const userHome = process.env.HOME && isAbsolute(process.env.HOME)
+    ? process.env.HOME
+    : homedir();
+  const candidates = [
+    process.env.TOKENLESS_HOOK_RUNNER,
+    adapterDir ? join(adapterDir, "common", "hooks", "run-hook.sh") : "",
+    // The installed plugin remains beside the shared adapter tree after its
+    // global registration symlink is resolved through PLUGIN_FILE.
+    join(PLUGIN_DIR, "..", "common", "hooks", "run-hook.sh"),
+    join(
+      userHome,
+      ".local",
+      "share",
+      "anolisa",
+      "adapters",
+      "tokenless",
+      "common",
+      "hooks",
+      "run-hook.sh",
+    ),
+    "/usr/local/share/anolisa/adapters/tokenless/common/hooks/run-hook.sh",
+    "/usr/share/anolisa/adapters/tokenless/common/hooks/run-hook.sh",
+  ];
+  return candidates.find((candidate) => candidate && isFile(candidate)) ?? null;
+}
+
+function parseHookOutput(raw) {
+  if (!raw.trim()) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function runHook(runner, hookName, payload) {
+  if (!runner) return Promise.resolve(null);
+  let serialized;
+  try {
+    serialized = JSON.stringify(payload);
+  } catch {
+    return Promise.resolve(null);
+  }
+
+  return new Promise((resolve) => {
+    let stdout = "";
+    let settled = false;
+    let child;
+    let timer;
+    try {
+      child = spawn("bash", [runner, hookName], {
+        env: {
+          ...process.env,
+          TOKENLESS_AGENT_ID: AGENT_ID,
+        },
+        stdio: ["pipe", "pipe", "ignore"],
+      });
+    } catch {
+      resolve(null);
+      return;
+    }
+
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    timer = setTimeout(() => {
+      child.kill();
+      finish(null);
+    }, HOOK_TIMEOUT_MS);
+
+    child.on("error", () => finish(null));
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      if (stdout.length < MAX_HOOK_OUTPUT_BYTES) {
+        stdout += chunk.slice(0, MAX_HOOK_OUTPUT_BYTES - stdout.length);
+      }
+    });
+    child.on("close", (code) => {
+      finish(code === 0 ? parseHookOutput(stdout) : null);
+    });
+
+    child.stdin.on("error", () => {
+      child.kill();
+      finish(null);
+    });
+    child.stdin.end(serialized);
+  });
+}
+
+function toolPayload(input, args, toolResponse) {
+  const payload = {
+    session_id: input.sessionID,
+    tool_use_id: input.callID,
+    tool_call_id: input.callID,
+    tool_name: input.tool,
+    tool_input: args ?? {},
+  };
+  if (toolResponse !== undefined) payload.tool_response = toolResponse;
+  return payload;
+}
+
+function hookSpecificOutput(result) {
+  const output = result?.hookSpecificOutput;
+  return output && typeof output === "object" ? output : null;
+}
+
+function prependContext(context, content) {
+  if (typeof context !== "string" || !context) return content;
+  return content ? `${context}\n${content}` : context;
+}
+
+export const TokenlessPlugin = async () => {
+  const runner = findHookRunner();
+  const readinessContext = new Map();
+  const schemaCache = new Map();
+
+  const cacheValue = (cache, key, value) => {
+    if (cache.has(key)) {
+      cache.delete(key);
+    } else if (cache.size >= MAX_CACHE_ENTRIES) {
+      cache.delete(cache.keys().next().value);
+    }
+    cache.set(key, value);
+  };
+
+  const cachedValue = (cache, key) => {
+    if (!cache.has(key)) return undefined;
+    const value = cache.get(key);
+    cache.delete(key);
+    cache.set(key, value);
+    return value;
+  };
+
+  return {
+    "tool.execute.before": async (input, output) => {
+      const payload = toolPayload(input, output.args);
+      const readyResult = await runHook(runner, "tool_ready_hook.sh", payload);
+      if (readyResult?.decision === "block") {
+        throw new Error(
+          readyResult.reason || "Tokenless reports that the tool is not ready",
+        );
+      }
+
+      const readyOutput = hookSpecificOutput(readyResult);
+      if (typeof readyOutput?.additionalContext === "string") {
+        cacheValue(
+          readinessContext,
+          `${input.sessionID}:${input.callID}`,
+          readyOutput.additionalContext,
+        );
+      }
+
+      if (input.tool !== "bash" || typeof output.args?.command !== "string") return;
+      const rewriteResult = await runHook(runner, "rewrite_hook.py", payload);
+      const rewritten = hookSpecificOutput(rewriteResult)?.updatedInput?.command;
+      if (typeof rewritten === "string" && rewritten) output.args.command = rewritten;
+    },
+
+    "tool.execute.after": async (input, output) => {
+      const key = `${input.sessionID}:${input.callID}`;
+      const readyContext = readinessContext.get(key);
+      readinessContext.delete(key);
+
+      const result = await runHook(
+        runner,
+        "compress_response_hook.py",
+        toolPayload(input, input.args, output.output),
+      );
+      const hookOutput = hookSpecificOutput(result);
+      const compressedOutput = hookOutput?.updatedToolOutput;
+      if (typeof compressedOutput === "string") {
+        output.output = compressedOutput;
+      }
+      const context = [readyContext, hookOutput?.additionalContext]
+        .filter((value) => typeof value === "string" && value)
+        .join("\n");
+      output.output = prependContext(context, output.output);
+    },
+
+    "tool.definition": async (input, output) => {
+      const declaration = {
+        name: input.toolID,
+        description: output.description,
+        parameters: output.parameters,
+      };
+      let cacheKey;
+      try {
+        cacheKey = JSON.stringify(declaration);
+      } catch {
+        return;
+      }
+      let tools = cachedValue(schemaCache, cacheKey);
+      if (!tools) {
+        const result = await runHook(runner, "compress_schema_hook.py", {
+          llm_request: { config: { tools: [declaration] } },
+        });
+        tools = hookSpecificOutput(result)?.llm_request?.config?.tools;
+        if (Array.isArray(tools)) cacheValue(schemaCache, cacheKey, tools);
+      }
+      if (!Array.isArray(tools) || tools.length !== 1 || tools[0]?.name !== input.toolID) {
+        return;
+      }
+
+      if (typeof tools[0].description === "string") output.description = tools[0].description;
+      if (tools[0].parameters && typeof tools[0].parameters === "object") {
+        output.parameters = tools[0].parameters;
+      }
+    },
+  };
+};

package/adapters/tokenless/opencode/scripts/detect.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# detect.sh — Check whether OpenCode can load the Tokenless local plugin.
+set -euo pipefail
+
+AGENT="${ANOLISA_TARGET:-opencode}"
+COMPONENT="${ANOLISA_COMPONENT:-tokenless}"
+ADAPTER_DIR="${ANOLISA_ADAPTER_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+PLUGIN_SOURCE="$ADAPTER_DIR/opencode/plugin.js"
+
+OPENCODE_BIN="${OPENCODE_BIN:-}"
+if [ -z "$OPENCODE_BIN" ]; then
+    OPENCODE_BIN="$(command -v opencode 2>/dev/null || true)"
+fi
+
+if [ -z "$OPENCODE_BIN" ] || { [ ! -x "$OPENCODE_BIN" ] && ! command -v "$OPENCODE_BIN" >/dev/null 2>&1; }; then
+    echo "[${COMPONENT}] ${AGENT}: opencode CLI not found" >&2
+    exit 2
+fi
+if [ ! -f "$PLUGIN_SOURCE" ]; then
+    echo "[${COMPONENT}] ${AGENT}: plugin source missing: ${PLUGIN_SOURCE}" >&2
+    exit 2
+fi
+
+VERSION="$($OPENCODE_BIN --version 2>/dev/null || true)"
+if [ -z "$VERSION" ]; then
+    echo "[${COMPONENT}] ${AGENT}: opencode CLI did not report a version" >&2
+    exit 2
+fi
+
+CONFIG_HOME="${TOKENLESS_OPENCODE_CONFIG_DIR:-${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}}"
+PLUGIN_LINK="$CONFIG_HOME/plugins/tokenless.js"
+if [ -L "$PLUGIN_LINK" ] && [ "$PLUGIN_LINK" -ef "$PLUGIN_SOURCE" ]; then
+    echo "[${COMPONENT}] ${AGENT}: ready (${VERSION})"
+    exit 0
+fi
+
+echo "[${COMPONENT}] ${AGENT}: detected (${VERSION}), plugin not installed"
+exit 1

package/adapters/tokenless/opencode/scripts/install.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# install.sh — Register Tokenless in OpenCode's global local-plugin directory.
+set -euo pipefail
+
+AGENT="${ANOLISA_TARGET:-opencode}"
+COMPONENT="${ANOLISA_COMPONENT:-tokenless}"
+ADAPTER_DIR="${ANOLISA_ADAPTER_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+PLUGIN_SOURCE="$ADAPTER_DIR/opencode/plugin.js"
+
+OPENCODE_BIN="${OPENCODE_BIN:-}"
+if [ -z "$OPENCODE_BIN" ]; then
+    OPENCODE_BIN="$(command -v opencode 2>/dev/null || true)"
+fi
+if [ -z "$OPENCODE_BIN" ] || { [ ! -x "$OPENCODE_BIN" ] && ! command -v "$OPENCODE_BIN" >/dev/null 2>&1; }; then
+    echo "[${COMPONENT}] opencode CLI not found — skipping ${AGENT} plugin installation."
+    exit 0
+fi
+if [ ! -f "$PLUGIN_SOURCE" ]; then
+    echo "[${COMPONENT}] ERROR: OpenCode plugin source not found: ${PLUGIN_SOURCE}" >&2
+    exit 1
+fi
+
+CONFIG_HOME="${TOKENLESS_OPENCODE_CONFIG_DIR:-${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}}"
+PLUGIN_DIR="$CONFIG_HOME/plugins"
+PLUGIN_LINK="$PLUGIN_DIR/tokenless.js"
+
+is_managed_link() {
+    [ -L "$PLUGIN_LINK" ] && {
+        [ "$PLUGIN_LINK" -ef "$PLUGIN_SOURCE" ] ||
+            [ "$(readlink "$PLUGIN_LINK")" = "$PLUGIN_SOURCE" ]
+    }
+}
+
+if [ -e "$PLUGIN_LINK" ] || [ -L "$PLUGIN_LINK" ]; then
+    if is_managed_link; then
+        echo "[${COMPONENT}] ${AGENT} plugin already installed at ${PLUGIN_LINK}."
+        exit 0
+    fi
+    echo "[${COMPONENT}] ERROR: refusing to replace unmanaged path: ${PLUGIN_LINK}" >&2
+    exit 1
+fi
+
+if [ "${ANOLISA_DRY_RUN:-0}" = "1" ]; then
+    echo "DRY-RUN: ln -s ${PLUGIN_SOURCE} ${PLUGIN_LINK}"
+    exit 0
+fi
+
+mkdir -p "$PLUGIN_DIR"
+ln -s "$PLUGIN_SOURCE" "$PLUGIN_LINK"
+if ! is_managed_link; then
+    echo "[${COMPONENT}] ERROR: failed to verify OpenCode plugin link: ${PLUGIN_LINK}" >&2
+    exit 1
+fi
+
+echo "[${COMPONENT}] ${AGENT} plugin installed at ${PLUGIN_LINK}."
+echo "[${COMPONENT}] Restart OpenCode to load the plugin."

package/adapters/tokenless/opencode/scripts/uninstall.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# uninstall.sh — Remove only the OpenCode plugin link managed by Tokenless.
+set -euo pipefail
+
+AGENT="${ANOLISA_TARGET:-opencode}"
+COMPONENT="${ANOLISA_COMPONENT:-tokenless}"
+ADAPTER_DIR="${ANOLISA_ADAPTER_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+PLUGIN_SOURCE="$ADAPTER_DIR/opencode/plugin.js"
+CONFIG_HOME="${TOKENLESS_OPENCODE_CONFIG_DIR:-${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}}"
+PLUGIN_LINK="$CONFIG_HOME/plugins/tokenless.js"
+
+is_managed_link() {
+    [ -L "$PLUGIN_LINK" ] && {
+        [ "$PLUGIN_LINK" -ef "$PLUGIN_SOURCE" ] ||
+            [ "$(readlink "$PLUGIN_LINK")" = "$PLUGIN_SOURCE" ]
+    }
+}
+
+if [ ! -e "$PLUGIN_LINK" ] && [ ! -L "$PLUGIN_LINK" ]; then
+    echo "[${COMPONENT}] ${AGENT} plugin is already absent."
+    exit 0
+fi
+if ! is_managed_link; then
+    echo "[${COMPONENT}] WARNING: leaving unmanaged path untouched: ${PLUGIN_LINK}" >&2
+    exit 0
+fi
+
+rm "$PLUGIN_LINK"
+echo "[${COMPONENT}] ${AGENT} plugin removed."