@vimoxshah/tokenflow 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to TokenFlow are recorded here. Versions follow
 [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
+## 1.1.2 — 2026-09-03
+
+Makes the downloadable app usable on a machine that is not the one that built
+it. 1.1.1 was correct as source and as an npm package; its DMG was not.
+
+### Fixed
+
+- **The released app pointed at the machine that built it.** Every build
+  embedded the absolute path of its own node binary and CLI, which is right for
+  a developer driving their checkout and wrong for a release: the 1.1.1 DMG
+  shipped `TokenFlowCLIPath = /Users/runner/work/tokenflow/...`, a path that
+  exists on no user's machine. Only path-discovery fallbacks kept the app
+  working at all. A distributable build now embeds no path
+  (`TOKENFLOW_PORTABLE=1`), the DMG script refuses to package one that does,
+  and the release workflow re-checks it after mounting the finished image.
+- **A cask-only install had nothing to run.** The cask installs the app; the
+  CLI came from npm. Anyone who only ran `brew install --cask tokenflow` got a
+  menu bar that could read an existing status file and do nothing else — no
+  refresh, no watcher, no dashboard. The app now carries its own CLI (see
+  below).
+- **Node discovery named one specific version.** The first candidate was
+  `~/.nvm/versions/node/v24.13.1/bin/node` — whichever version the developer
+  happened to have. One `nvm install` away from being wrong for everybody.
+  nvm installs are now discovered and the highest one at or above the engine
+  floor wins.
+
+### Added
+
+- **The app bundles its own CLI**, at
+  `Contents/Resources/cli/package/bin/tokenflow.js`. It is packed with
+  `npm pack` and then pruned to the files the CLI actually executes, so the
+  bundle is always a subset of the published package and never carries a file
+  npm does not ship. The bundled copy takes priority over any CLI found on the
+  system, because the app and the CLI share a contract — the status file's
+  shape, the watcher lock format, `/api/ping` — and the copy shipped beside the
+  binary is the only one guaranteed to match it. A local build still embeds the
+  developer's clone, which wins, so an installed app keeps driving the checkout
+  being edited.
+- **A missing dependency now says so.** With no CLI or no Node the menu bar
+  reported nothing and every button failed silently. It names the problem and
+  the command that fixes it, at launch rather than on the first click.
+
+### Changed
+
+- The cask states the Node requirement in `caveats` instead of declaring
+  `depends_on formula: "node"`, which would install a second Node beside an
+  nvm- or asdf-managed one and fight the version manager.
+
 ## 1.1.1 — 2026-09-03
 
 A reliability release. Five defects had combined to leave the app paused, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vimoxshah/tokenflow",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Local-first, provider-agnostic analytics for the AI tokens you actually spend. Zero dependencies, nothing leaves your machine.",
   "type": "module",
   "license": "MIT",

package/scripts/build-dmg.sh

@@ -15,8 +15,17 @@ DIST="$REPO/dist"
 APP="$DIST/TokenFlow.app"
 DMG="$DIST/TokenFlow-$VERSION.dmg"
 
-"$REPO/scripts/build-menubar-app.sh" "$DIST" "$VERSION" >/dev/null
-echo "built TokenFlow.app"
+# A DMG is for other people's machines, so it must carry no path from this one.
+TOKENFLOW_PORTABLE=1 "$REPO/scripts/build-menubar-app.sh" "$DIST" "$VERSION" >/dev/null
+echo "built TokenFlow.app (portable)"
+
+# Fail here rather than shipping an app that points at the build host.
+for KEY in TokenFlowCLIPath TokenFlowNodePath; do
+  if /usr/libexec/PlistBuddy -c "Print :$KEY" "$APP/Contents/Info.plist" >/dev/null 2>&1; then
+    echo "error: $KEY is embedded in a distributable build" >&2
+    exit 1
+  fi
+done
 
 STAGING="$(mktemp -d)"
 trap 'rm -rf "$STAGING"' EXIT

package/scripts/build-menubar-app.sh

@@ -4,8 +4,24 @@
 #   scripts/build-menubar-app.sh [output-dir]
 #
 # Compiles menubar/TokenFlow/main.swift with swiftc (Xcode Command Line Tools)
-# into a minimal .app bundle, embedding the absolute paths of this clone's
-# node binary and CLI so the app can drive refresh/watch actions.
+# into a minimal .app bundle.
+#
+# The CLI is ALWAYS bundled into Contents/Resources/cli, packed with `npm pack`
+# so the copy inside the app is byte-for-byte the published package rather than
+# a hand-picked subset of the working tree. The app drives that copy, which is
+# the only one guaranteed to match the binary it ships beside: the app and the
+# CLI share a contract (the status file, the watcher lock format, /api/ping),
+# and an unrelated CLI version next door is a mismatch nobody can reason about.
+#
+# Two build flavours:
+#
+#   local (default)      also embeds this clone's absolute node + CLI paths, so
+#                        a developer's installed app drives the checkout they
+#                        are editing.
+#   TOKENFLOW_PORTABLE=1 embeds NO absolute paths. Anything built for
+#                        distribution must use this: a release built on CI
+#                        otherwise ships /Users/runner/... in its Info.plist,
+#                        which exists on no user's machine.
 set -euo pipefail
 
 REPO="$(cd "$(dirname "$0")/.." && pwd)"
@@ -25,14 +41,40 @@ command -v swiftc >/dev/null 2>&1 || {
 NODE_BIN="$(command -v node)"
 CLI_JS="$REPO/bin/tokenflow.js"
 [ -f "$CLI_JS" ] || { echo "error: $CLI_JS missing" >&2; exit 1; }
+PORTABLE="${TOKENFLOW_PORTABLE:-0}"
 
 TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT
 
+rm -rf "$APP"
 mkdir -p "$APP/Contents/MacOS"
 mkdir -p "$APP/Contents/Resources"
 cp "$REPO/menubar/TokenFlow/AppIcon.icns" "$APP/Contents/Resources/AppIcon.icns"
 
+# ---- bundle the CLI ---------------------------------------------------------
+# `npm pack` rather than copying bin/ and src/: the tarball is what npm
+# publishes, filtered by package.json "files", so the app can never ship a file
+# the package does not.
+echo "packing the CLI into the bundle"
+( cd "$REPO" && npm pack --silent --pack-destination "$TMP" >/dev/null )
+TGZ="$(ls "$TMP"/*.tgz | head -1)"
+[ -f "$TGZ" ] || { echo "error: npm pack produced no tarball" >&2; exit 1; }
+mkdir -p "$APP/Contents/Resources/cli"
+tar -xzf "$TGZ" -C "$APP/Contents/Resources/cli"
+BUNDLED_CLI="$APP/Contents/Resources/cli/package/bin/tokenflow.js"
+[ -f "$BUNDLED_CLI" ] || { echo "error: bundled CLI missing at $BUNDLED_CLI" >&2; exit 1; }
+
+# Keep only what the CLI actually executes. docs/, skills/, examples/ and
+# scripts/ are never read at runtime — they appear in printed hints and nothing
+# opens them — and they are four fifths of the tarball. Whatever remains still
+# came from `npm pack`, so the bundle is a subset of the published package and
+# never a file npm does not ship.
+( cd "$APP/Contents/Resources/cli/package" \
+  && rm -rf docs skills examples scripts \
+     README.md CONTRIBUTING.md SECURITY.md CHANGELOG.md "Refresh & Open Dashboard.command" )
+[ -f "$BUNDLED_CLI" ] || { echo "error: pruning removed the CLI" >&2; exit 1; }
+[ -d "$APP/Contents/Resources/cli/package/src" ] || { echo "error: pruning removed src/" >&2; exit 1; }
+
 cat > "$APP/Contents/Info.plist" <<PLIST
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -50,12 +92,19 @@ cat > "$APP/Contents/Info.plist" <<PLIST
     <key>LSUIElement</key>                  <true/>
     <key>NSHighResolutionCapable</key>      <true/>
     <key>NSHumanReadableCopyright</key>     <string>MIT — local-first, nothing leaves your machine.</string>
-    <key>TokenFlowNodePath</key>            <string>$NODE_BIN</string>
-    <key>TokenFlowCLIPath</key>             <string>$CLI_JS</string>
 </dict>
 </plist>
 PLIST
 
+# A distributable build embeds no machine-specific path. A local one does, so
+# the developer's installed app drives the clone they are working in.
+if [ "$PORTABLE" != "1" ]; then
+  /usr/libexec/PlistBuddy \
+    -c "Add :TokenFlowNodePath string $NODE_BIN" \
+    -c "Add :TokenFlowCLIPath string $CLI_JS" \
+    "$APP/Contents/Info.plist" >/dev/null
+fi
+
 echo "compiling with $(swiftc --version | head -1)"
 swiftc -O -swift-version 5 \
   -o "$APP/Contents/MacOS/TokenFlow" \
@@ -63,5 +112,5 @@ swiftc -O -swift-version 5 \
 
 codesign --force --sign - "$APP" >/dev/null 2>&1 || true
 
-SIZE=$(du -h "$APP" | cut -f1 | tr -d ' ')
-echo "built: $APP ($SIZE)"
+SIZE=$(du -sh "$APP" | cut -f1 | tr -d ' ')
+echo "built: $APP ($SIZE)$([ "$PORTABLE" = "1" ] && echo ' · portable, no embedded paths')"