@tokenade/cli 1.2.4 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/LICENSE-APACHE +73 -0
  2. package/LICENSE-MIT +21 -0
  3. package/README.md +37 -460
  4. package/install.js +62 -20
  5. package/package.json +22 -12
  6. package/LICENSE +0 -100
package/LICENSE-APACHE ADDED
@@ -0,0 +1,73 @@
1
+ Apache License
2
+ Version 2.0, January 2004
3
+ http://www.apache.org/licenses/
4
+
5
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+ 1. Definitions.
8
+
9
+ "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
10
+
11
+ "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
12
+
13
+ "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
14
+
15
+ "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
16
+
17
+ "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
18
+
19
+ "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
20
+
21
+ "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
22
+
23
+ "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
24
+
25
+ "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
26
+
27
+ "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
28
+
29
+ 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
30
+
31
+ 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
32
+
33
+ 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
34
+
35
+ (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
36
+
37
+ (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
38
+
39
+ (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
40
+
41
+ (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
42
+
43
+ You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
44
+
45
+ 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
46
+
47
+ 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
48
+
49
+ 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
50
+
51
+ 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
52
+
53
+ 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
54
+
55
+ END OF TERMS AND CONDITIONS
56
+
57
+ APPENDIX: How to apply the Apache License to your work.
58
+
59
+ To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
60
+
61
+ Copyright [yyyy] [name of copyright owner]
62
+
63
+ Licensed under the Apache License, Version 2.0 (the "License");
64
+ you may not use this file except in compliance with the License.
65
+ You may obtain a copy of the License at
66
+
67
+ http://www.apache.org/licenses/LICENSE-2.0
68
+
69
+ Unless required by applicable law or agreed to in writing, software
70
+ distributed under the License is distributed on an "AS IS" BASIS,
71
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
72
+ See the License for the specific language governing permissions and
73
+ limitations under the License.
package/LICENSE-MIT ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Paul Irolla
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md CHANGED
@@ -1,478 +1,55 @@
1
- <div align="center">
2
-
3
1
  # Tokenade
4
2
 
5
- ### The #1 tool to cut your AI agent's token bill.
6
-
7
- **Ranked #1 on the [Token-Harness Optimizer Leaderboard](https://pi-infected.github.io/token-harness-optimizer-leaderboard/) — zero config.**
8
-
9
- **Tokenade is the simplest way to slash what your coding agent sends to the model.**
10
- Set it up once, save on every prompt — same results, a fraction of the tokens.
11
-
12
- **Freemium** — free with a free account (10M tokens/month, no credit card), upgrade only when you scale.
3
+ **Cut your AI coding agent's token bill — locally, automatically, on every prompt.**
13
4
 
14
- [![npm](https://img.shields.io/npm/v/@tokenade/cli?color=8b5cf6&label=%40tokenade%2Fcli&logo=npm)](https://www.npmjs.com/package/@tokenade/cli)
15
- [![platforms](https://img.shields.io/badge/platforms-Linux%20%C2%B7%20macOS%20%C2%B7%20Windows-2563eb)](https://tokenade.net)
16
- [![node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)](https://nodejs.org)
17
- [![free plan](https://img.shields.io/badge/free-10M%20tokens%2Fmo%2C%20no%20card-22c55e)](https://tokenade.net/signup)
18
-
19
- [**Start free**](https://tokenade.net/signup) &nbsp;·&nbsp; [**Pricing**](https://tokenade.net/pricing) &nbsp;·&nbsp; [**Dashboard**](https://tokenade.net/dashboard) &nbsp;·&nbsp; [**Report an issue**](https://github.com/pi-infected/tokenade-npm/issues)
20
-
21
- </div>
22
-
23
- ---
5
+ Open source (MIT OR Apache-2.0) · no account · no telemetry ·
6
+ **#1 on [THOL](https://tokenade.net/en/thol): 39% cheaper on long sessions.**
24
7
 
25
8
  ```sh
26
9
  npm install -g @tokenade/cli
27
- tokenade install # wires Tokenade into your coding agent automatically
28
- tokenade login # connect your free account (opens tokenade.net to approve this device)
29
- ```
30
-
31
- That's it — Tokenade is **free**, you just need a free account. After `tokenade login` it trims tokens on **every prompt**, in the background. No config, nothing to remember. Don't have an account yet? [Create one](https://tokenade.net/signup) — it's free (10M tokens/month, no credit card).
32
-
33
- ---
34
-
35
- ## Why Tokenade
36
-
37
- Your coding agent burns tokens on things the model never needed to see — whole files when one function mattered, 2,000-line build logs, every MCP tool definition on every turn. Tokenade strips that waste **before it reaches the model**, locally, automatically.
38
-
39
- > **Less tokens, same results — automatically, on every prompt.**
40
-
41
- ## What it does
42
-
43
- | Feature | What you get |
44
- |---|---|
45
- | **Semantic code search** | Finds the right files by *meaning*, so your agent reads only what matters — not your whole project. |
46
- | **Command optimization** | Trims long command outputs (logs, builds, tests) down to what counts before your agent ever sees them. |
47
- | **MCP optimization** | Loads only the MCP tools your agent actually needs, on demand — instead of every tool, every time. |
48
- | **Token dashboard** | See exactly how many tokens Tokenade saved you — clear numbers, no guesswork. |
49
- | **Free to start** | Save up to **10M tokens/month** on the free plan — unlimited machines, no credit card. |
50
- | **One-command install** | Ready in seconds. Connects to your agent automatically, with zero configuration. |
51
-
52
- ## Works with the agents you already use
53
-
54
- Every agent gets Tokenade's prompt- and CLI-level features — **code search**, **lean output**, **context optimization**, and **privacy** (fully local — your code never leaves your machine). What varies is how much of the agent's **tool output** Tokenade can reach (command output, web results, MCP tool outputs, file reads) — which drives **command compaction**, **web search** folding, **MCP optimization**, **re-read dedup**, and **security** (automatic secret redaction, which needs both command and file-read coverage).
55
-
56
- **Legend:** ✅ full · ◐ partial · — not available
57
-
58
- | Agent | Command compaction | Web search | MCP optimization | Code search | Lean output | Context opt.¹ | Re-read dedup | Privacy | Security² |
59
- |---|:--:|:--:|:--:|:--:|:--:|:--:|:--:|:--:|:--:|
60
- | **Claude Code CLI** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
61
- | **OpenCode** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
62
- | **Kilo Code** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
63
- | **Copilot CLI**³ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
64
- | **Hermes** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
65
- | **Cline** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
66
- | **T3 Code**⁴ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
67
- | **OpenClaw** | ✅ | ✅ | — | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
68
- | **Pi** | ✅ | ✅ | — | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
69
- | **Qwen Code** | ✅ | — | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
70
- | **Codex CLI** | ✅ | — | ✅ | ✅ | ✅ | ✅ | — | ✅ | — |
71
- | **Cursor** | ✅ | — | ✅ | ✅ | ✅ | ✅ | — | ✅ | — |
72
- | **Grok** | ✅ | — | ✅ | ✅ | ✅ | ✅ | — | ✅ | — |
73
- | **Droid** | ✅ | — | — | ✅ | ✅ | ✅ | — | ✅ | — |
74
- | **Aider** | ◐⁶ | — | — | ✅ | ✅ | ✅ | — | ✅ | — |
75
- | **Antigravity**⁵ | — | — | ✅ | ✅ | ✅ | ◐ | — | ✅ | — |
76
-
77
- <sub>¹ Batching and lean-output savings apply everywhere; prompt-cache trimming is available on Claude Code today. ² Automatic secret redaction requires both command and file-read coverage. ³ Copilot **CLI** — the VS Code Copilot extension is not covered. ⁴ Inherits full coverage from the Claude Code it runs on. ⁵ MCP-based integration: Tokenade compacts MCP tool outputs; the agent's native command/read/web tools aren't reachable. ⁶ **Aider** is wrap-only: command compaction is not automatic — run commands through `tokenade wrap …`.</sub>
78
-
79
- ### Command-line vs. desktop editions
80
- The table above is for each tool's **command-line edition** — that's where Tokenade attaches (hooks, config, shell). Desktop apps, on Windows, macOS and Linux:
81
-
82
- - **Claude Desktop — Code tab**: runs Claude Code itself, with your `~/.claude` settings, so it gets the **Claude Code** row above. `tokenade install` sets it up even when no separate `claude` command is installed.
83
- - **Claude Desktop — Chat**: only **MCP optimization** applies (`tokenade mcp-wrap install`): chat runs no local commands or file reads.
84
- - **Codex app** (the ChatGPT desktop app's Codex): runs Codex on your machine with your `~/.codex/config.toml`, so it gets the **Codex CLI** row through the LLM proxy, and MCP optimization through `mcp-wrap`.
85
- - **Claude Cowork**: **not supported** — it runs in an isolated environment that local tools can't reach.
86
-
87
- **Codex hooks need your approval.** Codex only runs hooks that you've approved in Codex. Until you do, Tokenade's LLM proxy carries compaction, style and secret redaction for Codex (CLI and app) and is set up automatically. Once you approve the hooks, they take over and the proxy only measures.
88
-
89
- ### Keeping your agent's own web search
90
- Some organisations want web queries to leave only through their AI vendor. Set `TOKENADE_NO_WEBSEARCH=1` in the agent's environment (for Claude Code: the `env` block of `~/.claude/settings.json`), and run `tokenade install` once with it set in your shell. Tokenade then no longer replaces or compacts the agent's web search, `tokenade search` refuses to run, and the rules Tokenade writes for the agent no longer mention it. Fetching pages is a separate switch: `TOKENADE_NO_WEBFETCH=1`.
91
-
92
- ## Install
93
-
94
- ```sh
95
- npm install -g @tokenade/cli
96
- ```
97
-
98
- The `postinstall` step downloads the prebuilt binary for your platform from the **signed release manifest** (`downloads.tokenade.net/manifest.json`) and verifies its **SHA‑256**. Nothing is run blindly — and the launcher in [`bin/tokenade.js`](bin/tokenade.js) and the installer in [`install.js`](install.js) are right here in this repo for you to inspect.
99
-
100
- **Supported:** Linux · macOS · Windows · x64 & arm64 · Node ≥ 18.
101
-
102
- ## Connect your account (required — browser, no key to type)
103
-
104
- ```sh
105
- tokenade login # opens tokenade.net so you (logged into your dashboard) approve this device
106
- ```
107
-
108
- Tokenade needs a free account. `tokenade login` links this machine to your dashboard and your plan's quota. No account yet? [Create one](https://tokenade.net/signup) — it's free.
109
-
110
- **Free** and **Pro** include **unlimited machines**; **Enterprise** is sized to your fleet. Manage machines anytime at [tokenade.net/dashboard](https://tokenade.net/dashboard).
111
-
112
- ## What leaves your machine
113
-
114
- **Nothing**, except anonymous token-savings counts and an update check. Tokenade runs **locally**; its agent hooks live in your editor/agent config — **inspectable and reversible**.
115
-
116
- ## Pricing
117
-
118
- | | **Free** | **Pro** | **Enterprise** |
119
- |---|---|---|---|
120
- | Token savings | Up to **10M / mo** | Up to **100M / mo** | **Unlimited** |
121
- | Machines | **Unlimited** | **Unlimited** | 3 (+ paid seats) |
122
- | All reduction features | ✓ | ✓ | ✓ |
123
- | Token-savings dashboard | ✓ | ✓ | ✓ |
124
- | Priority support | — | ✓ | ✓ |
125
- | Price | **$0** — no card | **$19.90/mo** — beyond the cap: optional pay-as-you-save at $0.20/M saved | **Contact us** — custom fleet |
126
- | | [Start free →](https://tokenade.net/signup) | [Go Pro →](https://tokenade.net/pricing) | [hello@tokenade.net](mailto:hello@tokenade.net) |
127
-
128
- ## Found a bug? Tell us!
129
-
130
- Tokenade is in **active beta** and your reports make it better — fast.
131
-
132
- - **Open an issue:** https://github.com/pi-infected/tokenade-npm/issues
133
- - **Join the beta testers on WhatsApp:** https://chat.whatsapp.com/JmBZxT41XB6AtQWgW9oNif
134
-
135
- When reporting, please include your OS, `tokenade --version`, your coding agent, and what you expected vs. what happened. The more detail, the faster we fix it.
136
-
137
- ---
138
-
139
- ## CLI reference — every command
140
-
141
- > **You rarely need any of these by hand.** After `tokenade install`, Tokenade works automatically through your agent's hooks. The CLI below is for power users, scripting, and inspection. Run `tokenade help` for the live list, and `tokenade <command> --help` where available.
142
-
143
- ### Setup & account
144
-
145
- | Command | What it does |
146
- |---|---|
147
- | `install` | Register Tokenade with your detected agent (hooks). Flags: `--only <agent>`, `--with-hook`, `--with-claude-md`, `--with-lsp-enforcement-hook`, `--with-brevity-skill`, `--dry-run`. |
148
- | `uninstall` | Remove the integration (restores wrapped MCP servers). `--dry-run` to preview. |
149
- | `login` | Activate via browser device-flow — no key to type. |
150
- | `activate <key>` | Link this machine to a tokenade.net license (free or paid) with a key. |
151
- | `upgrade` | Self-update in place (aliases: `self-update`). `--on`/`--off` toggles the 24h background updater. |
152
- | `healthcheck` | Diagnose the install (aliases: `health`, `doctor`). |
153
- | `detect` | Print the detected AI agent. |
154
- | `discover` | Scan `~/.claude` logs, surface top tools + install suggestions. |
155
- | `hooks <status\|tail [N]>` | Show installed hooks + recent activity / live tail. |
156
- | `statusline` | One-line summary for `~/.claude/settings.json` `statusLine`. |
157
- | `incompatibilities` | Check for other token tools that conflict with Tokenade and propose fixes (aliases: `competitors`, `scan`). |
158
-
159
- ### Code intelligence — read less, find faster
160
-
161
- | Command | What it does |
162
- |---|---|
163
- | `map` | Print a compact codebase structure map. |
164
- | `skeleton <file>` | Signatures-only skeleton of a file. |
165
- | `query <symbol>` | Locate a symbol without reading files. |
166
- | `impact <file>` | Refactor impact radius (dependents + symbols). |
167
- | `semantic <query>` | Hybrid BM25 + dense, framework-aware search (aliases: `ask`, `sem`). |
168
- | `index` | Build & cache the codebase symbol index. |
169
- | `watch` | Keep the index fresh: incremental reindex on every save. |
170
- | `measure` | Report agent-loaded-file startup-token cost. |
171
- | `review-context` | Token-budgeted code-review context (`--budget N`, `--base ref`). |
172
- | `pack` | Budget-bounded repo export, one fenced bundle (`--budget N`, `--diff`, `--out FILE`). |
173
- | `semantic-status` | Per-project state of `~/.tokenade/semantic.db`. |
174
-
175
- ### Run commands through compaction
176
-
177
- | Command | What it does |
178
- |---|---|
179
- | `wrap <cmd>` | Run a command through the auto-detected compactor (default for noisy commands). |
180
- | `raw <cmd...>` | Run a command **without** compaction (aliases: `bypass`, `noproxy`). |
181
- | `filter <cmd...>` | Filter stdin as if it were produced by `<cmd>`. |
182
- | `execute --lang L --script CODE` | Sandboxed "think-in-code" runner (bash/python/node/jq/awk/ruby/perl) — returns only stdout, redacted + compacted, keeps raw data out of context. |
183
- | `shell-init` | Print the shell proxy fragment for your shell (`--shell …`, `--all`). |
184
- | `shellwrap` | TTY-aware alias target for csh/tcsh + cmd.exe. |
185
-
186
- ### Read & compact content
187
-
188
- `read <file|->` is the content entry point: it auto-detects a blob's format and
189
- dispatches to the right compactor. Point it at a file (or `-` for stdin) carrying
190
- JSON, YAML, CSV/TSV, NDJSON, logs, unified diffs, stack traces, env dumps,
191
- markdown, lockfiles, SQL, OpenAPI/GraphQL, build & CI output, and many more —
192
- the format is detected automatically. Live command output is compacted the same
193
- way through `wrap`.
194
-
195
- | Command | What it does |
196
- |---|---|
197
- | `read <file\|->` | Auto-detect a blob's format and compact it (**the content entry point**). |
198
- | `web <file\|->` | Compact an HTML page → markdown (real web content). |
199
- | `serp <file\|->` | Compact raw SERP HTML (aliases: `google`/`bing`/`ddg`). |
200
- | `snapshot <file\|->` | Compact a Playwright accessibility-tree snapshot. |
201
-
202
- **Your own compactors.** `add-compactor --file <rules.toml>` teaches Tokenade to fold output from a command it doesn't cover yet (alias `add-filter`); `add-compactor --list` shows the ones you've added, and `add-compactor --help` prints the file format. Filters shipped INSIDE a repo (`.tokenade/filters/`) apply only after you approve them once with `trust-filters` — a cloned project can't silently rewrite your outputs.
203
-
204
- ### Savings, receipts & reporting
205
-
206
- | Command | What it does |
207
- |---|---|
208
- | `gain` | Cumulative token savings (`--json`, `--history`, `--by-source`). |
209
- | `dashboard` | Screenshot-ready savings overview (aliases: `dash`, `stats`; `--html`/`--json`). |
210
- | `receipt` | Signed, tamper-evident savings receipt over the local ledger (`--verify <file>`). |
211
- | `cache-note` | Prompt-cache-aware framing of savings (net vs gross). |
212
- | `mcp-stats` | MCP manifest rollup (servers/wrapped) + token-aware skills index. |
213
- | `report` | Share redacted Tokenade + agent logs (consent-gated, typed phrase) to improve compression (`--dry-run`, `--message`, `--accept`). |
214
-
215
- ### Recovery & disclosure — get folded bytes back
216
-
217
- | Command | What it does |
218
- |---|---|
219
- | `expand-ref <hash>` | Re-emit the verbatim bytes a compactor folded, by hash (alias: `xref`). |
220
- | `expand-fold <id>` | Expand a folded log run back to its raw lines (alias: `xfold`). |
221
- | `disclose <stash\|read\|search>` | Progressive disclosure: stash a big blob to a file, read/search by hash. |
222
- | `search-stash <hash> <query>` | Fuzzy / natural-language recall within a stashed blob (BM25). |
223
- | `turn-summary` | Extractive summary of a conversation turn (`--max N`). |
224
-
225
- ### Security & maintenance
226
-
227
- | Command | What it does |
228
- |---|---|
229
- | `scrub-secret <substring>` | **Emergency:** purge a leaked credential from all Tokenade-owned files + caches (`--dry-run`). |
230
- | `scrub-cache` | Re-apply built-in redaction patterns to every persisted byte (use after upgrade). |
231
- | `redact <file…>` | Redact secret-shaped values to `<redacted>` in any file (`--in-place`, `--dry-run`). Streams line-by-line, idempotent. |
232
- | `evict-stale` | Prune 7-day-stale cache rows + zero-saved noise, then VACUUM to reclaim disk. |
233
- | `mistake <list\|add\|from-revert>` | Persistent "bad direction" memory (records git reverts). |
234
- | `audit-claude-md [DIR]` | Audit the `CLAUDE.md` cascade for bloat + cross-file dupes (alias: `claudemd`). |
235
-
236
- ### Agent integration & config
237
-
238
- | Command | What it does |
239
- |---|---|
240
- | `style <chat\|coding\|off>` | Response-style preamble injected before each prompt. |
241
- | `read-mode` | Show the active fold read-mode ladder (`TOKENADE_READ_MODE`). |
242
- | `unwrap-mcps` | Restore wrapped MCP servers to their original form (idempotent). |
243
- | `mcp-proxy <bin>` | Transparent JSON-RPC proxy in front of an MCP server (written by `install`; internal). |
244
- | `--version` | Print the installed version. |
245
-
246
- > **User presets:** drop TOML files in `~/.config/tokenade/presets/` to add command-rewrite rules for your own CLIs (helm, ansible, internal scripts).
247
-
248
- ---
249
-
250
- ## Examples & recipes
251
-
252
- Real commands, real (trimmed) output — so both humans **and coding agents** know exactly what each command does and when to reach for it. `read` (and every format-aware entry point) reads a file **or `-` for stdin**, so you can pipe: `some-noisy-cmd | tokenade read -`.
253
-
254
- ### Setup & account
255
-
256
- **`install`** — wire Tokenade into your agent (run once).
257
- ```text
258
- $ tokenade install
259
- ✓ detected agent: claude-code
260
- ✓ hooks registered in ~/.claude/settings.json (Bash|Read + Edit/Write)
261
- ✓ shell proxy added to ~/.zshrc
262
- ── Incompatible tools — suggested fixes ── # only if any are found
263
- ✓ install complete — token savings start on your next prompt.
264
- ```
265
-
266
- **`login`** — authorize this machine in your browser (no key to paste).
267
- ```text
268
- $ tokenade login
269
- → opening https://tokenade.net/device?code=ABCD-1234 …
270
- ✓ this machine is now linked to your account (plan: free).
271
- ```
272
-
273
- **`activate <key>`** — link a machine with a license key instead of the browser.
274
- ```text
275
- $ tokenade activate tk_live_xxx
276
- ✓ activated — plan: pro · unlimited machines.
277
- ```
278
-
279
- **`healthcheck`** (aliases `health`, `doctor`) — confirm everything is wired.
280
- ```text
281
- $ tokenade healthcheck
282
- ─── tokenade healthcheck ───
283
- OK binary at ~/.local/bin/tokenade (0.6.2)
284
- OK gain ledger writable at ~/.tokenade/gain.jsonl
285
- OK license active — plan: pro
286
- OK agent detected: claude-code
287
- OK hookwrap found in ~/.claude/settings.json
288
- all checks passed
289
- ```
290
-
291
- **`detect`** — print the detected agent. **`discover`** — scan your logs and suggest installs. **`hooks status`** — show installed hooks. **`statusline`** — one line for your editor status bar. **`upgrade`** — self-update; **`uninstall`** — remove cleanly.
292
- ```text
293
- $ tokenade detect
294
- claude-code
295
- ```
296
-
297
- **`incompatibilities`** (aliases `competitors`, `scan`) — find other token tools that conflict with Tokenade and propose fixes.
298
- ```text
299
- $ tokenade incompatibilities
300
- ── Found 1 potentially incompatible tool(s) ──
301
-
302
- [redundant] rtk
303
- Output-filtering CLI proxy (filters/compresses bash output)
304
- → binary at ~/.cargo/bin/rtk
305
- fix: Tokenade subsumes rtk: `tokenade wrap '<cmd>'` does the same AND
306
- auto-detects 48 formats — usually with better savings.
307
-
308
- Run `tokenade install` to interactively migrate & fix the [redundant] /
309
- [overlapping] tools (the fix-up pass is on by default; opt out with `--no-cleanup`).
310
- ```
311
-
312
- ### Code intelligence — read less, find faster
313
-
314
- **`map`** — get the lay of the land without reading anything.
315
- ```text
316
- $ tokenade map
317
- 4722 files, 49898 symbols indexed
318
- by directory:
319
- crates/tokenade-core/src/ 140 files, 4802 symbols
320
- crates/tokenade-core/src/cmd/ 2637 files, 25741 symbols
321
- crates/tokenade-cli/src/ 12 files, 1188 symbols
322
- ```
323
-
324
- **`skeleton <file>`** — see a file's shape (signatures only), not its body.
325
- ```text
326
- $ tokenade skeleton crates/tokenade-core/src/redact.rs
327
- use regex::Regex;
328
- // … 3 lines …
329
- pub fn redact(s: &str) -> String {
330
- // … 8 lines …
331
- pub fn redact_argv(argv: &[String]) -> Vec<String> {
332
- struct PatternSet {
333
- ```
334
-
335
- **`query <symbol>`** — jump straight to where a symbol is defined.
336
- ```text
337
- $ tokenade query redact
338
- module redact — crates/tokenade-core/src/lib.rs:137
339
- fn redact — crates/tokenade-core/src/redact.rs:28
340
- fn redact_argv — crates/tokenade-core/src/redact.rs:38
341
- ```
342
-
343
- **`impact <file>`** — before a refactor, see what depends on it.
344
- ```text
345
- $ tokenade impact crates/tokenade-core/src/redact.rs
346
- crates/tokenade-core/src/redact.rs declares (47 symbols): fn redact, redact_argv, …
347
- dependents (3):
348
- crates/tokenade-core/src/debug_log.rs
349
- crates/tokenade-core/src/sandbox.rs
350
- crates/tokenade-core/tests/proptest_compactors.rs
10
+ tokenade install # detects your coding agents and wires Tokenade in
11
+ tokenade healthcheck # optional: verify the wiring
351
12
  ```
352
13
 
353
- **`semantic "<query>"`** (aliases `ask`, `sem`) — find code by meaning, not by string match.
354
- ```text
355
- $ tokenade semantic "where do we redact secrets before logging"
356
- 1. crates/tokenade-core/src/redact.rs:28 fn redact — applies all secret patterns
357
- 2. crates/tokenade-core/src/gain.rs:231 record_inner — redacts label before write
358
- ```
359
-
360
- **`measure`** — see the per-session token cost of your agent-loaded files (CLAUDE.md, etc.).
361
- ```text
362
- $ tokenade measure
363
- file tokens
364
- CLAUDE.md 642
365
- AGENTS.md 385
366
- PER SESSION (one agent loads one) 642
367
- ```
368
-
369
- Also: **`index`** (build the cache up front) · **`watch`** (keep it fresh on save) · **`review-context --base main`** (budget-bounded diff context for reviews) · **`pack --budget 8000`** (export a repo slice as one bundle) · **`semantic-status`** (index state).
370
-
371
- ### Run commands through compaction
372
-
373
- **`wrap <cmd>`** — the default: run any noisy command, get the compacted output.
374
- ```text
375
- $ tokenade wrap 'kubectl get pods -A'
376
- NAMESPACE NAME READY STATUS RESTARTS AGE
377
- default web-xx 1/1 Running 0 2h
378
- … 47 rows · grouped by status: Running=46, Pending=1
379
- ```
380
-
381
- **`execute --lang <L> --script <code>`** — "think in code": run a snippet in a sandbox, get **only stdout** back (raw data never enters your context).
382
- ```text
383
- $ tokenade execute --lang python --script 'print(sum(range(101)))'
384
- 5050
385
- ```
386
-
387
- **`raw <cmd…>`** — run *without* compaction (escape hatch). **`filter <cmd…>`** — treat stdin as if produced by `<cmd>`. **`shell-init`** — print the shell fragment that auto-wraps noisy commands:
388
- ```text
389
- $ eval "$(tokenade shell-init)" # add to ~/.zshrc — git/cargo/kubectl/… auto-compact
390
- ```
391
-
392
- ### Read & compact content
14
+ That's it: Tokenade now trims what your agent sends to the model — noisy
15
+ command output, re-reads, verbose MCP payloads, whole-file reads — and keeps
16
+ every folded byte recoverable (`tokenade expand-ref <hash>`).
393
17
 
394
- `read` auto-detects a blob's format and dispatches to the right compactor.
395
- It reads a file or `-` (stdin); live command output is folded the same way
396
- through `wrap`:
18
+ Works with Claude Code, OpenCode, Kilo Code, Copilot CLI, Hermes, Cline,
19
+ T3 Code, OpenClaw, Pi, Qwen Code, Codex (CLI and app), Cursor, Grok, Droid,
20
+ Aider and Antigravity — see the
21
+ [supported-agents section](https://github.com/pi-infected/tokenade#supported-agents)
22
+ for what each one gets.
397
23
 
398
- ```sh
399
- tokenade read <file> # auto-detect and compact
400
- some-noisy-cmd | tokenade read - # …or pipe stdin
401
-
402
- tokenade add-compactor --file my-rules.toml # teach Tokenade a new compactor
403
- tokenade add-compactor --list # list the ones you've added
404
- tokenade trust-filters # approve a repo's bundled filters
405
- ```
24
+ ## How this package installs the binary
406
25
 
407
- ### Savings, receipts & reporting
26
+ The binary for your platform comes from a per-platform optional dependency
27
+ (`@tokenade/cli-<os>-<cpu>[-musl]`). If npm skipped it (`--no-optional`, an
28
+ unusual platform), `postinstall` downloads
29
+ `tokenade-<version>-<target>.tar.gz` from the
30
+ [GitHub Release](https://github.com/pi-infected/tokenade/releases) of the same
31
+ version, after verifying the release's `manifest.json` against its Ed25519
32
+ signature and the archive against the SHA-256 listed there.
33
+ `TOKENADE_DOWNLOADS_BASE` points that fallback at a mirror serving the same
34
+ files. Behind a proxy, set `HTTPS_PROXY`.
408
35
 
409
- **`gain`** — how many tokens you've saved.
410
- ```text
411
- $ tokenade gain
412
- operations: 136
413
- tokens: 1,333,261 → 99,204
414
- saved: 1,234,057 (92.6%)
415
- by op: auto:json 9× −36% · auto-compact 4× −96% · …
416
- ```
36
+ Linux (x64 glibc/musl, arm64) · macOS (x64, arm64) · Windows (x64, arm64) ·
37
+ Node ≥ 18.
417
38
 
418
- **`dashboard`** (aliases `dash`, `stats`) — the big-picture banner (`--html` / `--json`).
419
- ```text
420
- $ tokenade dashboard
421
- 25.5M measured · 97.9% · 1571 ops
422
- ```
423
-
424
- **`receipt`** — a signed, tamper-evident savings receipt (`--verify <file>` to check one). **`cache-note --saved N`** — frames savings honestly (net vs gross of prompt-cache). **`mcp-stats`** — rollup of your MCP servers + skills index.
425
-
426
- **`report`** — share redacted logs (consent-gated) so we can improve compression. A typed-phrase contract is required before anything leaves your machine; `--dry-run` packs locally and uploads nothing.
427
- ```text
428
- $ tokenade report --dry-run
429
- collected 42 transcripts since install · redacted 17 secrets
430
- wrote ~/.tokenade/last-report.zip (4.2 MB) — nothing uploaded
431
- ```
432
-
433
- ### Recovery & disclosure — get folded bytes back
434
-
435
- Compaction is never lossy-by-surprise: every fold is recoverable.
436
- ```text
437
- $ tokenade expand-ref 927a921273b2 # re-emit the exact bytes a banner folded
438
- $ tokenade expand-fold app-3f2a # expand one folded log run to raw lines
439
- $ tokenade disclose read <hash> # read a stashed big blob
440
- $ tokenade search-stash <hash> "timeout" # fuzzy recall inside a stash
441
- $ tokenade turn-summary --max 5 chat.txt # top-5 salient sentences of a turn
442
- ```
443
-
444
- ### Security & maintenance
445
-
446
- ```text
447
- $ tokenade scrub-secret 'ak_98_leakedkey' --dry-run # purge a leaked credential everywhere
448
- $ tokenade scrub-cache # re-apply redaction to all persisted bytes (after upgrade)
449
- $ tokenade redact secrets.log --dry-run # count secret-shaped values in a file; write nothing
450
- $ tokenade evict-stale # prune 7-day-stale cache rows + VACUUM
451
- $ tokenade audit-claude-md # find bloat + dupes across your CLAUDE.md cascade
452
- $ tokenade mistake from-revert # record a 'bad direction' from a git revert
453
- ```
454
-
455
- ### Agent integration & config
456
-
457
- **`read-mode`** — show (and tune via `TOKENADE_READ_MODE`) how aggressively file reads are folded.
458
- ```text
459
- $ tokenade read-mode
460
- active: task (default)
461
- ladder: aggressive 0.4× · → task 1.0× · reference 3.0× · entropy
462
- ```
463
-
464
- **`style <chat|coding|off>`** — inject a response-style preamble before each prompt. **`unwrap-mcps`** — restore wrapped MCP servers. **`--version`** — print the version.
465
- ```text
466
- $ tokenade style coding # terse, code-first replies
467
- current style: coding
468
- ```
39
+ ## Privacy
469
40
 
470
- > **User-defined presets:** drop TOML files in `~/.config/tokenade/presets/` to teach Tokenade your own CLIs (helm, ansible, internal scripts) — same compaction, your commands.
41
+ Nothing leaves your machine except what you ask for (`tokenade web`,
42
+ `tokenade search`), the one-time embedding-model download, and a daily signed
43
+ update check against GitHub Releases. Disable auto-update with
44
+ `TOKENADE_NO_AUTO_UPDATE=1` or `tokenade upgrade --off`.
471
45
 
472
- ---
46
+ ## Upgrading from 1.x
473
47
 
474
- <div align="center">
48
+ `npm i -g @tokenade/cli@latest`. On first run 2.0 removes the old licence and
49
+ usage-report files under `~/.tokenade` and keeps your savings history.
475
50
 
476
- **[tokenade.net](https://tokenade.net)** · Made for people who'd rather spend tokens on shipping than on overhead.
51
+ ## Links
477
52
 
478
- </div>
53
+ - Source, issues, docs: <https://github.com/pi-infected/tokenade>
54
+ - Changes: [PATCHNOTES.md](https://github.com/pi-infected/tokenade/blob/main/PATCHNOTES.md)
55
+ - License: MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`)
package/install.js CHANGED
@@ -1,12 +1,19 @@
1
1
  #!/usr/bin/env node
2
2
  /**
3
- * postinstall — download the prebuilt Tokenade binary for this platform from
4
- * the signed release manifest, verify its SHA-256, and drop `tokenade`
5
- * into ./vendor. The bin shim in ./bin execs it.
3
+ * postinstall — make sure a Tokenade binary for this platform is present.
6
4
  *
7
- * Closed-source commercial binary, distributed via the npm registry (the trust
8
- * anchor) — same pattern as esbuild/biome/swc. Nothing is executed blindly:
9
- * the checksum comes from downloads.tokenade.net/manifest.json.
5
+ * 1. Fast path: the matching per-platform package (@tokenade/cli-<os>-<cpu>,
6
+ * an optionalDependency) already carries the binary — nothing to download.
7
+ * 2. Fallback (optional deps skipped, or no registry build): download the
8
+ * release archive from the GitHub Release of THIS package version,
9
+ * `https://github.com/pi-infected/tokenade/releases/download/v<version>/`,
10
+ * after checking the release's `manifest.json` against its Ed25519
11
+ * signature (`manifest.json.sig`, same key the CLI's updater trusts) and the
12
+ * archive against the SHA-256 that signed manifest lists.
13
+ *
14
+ * `TOKENADE_DOWNLOADS_BASE` points the fallback at a mirror that serves the
15
+ * same files (`manifest.json`, `manifest.json.sig`, `tokenade-<v>-<target>.tar.gz`).
16
+ * `TOKENADE_UPDATE_PUBKEY_HEX` replaces the embedded public key (test rigs).
10
17
  *
11
18
  * Network robustness (why this file is more than a one-liner): a postinstall
12
19
  * runs on whatever machine `npm install` runs on — corporate laptops behind a
@@ -33,9 +40,18 @@ const {
33
40
  binaryName,
34
41
  } = require("./platform.js");
35
42
 
36
- const DOWNLOADS_BASE =
37
- process.env.TOKENADE_DOWNLOADS_BASE || "https://downloads.tokenade.net";
43
+ const { version: PKG_VERSION } = require("./package.json");
44
+
45
+ const RELEASES = "https://github.com/pi-infected/tokenade/releases";
46
+ const DOWNLOADS_BASE = (
47
+ process.env.TOKENADE_DOWNLOADS_BASE || `${RELEASES}/download/v${PKG_VERSION}`
48
+ ).replace(/\/+$/, "");
38
49
  const MANIFEST_URL = `${DOWNLOADS_BASE}/manifest.json`;
50
+
51
+ // Release-signing public key (Ed25519, raw 32 bytes hex). Must equal
52
+ // `RELEASE_PUBKEY_HEX` in crates/tk-base/src/signing.rs.
53
+ const RELEASE_PUBKEY_HEX =
54
+ "088950e7ee18e9968f12276d5d6351ad120c47e95ea63eb4958d3da206f2f31f";
39
55
  const VENDOR = path.join(__dirname, "vendor");
40
56
 
41
57
  // Leading-byte format sniff. SHA-256 proves the bytes match what the manifest
@@ -216,7 +232,7 @@ function get(targetUrl, redirects = 0) {
216
232
  });
217
233
  req = connectReq;
218
234
  } else {
219
- req = https.get(targetUrl, onResponse);
235
+ req = (new URL(targetUrl).protocol === "http:" ? http : https).get(targetUrl, onResponse);
220
236
  }
221
237
  req.on("error", reject);
222
238
  req.setTimeout(REQUEST_TIMEOUT_MS, () => {
@@ -257,13 +273,39 @@ async function withRetry(label, fn) {
257
273
  throw lastErr;
258
274
  }
259
275
 
260
- async function fetchJson(url) {
261
- return withRetry("manifest fetch", async () => {
276
+ async function fetchBytes(url) {
277
+ return withRetry("fetch", async () => {
262
278
  const res = await get(url);
263
279
  const chunks = [];
264
280
  for await (const c of res) chunks.push(c);
265
- return JSON.parse(Buffer.concat(chunks).toString("utf8"));
281
+ return Buffer.concat(chunks);
282
+ });
283
+ }
284
+
285
+ // Verify the detached Ed25519 signature (base64url, as written by
286
+ // scripts/ci/manifest.mjs) over the manifest's exact bytes, then parse it.
287
+ function verifyManifest(bytes, sigText) {
288
+ const hex = (process.env.TOKENADE_UPDATE_PUBKEY_HEX || "").trim() || RELEASE_PUBKEY_HEX;
289
+ const raw = Buffer.from(hex, "hex");
290
+ if (raw.length !== 32) throw new Error("release public key must be 32 bytes hex");
291
+ const key = crypto.createPublicKey({
292
+ key: Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]),
293
+ format: "der",
294
+ type: "spki",
266
295
  });
296
+ const sig = Buffer.from(sigText.trim().replace(/=+$/, ""), "base64url");
297
+ if (sig.length !== 64 || !crypto.verify(null, bytes, key, sig)) {
298
+ throw new Error("manifest signature does not verify — refusing to install");
299
+ }
300
+ return JSON.parse(bytes.toString("utf8"));
301
+ }
302
+
303
+ async function fetchSignedManifest() {
304
+ const [bytes, sig] = await Promise.all([
305
+ fetchBytes(MANIFEST_URL),
306
+ fetchBytes(`${MANIFEST_URL}.sig`),
307
+ ]);
308
+ return verifyManifest(bytes, sig.toString("utf8"));
267
309
  }
268
310
 
269
311
  async function downloadTo(url, dest) {
@@ -289,7 +331,7 @@ async function main() {
289
331
  // It arrives one of two ways — the matching per-platform optionalDependency
290
332
  // npm just installed from the registry, or a ./vendor copy from a previous
291
333
  // run. Either way postinstall is a clean no-op. Crucially this returns
292
- // BEFORE any network call, so an unreachable downloads.tokenade.net (blocked
334
+ // BEFORE any network call, so an unreachable release host (blocked
293
335
  // corporate proxy, offline sandbox) can never fail an install whose binary
294
336
  // the registry already delivered.
295
337
  let platPkgDir = null;
@@ -323,11 +365,14 @@ async function main() {
323
365
  }
324
366
  }
325
367
 
326
- const manifest = await fetchJson(MANIFEST_URL);
368
+ const manifest = await fetchSignedManifest();
327
369
  const entry = manifest.targets && manifest.targets[target];
328
370
  if (!entry || !entry.url || !entry.sha256) {
329
371
  throw new Error(`no published build for ${target}`);
330
372
  }
373
+ // Download from DOWNLOADS_BASE (the release, or the mirror the user set),
374
+ // by the asset name the signed manifest gives; the SHA-256 is what binds it.
375
+ const assetUrl = `${DOWNLOADS_BASE}/${entry.url.split(/[?#]/, 1)[0].split("/").pop()}`;
331
376
 
332
377
  // Derive the temp filename from the URL's path only. The download URL
333
378
  // carries a cache-buster query string (…tar.gz?b=<hash>); `?` and the
@@ -342,7 +387,7 @@ async function main() {
342
387
  "_",
343
388
  );
344
389
  const tmp = path.join(os.tmpdir(), `tokenade-${process.pid}-${safeBase}`);
345
- const got = await downloadTo(entry.url, tmp);
390
+ const got = await downloadTo(assetUrl, tmp);
346
391
  if (got !== entry.sha256) {
347
392
  fs.rmSync(tmp, { force: true });
348
393
  throw new Error(
@@ -404,10 +449,7 @@ async function main() {
404
449
  assertRunnable(path.join(VENDOR, binaryName()), `tokenade ${manifest.version}`);
405
450
 
406
451
  console.log(`✓ tokenade ${manifest.version} installed (${target})`);
407
- console.log(" Next: run `tokenade install` — that's it, savings start immediately.");
408
- console.log(
409
- " 10M free tokens included, no account needed. `tokenade healthcheck` verifies the wiring.",
410
- );
452
+ console.log(" Next: run `tokenade install` to wire it into your coding agent; `tokenade healthcheck` verifies the wiring.");
411
453
  }
412
454
 
413
455
  main().catch((err) => {
@@ -425,7 +467,7 @@ main().catch((err) => {
425
467
  if (proxy) console.error(` via proxy ${redact(proxy)}`);
426
468
  console.error(` manifest ${MANIFEST_URL}`);
427
469
  console.error(
428
- " Retry; if you're behind a corporate proxy set HTTPS_PROXY, or download manually from https://downloads.tokenade.net",
470
+ ` Retry; if you're behind a corporate proxy set HTTPS_PROXY, or download manually from ${RELEASES}`,
429
471
  );
430
472
  process.exit(1);
431
473
  });
package/package.json CHANGED
@@ -1,13 +1,23 @@
1
1
  {
2
2
  "name": "@tokenade/cli",
3
- "version": "1.2.4",
4
- "description": "Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).",
3
+ "version": "2.0.0",
4
+ "description": "Tokenade — cut your AI coding agent's token bill. Installs the open-source Tokenade CLI (local token reduction for Claude Code, Codex, Cursor, Copilot and more).",
5
5
  "homepage": "https://tokenade.net",
6
- "license": "SEE LICENSE IN LICENSE",
6
+ "repository": {
7
+ "type": "git",
8
+ "url": "git+https://github.com/pi-infected/tokenade.git",
9
+ "directory": "npm"
10
+ },
11
+ "bugs": {
12
+ "url": "https://github.com/pi-infected/tokenade/issues"
13
+ },
14
+ "license": "MIT OR Apache-2.0",
15
+ "author": "Paul Irolla",
7
16
  "bin": {
8
17
  "tokenade": "bin/tokenade.js"
9
18
  },
10
19
  "scripts": {
20
+ "prepack": "node -e \"for (const f of ['LICENSE-MIT','LICENSE-APACHE']) require('fs').copyFileSync('../'+f, f)\"",
11
21
  "postinstall": "node install.js",
12
22
  "preuninstall": "node uninstall.js"
13
23
  },
@@ -15,13 +25,13 @@
15
25
  "tar": "^7.5.16"
16
26
  },
17
27
  "optionalDependencies": {
18
- "@tokenade/cli-linux-x64": "1.2.4",
19
- "@tokenade/cli-linux-x64-musl": "1.2.4",
20
- "@tokenade/cli-linux-arm64-musl": "1.2.4",
21
- "@tokenade/cli-darwin-arm64": "1.2.4",
22
- "@tokenade/cli-darwin-x64": "1.2.4",
23
- "@tokenade/cli-win32-x64": "1.2.4",
24
- "@tokenade/cli-win32-arm64": "1.2.4"
28
+ "@tokenade/cli-linux-x64": "2.0.0",
29
+ "@tokenade/cli-linux-x64-musl": "2.0.0",
30
+ "@tokenade/cli-linux-arm64-musl": "2.0.0",
31
+ "@tokenade/cli-darwin-arm64": "2.0.0",
32
+ "@tokenade/cli-darwin-x64": "2.0.0",
33
+ "@tokenade/cli-win32-x64": "2.0.0",
34
+ "@tokenade/cli-win32-arm64": "2.0.0"
25
35
  },
26
36
  "files": [
27
37
  "bin/",
@@ -29,7 +39,8 @@
29
39
  "install.js",
30
40
  "uninstall.js",
31
41
  "README.md",
32
- "LICENSE"
42
+ "LICENSE-MIT",
43
+ "LICENSE-APACHE"
33
44
  ],
34
45
  "engines": {
35
46
  "node": ">=18"
@@ -56,6 +67,5 @@
56
67
  "access": "public"
57
68
  },
58
69
  "main": "install.js",
59
- "author": "",
60
70
  "type": "commonjs"
61
71
  }
package/LICENSE DELETED
@@ -1,100 +0,0 @@
1
- Tokenade Commercial License
2
- (End User License Agreement)
3
-
4
- Copyright (c) Tokenade. All rights reserved.
5
-
6
- Tokenade is proprietary software. This repository contains the public npm
7
- launcher and installer for the Tokenade CLI, published for transparency and
8
- inspection: the files here (`bin/tokenade.js`, `install.js`, `platform.js`,
9
- `package.json`) may be read and audited freely.
10
-
11
- The Tokenade CLI binary itself is NOT distributed in this repository — it is
12
- downloaded at install time from the signed release manifest at
13
- https://downloads.tokenade.net and verified by SHA-256.
14
-
15
- "Software" below means the Tokenade CLI, the npm package `@tokenade/cli`, the
16
- binaries published by Tokenade, and any accompanying files.
17
-
18
- By installing or using the Software, you accept this Agreement. If you do not
19
- accept it, do not install or use the Software.
20
-
21
-
22
- 1. LICENCE GRANT
23
-
24
- Tokenade grants you a non-exclusive, revocable licence to install and use the
25
- Software, subject to the terms below and to the limits of the plan associated
26
- with your Tokenade account.
27
-
28
-
29
- 2. REDISTRIBUTION
30
-
31
- You may copy and share the Software as published by Tokenade, provided it is
32
- complete and unmodified. Any copy you share remains subject to this Agreement,
33
- and the recipient must use it under their own Tokenade account and plan.
34
-
35
-
36
- 3. RESTRICTIONS
37
-
38
- You may not:
39
-
40
- (a) modify, adapt, patch, translate or create derivative works of the
41
- Software, or of any binary published by Tokenade;
42
-
43
- (b) reverse engineer, decompile, disassemble, or otherwise attempt to derive
44
- the source code, algorithms or internal design of the Software, except to
45
- the extent this restriction cannot be enforced under applicable law;
46
-
47
- (c) circumvent, disable, tamper with or attempt to defeat any licensing,
48
- activation, authentication, quota, metering or entitlement mechanism, or
49
- by any means obtain features, capacity or a plan tier other than the one
50
- your account is entitled to;
51
-
52
- (d) remove, obscure or alter any copyright, trademark or licence notice.
53
-
54
-
55
- 4. ACCOUNTS AND PLANS
56
-
57
- Use of the Software requires a Tokenade account. Entitlements, quotas and plan
58
- limits are determined and enforced by Tokenade and may change for future
59
- releases. Obtaining, or attempting to obtain, entitlements you have not been
60
- granted is a breach of Section 3(c).
61
-
62
-
63
- 5. NO WARRANTY
64
-
65
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
66
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
67
- FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT. TOKENADE DOES NOT
68
- WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT IT WILL
69
- PRODUCE ANY PARTICULAR RESULT.
70
-
71
-
72
- 6. LIMITATION OF LIABILITY
73
-
74
- TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, TOKENADE SHALL NOT BE LIABLE
75
- FOR ANY CLAIM, DAMAGE OR OTHER LIABILITY — WHETHER DIRECT, INDIRECT, INCIDENTAL,
76
- SPECIAL, CONSEQUENTIAL OR EXEMPLARY, AND INCLUDING WITHOUT LIMITATION LOSS OF
77
- DATA, LOSS OF PROFITS, OR BUSINESS INTERRUPTION — ARISING FROM OR IN CONNECTION
78
- WITH THE SOFTWARE, ITS USE, OR ANY INABILITY TO USE IT.
79
-
80
- You are solely responsible for the consequences of using the Software. Tokenade
81
- operates alongside AI coding agents and changes what those agents send and
82
- receive; you remain responsible for reviewing their output and for any action
83
- taken on your systems or data as a result.
84
-
85
-
86
- 7. TERMINATION
87
-
88
- This licence terminates automatically if you breach any of its terms. On
89
- termination you must stop using the Software and delete all copies in your
90
- possession. Sections 5, 6 and 7 survive termination.
91
-
92
-
93
- 8. GENERAL
94
-
95
- If any provision of this Agreement is held unenforceable, the remaining
96
- provisions stay in full force. A failure by Tokenade to enforce any provision
97
- is not a waiver of it.
98
-
99
- Licensing questions: https://tokenade.net
100
- Issues: https://github.com/pi-infected/tokenade-npm/issues