@kunal_dutt/token-lens 0.2.35 → 0.2.36

package/PRIVACY.md

@@ -18,7 +18,7 @@ anyone.
 | --- | --- | --- | --- |
 | **Browser extension** (Chrome, Edge, Firefox) | The prompt box, model picker and visible messages on the AI chat sites listed in its permissions, to count tokens. | Your settings, prices, budget and savings totals, in your browser's own extension storage. Uninstalling deletes them. | Nothing. Its only network request is on claude.ai: at most once a minute it reads your own session and weekly usage from claude.ai, signed in as you, so plan tips use real numbers. The result is not stored and goes nowhere else. |
 | **MCP server on your computer** (`npx @kunal_dutt/token-lens`, Claude Desktop extension) | Only the text an AI app passes to its tools. | Savings totals only: per day, action and model, the number of tokens and dollars saved, in `~/.token-lens/savings.json` on your computer. Never any text. Delete the file to clear it; `TOKEN_LENS_LEDGER=off` turns it off. | Nothing by default. Only if you set your own `ANTHROPIC_API_KEY` or `GEMINI_API_KEY` for it does it send the text to that provider's token-counting endpoint, with your key, for an exact count. |
-| **Live tips in the Claude app on a Mac** (part of the MCP server when the Claude desktop app starts it) | Through macOS Accessibility, once it is allowed: the text in the front AI app's message box and open chat (Claude or ChatGPT), to count tokens. | Only on/off settings in `~/.token-lens/live.json`. The text stays in memory while counting and is never written down. | Nothing. macOS notifications on your Mac, and a panel served only to your own Mac at `localhost:4797` that refuses other sites and shows drafts only with a key Token Lens gives the page it opens. |
+| **Live tips in the Claude app on a Mac** (part of the MCP server when the Claude desktop app starts it) | Through macOS Accessibility, granted to Token Lens Helper once you set it up: the text in the front AI app's message box and open chat (Claude or ChatGPT), to count tokens. The text stays inside the helper. | Only on/off settings in `~/.token-lens/live.json`, the helper app in `~/.token-lens/helper`, and its plan-coach times and token counts (never text) in `~/Library/Application Support/Token Lens Helper`. The text stays in memory while counting and is never written down. | Nothing. macOS notifications on your Mac, and a panel served only to your own Mac at `localhost:4797` that refuses other sites and shows drafts only with a key Token Lens gives the page it opens. Token Lens Helper's only network request is a daily check of the npm registry (registry.npmjs.org) for a newer Token Lens. |
 | **Your own connector** (`npx @kunal_dutt/token-lens --http`) | Only the text sent to its tools. | Nothing. | Nothing beyond the reply. |
 | **Public hosted connector** (`/api/mcp`) | Only the text an AI app passes to its tools. | Nothing. Each request is handled in memory and discarded; requests are not logged or stored. The hosting provider keeps standard request metadata (time, IP address, URL) for security, as any website does. | Nothing beyond the reply. Prefer running your own copy if even that metadata matters. |
 | **Developer library** (`@kunal_dutt/token-lens/sdk` on npm, `token-lens` on PyPI, inside your app) | Your app's requests to OpenAI or Anthropic, in your own process. | Savings counters in your app's memory. | Nothing of its own. Your requests still go only to the provider your code already calls. |

package/README.md

@@ -54,10 +54,17 @@ desktop app starts Token Lens, it also watches the message box and open chat of
 the AI app in front (Claude, or ChatGPT's Mac app), through macOS Accessibility.
 macOS gives that permission to whatever started Token Lens, which is often
 "node", and turning node on would give every Node program that control, so
-Token Lens never asks for it. A helper app that holds the permission for Token
-Lens alone is in the works; until then live tips run only where that access is
-already granted. The panel at <http://localhost:4797> shows your drafts only
-when Token Lens opens it (ask Claude to "open the Token Lens panel"). When you pause typing and a
+Token Lens never asks for it. Instead it offers **Token Lens Helper**, a small
+native Mac app set up only when you click **Set up Token Lens Helper** at
+<http://localhost:4797> (or tell Claude yes when it offers): you turn it on once
+in System Settings > Privacy & Security > Accessibility. It reads only the
+message box and chat of Claude or ChatGPT, whichever is in front, runs Token
+Lens's own optimizer inside itself, and shows tips as notifications and in its
+menu bar window. It takes no input from other programs and the text never
+leaves it, so the permission can't be borrowed. Once a day it asks the npm
+registry for a newer Token Lens, checked against the registry's sha512 and
+never older than one it used. The panel shows your drafts only when Token Lens
+opens it (ask Claude to "open the Token Lens panel"). When you pause typing and a
 shorter prompt says the same thing, or a chat gets long enough that every
 message re-reads a lot, a macOS notification says so, in tokens and dollars.
 The shorter draft waits, ready to copy, at <http://localhost:4797>. It never