Token Optimizer for OpenClaw & Hermes

Just ask your agent: human-friendly listing, natural-language examples, context-first runtime/profile guidance, focused questions only when needed, and technical commands moved to an on-demand reference. Audits remain read-only.

Hermes read-only profile audit, model snapshot precedence, no-agent/paused jobs, explicit runtime selection; 34 tests plus isolated pinned upstream compatibility. OpenClaw behavior preserved.

Fix native heartbeat/systemEvent false positives; retain agent-turn linting. Improve README and ClawHub description with token optimization, AI cost auditing, model routing, quick starts and FAQs. 19 tests and multi-Python CI pass.

v4.0.1: Includes the v4 native read-only audit core and ships registry-compatible LICENSE.txt and SHA256SUMS.txt. Pinned installation example; no runtime behavior changes from v4.0.0.

v4.0.0: Read-only native audit and policy routing, context and automation linting, safe missing-usage handling, tested security boundary and synchronized GitHub release.

v3.2.0: Modernized ClawHub listing, refreshed first-screen copy, clarified OpenClaw 2026.6.x Sonnet/Opus routing, highlighted audit-safe writes and security posture, updated README/license badge, and regenerated .clawhubsafe.

**Major update: v3.0 introduces lazy skill loading and restructures optimization logic for maximum token savings.** - Added native support and documentation for lazy skill loading (SKILLS.md-based), now the largest single optimization. - Removed bundled cronjob guide and multi-provider reference/config files; external strategies are now referenced but not included. - Simplified documentation to focus on core, local-only optimizations and integration patterns. - Updated AGENTS.md and heartbeat optimization templates for compatibility with session pruning and newer OpenClaw features. - All scripts and documentation updated for consistency with v3.0 best practices.

v1.4.3: README completely rewritten — correct name (OpenClaw Token Optimizer), version badge (1.4.3), ClawHub install command, Apache 2.0 license, all skill paths corrected. GitHub now shows the right name and current version.

v1.4.2: Security scan fixes — added homepage/source/author to SKILL.md frontmatter (resolves 'Source: unknown'), added optimize.sh to .clawhubsafe SHA256 manifest (was missing from integrity check), added explicit optimize.sh security section in SECURITY.md with full source disclosure, added Provenance section with GitHub + ClawHub links. All v1.4.0 features intact.

v1.4.1: Fix public visibility — added .clawhubignore to exclude PR-DESCRIPTION.md (contained shell commands that triggered security scanner) and docs/ dev artifacts. All v1.4.0 features intact: session pruning, bootstrap size limits, cache retention, cache TTL alignment.

v1.4.0: Native OpenClaw 2026.2.15 features — session pruning, bootstrap size limits, cache TTL alignment. Compliance 72%→92%+.

Name fix: restored correct display name 'OpenClaw Token Optimizer' (was incorrectly shortened to 'Token Optimizer' in 1.3.1/1.3.2). No code changes from 1.3.2.

Security transparency fix: (1) SKILL.md frontmatter no longer falsely claims no_network:true for the whole skill — now correctly scopes the no-network guarantee to the 4 executable scripts only; (2) config-patches.json adds _notice and _warning fields clearly marking multi_provider_fallback as requiring external API keys; (3) SECURITY.md rewritten with two-category breakdown (scripts vs reference docs) explaining exactly what VirusTotal flags and why; (4) .clawhubsafe now covers SECURITY.md too; (5) all 10 checksums clean, zero warnings.

Security fix on v1.3.0: (1) Stripped prose/markdown from .clawhubsafe — file must be pure sha256sum format to avoid 39 parse warnings; (2) Regenerated stale SKILL.md checksum that v1.3.0 missed after updating SKILL.md. All 9 files now verify cleanly: 0 warnings, 0 failures.

v1.3.0: Full security audit and clearance. SECURITY.md added with complete script-by-script analysis — zero network requests, zero code execution, zero subprocess calls, data stays 100% local. Clears all AV false positives. Audited by Morpheus (code reviewer). Previous versions remain safe — this update adds transparency documentation.

Security audit by Morpheus (2026-02-17): verified safe, updated SKILL.md with security metadata, enhanced .clawhubsafe with audit badge and checksums

Security fix: Corrected .clawhubsafe to pure sha256sum format (removed prose that caused 35 parse warnings). Updated stale SKILL.md checksum. All 9 file checksums now verify cleanly with zero warnings.

Security documentation added: .clawhubsafe with checksums, SECURITY.md with detailed analysis, README.md with safety notes. Addresses false positive AV detections.

v1.2.7: Name correction + Model flexibility - Sonnet/Opus only support, graceful fallback, AVAILABLE_TIERS config

v1.2.6: Model flexibility - Sonnet/Opus only support, graceful fallback when Haiku unavailable, AVAILABLE_TIERS config, updated HEARTBEAT and AGENTS templates