@tokenade/cli 0.5.5 → 0.6.0

package/install.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /**
  * postinstall — download the prebuilt Tokenade binary for this platform from
- * the signed release manifest, verify its SHA-256, and drop `tokenade` +
- * `tokenade-mcp` into ./vendor. The bin shims in ./bin exec them.
+ * the signed release manifest, verify its SHA-256, and drop `tokenade`
+ * into ./vendor. The bin shim in ./bin execs it.
  *
  * Closed-source commercial binary, distributed via the npm registry (the trust
  * anchor) — same pattern as esbuild/biome/swc. Nothing is executed blindly:
@@ -261,10 +261,19 @@ async function main() {
 		throw new Error(`no published build for ${target}`);
 	}
 
-	const tmp = path.join(
-		os.tmpdir(),
-		`tokenade-${process.pid}-${path.basename(entry.url)}`,
-	);
+	// Derive the temp filename from the URL's path only. The download URL
+	// carries a cache-buster query string (…tar.gz?b=<hash>); `?` and the
+	// rest are legal in a URL but ILLEGAL in a Windows filename, so leaving
+	// them in the basename makes fs.createWriteStream fail with ENOENT on
+	// win32 (passes silently on POSIX where `?` is a valid char). Strip the
+	// query/fragment, then sanitize any remaining hostile chars defensively.
+	const urlPath = entry.url.split(/[?#]/, 1)[0];
+	const safeBase =
+		(path.basename(urlPath) || "tokenade-build.tar.gz").replace(
+			/[^A-Za-z0-9._-]/g,
+			"_",
+		);
+	const tmp = path.join(os.tmpdir(), `tokenade-${process.pid}-${safeBase}`);
 	const got = await downloadTo(entry.url, tmp);
 	if (got !== entry.sha256) {
 		fs.rmSync(tmp, { force: true });
@@ -292,7 +301,7 @@ async function main() {
 	fs.rmSync(tmp, { force: true });
 
 	if (process.platform !== "win32") {
-		for (const name of ["tokenade", "tokenade-mcp"]) {
+		for (const name of ["tokenade"]) {
 			const f = path.join(VENDOR, name);
 			if (fs.existsSync(f)) fs.chmodSync(f, 0o755);
 		}
@@ -301,7 +310,7 @@ async function main() {
 	console.log(`✓ tokenade ${manifest.version} installed (${target})`);
 	console.log("  Next: run `tokenade login` to activate this machine.");
 	console.log(
-		"  Login also wires up your coding agents (hooks + MCP) so token savings start —",
+		"  Login also wires up your coding agents (hooks) so token savings start —",
 	);
 	console.log(
 		"  already activated? run `tokenade install`, or `tokenade healthcheck` to verify the wiring.",

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@tokenade/cli",
-  "version": "0.5.5",
-  "description": "Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI + MCP server (a local, paid token-reduction tool; activate via your browser).",
+  "version": "0.6.0",
+  "description": "Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).",
   "homepage": "https://tokenade.net",
   "license": "UNLICENSED",
   "bin": {
-    "tokenade": "bin/tokenade.js",
-    "tokenade-mcp": "bin/tokenade-mcp.js"
+    "tokenade": "bin/tokenade.js"
   },
   "scripts": {
     "postinstall": "node install.js"

package/bin/tokenade-mcp.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-const { spawnSync } = require("node:child_process");
-const path = require("node:path");
-const fs = require("node:fs");
-
-const bin = path.join(
-	__dirname,
-	"..",
-	"vendor",
-	process.platform === "win32" ? "tokenade-mcp.exe" : "tokenade-mcp",
-);
-if (!fs.existsSync(bin)) {
-	console.error(
-		"tokenade-mcp: binary not found. Re-run `npm install -g @tokenade/cli`.",
-	);
-	process.exit(1);
-}
-const r = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
-if (r.error) {
-	console.error(`tokenade-mcp: ${r.error.message}`);
-	process.exit(1);
-}
-process.exit(r.status === null ? 1 : r.status);