anolisa-tokenless 0.8.0 → 0.8.1

package/README.md

@@ -6,7 +6,7 @@
 
 Token-Less combines complementary strategies to minimize LLM token consumption:
 
-- **Lifecycle-aware Compression** — Protocol v2 owns BeforeModel schema handling, PreTool RTK rewriting, PostTool routing, and authorized Retrieve; the PostTool Pipeline compresses JSON and recognized build/test command logs.
+- **Lifecycle-aware Compression** — Protocol v2 owns BeforeModel schema handling, PreTool RTK rewriting, PostTool routing, and authorized Retrieve; the PostTool Pipeline compresses JSON, CSV/TSV tables, and recognized build/test command logs.
 - **TOON Context Compression** — Encodes JSON responses to TOON (Token-Oriented Object Notation) format via the `toon-format` library linked into `tokenless`, reducing syntax overhead for suitable structured data.
 - **Command Rewriting** — Integrates [RTK](https://github.com/rtk-ai/rtk) to filter and rewrite CLI command output, eliminating noise that would otherwise waste 60–90% of tokens.
 - **Tool Ready (legacy, hard-disabled)** — Its pre-call dependency checks are retained in source but unconditionally bypassed while the readiness model is redesigned.
@@ -35,6 +35,7 @@ retrieval, and attribution.
 | Schema compression | 47.3% on reference fixture | Compresses OpenAI Function Calling tool schemas |
 | Content-aware response compression | 36.3% lossless savings on the JSON reference fixture | Routes successful JSON through `JsonCompressor`; lossless candidates saving at least 15% take priority, while recoverable record arrays can be reduced to a 32-record base budget |
 | Build-log compression | workload-dependent | Cleans terminal control output and reduces repeated routine progress in recognized Cargo, pytest, npm/Jest, Go, Make/C, and generic command logs while preserving diagnostics, summaries, phases, and stack traces |
+| CSV/TSV table compression | workload-dependent | Preserves every cell when compacting quoting and record separators; larger tables can retain selected rows with an explicit incomplete-table notice and byte-exact original retrieval. Requires a text replacement slot; file reads pass through |
 | Reversible compression (stash) | — | Omitted record collections and bounded values are stashed; supported agents run `tokenless retrieve HASH` or call their static Retrieve Tool when full data is needed |
 | TOON context compression | 17.0% on reference response | Encodes JSON to TOON format for LLMs |
 | Command rewriting | 60–90% | Filters CLI output via RTK (70+ commands supported) |
@@ -114,7 +115,7 @@ Token-Less/
 ├── crates/tokenless-ccr/      # Reversible compression stash (Compress-Cache-Retrieve)
 ├── crates/tokenless-runtime/  # Lifecycle API and Runtime-owned PostTool pipeline
 ├── crates/tokenless-protocol/ # Versioned adapter contract and token estimator
-├── crates/tokenless-compressors/ # JSON and build-log domain compressors
+├── crates/tokenless-compressors/ # JSON, tabular, and build-log compressors
 ├── crates/tokenless-cli/      # CLI binary: `tokenless` command (env-check, compress, retrieve, stats)
 ├── python/tokenless/          # PyO3 package: `anolisa_tokenless`
 ├── python/agentscope/         # Pure-Python AgentScope integration package
@@ -273,7 +274,7 @@ Agent adapters may apply separate pre-check thresholds; see the
 ### compress
 
 Shared Agent hooks send lifecycle requests to `tokenless compress`; only
-successful, non-bypassed PostTool JSON and eligible command-output build logs
+successful, non-bypassed PostTool JSON, CSV/TSV tables, and eligible command-output build logs
 enter the Runtime-owned Pipeline. Tool errors bypass compression and keep their
 original output while Core attaches environment-diagnostic context.
 
@@ -397,6 +398,25 @@ duplicate intermediate token counts. See
 [Measuring Tokenless Savings](../../docs/user-guide/en/token-saving/tokenless/measuring-savings.md)
 for options and measurement limits.
 
+### Trace correlation
+
+Exported SLS records carry the trace identity of the host span they were
+produced under, so an observability backend such as AgentLoop can attribute
+token savings to a trace. Two optional environment variables supply it:
+
+- `TOKENLESS_TRACEPARENT` — adapter-facing override, read first.
+- `TRACEPARENT` — standard W3C variable, used when the override is absent,
+  empty, or unparsable.
+
+Injecting one is the launcher's responsibility: OpenTelemetry keeps the active
+span in an in-process carrier and does not export it to child processes, so a
+host or adapter that wants correlation must set one of them before spawning
+Tokenless. Without a usable context the record shape is unchanged, and the
+identity is written only to the SLS JSONL — never to the local `stats.db`. See
+[Measuring Tokenless Savings](../../docs/user-guide/en/token-saving/tokenless/measuring-savings.md)
+and
+[Configuration and Data Privacy](../../docs/user-guide/en/token-saving/tokenless/configuration-and-privacy.md).
+
 ### Database location
 
 Tokenless stores statistics and reversible-compression data in
@@ -944,7 +964,7 @@ layout and single-target interface.
 |---|---|
 | `crates/tokenless-cli/` | CLI binary — `tokenless` command (compress, stats, env-check) |
 | `crates/tokenless-schema/` | BeforeModel tool-schema compression — `SchemaCompressor` |
-| `crates/tokenless-compressors/` | Content-domain engines — `JsonCompressor` and `BuildLogCompressor` are connected to PostTool |
+| `crates/tokenless-compressors/` | Content-domain engines — `JsonCompressor`, `TabularCompressor` and `BuildLogCompressor` are connected to PostTool |
 | `crates/tokenless-runtime/` | Lifecycle API and Runtime-owned `PostToolPipeline`, shared by CLI and language bindings |
 | `crates/tokenless-protocol/` | Versioned adapter contract and shared `heuristic-v1` token estimator |
 | `python/tokenless/` | PyO3 package exposing `anolisa_tokenless` for CPython 3.11+ |

package/adapters/tokenless/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Token-Less context compression for Claude Code — RTK command rewriting, response/TOON compression, and Tool Ready environment pre-check",
   "author": { "name": "ANOLISA" },
   "license": "Apache-2.0",

package/adapters/tokenless/claude-code/scripts/detect.sh

@@ -24,6 +24,14 @@ export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
 # fast.
 DETECT_RETRIES="${TOKENLESS_DETECT_RETRIES:-3}"
 DETECT_RETRY_DELAY="${TOKENLESS_DETECT_RETRY_DELAY:-1}"
+# Separate, smaller budget for one result that only looks definitive: a
+# `plugin list` that succeeds but omits the plugin. `claude plugin install`
+# writes marketplace.json/plugin.json, yet the CLI's plugin registry index
+# only picks them up on a later scan, so the very first list right after
+# provisioning can succeed and still omit the just-installed plugin (GH
+# #3082). Kept apart from DETECT_RETRIES so a genuinely absent plugin pays a
+# couple of cheap re-lists rather than the whole settling budget.
+DETECT_PLUGIN_RELISTS="${TOKENLESS_DETECT_PLUGIN_RELISTS:-2}"
 
 # settle <cmd...> — run cmd once; if it reports a retryable failure (exit
 # status 1), sleep DETECT_RETRY_DELAY and retry, up to DETECT_RETRIES retries
@@ -97,13 +105,21 @@ else
     field "plugin.json"       "missing (run: make stamp-adapter-templates)"
 fi
 
+# plugin_manifests_staged — true when the local manifests that
+# `claude plugin install` consumes (the single-plugin marketplace plus the
+# stamped plugin manifest) are both on disk. Their presence is what makes an
+# omitted plugin ambiguous: the installer had something to register, so the
+# CLI's registry index may simply not have caught up with it yet.
+plugin_manifests_staged() {
+    [ -f "$PLUGIN_SRC/.claude-plugin/marketplace.json" ] \
+        && [ -f "$PLUGIN_SRC/.claude-plugin/plugin.json" ]
+}
+
 # claude_plugin_listed — probe the plugin registry, using the settle()
 # exit-status contract: 0 = plugin listed; 1 = `claude plugin list` itself
 # failed (the CLI may still be initializing ~/.claude on first run, so a
 # retry may still succeed); 2 = `plugin list` ran successfully but did not
-# list the plugin. That is a definitive absent result — no retry can change
-# it — so settle() must return immediately instead of sleeping out the
-# retry budget and invoking the CLI DETECT_RETRIES + 1 times.
+# list the plugin.
 claude_plugin_listed() {
     local listing
     if ! listing="$("$CLAUDE_BIN" plugin list 2>&1)"; then
@@ -115,12 +131,39 @@ claude_plugin_listed() {
     return 2
 }
 
+# settle_plugin_listed — settle() for the plugin probe, extended with a
+# bounded re-list of the "list succeeded but omitted the plugin" case.
+#
+# With nothing staged on disk that omission is definitive — there was no
+# plugin for the registry to index — so it is returned immediately (status
+# 2) without spending any budget. With the manifests staged it is also the
+# shape of the GH #3082 first-run race, where the registry index lags one
+# scan behind the installer and the just-installed plugin is missing from an
+# otherwise successful list. Re-list up to DETECT_PLUGIN_RELISTS times to
+# ride out that refresh window; a genuinely absent plugin still ends up
+# reported as "not installed", only a few cheap calls later.
+#
+# Like settle(), this must be called in a condition context so that `set -e`
+# stays suppressed while the probe reports a non-zero status.
+settle_plugin_listed() {
+    local relist=0 rc=0
+    settle claude_plugin_listed; rc=$?
+    while [ "$rc" -eq 2 ] && [ "$relist" -lt "$DETECT_PLUGIN_RELISTS" ] \
+        && plugin_manifests_staged; do
+        relist=$((relist + 1))
+        sleep "$DETECT_RETRY_DELAY"
+        settle claude_plugin_listed; rc=$?
+    done
+    return "$rc"
+}
+
 if [ -n "$CLAUDE_BIN" ] && [ -x "$CLAUDE_BIN" ]; then
     # First-run race: `claude plugin list` may transiently fail while the CLI
-    # initializes ~/.claude; settle() retries while that failure (status 1)
-    # persists. A successful list that simply omits the plugin is definitive
-    # (status 2) and is reported as "not installed" without further retries.
-    if settle claude_plugin_listed; then
+    # initializes ~/.claude (status 1), and may transiently omit a plugin
+    # whose manifests were staged only moments ago (status 2). Both are
+    # retried within their own bounded budgets, and "not installed" is
+    # reported only once those budgets are exhausted.
+    if settle_plugin_listed; then
         field "plugin install"    "installed ($PLUGIN_ID)"
     else
         field "plugin install"    "not installed"

package/adapters/tokenless/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Shell command output reduction and environment error diagnostics for Codex. Rewrites supported commands through RTK before execution and classifies environment failures with actionable fix hints.",
   "keywords": [
     "rtk",

package/adapters/tokenless/common/cosh-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "contextFileName": "COPILOT.md",
   "hooks": {
     "PreToolUse": [

package/adapters/tokenless/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolisa/dsh-tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Native DeepSeek Harness lifecycle integration for Tokenless",
   "type": "module",
   "main": "./dist/index.js",

package/adapters/tokenless/hermes/__init__.py

@@ -14,6 +14,7 @@ Activation is controlled by the Hermes plugin system — list ``tokenless`` in
 
 from __future__ import annotations
 
+import inspect
 import json
 import logging
 import os
@@ -76,13 +77,147 @@ def _validate_hooks_dir(path: str) -> str | None:
     return None
 
 
+# Symbols that must exist in the shared hook_utils module, paired with the
+# exact call shape this adapter uses at its hook entry points.  When a
+# candidate passes the trust check but ships an older hook_utils.py (e.g. a
+# stale install from a previous adapter version), the candidate is rejected and
+# the search continues to later paths.  The lifecycle migration made the Hermes
+# adapter a thin Core client, so the required symbols are the Protocol v2
+# request builders, the compress runner, and the Retrieve helpers this module
+# from-imports at load time.  The remaining load-time imports (resolve_binary,
+# SHELL_TOOLS, SKIP_TOOLS, and the local-path constants) predate Protocol v2,
+# so every module that ships the v2 API also ships them.  A module missing any
+# listed symbol would pass a narrower check and then raise ImportError at the
+# top-level from-import, after the candidate search has already ended — with no
+# fallback to later complete candidates.
+#
+# Symbol names alone are not enough: hook_utils has also changed *call
+# signatures* while keeping names stable.  ``build_post_tool_request`` took a
+# keyword-only ``retrieval_available`` flag until c2c7e580e replaced it with
+# the ``recovery`` mapping, so the module shipped by 9f109d559 exports all five
+# required symbols yet rejects the ``recovery=`` this adapter passes — the
+# plugin would import cleanly and every PostTool request would then die with
+# "unexpected keyword argument 'recovery'", again after the candidate search
+# has ended and with no fallback.  Each shape is therefore bound with
+# :func:`inspect.signature`; the values below are placeholders mirroring the
+# real call sites (``bind`` only checks arity and parameter names, so nothing
+# is ever called here).
+_HOOK_UTILS_CALL_SHAPES: tuple[tuple[str, tuple[Any, ...], dict[str, Any]], ...] = (
+    # on_compress_pre_tool:
+    #   build_pre_tool_request(args, AGENT_ID, tool_name, "command",
+    #                          session_id, tool_call_id,
+    #                          replace_arguments=False, block_and_suggest=True)
+    (
+        "build_pre_tool_request",
+        ({}, "", "", "", "", ""),
+        {"replace_arguments": False, "block_and_suggest": True},
+    ),
+    # on_transform_tool_result:
+    #   build_post_tool_request(content, AGENT_ID, tool_name, protocol_status,
+    #                           content_origin, output_optimization,
+    #                           result_kind=..., recovery=..., session_id=...,
+    #                           tool_use_id=..., replace_output=True,
+    #                           replace_with_text=True)
+    (
+        "build_post_tool_request",
+        ("", "", "", "", "", ""),
+        {
+            "result_kind": "tool",
+            "recovery": {"kind": "none"},
+            "session_id": "",
+            "tool_use_id": "",
+            "replace_output": True,
+            "replace_with_text": True,
+        },
+    ),
+    # Both hooks: run_compress(tokenless_bin, request, timeout, operation)
+    ("run_compress", ("", {}, 0, ""), {}),
+    # on_transform_tool_result: is_tokenless_retrieve_command(tool_name, args)
+    ("is_tokenless_retrieve_command", ("", {}), {}),
+    # on_transform_tool_result: tokenless_retrieve_command_available()
+    ("tokenless_retrieve_command_available", (), {}),
+)
+
+_HOOK_UTILS_REQUIRED_SYMBOLS = tuple(name for name, _, _ in _HOOK_UTILS_CALL_SHAPES)
+
+
+def _restore_cached_hook_utils(saved: Any) -> None:
+    """Reinstate the module cached before a trial import, or drop the trial."""
+    if saved is not None:
+        sys.modules["hook_utils"] = saved
+    else:
+        sys.modules.pop("hook_utils", None)
+
+
+def _call_shape_rejection(
+    symbol: Any, name: str, args: tuple[Any, ...], kwargs: dict[str, Any]
+) -> str | None:
+    """Return why *symbol* cannot take the adapter call shape, else ``None``."""
+    try:
+        signature = inspect.signature(symbol)
+    except (TypeError, ValueError) as exc:
+        return f"{name} is not an introspectable callable ({exc})"
+    try:
+        signature.bind(*args, **kwargs)
+    except TypeError as exc:
+        # Name the shape the adapter needs, not only what the module offers:
+        # a renamed keyword (retrieval_available -> recovery) reports as a
+        # missing argument on some Python versions, which alone would not tell
+        # the reader which side of the contract moved.
+        return (
+            f"{name}{signature} rejects the adapter call shape "
+            f"({len(args)} positional, kwargs: {', '.join(sorted(kwargs)) or 'none'}): "
+            f"{exc}"
+        )
+    return None
+
+
+def _check_api_compat(candidate_dir: str) -> str | None:
+    """Trial-import hook_utils from *candidate_dir* and verify its API.
+
+    Returns ``None`` when the module loads, exposes every symbol in
+    :data:`_HOOK_UTILS_REQUIRED_SYMBOLS`, and every one of them accepts the
+    matching call shape in :data:`_HOOK_UTILS_CALL_SHAPES`; otherwise a
+    human-readable rejection reason.  On success the freshly imported module is
+    kept in ``sys.modules`` so the subsequent ``from hook_utils import …``
+    reuses it rather than a stale cached copy.  On rejection the ``sys.path``
+    mutation is cleaned up and the previously cached module (if any) is
+    restored so later candidates start from a clean state.
+    """
+    sys.path.insert(0, candidate_dir)
+    saved = sys.modules.pop("hook_utils", None)
+    try:
+        import hook_utils as _trial  # type: ignore[import-not-found]
+        missing = [s for s in _HOOK_UTILS_REQUIRED_SYMBOLS
+                   if not hasattr(_trial, s)]
+        if missing:
+            _restore_cached_hook_utils(saved)
+            return f"API mismatch: missing {', '.join(missing)}"
+        mismatched = []
+        for name, args, kwargs in _HOOK_UTILS_CALL_SHAPES:
+            reason = _call_shape_rejection(getattr(_trial, name), name, args, kwargs)
+            if reason is not None:
+                mismatched.append(reason)
+        if mismatched:
+            _restore_cached_hook_utils(saved)
+            return "API mismatch: " + "; ".join(mismatched)
+        # Success — keep the freshly imported module in sys.modules.
+        return None
+    except Exception as exc:
+        _restore_cached_hook_utils(saved)
+        return f"import failed: {exc}"
+    finally:
+        sys.path.pop(0)
+
+
+
 def _resolve_hook_utils() -> tuple[str, list[str]]:
     """Locate a trusted shared hooks directory and make it importable.
 
     Returns ``(resolved_path, candidate_list)``.  The resolved path is
     inserted at the front of ``sys.path`` so the shared ``hook_utils``
     module can be imported.  Raises :exc:`ImportError` when no candidate
-    passes the trust policy.
+    passes both the trust policy and the API compatibility check.
     """
     # Resolve real home from passwd DB for user-install fallback path
     # (NOT $HOME — env-controllable).
@@ -119,11 +254,17 @@ def _resolve_hook_utils() -> tuple[str, list[str]]:
     rejections: list[str] = []
     for candidate in candidates:
         reason = _validate_hooks_dir(candidate)
-        if reason is None:
-            resolved = os.path.realpath(candidate)
-            sys.path.insert(0, resolved)
-            return resolved, candidates
-        rejections.append(f"  - {candidate}: {reason}")
+        if reason is not None:
+            rejections.append(f"  - {candidate}: {reason}")
+            continue
+        # Trust check passed — verify API compat (version mismatch guard).
+        resolved = os.path.realpath(candidate)
+        api_reason = _check_api_compat(resolved)
+        if api_reason is not None:
+            rejections.append(f"  - {candidate}: {api_reason}")
+            continue
+        sys.path.insert(0, resolved)
+        return resolved, candidates
 
     raise ImportError(
         "tokenless: no trusted shared hook_utils module (common/hooks/) found.\n"

package/adapters/tokenless/hermes/plugin.yaml

@@ -1,5 +1,5 @@
 name: tokenless
-version: "0.8.0"
+version: "0.8.1"
 description: "Tokenless lifecycle integration for Hermes Agent — Core-owned command rewriting and result optimization"
 author: ANOLISA
 requires_env: []

package/adapters/tokenless/manifest.json

@@ -1,6 +1,6 @@
 {
   "component": "tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "targets": {
     "cosh": {
       "compatibleVersions": "*",

package/adapters/tokenless/openclaw/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "tokenless",
   "name": "Tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Protocol v2 PreTool RTK rewriting and PostTool optimization. Wraps the tokenless system binary via child_process — this is expected and not malicious.",
   "activation": {
     "onCapabilities": ["hook"]

package/adapters/tokenless/openclaw/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenless/openclaw-plugin",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "OpenClaw lifecycle adapter for Tokenless Protocol v2",
   "type": "module",
   "main": "dist/index.js",

package/adapters/tokenless/openclaw/scripts/install.sh

@@ -45,7 +45,9 @@ if [ ! -f "$PLUGIN_SRC/dist/index.js" ]; then
 fi
 
 if [ "$DRY_RUN" = "1" ]; then
-    echo "DRY-RUN: env -u OPENCLAW_HOME OPENCLAW_STATE_DIR=$OPENCLAW_STATE_DIR $OPENCLAW_BIN plugins install $PLUGIN_SRC --force --dangerously-force-unsafe-install"
+    echo "DRY-RUN: env -u OPENCLAW_HOME OPENCLAW_STATE_DIR=$OPENCLAW_STATE_DIR $OPENCLAW_BIN plugins install $PLUGIN_SRC --force"
+    echo "DRY-RUN: add --dangerously-force-unsafe-install only while the advertised option still has effect (legacy hosts)"
+    echo "DRY-RUN: add --accept-capabilities only if advertised by plugins install --help"
     exit 0
 fi
 
@@ -55,19 +57,56 @@ if ! command -v "$OPENCLAW_BIN" &>/dev/null; then
     exit 0
 fi
 
-# OpenClaw's built-in security scanner flags child_process imports as "dangerous
-# code patterns" and requires --dangerously-force-unsafe-install to proceed.
-# This is expected for the tokenless plugin: it delegates to tokenless and rtk
-# system binaries via execFileSync/spawnSync with fixed paths and timeouts.
-# No shell injection vector exists — all subprocess arguments are hardcoded or
-# come from resolveBinaryPath(), never from user input.
-echo "[${COMPONENT}] Note: --dangerously-force-unsafe-install is required because"
-echo "[${COMPONENT}]       this plugin wraps tokenless/rtk system binaries via child_process."
-echo "[${COMPONENT}]       See https://github.com/alibaba/anolisa for source."
+INSTALL_ARGS=(plugins install "$PLUGIN_SRC" --force)
+if ! INSTALL_HELP="$(env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" plugins install --help 2>&1)"; then
+    printf '[%s] Cannot inspect OpenClaw installer options: %s\n' "$COMPONENT" "$INSTALL_HELP" >&2
+    exit 1
+fi
+# Invoking this installer accepts declared capabilities. Older hosts must
+# never receive an unsupported flag or a similarly named option.
+if [[ "$INSTALL_HELP" =~ (^|[^[:alnum:]_.-])--accept-capabilities([^[:alnum:]_.-]|$) ]]; then
+    INSTALL_ARGS+=(--accept-capabilities)
+fi
+
+# Legacy hosts gate installs on a safety scan of child_process usage whose only
+# non-interactive bypass is --dangerously-force-unsafe-install. OpenClaw 2026.9.2
+# keeps the token as a deprecated no-op: passing it there accomplishes nothing
+# and breaks again once the token is removed outright, so keep it only while the
+# advertised option still has effect (the scanner moved to
+# security.installPolicy on no-op hosts). The npm package ships this script to
+# macOS, where /bin/bash stays at 3.2 — no ${var,,} here.
+UNSAFE_SUPPORT=absent
+while IFS= read -r help_line; do
+    if [[ "$help_line" =~ (^|[^[:alnum:]_.-])--dangerously-force-unsafe-install([^[:alnum:]_.-]|$) ]]; then
+        help_line_lc="$(printf '%s' "$help_line" | tr '[:upper:]' '[:lower:]')"
+        case "$help_line_lc" in
+            *"no op"*|*"no-op"*) UNSAFE_SUPPORT=noop ;;
+            *) UNSAFE_SUPPORT=effective; INSTALL_ARGS+=(--dangerously-force-unsafe-install) ;;
+        esac
+        break
+    fi
+done <<< "$INSTALL_HELP"
+
+# Why the bypass is legitimate on the hosts that still need it: their scanner
+# reads child_process imports as "dangerous code patterns", and the tokenless
+# plugin does delegate to the tokenless and rtk system binaries via
+# execFileSync/spawnSync — with fixed paths and timeouts. No shell injection
+# vector exists: all subprocess arguments are hardcoded or come from
+# resolveBinaryPath(), never from user input. Hosts that dropped install-time
+# scanning get no note, because nothing was bypassed.
+if [ "$UNSAFE_SUPPORT" = "effective" ]; then
+    echo "[${COMPONENT}] Note: --dangerously-force-unsafe-install is required because"
+    echo "[${COMPONENT}]       this plugin wraps tokenless/rtk system binaries via child_process."
+    echo "[${COMPONENT}]       See https://github.com/alibaba/anolisa for source."
+fi
 
-env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" plugins install "$PLUGIN_SRC" \
-    --force --dangerously-force-unsafe-install || {
+env -u OPENCLAW_HOME OPENCLAW_STATE_DIR="$OPENCLAW_STATE_DIR" "$OPENCLAW_BIN" "${INSTALL_ARGS[@]}" || {
     echo "[${COMPONENT}] openclaw CLI install failed — check OpenClaw version >= 5.0.0" >&2
+    if [ "$UNSAFE_SUPPORT" = "noop" ]; then
+        echo "[${COMPONENT}]       this OpenClaw advertises --dangerously-force-unsafe-install as a" >&2
+        echo "[${COMPONENT}]       deprecated no-op; the safety scan follows the operator-owned" >&2
+        echo "[${COMPONENT}]       security.installPolicy instead." >&2
+    fi
     exit 1
 }
 

package/adapters/tokenless/qoder/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Token-Less LLM Token Optimization Toolkit for Qoder CLI",
   "author": {
     "name": "Shile Zhang",

package/adapters/tokenless/qwencode/qwen-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Token-Less context compression for Qwen Code — RTK command rewriting, response/TOON/schema compression, and registered but hard-disabled Tool Ready",
   "author": { "name": "ANOLISA" },
   "license": "Apache-2.0",

package/adapters/tokenless/qwenpaw/plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "tokenless",
   "name": "Tokenless",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "general",
   "description": "ANOLISA Tokenless: compress tool schemas and tool results before they reach the model",
   "author": "ANOLISA",

package/adapters/tokenless/qwenpaw/requirements.txt

@@ -1,6 +1,6 @@
 # Installed by QwenPaw's plugin loader into QwenPaw's own Python environment.
 # The native wheel is published only as a Tokenless GitHub Release asset; pip
 # picks the single line whose environment marker matches this host.
-anolisa-tokenless @ https://github.com/alibaba/anolisa/releases/download/tokenless/v0.8.0/anolisa_tokenless-0.8.0-cp311-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl ; sys_platform == "linux" and platform_machine == "x86_64"
-anolisa-tokenless @ https://github.com/alibaba/anolisa/releases/download/tokenless/v0.8.0/anolisa_tokenless-0.8.0-cp311-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl ; sys_platform == "linux" and platform_machine == "aarch64"
-anolisa-tokenless @ https://github.com/alibaba/anolisa/releases/download/tokenless/v0.8.0/anolisa_tokenless-0.8.0-cp311-abi3-macosx_11_0_arm64.whl ; sys_platform == "darwin" and platform_machine == "arm64"
+anolisa-tokenless @ https://github.com/alibaba/anolisa/releases/download/tokenless/v0.8.1/anolisa_tokenless-0.8.1-cp311-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl ; sys_platform == "linux" and platform_machine == "x86_64"
+anolisa-tokenless @ https://github.com/alibaba/anolisa/releases/download/tokenless/v0.8.1/anolisa_tokenless-0.8.1-cp311-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl ; sys_platform == "linux" and platform_machine == "aarch64"
+anolisa-tokenless @ https://github.com/alibaba/anolisa/releases/download/tokenless/v0.8.1/anolisa_tokenless-0.8.1-cp311-abi3-macosx_11_0_arm64.whl ; sys_platform == "darwin" and platform_machine == "arm64"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "anolisa-tokenless",
   "type": "module",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Token-Less — LLM token optimization toolkit (schema/response compression, command rewriting, tool readiness)",
   "license": "Apache-2.0",
   "repository": {
@@ -44,10 +44,10 @@
     "arm64"
   ],
   "optionalDependencies": {
-    "@anolisa/tokenless-linux-x64": "0.8.0",
-    "@anolisa/tokenless-linux-arm64": "0.8.0",
-    "@anolisa/tokenless-darwin-x64": "0.8.0",
-    "@anolisa/tokenless-darwin-arm64": "0.8.0"
+    "@anolisa/tokenless-linux-x64": "0.8.1",
+    "@anolisa/tokenless-linux-arm64": "0.8.1",
+    "@anolisa/tokenless-darwin-x64": "0.8.1",
+    "@anolisa/tokenless-darwin-arm64": "0.8.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",