TokenLighten v0.14.4

TokenLighten v0.14.4

Public Beta. TokenLighten v0.14.4 improves ranged file reads, task
continuation, and the evidence returned for compound questions in English
and Japanese. It also reduces repeated work and memory use when exploring
large workspaces.

The same three MCP tools remain available: read_file, search_files, and
edit_file. The server remains read-only unless started with --allow-write.

Highlights

• Complete ranged reads across multiple files. When a response cannot
  fit every requested line, following its returned next calls retrieves
  the remaining ranges for every target. A continuation no longer loses
  a file's remaining lines when the response is shortened.
• Consistent range and budget handling. range, ranges, and symbol
  select the content to read; content:"full" preserves that selection
  instead of widening it to the whole file. Continuations retain the
  caller's response budget. If the budget is too small, the server returns
  a refusal with a retry size.
• Compound questions retain all their parts. Read-only questions joined
  by conjunctions, line breaks, or lists keep their separate requirements,
  including supported Japanese phrasing. A task is ready to answer only
  when those requirements are supported by returned evidence or explicitly
  disclosed as unresolved or absent within the searched scope.
• Answers include the evidence they depend on. Questions about values,
  conditions, callers, and processing paths now request the relevant
  constants, call sites, and related code before the server marks the task
  ready. A mention in a README or unrelated code is not sufficient evidence.
• More reliable Japanese and identifier matching. Search and absence
  checks share word normalization and Japanese-to-English glossary matching.
  A question whose evidence was returned is not reported absent in the same
  response. Translation-only matches can remain undetermined; see the
  limitations below.
• Exact source ranges and safer continuation. Evidence bodies contain
  the source lines identified by their ranges. Re-packing a completed
  read-only task reuses its evidence while the files are unchanged. If a
  file changes during a ranged continuation, the server requests a fresh
  read instead of silently combining different versions.
• Less repeated work in large workspaces. File discovery, reference
  searches, and index handling avoid redundant scans. The standard MCP
  launcher uses a lower-memory WebAssembly compilation mode where supported.

Other changes

• Updated runtime and packaging dependencies to include upstream fixes.
• Dependency, virtual-environment, and generated-cache folders such as
  .venv, site-packages, __pycache__, .gradle, Pods, and DerivedData
  are excluded from default discovery. Explicit file paths remain readable.
• Test availability is detected more accurately for monorepos and projects
  whose dependencies have not been installed.
• A nonexistent cwd or --workspace is rejected without creating a
  directory, and long repetitive questions are handled more efficiently.

Compatibility and upgrade

• Install the v0.14.4 archive for your platform or update the VS Code
  extension with the v0.14.4 VSIX. For archive installs, re-run
  tl-setup <workspace> from the extracted new archive to upgrade the
  machine installation. See Getting started.
• The managed agent instructions are unchanged from v0.14.3. Workspaces
  already configured with v0.14.3 do not require a separate guide refresh
  after the runtime or extension is upgraded.
• These fixes are enabled by default. The three tools, canonical request
  fields, and read-only default remain unchanged.
• Responses add certificate.gaps entries for undetermined or empty
  request points and certificate.obligations entries for the requested
  kinds of evidence. Clients should handle these additive entries and
  include disclosed gaps when presenting an answer. See MCP tools.
• Workflows that read dependency or virtual-environment files should name
  those files explicitly instead of relying on default discovery.
• Legacy v0.12/v0.13 request fields remain refused by default.
  TL_LEGACY_INPUT=accept remains a temporary server-side migration bridge.

Known limitations

• The improvements to compound questions and answer evidence apply to
  read-only questions. Change requests retain their existing behavior.
• Caller and value lookup uses textual matching, not full type-aware
  semantic analysis. Some unresolved forms are disclosed as undetermined: for example a call inside a
  multi-line template's ${…}, an import { X as y } alias,
  module.exports = config or export default Object.freeze({…}), a Rust
  pub use re-export, an inline crate:: path or inline module, a C# method
  whose body is a single switch expression, a Scala class method as the
  subject of a question, Kotlin Multiplatform expect/actual, or a getter
  that returns a nested property (this.options.timeoutMs).
• A PascalCase C# or Java constant that is declared outside the workspace
  and read by its bare name — inherited from a library base class, or
  brought in by using static from a library — may be missing from both the returned evidence and the stated gaps.
  Check external library definitions separately when the answer depends on them.
• A term matched only through the Japanese-to-English glossary can remain
  undetermined. A katakana loanword with no occurrence in the searched
  workspace can be reported absent. These disclosures do not establish an
  answer; check the returned evidence and search scope.
• Platform targets are Windows x64, macOS Apple silicon, macOS Intel, and
  Linux x64. Use the archive matching your operating system and processor.
  Managed machines may require administrator approval; see
  Managed environments.
• On Windows, a runtime file that a running AI host still holds cannot be
  deleted immediately: an upgrade sets it aside and a later run removes it;
  an uninstall completes, names the path, and removes it in the background
  once the host is closed.
• Gemini CLI's MCP configuration only expands environment-variable
  placeholders inside the env block, not in command/args; a committed
  Gemini entry therefore carries an absolute, machine-specific path with a
  comment saying so, rather than a portable variable form.
• Copilot CLI's support for ${VAR}-style placeholders is undocumented and
  is reported to have regressed between versions, so its generated entries
  also use absolute paths rather than relying on that expansion.
• The in-memory record of an executed search's own results does not survive
  a server restart; a task resumed after a restart falls back to proposing
  the search again rather than reusing a stale result.
• Extra evidence's stated relation to a named file (for example, that it
  calls or is called by it) is a lexical match on a shared declared name,
  not a resolved call graph.
• The edit gate still grants write access to any file served in the
  current lane and epoch, even one a decision marked read-only; such an
  edit applies and is marked in the response, and an opt-in strict mode
  (TL_FRONTIER_STRICT_WRITES=1) refuses it with a re-pack step instead.
• A Japanese noun phrase that names a concept (for example, a request to
  update a changelog by its Japanese name) does not yet resolve to the
  specific file it refers to the way the equivalent English wording does.
• Editing a file larger than 4 KiB that contains NUL bytes is refused
  safely, but with a generic write-error message rather than the read-side
  encoding wording.

Assets

• tokenlighten-0.14.4-win-x64.tgz and tokenlighten-0.14.4-win-x64.zip
• tokenlighten-0.14.4-darwin-arm64.tgz
• tokenlighten-0.14.4-darwin-x64.tgz
• tokenlighten-0.14.4-linux-x64.tgz
• tokenlighten-vscode-extension-0.14.4.vsix
• SHA256SUMS (covers every archive and the VSIX)

Documentation and support

• Getting started
• Managed environments
• MCP tools
• VS Code extension
• Privacy, security, and support
• Licensing and use policy

TokenLighten is source-available. The release's LICENSE file defines the
terms of use. Support is provided on a best-effort basis.

TokenLighten v0.14.3

TokenLighten v0.14.3

Public Beta install update. TokenLighten v0.14.3 adds an install path
that needs no editor extension and no separate Node.js install: download one
archive for your OS, run one command, and every AI-agent host TokenLighten
detects on the machine — including GitHub Copilot Chat in VS Code — can use
it. It keeps the same three MCP tools: read_file, search_files, and
edit_file. The server remains read-only unless started with
--allow-write.

Highlights

• One archive, one command. Download a platform archive, verify it
  against the published SHA256SUMS, extract it, and run ./tl-setup /path/to/workspace (macOS/Linux) or tl-setup C:\path\to\workspace
  (Windows). Each archive bundles its own Node.js runtime; nothing else is
  installed system-wide. Re-running tl-setup with a newer archive upgrades
  in place.
• tl install under the hood. The new tl install CLI subcommand
  plans and confirms in one step, stages the runtime and CLI, registers
  detected hosts, sets up any given workspace(s), and verifies the result
  with a real MCP handshake before reporting success. tl install --use <version> rolls back to a previously staged version; tl install --uninstall removes the machine install and TokenLighten-managed host
  registrations (foreign entries stay, and are reported); for every
  workspace this machine install set up, it also removes TokenLighten's
  managed guide blocks and managed MCP entries, leaving your own content
  and other servers' entries untouched.
• Two more hosts register directly. Gemini CLI and Copilot CLI join
  Claude Code and Codex as hosts tl install/tl clients can register
  without a manual copy-paste step. tl clients snippet prints a pasteable
  entry (plus a one-line add command where a vendor CLI exists) for any
  detected host that cannot be written directly.
• One enabled TokenLighten server per VS Code workspace. The
  extension's own MCP provider now steps aside once a workspace has been
  set up: previously it added a further same-label tokenlighten
  definition on top of the workspace files, and VS Code's default collision
  handling silently disabled all but one without saying why. VS Code starts
  the entry in .vscode/mcp.json; it still lists the copy in the root
  .mcp.json (written for Claude Code) and marks it disabled as a
  duplicate. A workspace that has never been set up gets a
  provider-supplied fallback definition only when this machine already has
  a tl-setup/tl install machine install; installing the extension by
  itself, with no machine install anywhere, offers no definition and
  starts no server.
• tl doctor gains install_consistency. It reports the machine
  install's version against the VS Code extension's bundled version and any
  tl found on PATH, whether the managed launcher still resolves to a
  live runtime, and duplicate or stale-identity host/workspace entries. When
  no machine install exists yet, this check is informational (not a
  warning) — the entire VSIX-only population has no machine install to
  compare against.
• One fallback order for both shims. The human-facing tl/tl.cmd
  launcher now tries the same runtime-first order on macOS/Linux and
  Windows.
• macOS quarantine cleared on the copied runtime. tl install clears
  the com.apple.quarantine attribute on the copy of the Node.js runtime it
  stages under <home> (its own copied payload only, never a system-wide
  change), so a runtime extracted by a quarantine-stamping tool (for
  example, Archive Utility on a browser-downloaded archive) is not blocked
  by Gatekeeper on first launch.
• Task-pack continuation fixes. A qref or task.handle re-pack against
  an unchanged workspace no longer re-presents an already-executed search,
  drops an already-served create decision, or resends a body it already
  returned. A verified absence for a search the pack itself proposed now
  closes the task instead of leaving it stuck waiting.
• More accurate evidence selection. A request naming two or more
  independent file-and-change pairs — in English or Japanese — reaches an edit decision with one obligation per change
  instead of an unnecessary candidate choice, and an "either this file or
  that one" alternative is never marked writable on its own. A Japanese
  request's trailing particle or verb ending is no longer disclosed as a
  missing item, and a question that names its target files explicitly (up
  to three) gets each of them served as its own evidence item, with any
  additional evidence requiring a stated relation to one of them. A file
  the request names by path that the server cannot read, or cannot decode
  as text, is now disclosed as such instead of being answered from
  unrelated evidence in its place.
• Safer, more consistent file decoding. Every file body a response can
  carry now goes through one decoding policy, applied the same way at every
  route: valid text is served as-is, a file with a few incidental NUL bytes
  is served with them stripped and the strip is always stated, and a file
  that is not valid UTF-8, or is mostly NUL, is disclosed instead of being
  served or used as evidence. A located declaration in a file type the
  server has no comment-syntax support for is now served, with a note that
  the identifier is unverified, instead of being silently discarded.
• More precise edit targeting. A request that both asks about one file
  and asks to change another now keeps the explain-only file read-only and
  makes only the real edit target writable, across several common ways of
  phrasing the same two-part request, in English and Japanese. An edit
  decision's writable list no longer includes a file that was only a loose
  keyword match, or a file whose content needed NUL bytes stripped before
  it could be served.
• Windows compatibility. Reading ZIP, TAR, TAR.GZ, 7Z, and RAR archives
  no longer hangs until it times out on Windows. Command-line client
  registration and bundled runtime handling also work from archives
  extracted with Explorer.
• More useful first responses. Read-only requests that ask several
  things at once can find evidence for each point, including when the call
  names files explicitly. Japanese questions against English codebases can
  retry with English search terms derived from the request. Named types and
  members lead to their relevant declarations instead of an unrelated file
  heading. TL_CONCERN_RECOVERY=0 and TL_JA_QUERY_BRIDGE=0 disable the
  corresponding recovery features.
• Reliable task continuity. A read-only task stays read-only when a
  continuation omits task.profile. On read_file and search_files, a
  malformed task handle can recover the caller's own live task when there
  is exactly one matching candidate in the same workspace and lane.
  edit_file remains strict; TL_TASK_HANDLE_RECOVERY=0 disables recovery.
• Updated GitHub Copilot integration in VS Code. Workspace setup keeps
  larger tool results inline, replaces duplicate Copilot instructions with
  a short reference to the shared guide, and adds a read-only exploration
  agent restricted to TokenLighten's tools. Named files and relevant ranges
  are returned more fully, code evidence includes line numbers, and
  host-specific tool definitions and follow-up calls are shorter. These
  serving changes are enabled for VS Code by setup (TL_TURN_ECONOMY=1);
  other hosts keep their existing defaults. To keep the current inline
  result setting, use --copilot-inline-results keep. Settings files with
  comments or trailing commas are left unchanged with manual instructions.
• Choose the guide for your workspace. A Copilot-only workspace can use
  tl workspace setup --guide-profile compact. The VS Code extension also
  offers this choice when no explicit guide profile or code-only tool
  surface has already selected one. AGENTS.md is shared with Codex and
  Claude Code, so choose the full guide when those clients also need the
  detailed instructions. Smaller guides and fewer follow-up calls do not
  guarantee lower provider charges.
• A ranged multi-file read no longer loses lines. A read_file call
  that names several files, each with its own line range, previously could
  return a next that began after lines that were never sent, continued
  only the first file, or stopped short of the requested end when the
  response had to be shortened. Following next until none is left now
  delivers every requested line of every named file, and complete,
  commented code is no longer reported as partial.
• Honest completion for requests made of several questions. A
  read-only request such as "where does the order status change, how is a
  coupon validated, and where are failed notifications retried?" was
  reported as ready to answer once ONE of its questions had evidence. It
  now says discover and names one bounded follow-up for each question
  that has none, then closes once every question is served (two responses
  instead of one silent, incomplete one). The rule is deliberately narrow:
  it applies only when the request contains two or more independent
  questions; a single question that lists details in parentheses is
  treated exactly as before, and two questions joined by a bare "and" are
  recognised as two. Absence is also stricter: a word is not certified
  absent when only its inflection differs from what the code uses
  (validated/validate, retried/retry, invoices/invoice), and no
  response certifies a word absent while serving a file that contains it.

Compatibility and migration

• Existing VS Code extension and source-checkout (npm link) installs
  continue to work. The first time any entry point runs under v0.14.3 —
  tl-setup, Set up this workspace, or tl clients activate — it
  migrates the legacy ~/.tokenlighten/bin/tl shim into a forwarder to...

TokenLighten v0.14.2

TokenLighten v0.14.2

Public Beta reliability update. TokenLighten v0.14.2 improves task
continuation, interpretation of multi-point and Japanese requests, and
workspace setup for code-only projects. It keeps the same three MCP tools:
read_file, search_files, and edit_file. The server remains read-only
unless started with --allow-write.

Highlights

• Continue without repeating finished steps. A task resumed through its
  returned qref remembers completed reads and requirements established by
  earlier calls. It moves to the answer, edit, or next unfinished step.
• Keep the request's focus. Requests naming specific files, identifiers,
  or quoted topics no longer fall back to a generic overview. Multi-sentence
  Japanese requests retain their opening sentence, and discovery handles
  Japanese topic words more accurately.
• Explain what is missing. Topics that cannot be found are disclosed
  alongside the content that is available. When a task waits for input, it
  names what remains unresolved and provides a recovery call when available.
• Avoid unnecessary resends. Repeated full reads respect the requested
  comment projection. budget.allowFull:true raises the size cap without
  forcing content already in context to be sent again.
• Recover batch edits together. If a batch includes files that have not
  been read, its recovery call gathers the context needed for the entire
  batch. Explicit file-creation requests are recognized directly.
• Use a smaller guide for code-only projects. Workspace setup with the
  code tool surface now selects the compact agent guide by default. An
  explicit CLI or VS Code guide-profile setting still takes precedence.
• More reliable client validation and task state. Valid cursor
  continuations with task or budget fields pass the advertised schema;
  invalid field combinations and incorrectly typed arrays are rejected.
  Task state also recovers more reliably after an interrupted state write.

Compatibility and migration

• The three tools and canonical request fields remain available. Reconnect
  custom MCP clients to pick up the updated tool definitions; VS Code uses
  the bundled schema stamp to refresh its cached definitions.
• budget.allowFull:true no longer forces a resend. Use
  task.force_serve:true when previously served context has been lost and
  must be sent again. content:"full" keeps its existing receipt behavior.
• An await_input decision may include unresolved[] and next. Read
  the unresolved reason and execute any returned continuation as given.
• Re-run tl workspace setup, or Set up this workspace in VS Code, to
  refresh managed agent instructions. With --tool-surface code, setup now
  writes the compact guide unless a guide profile is explicitly selected.
  Use --guide-profile full or medium, or the VS Code setting
  tokenlighten.guideProfile, to override that default.
• Legacy v0.12/v0.13 request fields remain refused by default.
  TL_LEGACY_INPUT=accept remains a temporary server-side migration bridge.
• No dependency changes are declared relative to v0.14.1.
• The public release includes the CLI, MCP server, source and package tests,
  and VS Code extension. The desktop application is not included.

Known limitations

• A rare response-budget fallback can still return a generic JSON-RPC error.
  Retry with a larger budget or a narrower target.
• Read plain files separately from archive or document members when using
  multiple targets in one request.
• For a file the built-in parser cannot analyze, a decision depending on
  that file may need the whole file to be served; follow the returned next.
• When quoted text occurs twice in one large file, the narrowed edit context
  may include only one occurrence. Read the other explicitly before changing
  both.
• Files larger than the discovery index limit may require an explicit path
  and range. Very large repositories may take longer on the first request.
• Rename and reference operations are lexical and do not provide full
  language-server semantic resolution.
• PDF reading requires a text layer; scanned PDFs need OCR elsewhere.
  TAR, TAR.GZ/TGZ, 7Z, and RAR archives remain read-only.

See Language and file support for supported formats.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.14.2.vsix from the release assets.
The same file works on Windows, macOS, and Linux and includes the CLI, MCP
server, license, and third-party notices. A separate Node.js or tl
installation is not required.

code --install-extension tokenlighten-vscode-extension-0.14.2.vsix

Open a trusted project folder, open the TokenLighten view, and choose
Set up this workspace. Compare the downloaded file's SHA-256 with the
SHA256SUMS release asset.

Documentation and support

• Getting started
• MCP tools
• VS Code extension
• Privacy, security, and support
• Licensing and use policy

TokenLighten is source-available. The release's LICENSE file defines the
terms of use. Support is provided on a best-effort basis.

Download integrity

SHA-256 for tokenlighten-vscode-extension-0.14.2.vsix:

50ad88cdf723cfdb0c81e5ebea31f2eeda4bab5d14d14307dfd6c73e4915a595

TokenLighten v0.14.1

TokenLighten v0.14.1

Public Beta reliability update. TokenLighten v0.14.1 improves how coding
agents decide that they have read enough, and how interrupted reads and
searches continue. It keeps the same three MCP tools: read_file,
search_files, and edit_file. The server remains read-only unless started
with --allow-write.

Highlights

• Completion waits for the evidence. A task pack is not reported as ready
  to answer or edit until the content actually returned covers every point in
  the request, including the full declaration of a function the decision
  depends on. A point the workspace verifiably lacks is disclosed as absent
  instead of being dropped.
• Full reads finish. A read_file that exceeds its response budget
  returns a cursor that continues the original request until every
  requested line has been delivered. Run the returned next as given; the
  response also names the remainder still outstanding.
• Searches stay searches. A bounded search_files continues through a
  cursor over its matches in a stable order. It no longer proposes a
  whole-file read to finish a search.
• Receipts without detours. When requested content is already in the
  client's context, the receipt carries a next only if that request still
  has undelivered lines.
• Explicit resend. content:"full" selects what to read; it no longer
  forces content already in context to be sent again. Use
  task.force_serve:true when the client has genuinely lost that context.
• Edits that quote unique text stay local. A request that identifies a
  unique piece of source text narrows discovery to that occurrence and
  returns its source with the edit context.
• Batch edits behave as advertised. target:"all" replaces every match
  of a path-based edit and reports the count, a new file can be created in
  the same batch as other edits, and a refused batch's recovery names every
  file it needs.
• Smaller tool surface for code-only workspaces. --tool-surface code
  (also TOKENLIGHTEN_TOOL_SURFACE=code, tl workspace setup --tool-surface code, or the VS Code setting tokenlighten.toolSurface) advertises a
  smaller schema without Office, archive, or credential inputs. full
  remains the default.

See the changelog for release highlights.

Compatibility and migration

• The three tools and their canonical request structure are unchanged apart
  from the added read_file cursor field. The schema stamp changes, so the
  VS Code extension refreshes its cached tool definitions; other clients pick
  up the new definitions when they reconnect.
• content:"full" no longer forces a resend. A custom client that relied on
  it to re-fetch content should send task.force_serve:true instead.
• Continuations may now carry an opaque cursor. Execute the returned next
  exactly as given. A cursor-stale refusal carries a restart next, and a
  cursor-invalid refusal means the original call should be re-issued.
• Legacy v0.12/v0.13 request fields remain refused by default;
  TL_LEGACY_INPUT=accept is still available as a temporary server-side
  migration bridge.
• Under an active task, edit_file changes only files the server served in
  that task; an edit to any other file is refused with a next that reads
  every refused file first. target:"all" now replaces every match of a
  path-based item and reports the count, and a create:true item can ride
  the same batch as other edits. See MCP tools.
• The managed agent instructions (the TokenLighten blocks in AGENTS.md and
  CLAUDE.md) were updated for cursor continuation, receipts, and these edit
  rules. Re-run tl workspace setup, or Set up this workspace in
  VS Code, to refresh them.
• Changing the tool surface requires restarting or reconnecting the server.
• This release declares no dependency changes; the runtime dependency set is
  the same as v0.14.0. Workspace changes still require --allow-write.
• The public release includes the CLI, MCP server, source and package tests,
  and VS Code extension. The desktop application is not included.

Known limitations

• A rare response-budget fallback can still return a generic JSON-RPC error.
  Retry with a larger budget or a narrower target.
• Read plain files separately from archive or document members when using
  multiple targets in one request.
• budget.allowFull:true still re-sends full content that is already in
  context; only content:"full" gained receipt behavior in this release.
• For a file the built-in parser cannot analyze, a decision that depends on
  that file closes only after the whole file has been served; the returned
  next names the unserved range.
• When a quoted literal occurs twice in one large file, the narrowed edit
  context may include only one occurrence. Read the other occurrence
  explicitly before an edit that must change both.
• Files larger than the discovery index limit may require an explicit path
  and range. Very large repositories may take longer on the first request.
• Rename and reference operations are lexical and do not provide full
  language-server semantic resolution.
• PDF reading requires a text layer; scanned PDFs need OCR elsewhere.
  TAR, TAR.GZ/TGZ, 7Z, and RAR archives remain read-only.

See Language and file support for supported formats.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.14.1.vsix from the release assets.
The same file works on Windows, macOS, and Linux and includes the CLI, MCP
server, license, and third-party notices. A separate Node.js or tl
installation is not required.

code --install-extension tokenlighten-vscode-extension-0.14.1.vsix

Open a trusted project folder, open the TokenLighten view, and choose
Set up this workspace. Compare the downloaded file's SHA-256 with the
SHA256SUMS release asset.

Documentation and support

• Getting started
• MCP tools
• VS Code extension
• Privacy, security, and support
• Licensing and use policy

TokenLighten is source-available. The release's LICENSE file defines the
terms of use. Support is provided on a best-effort basis.

Checksums

Download SHA256SUMS.

2a0d716cdae9c693d9872b1655868ab10f6220ce71e533f57cddb46e41d32570  tokenlighten-vscode-extension-0.14.1.vsix

TokenLighten v0.14.0

TokenLighten v0.14.0

Public Beta. TokenLighten v0.14.0 improves repository discovery, task
continuation, and focused editing for coding agents. It provides the same
three MCP tools: read_file, search_files, and edit_file.
The server remains read-only unless started with --allow-write.

Highlights

• Clearer recovery. When a request exceeds its response budget or needs a
  different search scope, the server provides a next call in the supported
  request format.
• More focused edits. Requests that identify a unique piece of source text
  use that text to narrow discovery by default.
• Reliable continuation and retries. Continuations preserve task and
  workspace context, including requests that start a new task. Edit retries
  with the same operation_id return the recorded result.
• Consistent context handling. Read and edit decisions use the content
  actually returned to the client.
• Clearer local usage information. The CLI and VS Code extension distinguish
  observed usage from estimates. Local estimates are not provider billing
  records, and savings vary by task, repository, client, and model.
• Updated dependencies. Dependency updates address security issues.

See the changelog for release highlights.

Compatibility and migration

• The three tools retain the canonical request structure introduced in v0.13.
  VS Code refreshes cached tool definitions when their schema changes.
• Legacy input is refused by default. Old fields such as mode,
  paths, handles, bare maxBytes/maxTokens, and legacy task
  fields return a legacy-input refusal with migration guidance. Update
  custom clients to the fields documented in MCP tools.
• TL_LEGACY_INPUT=accept temporarily enables old request fields on the
  server during migration. New integrations should use canonical arguments
  and execute the returned next calls.
• Literal-first discovery is enabled by default. Set
  TL_LITERAL_FIRST_ROUTING=0 to restore the previous routing behavior.
• Workspace changes still require --allow-write.
• The public release includes the CLI, MCP server, source and package tests,
  and VS Code extension. The desktop application is not included.

Known limitations

• A rare response-budget fallback can still return a generic JSON-RPC error.
  Retry with a larger budget or a narrower target.
• Read plain files separately from archive or document members when using
  multiple targets in one request.
• Files larger than the discovery index limit may require an explicit path
  and range. Very large repositories may take longer on the first request.
• Rename and reference operations are lexical and do not provide full
  language-server semantic resolution.
• PDF reading requires a text layer; scanned PDFs need OCR elsewhere.
  TAR, TAR.GZ/TGZ, 7Z, and RAR archives remain read-only.

See Language and file support for supported formats.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.14.0.vsix from the release assets.
The same file works on Windows, macOS, and Linux and includes the CLI, MCP
server, license, and third-party notices. A separate Node.js or tl
installation is not required.

code --install-extension tokenlighten-vscode-extension-0.14.0.vsix

Open a trusted project folder, open the TokenLighten view, and choose
Set up this workspace. Compare the downloaded file's SHA-256 with the
SHA256SUMS release asset.

Documentation and support

• Getting started
• MCP tools
• VS Code extension
• Privacy, security, and support
• Licensing and use policy

TokenLighten is source-available. The release's LICENSE file defines the
terms of use. Support is provided on a best-effort basis.

SHA-256

e729e1ebd7a8e864d5c4de724e68885f79e459ab4cf41090888a3796c00266ce  tokenlighten-vscode-extension-0.14.0.vsix

TokenLighten v0.13.1

TokenLighten v0.13.1

Public Beta reliability update. TokenLighten v0.13.1 improves correctness
for concurrent agents and canonical v0.13 request shapes without changing the
MCP surface: read_file, search_files, and edit_file. The server remains
read-only unless started with --allow-write.

Highlights

• Reliable concurrent-agent lanes. Task readiness, served context, and edit
  state are isolated per lane.
• Consistent batch operations. Ranged multi-target reads and batches that
  create files while editing existing files now behave as documented.
• More honest completion. Completed continuations are not proposed again,
  pathless tree discovery cannot loop, and checklist-style requests must prove
  or disclose every item before completion.
• Less overhead for known targets. Explicit creates and uniquely identified
  literal edits serve less unrelated neighboring context.
• Task-scoped local estimates. Savings accounting includes exploration calls
  in the task total. New logs use schemaVersion: 2; version-1 logs remain
  readable.
• Explicit recovery instead of silent omission. Unsupported mixed-target
  reads and workspace-coherence failures return a refusal with a recovery path.

See the changelog for the complete v0.13.1 inventory.

Compatibility

• The three advertised tools, their schemas, and the schema stamp are unchanged
  from v0.13.0.
• Writes still require explicit --allow-write.
• Legacy v0.12 field spellings remain compatibility-only in v0.13.x and are
  scheduled for removal in v0.14.
• TL_PROOF_COMPLETION defaults to on; TL_SCHEMA_DEFS defaults to off.
• The desktop application and private benchmark harness are not included in
  the public source release.

Validation summary

The release candidate passed the package and benchmark-library test suites,
protocol follower and release-rehearsal checks, generated-artifact checks,
dependency-license checks, and runtime and full dependency audits. The
advertised schema remains within the v0.13.0 compatibility ceiling.

Benchmark disclosure

The v0.13.1 developer benchmark produced a TokenLighten/native aggregate cost
ratio of 0.809, a point estimate of 19.1% lower task cost. Both
configurations solved and verified all 18 evaluated tasks.

Task pattern	v0.13.1 vs native
Cross-module decision tracing and downstream wiring	29.0% lower
Related multi-bug fix across control and mode transitions	17.9% lower
Spreadsheet-driven rating-rule implementation	16.7% lower
Narrow calculation or data-integrity fix	7.3% lower
Priority behavior spanning related feature paths	7.4% lower

Localized explanation work was more sensitive to fixed overhead and remains an area for improvement.

Median solver turns were 29.2% lower with TokenLighten. These are
developer-run observations, not guaranteed savings. Results vary by repository,
task, client, model behavior, evaluation window, and provider pricing.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.13.1.vsix from the Assets section.
The same VSIX works on Windows, macOS, and Linux and includes the CLI, MCP
server, approved license, and generated third-party notices.

Verify the downloaded VSIX against the SHA256SUMS release asset:

e91b790850d1211590cef91d652050f07be33245655278b8bc04f72691118865  tokenlighten-vscode-extension-0.13.1.vsix

TokenLighten v0.13.0

TokenLighten v0.13.0

Public Beta update. TokenLighten v0.13.0 strengthens completion honesty and the canonical MCP request surface while keeping exactly three advertised tools: read_file, search_files, and edit_file. The server remains read-only unless it is started with --allow-write.

Highlights

• Proof-carrying completion. Task packs now keep an obligation ledger, executed-continuation history, and open-universe completeness evidence so an answer or edit decision is emitted only when its required work is demonstrably closed.
• Canonical request surface. The three tools use grouped canonical fields for task state, scope, budgets, targets, selectors, and edits. Pre-canonical v0.12 request fields remain accepted through v0.13.x as a migration bridge.
• Honest continuations and compact replay. Executable next calls, served-content receipts, replay v2, and force-serve recovery reduce predictable follow-up calls without treating omitted bytes as served.
• Schema-aware client delivery. The VS Code extension stamps the MCP schema, refreshes stale cached definitions, and retains compatibility for hosts such as GitHub Copilot that stringify structured object arguments.
• Updated agent guidance. The managed v80 guide documents the canonical surface, refusal transitions, receipts, range continuation, batching, and verification behavior.
• Safer default rollout. Proof completion is enabled by default in v0.13.0. Tool-local $defs emission remains disabled by default while client compatibility continues to be evaluated.

See the changelog for the complete v0.13.0 change inventory.

Compatibility

• The MCP surface remains exactly read_file, search_files, and edit_file.
• Writes still require explicit --allow-write.
• The legacy v0.12 field spellings are compatibility-only in v0.13.x and are scheduled for removal in v0.14.
• TL_PROOF_COMPLETION defaults to on; TL_SCHEMA_DEFS defaults to off.
• The desktop application and private benchmark harness are not included in the public source release.

Validation summary

The release candidate passed the at-head follower matrix in all three configurations: baseline proof completion on (8/8), Tier-3 proof completion on (8/8), and baseline proof completion off (8/8). The release rehearsal passed 7/7.

The clean public-source staging tree built successfully and passed 283 test files: 4,008 tests passed and 2 were skipped. Bundled-CLI integration, dependency-license checks, generated notices, runtime and full dependency audits, and VSIX packaging also passed.

Benchmark disclosure

The v0.13 developer benchmark produced a TokenLighten/native aggregate cost ratio of 0.735. This point estimate means the evaluated work cost 26.5% less with TokenLighten.

v0.12.1 was a maintenance release with no performance change, so v0.12.0 is the relevant historical comparison. Its overall point estimate was approximately 28% lower, while v0.11.1 measured approximately 21% lower. v0.13 therefore remained close to v0.12 overall and was about 5.5 percentage points better than v0.11.1. Different source revisions and evaluation windows make these descriptive comparisons, not causal release-over-release measurements.

Task pattern	v0.13 vs native	Historical context
Cross-module telemetry-health decision and downstream wiring	42.5% lower	The advantage widened from 19.6% lower in v0.12 by 22.9 percentage points.
Related multi-bug fix across control and mode transitions	20.3% lower	Favorable, but below v0.12's 29.7%.
Priority behavior spanning related feature paths	12.0% lower	Below v0.12's 24.9%.
Spreadsheet-driven rating-rule implementation	18.0% lower	Below the more variable v0.12 result of 56.8%.
Localized orchestration explanation	4.1% higher	A near-parity small task.
Narrow calculation or data-integrity fix	1.1% higher	v0.12 measured 17.9% lower; v0.13 showed no advantage.

The clearest v0.13 strength is tracing a decision across components and connecting it to downstream consumers. Multi-location fixes and rule implementations also benefit, but less consistently. Small known-location changes, localized explanations, and narrow calculations remain the weak area because fixed MCP, guidance, and verification overhead can outweigh saved discovery. These are developer-run observations, not guaranteed savings; outcomes vary by repository, task, client, model behavior, evaluation window, and provider pricing.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.13.0.vsix from the Assets section. The same VSIX works on Windows, macOS, and Linux and includes the CLI, MCP server, approved license, and generated third-party notices.

code --install-extension tokenlighten-vscode-extension-0.13.0.vsix

Open a trusted project folder, open the TokenLighten view, and choose Set up this workspace. Workspace setup writes the managed instructions used by supported clients, including GitHub Copilot.

Build from source

Node.js 20 or later is required.

npm ci
npm run build
npm run test:packages
npm run test:bundle-cli
npm run licenses
npm run doctor

See Getting started for workspace setup.

Dependency security snapshot

For the v0.13.0 release candidate audited on 2026-08-30, both npm audit --omit=dev --audit-level=high and the full npm audit reported 0 vulnerabilities.

These counts are a dated snapshot, not a guarantee that future advisory data will remain unchanged. Rerun the audits against the exact release or checkout you use.

Privacy and permissions

Repository indexing and context selection run locally. TokenLighten does not add an AI model or upload repository contents on its own; the selected MCP client and model provider remain responsible for their requests.

The MCP server is read-only by default. Start it with --allow-write only when you intend to permit workspace changes.

Known limitations

• A multi-target range read can re-serve a previously supplied window or refuse a mixed continuation; issue separate canonical range calls when this occurs.
• A mixed edit batch that combines a new-file creation with edits to existing files can fail closed; create the new file and edit existing files in separate calls.
• Concurrent agents must pass distinct lane values. Omitting lanes can let one agent's frontier influence another agent's same-session decision.
• Rename and reference edits remain conservative and lexical rather than language-server semantic operations.
• Scanned or image-only PDFs require OCR elsewhere; TAR, TAR.GZ/TGZ, 7Z, and RAR containers remain read-only.
• Benchmark outcomes vary by workload and evaluation window; do not advertise a guaranteed saving.

License and support

TokenLighten is source-available and is not licensed under an OSI-approved open-source license. Product/service integration and organizational or commercial redistribution require prior written permission. See Licensing and use policy.

Support is best effort. No response-time, resolution-time, uptime, or compatibility SLA is provided.

Assets

• tokenlighten-vscode-extension-0.13.0.vsix
• tokenlighten-vscode-extension-0.13.0.vsix.sha256

Verified VSIX SHA-256:

e2f87851f98187e07826e9c942d5c3d18c7df9a216d5ad60ba0330ce4d66c6f5  tokenlighten-vscode-extension-0.13.0.vsix

TokenLighten v0.12.1

TokenLighten v0.12.1

Public Beta maintenance update. TokenLighten v0.12.1 addresses dependency, static-analysis, and source-quality findings discovered after v0.12.0. It does not introduce a new performance feature or change the v0.12.0 benchmark interpretation.

TokenLighten continues to expose exactly three MCP tools — read_file, search_files, and edit_file — and remains read-only by default unless the MCP server is started with --allow-write.

Highlights

• Dependency security and ownership. Vulnerable development and transitive packages were updated or overridden, unused packaged dependencies were removed, and the CLI now declares the spreadsheet dependency it imports directly.
• Linear-time parsing and scanning. CodeQL-identified superlinear regular expressions in task routing, source fallback parsing, Markdown handling, tokenization, path checks, and secret scanning were replaced with bounded scanners or direct string operations.
• Safer configuration and identifiers. CLI dot-path configuration rejects __proto__ pollution while preserving legitimate constructor and prototype keys. Random handle generation now uses rejection sampling to avoid modulo bias.
• Safer document and generated-text handling. DOCX/OOXML extraction, Markdown/table output, license rendering, and generated preload code now use single-pass or explicit escaping paths that preserve ordinary content without allowing markup or code-boundary confusion.
• Clearer content-hash intent. Stable SHA-256 content identifiers use shared helpers and narrowly scoped CodeQL annotations; they are integrity identifiers, not password hashes.
• Regression coverage. New tests cover the exact configuration-pollution, sanitizer, parser, path, test-marker, secret-path, hash, and handle-generation behaviors changed in this release.

The changes address the 12 Dependabot and 38 CodeQL Security and quality findings inventoried before this release. The release source and dependency lock were rebuilt and audited after remediation.

See the changelog for the complete v0.12.1 change inventory.

Compatibility

• The MCP surface remains exactly read_file, search_files, and edit_file.
• Writes still require explicit --allow-write.
• Existing content-hash values and handle wire formats remain compatible.
• Java/C# fallback parsing, PascalCase routing, test-file detection, Markdown headings (including C#), and ordinary DOCX/OOXML text behavior retain regression coverage.
• The desktop application and private benchmark harness are not included in the public source release.

Benchmark disclosure

v0.12.1 is a maintenance and security-quality release. No new benchmark result or performance claim is introduced. The reviewed v0.12.0 benchmark observations and their caveats remain unchanged in the v0.12.0 release notes.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.12.1.vsix from the Assets section. The same VSIX works on Windows, macOS, and Linux and does not require a separate Node.js or tl installation.

code --install-extension tokenlighten-vscode-extension-0.12.1.vsix

Open a trusted project folder, open the TokenLighten view, and choose Set up this workspace.

Build from source

Node.js 20 or later is required.

npm ci
npm run build
npm run test:packages
npm run test:bundle-cli
npm link --workspace packages/cli
tl doctor --json

See Getting started for workspace setup.

Dependency security snapshot

For the v0.12.1 release candidate audited on 2026-08-28, both npm audit --omit=dev and the full npm audit reported 0 vulnerabilities.

These counts are a dated snapshot, not a guarantee that future advisory data will remain unchanged. Rerun the audits against the exact release or checkout you use.

Privacy and permissions

Repository indexing and context selection run locally. TokenLighten does not add an AI model or upload repository contents on its own; the selected MCP client and model provider remain responsible for their requests.

The MCP server is read-only by default. Start it with --allow-write only when you intend to permit workspace changes.

Known limitations

• Experimental retrieval, packing, reasoning, fast-path, and wire features remain off by default unless the changelog says otherwise.
• Rename and reference edits remain conservative and lexical rather than language-server semantic operations.
• Scanned or image-only PDFs require OCR elsewhere; TAR, TAR.GZ/TGZ, 7Z, and RAR containers remain read-only.
• Benchmark outcomes vary by workload and evaluation window; v0.12.1 makes no new performance claim.

License and support

TokenLighten is source-available and is not licensed under an OSI-approved open-source license. Product/service integration and organizational or commercial redistribution require prior written permission. See Licensing and use policy.

Support is best effort. No response-time, resolution-time, uptime, or compatibility SLA is provided.

Assets

• tokenlighten-vscode-extension-0.12.1.vsix
• tokenlighten-vscode-extension-0.12.1.vsix.sha256

Verified VSIX SHA-256:

ffcc4a39c48f17f58c28461dc31fe1000bc53e0ef6aa11760cbabf7abd30c52e  tokenlighten-vscode-extension-0.12.1.vsix

Post-release CodeQL follow-up

The protected v0.12.1 tag was published before the final CodeQL re-analysis completed. The final source-quality follow-up is available on main at e2144b78. Public CI and CodeQL passed for that commit, and open CodeQL and Dependabot alerts are both zero. The two final CodeQL results were documented false positives for SHA-256 content addressing, not password storage.

Because the release tag is protected, GitHub-generated source archives remain the original tag snapshot; use commit e2144b7 for the final post-release source state. No benchmark result or interpretation was changed.

TokenLighten v0.12.0

TokenLighten v0.12.0

Public Beta update. TokenLighten v0.12.0 is the newest source release of the local-first MCP toolkit for coding agents. It keeps exactly three advertised tools — read_file, search_files, and edit_file — while extending v0.11.1 with several serving/contract correctness fixes, a new byte-economy capability, and delivery/onboarding documentation improvements.

Highlights since v0.11.1

• More reliable task continuation. Continuations preserve the complete query, same-epoch requirements remain monotone, stale prepared certificates are demoted, and unrelated follow-ups no longer inherit an old decision.
• Stronger retrieval and file honesty. Japanese prose participates in ranking, large Markdown files return heading outlines, exact identifier routing covers the 1–8 MiB band, and UTF-16 or undecodable files no longer produce false absence or unsafe writes.
• Lower response overhead. Task packs and batch reads honor response-size bounds, edit.applied proofs are more compact, and optional TL_DELTA_CONTEXT rereads avoid re-serving already-held post-edit context.
• Faster bounded edits. Guarded known-location value changes can take a compact fast path, construction packs serve the exact landing region, and retries disclose machine-readable replay.
• Clearer setup and diagnostics. Runtime and development doctor checks are separated, log summaries always show measured usage, compact and Japanese guide profiles are available, and workspace status reports managed-guide presence.
• Safer command and verification behavior. Nested CLI help is side-effect-free, verification recipes disclose per-target proof gaps, and unsupported-encoding edits fail closed without changing bytes.

See the changelog for the complete v0.12.0 change inventory.

Detailed changes

Compared with v0.11.1, this release adds and tightens:

• lossless query continuation, monotone per-epoch requirements, and stale-certificate demotion;
• Japanese-language retrieval using shared Han/kana spans and bigrams;
• a guarded known-location edit fast path for natural value-change requests;
• maxBytes/maxTokens bounds for task packs and batch reads, including a 14,336-byte VS Code default;
• machine-readable edit replay, remaining-query tails, and synthesized-range disclosure;
• UTF-16-aware search plus fail-closed writes for unsupported encodings;
• exact identifier routing in the 1–8 MiB band and bounded large-file continuations;
• heading outlines for large Markdown skeletons and honest prepared-certificate search;
• compact edit.applied proofs (19.9% lower median response bytes across five representative scenarios);
• optional TL_DELTA_CONTEXT rereads (6,214→415 bytes, -93.3%, in one representative case);
• clearer runtime/development diagnostics, measured-side log summaries, compact guide profiles, and Japanese medium/compact guides;
• side-effect-free nested CLI help and more explicit verification proof gaps.

Natural-autoload delivery — the managed guide plus workspace MCP configuration,
without manual prompt injection — remains the production setup path. Three
default-off v0.11 read-economy flags were retired after live probes found no
reliable contribution; their regression coverage remains.

Benchmark update

The retained six-task v0.12 decision archive produced 16 matched verified
pairs; 17 of 18 scheduled repetitions verified in each arm. Aggregate
verified task cost with TokenLighten was approximately 28% lower than
with native tools only.

For comparison, the retained v0.11.1 run showed an approximately 21% lower
aggregate cost, also from 16 matched verified pairs. The observed reduction
widened by about 7 percentage points. Both runs cover the same six task
classes, but use different source revisions and evaluation windows; this is
descriptive, not a causal before/after measurement of the release.

Among the clearer positive results, the artifact-driven rating-engine task
showed an approximately 57% lower median cost and the multi-bug on-call
task showed an approximately 30% lower median cost, across three verified
pairs each.

The narrowly scoped calculation task was close to parity. Results were more
variable when the two arms did not reach the same verification outcome, so
those cases are excluded from numeric comparisons. Small known-location tasks
can also see less benefit because fixed MCP and guide overhead accounts for a
larger share of the work.

These are developer-run observations, not guaranteed savings. Results vary
by repository, task, client, model behavior, evaluation window, and provider
pricing. Local TokenLighten estimates are not provider billing records.

Install the VS Code extension

Download tokenlighten-vscode-extension-0.12.0.vsix from the Assets section. The same VSIX works on Windows, macOS, and Linux and does not require a separate Node.js or tl installation.

code --install-extension tokenlighten-vscode-extension-0.12.0.vsix

Open a trusted project folder, open the TokenLighten view, and choose Set up this workspace.

Build from source

Node.js 20 or later is required.

npm ci
npm run build
npm run test:packages
npm run test:bundle-cli
npm link --workspace packages/cli
tl doctor --json

See Getting started for workspace setup.

Privacy and permissions

Repository indexing and context selection run locally. TokenLighten does not add an AI model or upload repository contents on its own; the selected MCP client and model provider remain responsible for their requests.

The MCP server is read-only by default. Start it with --allow-write only when you intend to permit workspace changes.

Dependency security snapshot

For the v0.12.0 public-source staging tree audited on 2026-08-27,
npm audit --omit=dev reported 0 Critical, 0 High, and 2 Moderate
findings in the runtime dependency view. The full public-source staging
installation, including development dependencies, reported 1 Critical,
1 High, and 5 Moderate findings. Development-toolchain findings are
outside the normal installed-VSIX runtime view. Re-run both audits if the
source or lockfile changes before publication.

These counts are a dated snapshot, not a guarantee of zero vulnerabilities. Rerun npm audit --omit=dev or npm audit against the exact release you use.

Known limitations

• The desktop application and private benchmark harness are not included in the public v0.12.0 source release.
• Experimental retrieval, packing, reasoning, fast-path, and wire features remain off by default unless the changelog says otherwise.
• The pathless task-pack locator's primary index covers files through 1 MiB; exact identifier routing adds a wide scan for the 1–8 MiB band. Larger files remain readable by explicit path/range.
• Very large repository indexes are not persisted once the 32 MiB cache cap would be exceeded, so the first call in a new server process may rebuild the index.
• Rename and reference edits remain conservative and lexical rather than language-server semantic operations.
• Scanned or image-only PDFs require OCR elsewhere; TAR, TAR.GZ/TGZ, 7Z, and RAR containers remain read-only.
• tl workspace status's readiness check is VS Code-oriented: a Codex- or Claude-Code-only workspace with a valid guide setup can still report not-ready. Pre-existing, not fixed in this release.
• Benchmark outcomes vary by workload and evaluation window; do not advertise a guaranteed saving.

License and support

TokenLighten is source-available and is not licensed under an OSI-approved open-source license. Product/service integration and organizational or commercial redistribution require prior written permission. See Licensing and use policy.

Support is best effort. No response-time, resolution-time, uptime, or compatibility SLA is provided.

Assets

• tokenlighten-vscode-extension-0.12.0.vsix
• tokenlighten-vscode-extension-0.12.0.vsix.sha256

Verified VSIX SHA-256:

d1a2c4b844687c99a2d08880e559ebe9494a46bb30a7eb1116b5ec016c27b88c

TokenLighten v0.11.1 Public Beta

TokenLighten v0.11.1

Public Beta update. TokenLighten v0.11.1 is the latest source release of the local-first MCP toolkit for coding agents. It keeps exactly three advertised tools — read_file, search_files, and edit_file — while extending the v0.9 public beta with restart-safe task state, stronger evidence and edit guarantees, improved multi-file discovery, optional retrieval and packing experiments, and substantially better VS Code diagnostics.

Highlights since v0.9.x

• Restart-safe task continuity. Optional task_handle values can recover task state across MCP server restarts, with purpose-bound validation, compare-and-swap protection, and executable recovery on stale or invalid handles.
• More honest discovery. Per-term absence status, repository scope counts, parser-provenance labels, oversize-file disclosures, and content-hash freshness checks reduce false "not found" conclusions.
• Fewer manufactured follow-ups. Task packs can close predictable discovery steps, batch several identifiers, batch skeleton reads, carry verification kits, and return terminal proof for successful creates.
• Safer bounded edits. Known-local edits gain target fingerprints, impact guards, focused verification, rollback visibility, and conservative refusal when the target has drifted.
• Modern and experimental paths without default wire churn. The MCP 2026-07-28 transport and the graph, weighted-RRF, coverage-packer, reasoning-IR, compound-retrieval, fast-path, and adaptive-wire cores are available behind explicit flags. They remain off by default unless documented otherwise.
• Better local measurement. Attribution and paired calibration are versioned, ambiguity fails closed, and the UI distinguishes measured progress from local fallback estimates.
• A more useful VS Code surface. The status-bar QuickPick and Diagnostics panel show versions, build identity, launch configuration, workspace registration, write permission, guide state, and recent privacy-safe TokenLighten call metadata.

See the changelog for the complete cumulative change inventory since v0.9.x.

v0.11.1 focus

This patch release concentrates on real-host reliability:

• improved task-profile binding and first-pack evidence focus;
• deterministic candidate selection when one source clearly dominates;
• fixed create-intent routing and terminal create proof;
• working exact-reissue receipts and served-but-unread discovery after a prepared decision;
• honest search_files behavior for source files between 1 MiB and 8 MiB;
• batched queries[], batched skeleton reads, and paged Markdown sections;
• lenient recovery for common wire-shape mistakes instead of internal errors;
• repaired tl agents update, a medium managed-guide profile, and Go verification-kit discovery;
• visible server_build identity and expanded VS Code diagnostics.

Benchmark update

Across 16 matched, verified task pairs in the latest six-task developer decision run, using TokenLighten reduced aggregate verified task cost by approximately 21% compared with the same agent using native tools only.

In a cross-module telemetry-wiring task, the agent had to locate the estimator health decision and connect it to the outbound system-status path. Across three verified repetitions, the median task cost with TokenLighten was approximately 33% lower.

In a multi-bug on-call task spanning flight control, mixer behavior, and mode transitions, the median cost among the two matched verified repetitions was approximately 29% lower. A third repetition had different verification outcomes between the two arms and is not included in that cost comparison.

The results also show where TokenLighten may help less:

• Benefits were modest for narrowly scoped calculation fixes and artifact-driven implementations whose target package was already constrained.
• Results were more variable when a task had mixed verification outcomes; those outcomes are excluded from the numeric comparisons above.
• Small known-location tasks can see little benefit or additional fixed MCP and guide overhead.

These are developer-run observations, not guaranteed savings. The v0.11.1 suite is broader than the published v0.9.x evaluation, so the two releases are not a direct before/after experiment. Actual cost varies by repository, task, client, model behavior, and provider pricing, and local estimates are not provider billing records.

Install the VS Code extension

After the release is published, download tokenlighten-vscode-extension-0.11.1.vsix from the Assets section. The same VSIX works on Windows, macOS, and Linux and does not require a separate Node.js or tl installation.

code --install-extension tokenlighten-vscode-extension-0.11.1.vsix

Open a trusted project folder, open the TokenLighten view, and choose Set up this workspace.

Build from source

Node.js 20 or later is required.

npm ci
npm run build
npm run test:packages
npm run test:bundle-cli
npm link --workspace packages/cli
tl doctor --json

See Getting started for workspace setup.

Privacy and permissions

Repository indexing and context selection run locally. TokenLighten does not add an AI model or upload repository contents on its own; the selected MCP client and model provider remain responsible for their requests.

The MCP server is read-only by default. Start it with --allow-write only when you intend to permit workspace changes.

Dependency security snapshot

For the v0.11.1 source tree audited on 2026-08-23, npm audit --omit=dev reported 0 Critical, 0 High, and 2 Moderate findings. The full source-development installation, including development dependencies, reported 1 Critical, 1 High, and 5 Moderate findings.

These counts are a dated snapshot, not a guarantee of zero vulnerabilities. Rerun npm audit --omit=dev or npm audit against the exact release you use.

Known limitations

• The desktop application and private benchmark harness are not included in the public v0.11.1 source release.
• Experimental retrieval, packing, reasoning, fast-path, and wire features remain off by default unless the changelog says otherwise.
• Source files larger than 1 MiB are not indexed for pathless task-pack location; direct path/range reads still work, and plain text/reference search scans up to 8 MiB.
• Very large repository indexes are not persisted once the 32 MiB cache cap would be exceeded, so the first call in a new server process may rebuild the index.
• Rename and reference edits remain conservative and lexical rather than language-server semantic operations.
• Scanned or image-only PDFs require OCR elsewhere; TAR, TAR.GZ/TGZ, 7Z, and RAR containers remain read-only.
• Benchmark outcomes vary by workload and evaluation window; do not advertise a guaranteed saving.

License and support

TokenLighten is source-available and is not licensed under an OSI-approved open-source license. Product/service integration and organizational or commercial redistribution require prior written permission. See Licensing and use policy.

Support is best effort. No response-time, resolution-time, uptime, or compatibility SLA is provided.

Assets

• tokenlighten-vscode-extension-0.11.1.vsix
• tokenlighten-vscode-extension-0.11.1.vsix.sha256

Verified VSIX SHA-256:

b983df44abc3871c97baaf87b03b63cfb88c4bb15a962e6f295bd810233fb081