@tokmizer/plugin 0.9.65 → 0.9.66

package/dist/native/manifest.json

@@ -1,32 +1,32 @@
 {
   "darwin-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "file": "tkr-exec-darwin-arm64",
-    "sha256": "a3c4ec4ee900156fe262e64c4bb1769917901c92c2d909d5c4af0546c47d7dc0"
+    "sha256": "fcd2ced9066aede941b8605011512364e9dcd3d2f61b2e94d45ce119aff59d18"
   },
   "darwin-x64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "file": "tkr-exec-darwin-x64",
-    "sha256": "6d2cf0aa5ed73af8f55bab6e3277143043ba677ca701498ff7a8cb759d347bcd"
+    "sha256": "b342270fc372bf1b96cf764f6295884e120c10fcc5b535c1b98528fd825b6a96"
   },
   "linux-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "file": "tkr-exec-linux-arm64",
-    "sha256": "9073379a74db2a8effb04596123587c065073732169c993356a5b5b67aafd1d3"
+    "sha256": "552de68d8873d429b849c30c93437a9c67f9d4bee1fa594f7f490f42f246a26b"
   },
   "linux-x64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "file": "tkr-exec-linux-x64",
-    "sha256": "6aa518a4bcbba9b9c6c4a31ac09fcb0ae12b1e6a3aa4de61b2df90031c060832"
+    "sha256": "c7072b61ea57f4b695f46a5cd2fdafbcdf582068ff04b4f6cb175539a4e15724"
   },
   "win32-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "file": "tkr-exec-win32-arm64.exe",
-    "sha256": "678de126a05f5318903dbe1b93ae95c7013b34f628aca3d6858224dfd7beb189"
+    "sha256": "53cf4ba88286f253730faeace27a252cb8ee172afca7e4f7c76348f6887bd84b"
   },
   "win32-x64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "file": "tkr-exec-win32-x64.exe",
-    "sha256": "745cbc65d1c33bdf635d395c89cea182ea0e97225c0b85992b55e59f55264a5b"
+    "sha256": "a262844b9dd721672d1a1740685b996a5a0680aeaad12abd918ebf2d582b5590"
   }
 }

package/dist/native/single.json

@@ -1,38 +1,38 @@
 {
   "darwin-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "package": "@tokmizer/plugin-darwin-arm64",
     "file": "tkr",
-    "sha256": "caff99d95d73a1325803fcac5b2ef9703ee1376c1acd052309b5abca98d4b1d2"
+    "sha256": "219dc76f9537c7bf3dfee78c2a78d9a4a92b972815f319bd77344763d67727e1"
   },
   "darwin-x64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "package": "@tokmizer/plugin-darwin-x64",
     "file": "tkr",
-    "sha256": "d7d6191dfde72b69f64a780f4831f4c01b5f5b5cbcaa3709af9feced755a452b"
+    "sha256": "1306f71db7c45690d0fefa8d363036081fe3d1e829f89ba557f1088c835595ba"
   },
   "linux-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "package": "@tokmizer/plugin-linux-arm64",
     "file": "tkr",
-    "sha256": "3fc9ce5b71ccacd6e9869e205bf95631dde4fde400eeadd8c97989295fbcc8c9"
+    "sha256": "267eec55c5dd99b45ad69b9460c7e86075dc389d86474187446119098d8274ab"
   },
   "linux-x64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "package": "@tokmizer/plugin-linux-x64",
     "file": "tkr",
-    "sha256": "bb6a564243c955ecb939fe14a73ce97bd385dab33993b64c6dc4a723bc919d0a"
+    "sha256": "006b1e56394d263de1dec51bfb6036ff267487b413e30b063c06f864b1a4cb76"
   },
   "win32-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "package": "@tokmizer/plugin-win32-arm64",
     "file": "tkr.exe",
-    "sha256": "bc291580ab7be24ce999d1d75877f2f25f2c9625bab5727412e6f4b732fecfca"
+    "sha256": "3fdee6563ec1f659cadb6185225d1ae58d752b522f6c6a9a0617113ed4ffbd27"
   },
   "win32-x64": {
-    "version": "0.9.65",
+    "version": "0.9.66",
     "package": "@tokmizer/plugin-win32-x64",
     "file": "tkr.exe",
-    "sha256": "380565db1d15ac1598ac33db8a198c83a4cf5a20679e8a84b9cc757796bc11bd"
+    "sha256": "c8dc60a5705f6d2a89350ee79f0d7cf26703e4d997f4c4ac3fad3a4df214b79a"
   }
 }

package/hooks/on-session-start.mjs

@@ -136,7 +136,15 @@ try {
   if (latest && manifest.version && latest !== manifest.version) {
     const nudgeFile = join(home, `update-nudge-${latest}`);
     if (!existsSync(nudgeFile)) {
-      userMessages.push(`Tokmizer ${latest} is available. Update with: /tkr-update`);
+      const claudeDir = join(homedir(), ".claude");
+      const fromCatalog = /[\\/]plugins[\\/]cache[\\/]tokmizer[\\/]/.test(pluginRoot) && (process.env.CLAUDE_CONFIG_DIR || claudeDir) === claudeDir;
+      let autoOn = false;
+      try {
+        autoOn = JSON.parse(readFileSync(join(claudeDir, "settings.json"), "utf8"))?.extraKnownMarketplaces?.tokmizer?.autoUpdate === true;
+      } catch {}
+      userMessages.push(fromCatalog && !autoOn
+        ? `Tokmizer ${latest} is available. Run /tkr-update once: it updates now and turns on automatic updates.`
+        : `Tokmizer ${latest} is available. Update with: /tkr-update`);
       writeFileSync(nudgeFile, String(Date.now()));
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokmizer/plugin",
-  "version": "0.9.65",
+  "version": "0.9.66",
   "description": "Tokmizer reduces token consumption for AI coding tools (Claude Code, Codex, Cursor, Aider, Gemini CLI, Cline, Windsurf, Copilot). Cross-OS.",
   "type": "module",
   "engines": {
@@ -61,12 +61,12 @@
     "zod": "^3.23.8"
   },
   "optionalDependencies": {
-    "@tokmizer/plugin-darwin-arm64": "0.9.65",
-    "@tokmizer/plugin-darwin-x64": "0.9.65",
-    "@tokmizer/plugin-linux-arm64": "0.9.65",
-    "@tokmizer/plugin-linux-x64": "0.9.65",
-    "@tokmizer/plugin-win32-arm64": "0.9.65",
-    "@tokmizer/plugin-win32-x64": "0.9.65"
+    "@tokmizer/plugin-darwin-arm64": "0.9.66",
+    "@tokmizer/plugin-darwin-x64": "0.9.66",
+    "@tokmizer/plugin-linux-arm64": "0.9.66",
+    "@tokmizer/plugin-linux-x64": "0.9.66",
+    "@tokmizer/plugin-win32-arm64": "0.9.66",
+    "@tokmizer/plugin-win32-x64": "0.9.66"
   },
   "publishConfig": {
     "access": "public"

package/scripts/install-mac-linux.sh

@@ -11,6 +11,52 @@ node_ready() {
 
 work=""
 
+RELEASE_KEY_PEM='-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAQqaFzuV5RhhcjaYgECQqM1faOtWjIE5U54zyPADPSgM=
+-----END PUBLIC KEY-----'
+RELEASE_KEY_SSH='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKmhc7leUYYXI2mIBAkKjNX2jrVoyBOVOeM8jwAz0oD'
+
+openssl_ed25519() {
+  local help
+  command -v openssl >/dev/null 2>&1 || return 1
+  openssl pkey -pubin -in "$1" -noout >/dev/null 2>&1 || return 1
+  help="$(openssl pkeyutl -help 2>&1 || true)"
+  case "$help" in *-rawin*) return 0 ;; esac
+  return 1
+}
+
+ssh_keygen_sig() {
+  local out
+  command -v ssh-keygen >/dev/null 2>&1 || return 1
+  out="$(ssh-keygen -Y verify </dev/null 2>&1 || true)"
+  case "$out" in *"unknown option"*|*"illegal option"*|*"invalid option"*) return 1 ;; esac
+  return 0
+}
+
+verify_sums() {
+  local dir="$1" base="$2"
+  printf '%s\n' "$RELEASE_KEY_PEM" > "$dir/release.pem"
+  if openssl_ed25519 "$dir/release.pem"; then
+    curl -fsSL "$base/SHA256SUMS.sig" -o "$dir/SHA256SUMS.sig" || err "The release is not signed (SHA256SUMS.sig is missing). Do not install this build."
+    openssl pkeyutl -verify -pubin -inkey "$dir/release.pem" -rawin -in "$dir/SHA256SUMS" -sigfile "$dir/SHA256SUMS.sig" >/dev/null 2>&1 ||
+      err "Release signature check failed. Do not install this build."
+    log "Release signature verified (openssl)."
+    return 0
+  fi
+  if ssh_keygen_sig; then
+    curl -fsSL "$base/SHA256SUMS.sshsig" -o "$dir/SHA256SUMS.sshsig" || err "The release is not signed (SHA256SUMS.sshsig is missing). Do not install this build."
+    printf 'tokmizer-release %s\n' "$RELEASE_KEY_SSH" > "$dir/allowed_signers"
+    ssh-keygen -Y verify -f "$dir/allowed_signers" -I tokmizer-release -n tokmizer-release -s "$dir/SHA256SUMS.sshsig" < "$dir/SHA256SUMS" >/dev/null 2>&1 ||
+      err "Release signature check failed. Do not install this build."
+    log "Release signature verified (ssh-keygen)."
+    return 0
+  fi
+  if [ "${TOKMIZER_REQUIRE_SIG:-}" = "1" ]; then
+    err "Cannot verify the release signature: install OpenSSL 3 or OpenSSH 8.1+, or unset TOKMIZER_REQUIRE_SIG."
+  fi
+  log "Warning: cannot verify the release signature (no OpenSSL 3 with Ed25519, no ssh-keygen -Y). Relying on SHA256SUMS only."
+}
+
 sha256_of() {
   if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1
   else shasum -a 256 "$1" | cut -d' ' -f1
@@ -39,6 +85,7 @@ install_standalone() {
   work="$(mktemp -d)"
   trap 'rm -rf "${work:-}"' EXIT
   curl -fsSL "$base/SHA256SUMS" -o "$work/SHA256SUMS" || err "Could not download the standalone build. $unavailable"
+  verify_sums "$work" "$base"
   line="$(grep -E "^[0-9a-f]{64}  tokmizer-[0-9][^ /]*-$key\.tar\.gz$" "$work/SHA256SUMS" | head -n 1)" || true
   [ -n "$line" ] || err "No standalone build for $key. $unavailable"
   sum="${line%%  *}"