@tokenade/cli 0.3.0

package/README.md

@@ -0,0 +1,32 @@
+# @tokenade/cli
+
+**Tokenade** cuts your AI coding agent's token bill — semantic code search,
+output filtering and compaction, applied automatically as a local MCP server +
+inspectable agent hooks. Paid product (freemium) — see <https://tokenade.net>.
+
+## Install
+
+```sh
+npm install -g @tokenade/cli
+```
+
+The postinstall downloads the prebuilt binary for your platform from the signed
+release manifest (`downloads.tokenade.net/manifest.json`) and verifies its
+SHA-256. Nothing is run blindly.
+
+## Activate (browser — no key to type)
+
+```sh
+tokenade login      # opens tokenade.net to authorize this machine
+tokenade install    # registers the MCP server + hooks with your coding agent
+```
+
+`tokenade login` opens your browser so you (logged into your dashboard) approve
+this device. Each plan allows 3 machines; manage them at
+<https://tokenade.net/dashboard>.
+
+## What leaves your machine
+
+Nothing, except anonymous token-savings counts and an update check. Tokenade
+runs locally; its agent hooks live in your editor/agent config (inspectable,
+reversible).

package/bin/tokenade-mcp.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+"use strict";
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+const fs = require("node:fs");
+
+const bin = path.join(
+	__dirname,
+	"..",
+	"vendor",
+	process.platform === "win32" ? "tokenade-mcp.exe" : "tokenade-mcp",
+);
+if (!fs.existsSync(bin)) {
+	console.error(
+		"tokenade-mcp: binary not found. Re-run `npm install -g @tokenade/cli`.",
+	);
+	process.exit(1);
+}
+const r = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+if (r.error) {
+	console.error(`tokenade-mcp: ${r.error.message}`);
+	process.exit(1);
+}
+process.exit(r.status === null ? 1 : r.status);

package/bin/tokenade.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+"use strict";
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+const fs = require("node:fs");
+
+const bin = path.join(
+	__dirname,
+	"..",
+	"vendor",
+	process.platform === "win32" ? "tokenade.exe" : "tokenade",
+);
+if (!fs.existsSync(bin)) {
+	console.error(
+		"tokenade: binary not found. Re-run `npm install -g @tokenade/cli` (the postinstall downloads it).",
+	);
+	process.exit(1);
+}
+const r = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+if (r.error) {
+	console.error(`tokenade: ${r.error.message}`);
+	process.exit(1);
+}
+process.exit(r.status === null ? 1 : r.status);

package/install.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * postinstall — download the prebuilt Tokenade binary for this platform from
+ * the signed release manifest, verify its SHA-256, and drop `tokenade` +
+ * `tokenade-mcp` into ./vendor. The bin shims in ./bin exec them.
+ *
+ * Closed-source commercial binary, distributed via the npm registry (the trust
+ * anchor) — same pattern as esbuild/biome/swc. Nothing is executed blindly:
+ * the checksum comes from downloads.tokenade.net/manifest.json.
+ */
+
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+const https = require("node:https");
+const crypto = require("node:crypto");
+const tar = require("tar");
+
+const DOWNLOADS_BASE =
+	process.env.TOKENADE_DOWNLOADS_BASE || "https://downloads.tokenade.net";
+const MANIFEST_URL = `${DOWNLOADS_BASE}/manifest.json`;
+const VENDOR = path.join(__dirname, "vendor");
+
+function rustTarget() {
+	const p = process.platform;
+	const a = process.arch;
+	if (p === "darwin")
+		return a === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin";
+	if (p === "linux")
+		return a === "arm64"
+			? "aarch64-unknown-linux-musl"
+			: "x86_64-unknown-linux-gnu";
+	if (p === "win32") return "x86_64-pc-windows-gnu";
+	throw new Error(`unsupported platform: ${p}/${a}`);
+}
+
+function get(url, redirects = 0) {
+	return new Promise((resolve, reject) => {
+		if (redirects > 5) return reject(new Error("too many redirects"));
+		https
+			.get(url, (res) => {
+				if (
+					res.statusCode &&
+					res.statusCode >= 300 &&
+					res.statusCode < 400 &&
+					res.headers.location
+				) {
+					res.resume();
+					return resolve(get(res.headers.location, redirects + 1));
+				}
+				if (res.statusCode !== 200) {
+					res.resume();
+					return reject(new Error(`GET ${url} → HTTP ${res.statusCode}`));
+				}
+				resolve(res);
+			})
+			.on("error", reject);
+	});
+}
+
+async function fetchJson(url) {
+	const res = await get(url);
+	const chunks = [];
+	for await (const c of res) chunks.push(c);
+	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+
+async function downloadTo(url, dest) {
+	const res = await get(url);
+	const hash = crypto.createHash("sha256");
+	await new Promise((resolve, reject) => {
+		const out = fs.createWriteStream(dest);
+		res.on("data", (d) => hash.update(d));
+		res.pipe(out);
+		out.on("finish", resolve);
+		out.on("error", reject);
+		res.on("error", reject);
+	});
+	return hash.digest("hex");
+}
+
+async function main() {
+	const target = rustTarget();
+	const manifest = await fetchJson(MANIFEST_URL);
+	const entry = manifest.targets && manifest.targets[target];
+	if (!entry || !entry.url || !entry.sha256) {
+		throw new Error(`no published build for ${target}`);
+	}
+
+	const tmp = path.join(
+		os.tmpdir(),
+		`tokenade-${process.pid}-${path.basename(entry.url)}`,
+	);
+	const got = await downloadTo(entry.url, tmp);
+	if (got !== entry.sha256) {
+		fs.rmSync(tmp, { force: true });
+		throw new Error(
+			`checksum mismatch for ${target}\n  expected ${entry.sha256}\n  got      ${got}`,
+		);
+	}
+
+	fs.rmSync(VENDOR, { recursive: true, force: true });
+	fs.mkdirSync(VENDOR, { recursive: true });
+	await tar.x({ file: tmp, cwd: VENDOR });
+	fs.rmSync(tmp, { force: true });
+
+	if (process.platform !== "win32") {
+		for (const name of ["tokenade", "tokenade-mcp"]) {
+			const f = path.join(VENDOR, name);
+			if (fs.existsSync(f)) fs.chmodSync(f, 0o755);
+		}
+	}
+
+	console.log(`✓ tokenade ${manifest.version} installed (${target})`);
+	console.log("  Next: run `tokenade login` to activate this machine.");
+}
+
+main().catch((err) => {
+	console.error(`✗ tokenade install failed: ${err.message}`);
+	console.error(
+		"  You can retry, or download manually from https://downloads.tokenade.net",
+	);
+	process.exit(1);
+});

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@tokenade/cli",
+  "version": "0.3.0",
+  "description": "Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI + MCP server (a local, paid token-reduction tool; activate via your browser).",
+  "homepage": "https://tokenade.net",
+  "license": "UNLICENSED",
+  "bin": {
+    "tokenade": "bin/tokenade.js",
+    "tokenade-mcp": "bin/tokenade-mcp.js"
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "dependencies": {
+    "tar": "^7.4.3"
+  },
+  "files": [
+    "bin/",
+    "install.js",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "keywords": [
+    "tokenade",
+    "ai",
+    "tokens",
+    "mcp",
+    "claude",
+    "coding-agent",
+    "cli"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}