TokenGauge v0.0.4

Summary

TokenGauge v0.0.4 adds a guided setup path for the Claude Code statusLine, a compact terminal statusLine readout, and a substantial documentation pass, on top of the Codex weekly-window fix from v0.0.3.

This release keeps the existing package identity:

• Publisher: gares-extensions
• Name: tokengauge-vscode
• Extension ID: gares-extensions.tokengauge-vscode
• Version: 0.0.4

Added

• TokenGauge: Set Up Claude statusLine writes the canonical Node statusLine writer, validates it, configures TokenGauge's snapshot path, and shows the exact Claude Code statusLine.command JSON to paste. TokenGauge still does not edit ~/.claude/settings.json.
• A compact terminal statusLine readout from the canonical writer, so the same setup that feeds the cockpit can also show the provider-reported 5h and weekly windows in Claude Code's terminal status line.
• Setup guidance for Windows and WSL workflows, while the README remains the concise setup authority.

Changed

• The canonical statusLine writer body moved into docs/claude-statusline-writer.md, kept byte-identical to the shipped writer asset.
• Clarified native-source freshness, multiple-writer behavior, missing rate_limits states, and why TokenGauge uses local native surfaces rather than provider credentials or conversation logs.
• Reworked README, troubleshooting, SECURITY, and PRIVACY guidance for cleaner public onboarding and reader-first privacy/security reporting.

Fixed

• The status bar now shows Codex's promoted weekly-only window when the local app-server reports weekly usage without a short window.
• The setup command now reports writer, validation, and settings-scope failures more directly.
• Release-documentation checks now protect the canonical writer location, freshness caveats, setup claims, packaged-link posture, and public-clean documentation boundaries.

Migration notes — action required for existing users

Re-copy your statusLine writer. The writer at ~/.tokengauge/claude/claude-statusline-writer.mjs is a copy-paste, not a dependency, so upgrading the extension does not update it. Until you refresh it, you keep the old TokenGauge snapshot updated output.

This applies whichever version you are coming from: Marketplace users have a writer copied from the 0.0.2 README, GitHub users from the 0.0.3 README. Both need to re-copy.

• Run TokenGauge: Set Up Claude statusLine, or replace your local writer with the current copy from docs/claude-statusline-writer.md.
• Review and merge the displayed statusLine.command into ~/.claude/settings.json yourself. TokenGauge does not edit that file.
• The TokenGauge snapshot setting should point to the JSON snapshot file or per-session snapshot directory, not to the writer script.

Marketplace version jump

The Visual Studio Marketplace is on v0.0.2. v0.0.3 was published here on GitHub only and is not being published to the Marketplace.

• Installing from the Marketplace: you move 0.0.2 to 0.0.4 and receive v0.0.3's changes in the same update — the Codex rateLimitsByLimitId acceptance fix and the Manual Refresh probe-state fix. The packaged changelog lists them under 0.0.3.
• Installing from GitHub Releases: you already had v0.0.3, so this is a normal increment.

Security and maintenance

• Full npm audit: zero vulnerabilities.
• Production npm audit: zero vulnerabilities.

Install from GitHub Releases

Download the attached VSIX:

tokengauge-vscode-0.0.4.vsix

Verify its SHA-256:

d829190e31f5dfc762956139ddb7b92847f38f6dccc94e25f537e91af6176cde

Install from a terminal:

code --install-extension tokengauge-vscode-0.0.4.vsix

Visual Studio Marketplace

The permanent Marketplace identity remains:

gares-extensions.tokengauge-vscode

Marketplace publication of this exact v0.0.4 VSIX is a separate owner-authenticated upload step. Do not rebuild a different VSIX for Marketplace.

Validation

• PR checks passed on Ubuntu, macOS, and Windows.
• Post-merge checks passed on Ubuntu, macOS, and Windows.
• CodeQL passed.
• GitGuardian passed.
• Local tagged-source validation passed with npm run check.
• VSIX package audit passed with 13 entries.

Artifact provenance

• Tag: v0.0.4
• Commit: c7e175b3bb08b2012c1c61b4d9aac50310296809
• Tree: d2551debcced7de483cf5a0d6f81f428570cef20
• Final VSIX SHA-256: d829190e31f5dfc762956139ddb7b92847f38f6dccc94e25f537e91af6176cde
• Packaged production extension/dist/extension.js SHA-256: 8ff971e2d64b7cc8a3c4c3145363ecf436618732d28d1daaaad06a09e24687b1
• Packaged extension/dist/webview/cockpit.js SHA-256: 8a0f3c742efcb1cfdb5f719026efefa855ca60d09937ee9e547490632ae1a3b6
• Packaged extension/dist/webview/assets/cockpit-CyFit-wK.css SHA-256: 16ae099ecea2b56ff1ac64e3f0fb63044080a5ad048bf1ce6c1567582aab92f0

TokenGauge v0.0.3

Summary

TokenGauge v0.0.3 releases the current public main after the v0.0.2 Marketplace publication.

This patch keeps the existing package identity:

• Publisher: gares-extensions
• Name: tokengauge-vscode
• Extension ID: gares-extensions.tokengauge-vscode
• Version: 0.0.3

Fixed

• Manual Refresh now clears retained Codex probe state before forcing a fresh Codex native-status probe, matching the settings toggle behavior without requiring the user to disable and re-enable the probe.
• Codex app-server responses that expose recognized usage windows through rateLimitsByLimitId are accepted when direct rate-limit slots contain no recognized window, while duplicate recognized fallback windows still fail closed.

Changed

• README installation and project-status wording now reflects the existing GitHub Releases and Visual Studio Marketplace publication.

Security and maintenance

• Development and test tooling maintenance updated @vscode/test-electron to 3.1.0 and refreshed affected dev-only transitive packages, including linkify-it, brace-expansion, fast-uri, js-yaml, nanoid, postcss, and undici.
• Full npm audit: zero vulnerabilities.
• Production npm audit: zero vulnerabilities.

These maintenance items are development/test tooling changes. No installed-user runtime exposure was identified.

Install from GitHub Releases

Download the attached VSIX:

tokengauge-vscode-0.0.3.vsix

Verify its SHA-256:

ce8f2b9d30182486a975f3986ce3dbeb39e8d56bddf86597459b5f7c7743130c

Install from a terminal:

code --install-extension tokengauge-vscode-0.0.3.vsix

Visual Studio Marketplace

The permanent Marketplace identity remains:

gares-extensions.tokengauge-vscode

Marketplace publication of this exact v0.0.3 VSIX is a separate owner-authenticated upload step. Do not rebuild a different VSIX for Marketplace.

Validation

• PR checks passed on Ubuntu, macOS, and Windows.
• Post-merge checks passed on Ubuntu, macOS, and Windows.
• CodeQL passed.
• GitGuardian passed.
• Local tagged-source validation passed with npm run check.
• VSIX package audit passed with 12 entries.

Artifact provenance

• Tag: v0.0.3
• Commit: 87649b70df9cab448c204f316f76dc9f9d9af0b1
• Tree: ca813f632c972c3b617adc0ef0457d004a58401f
• Final VSIX SHA-256: ce8f2b9d30182486a975f3986ce3dbeb39e8d56bddf86597459b5f7c7743130c
• Packaged production extension/dist/extension.js SHA-256: 82aa1e1381a8713fa40dc201e1d87ac18e20f55d02f84905814f6a7fa933fe2b
• Packaged extension/dist/webview/cockpit.js SHA-256: dd26e8c1a89cbef22dadf9d97bab9022b0e4e20ae88d9ec1dba41b8453b1c6aa
• Packaged extension/dist/webview/assets/cockpit-7T_AkNyk.css SHA-256: 20e796fa2a878f4a5f15ab1f87444a17c691b935fa345666282bd4aff7e7479a

TokenGauge v0.0.2

TokenGauge v0.0.2

TokenGauge v0.0.2 is the first release prepared for publication under its
permanent Visual Studio Marketplace identity:

gares-extensions.tokengauge-vscode

Added

• Support for Codex weekly-only usage status.
• Support for Codex short-window-only usage status.
• Promotion of the Weekly meter to the primary position when a short usage
  window is unavailable.
• Preservation of the existing two-meter layout when both recognized windows
  are available.
• Third-party notices for runtime components shipped in the VSIX.

Changed

• Updated the permanent publisher identity to gares-extensions.
• Updated Vite to 6.4.3 and its nested esbuild dependency to 0.25.12.
• Updated documentation to describe Codex usage windows as independently
  optional.
• Updated release and credential-handling documentation.

Security and maintenance

• Full npm audit: 0 vulnerabilities.
• Production npm audit: 0 vulnerabilities.
• Open Dependabot alerts: 0.
• Dismissed Dependabot alerts: 0.
• No telemetry or additional network behavior was added.

Install from Visual Studio Marketplace

TokenGauge is available from the Visual Studio Marketplace:

Install TokenGauge

Install from a terminal:

code --install-extension gares-extensions.tokengauge-vscode

Or open the Extensions view in Visual Studio Code and search for:

@id:gares-extensions.tokengauge-vscode

TokenGauge v0.0.2 is the first Marketplace release under its permanent
extension identity, gares-extensions.tokengauge-vscode.

Feedback and reproducible bug reports are welcome through the
GitHub issue tracker.

Installation

Download tokengauge-vscode-0.0.2.vsix from the assets below and install it
through Visual Studio Code's Extensions: Install from VSIX... command.

SHA-256:

7f553d0736942aee7807f5023373ae9de4723cc14d261141183162b257b91b1d

Note for v0.0.1

v0.0.1 used the temporary extension identity
tokengauge.tokengauge-vscode. v0.0.2 uses the permanent identity
gares-extensions.tokengauge-vscode.

Anyone who manually installed v0.0.1 should uninstall it, reload Visual Studio
Code, and then install v0.0.2.

TokenGauge v0.0.1

Changelog

All notable changes to TokenGauge will be documented here. This project adheres to Keep a Changelog and Semantic Versioning.

0.0.1

First release line: a native-only, privacy-first multi-agent gauge cockpit.

• Native multi-agent cockpit. Claude Code and Codex appear as first-class
  per-agent gauge cards with plain-language provenance and freshness badges.
  Raw source, freshness, and accuracy metadata is available in Diagnostics.
• Claude native snapshots. Reads a passive local statusLine snapshot your
  own statusLine writer produces (opt-in bridge) plus per-model cost and model
  information from the local stats-cache.json cache.
• Codex native app-server probe. On explicit opt-in (off by default), asks
  the local codex app-server for account rate-limit information. This version
  recognizes the tested 5-hour and 7-day account-window shape; different bucket
  shapes show unavailable/unsupported instead of guessed values. Nothing is
  spawned while it is off or while the Codex card is hidden.
• Honest states. Missing native data reads unknown/unavailable; missing cost
  reads cost unknown. TokenGauge never reconstructs, estimates, or synthesizes
  values it cannot read natively.
• Secret handling, diagnostics, and Command Palette workflows. TokenGauge
  stores no API keys or provider credentials; the local install salt lives only
  in VS Code SecretStorage via SecretManager; redacted cockpit diagnostics and
  a privacy report; release-docs and release-workflow safety gates (release
  automation itself is added at release time).

Posture for this release:

• No developer-controlled telemetry; no outbound network by default.
• GitHub Release first distribution is planned; Marketplace and Open VSX publishing are optional PAT-gated paths.
• Every metric is accuracy-labeled; native-reported values are never presented as provider billing data.
• TokenGauge stores no API keys or provider credentials; the local install salt lives only in VS Code SecretStorage via SecretManager.

Internal cleanup (native-only reset):

• Removed the log-derived ingestion subsystem, the JSONL UsageStore and its
  PrivacyGuard write chokepoint, the cost engine and tokenizers, the synthetic
  observed-limit estimator and the estimated/log_derived taxonomy, and the
  inert threshold-notification settings. Each removal is protected by a negative
  CI guard. None of these were ever shipped as product features. See
  ADR-004.