@tokmizer/plugin 0.9.65 → 0.9.67

package/dist/native/manifest.json

@@ -1,32 +1,32 @@
 {
   "darwin-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "file": "tkr-exec-darwin-arm64",
-    "sha256": "a3c4ec4ee900156fe262e64c4bb1769917901c92c2d909d5c4af0546c47d7dc0"
+    "sha256": "1b444958877111e7860d4d882d58330aec294c43cdf4c1fc101d6d32c8e571a4"
   },
   "darwin-x64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "file": "tkr-exec-darwin-x64",
-    "sha256": "6d2cf0aa5ed73af8f55bab6e3277143043ba677ca701498ff7a8cb759d347bcd"
+    "sha256": "35c6e3f6b055bc23e587514868175462c4a65e39001584e9e076e152e9e60eb0"
   },
   "linux-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "file": "tkr-exec-linux-arm64",
-    "sha256": "9073379a74db2a8effb04596123587c065073732169c993356a5b5b67aafd1d3"
+    "sha256": "24c226733be10467b50310783133004589b2d6d1fa47eb40cd62a258c82fbe14"
   },
   "linux-x64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "file": "tkr-exec-linux-x64",
-    "sha256": "6aa518a4bcbba9b9c6c4a31ac09fcb0ae12b1e6a3aa4de61b2df90031c060832"
+    "sha256": "c8787764a24f576aea2fb86b4d26b79f4911a5adcdadf2923594a0910a6b812c"
   },
   "win32-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "file": "tkr-exec-win32-arm64.exe",
-    "sha256": "678de126a05f5318903dbe1b93ae95c7013b34f628aca3d6858224dfd7beb189"
+    "sha256": "19f69258b8be68cbef6b500515ea93c61cbfd541a86d3b8c823643068ce0ab6b"
   },
   "win32-x64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "file": "tkr-exec-win32-x64.exe",
-    "sha256": "745cbc65d1c33bdf635d395c89cea182ea0e97225c0b85992b55e59f55264a5b"
+    "sha256": "2e35cac5f1ec24b8d071d1bab7902d912c94e80b130e2d25612e188acc6ad8fb"
   }
 }

package/dist/native/single.json

@@ -1,38 +1,38 @@
 {
   "darwin-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "package": "@tokmizer/plugin-darwin-arm64",
     "file": "tkr",
-    "sha256": "caff99d95d73a1325803fcac5b2ef9703ee1376c1acd052309b5abca98d4b1d2"
+    "sha256": "77f5ec715776878b8fb8430c60895b7195cca3b1805da014e2f6a5a5ea11d7c8"
   },
   "darwin-x64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "package": "@tokmizer/plugin-darwin-x64",
     "file": "tkr",
-    "sha256": "d7d6191dfde72b69f64a780f4831f4c01b5f5b5cbcaa3709af9feced755a452b"
+    "sha256": "eb16d7908d62485fbda3ccf685d7d4032a74eb543d85f1fde29ea6f5d6b2378e"
   },
   "linux-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "package": "@tokmizer/plugin-linux-arm64",
     "file": "tkr",
-    "sha256": "3fc9ce5b71ccacd6e9869e205bf95631dde4fde400eeadd8c97989295fbcc8c9"
+    "sha256": "1c8af8dfcf33e4e22e20e2f7d2f534afb22acea5e1eb9bc5c264aa7cfafe5f83"
   },
   "linux-x64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "package": "@tokmizer/plugin-linux-x64",
     "file": "tkr",
-    "sha256": "bb6a564243c955ecb939fe14a73ce97bd385dab33993b64c6dc4a723bc919d0a"
+    "sha256": "9bcf7091817d7cb0178a3de988faf5fbb8c2eff0c8ad0dec9fda1e6814741563"
   },
   "win32-arm64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "package": "@tokmizer/plugin-win32-arm64",
     "file": "tkr.exe",
-    "sha256": "bc291580ab7be24ce999d1d75877f2f25f2c9625bab5727412e6f4b732fecfca"
+    "sha256": "b8c43b930f586db372ff7ad786f8a12f0a08ef6941a565d5d6a59459c15b4a02"
   },
   "win32-x64": {
-    "version": "0.9.65",
+    "version": "0.9.67",
     "package": "@tokmizer/plugin-win32-x64",
     "file": "tkr.exe",
-    "sha256": "380565db1d15ac1598ac33db8a198c83a4cf5a20679e8a84b9cc757796bc11bd"
+    "sha256": "8300e43a7a1400331dfeac4c975e7e57a274ca0b31c0a349234daf10bde5b386"
   }
 }

package/hooks/on-session-start.mjs

@@ -136,7 +136,15 @@ try {
   if (latest && manifest.version && latest !== manifest.version) {
     const nudgeFile = join(home, `update-nudge-${latest}`);
     if (!existsSync(nudgeFile)) {
-      userMessages.push(`Tokmizer ${latest} is available. Update with: /tkr-update`);
+      const claudeDir = join(homedir(), ".claude");
+      const fromCatalog = /[\\/]plugins[\\/]cache[\\/]tokmizer[\\/]/.test(pluginRoot) && (process.env.CLAUDE_CONFIG_DIR || claudeDir) === claudeDir;
+      let autoOn = false;
+      try {
+        autoOn = JSON.parse(readFileSync(join(claudeDir, "settings.json"), "utf8"))?.extraKnownMarketplaces?.tokmizer?.autoUpdate === true;
+      } catch {}
+      userMessages.push(fromCatalog && !autoOn
+        ? `Tokmizer ${latest} is available. Run /tkr-update once: it updates now and turns on automatic updates.`
+        : `Tokmizer ${latest} is available. Update with: /tkr-update`);
       writeFileSync(nudgeFile, String(Date.now()));
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokmizer/plugin",
-  "version": "0.9.65",
+  "version": "0.9.67",
   "description": "Tokmizer reduces token consumption for AI coding tools (Claude Code, Codex, Cursor, Aider, Gemini CLI, Cline, Windsurf, Copilot). Cross-OS.",
   "type": "module",
   "engines": {
@@ -61,12 +61,12 @@
     "zod": "^3.23.8"
   },
   "optionalDependencies": {
-    "@tokmizer/plugin-darwin-arm64": "0.9.65",
-    "@tokmizer/plugin-darwin-x64": "0.9.65",
-    "@tokmizer/plugin-linux-arm64": "0.9.65",
-    "@tokmizer/plugin-linux-x64": "0.9.65",
-    "@tokmizer/plugin-win32-arm64": "0.9.65",
-    "@tokmizer/plugin-win32-x64": "0.9.65"
+    "@tokmizer/plugin-darwin-arm64": "0.9.67",
+    "@tokmizer/plugin-darwin-x64": "0.9.67",
+    "@tokmizer/plugin-linux-arm64": "0.9.67",
+    "@tokmizer/plugin-linux-x64": "0.9.67",
+    "@tokmizer/plugin-win32-arm64": "0.9.67",
+    "@tokmizer/plugin-win32-x64": "0.9.67"
   },
   "publishConfig": {
     "access": "public"

package/scripts/install-mac-linux.sh

@@ -11,6 +11,52 @@ node_ready() {
 
 work=""
 
+RELEASE_KEY_PEM='-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAQqaFzuV5RhhcjaYgECQqM1faOtWjIE5U54zyPADPSgM=
+-----END PUBLIC KEY-----'
+RELEASE_KEY_SSH='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKmhc7leUYYXI2mIBAkKjNX2jrVoyBOVOeM8jwAz0oD'
+
+openssl_ed25519() {
+  local help
+  command -v openssl >/dev/null 2>&1 || return 1
+  openssl pkey -pubin -in "$1" -noout >/dev/null 2>&1 || return 1
+  help="$(openssl pkeyutl -help 2>&1 || true)"
+  case "$help" in *-rawin*) return 0 ;; esac
+  return 1
+}
+
+ssh_keygen_sig() {
+  local out
+  command -v ssh-keygen >/dev/null 2>&1 || return 1
+  out="$(ssh-keygen -Y verify </dev/null 2>&1 || true)"
+  case "$out" in *"unknown option"*|*"illegal option"*|*"invalid option"*) return 1 ;; esac
+  return 0
+}
+
+verify_sums() {
+  local dir="$1" base="$2"
+  printf '%s\n' "$RELEASE_KEY_PEM" > "$dir/release.pem"
+  if openssl_ed25519 "$dir/release.pem"; then
+    curl -fsSL "$base/SHA256SUMS.sig" -o "$dir/SHA256SUMS.sig" || err "The release is not signed (SHA256SUMS.sig is missing). Do not install this build."
+    openssl pkeyutl -verify -pubin -inkey "$dir/release.pem" -rawin -in "$dir/SHA256SUMS" -sigfile "$dir/SHA256SUMS.sig" >/dev/null 2>&1 ||
+      err "Release signature check failed. Do not install this build."
+    log "Release signature verified (openssl)."
+    return 0
+  fi
+  if ssh_keygen_sig; then
+    curl -fsSL "$base/SHA256SUMS.sshsig" -o "$dir/SHA256SUMS.sshsig" || err "The release is not signed (SHA256SUMS.sshsig is missing). Do not install this build."
+    printf 'tokmizer-release %s\n' "$RELEASE_KEY_SSH" > "$dir/allowed_signers"
+    ssh-keygen -Y verify -f "$dir/allowed_signers" -I tokmizer-release -n tokmizer-release -s "$dir/SHA256SUMS.sshsig" < "$dir/SHA256SUMS" >/dev/null 2>&1 ||
+      err "Release signature check failed. Do not install this build."
+    log "Release signature verified (ssh-keygen)."
+    return 0
+  fi
+  if [ "${TOKMIZER_REQUIRE_SIG:-}" = "1" ]; then
+    err "Cannot verify the release signature: install OpenSSL 3 or OpenSSH 8.1+, or unset TOKMIZER_REQUIRE_SIG."
+  fi
+  log "Warning: cannot verify the release signature (no OpenSSL 3 with Ed25519, no ssh-keygen -Y). Relying on SHA256SUMS only."
+}
+
 sha256_of() {
   if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1
   else shasum -a 256 "$1" | cut -d' ' -f1
@@ -39,6 +85,7 @@ install_standalone() {
   work="$(mktemp -d)"
   trap 'rm -rf "${work:-}"' EXIT
   curl -fsSL "$base/SHA256SUMS" -o "$work/SHA256SUMS" || err "Could not download the standalone build. $unavailable"
+  verify_sums "$work" "$base"
   line="$(grep -E "^[0-9a-f]{64}  tokmizer-[0-9][^ /]*-$key\.tar\.gz$" "$work/SHA256SUMS" | head -n 1)" || true
   [ -n "$line" ] || err "No standalone build for $key. $unavailable"
   sum="${line%%  *}"