tokenstat v0.8.3

tokenstat v0.8.3

tokenstat is CLI-first, local usage tracking for AI coding agents. Stable
downloads below include the CLI for macOS, Linux, and Windows, plus the macOS
desktop app. Counters stay on your machine unless you opt into sync.

Install the CLI

curl -fsSL https://tokenstat.ai/install.sh | bash

Windows (PowerShell):

irm https://tokenstat.ai/install.ps1 | iex

Or download an archive below, verify SHA256SUMS, and put tokenstat on your PATH.

macOS desktop app

Download tokenstat-0.8.3-macos.dmg below, open it, and drag the app to
Applications.

The Windows desktop and Android clients are still maturing. Their unsigned
development builds remain available from the Preview workflow and are not
stable release downloads yet.

What's changed

The model picker has a search, chat follows a turn started on another device,
and notifications wait until you have looked away.

Added

• Type to filter the model list. An agent CLI can offer forty models or more,
  and "meta 1.3" finds meta/muse-spark-1.3. Agent, model and effort share one
  panel, each section showing what it is set to. Lists under ten entries stay
  a plain menu.
• A Refresh sits beside the models. The list comes from the agent's own CLI
  and is held for ten minutes, so a provider you added an API key for a minute
  ago was missing until that expired. Refresh reads the CLI again. Short
  lists keep Refresh inside the menu.
• Codex models. A Codex chat had no model picker, so it ran only the model set
  in its own config file.
• Muse backend in chat, automations, and transcripts. Automations run it
  bypass-only. Plan-mode chat drops the bypass flag and turns off its write
  and shell tools.
• Quick section tabs in the agent/model/effort picker. Agent, Model, and
  Effort read as separate settings before any scrolling.
• Setup guidance for Remote Reach. The phone shows an empty state and a
  recovery card when a Mac never registered for remote reach, with the exact
  steps and a retry. Mac machine settings carry the same switch as a compact
  preference with status text.

Fixed

• Notifications hold off while you are watching. A turn that ended in the
  conversation on screen still posted a banner and buzzed your phone. Now both
  wait for another app to be in front, the window to be away, or the keyboard
  to go untouched for a while. A phone driving a chat on a desktop no longer
  notifies itself. Watching one conversation from a Mac and a phone holds a
  lease per watcher, so leaving on one device no longer drops the other, and
  iPhone and iPad suppress their own banner for the open chat, same as the
  Mac.
• An open conversation keeps reading its events. It polls every 2 seconds
  while idle and every 400 ms once work appears, so a turn started on another
  device appears with no tap. A background hiccup no longer pops an error
  banner on an idle screen.
• Chat scroll corrections run after layout and combine pending corrections. Image previews keep their frame while decoding and when scrolled
  back into view, instead of collapsing and growing during row placement.
• Live follow holds the end while a reply streams and keeps pinning through
  late resizes from diffs and images. Opening a long chat still settles on
  the end. Sending a message locks follow until a scroll of your own leaves;
  estimate shifts no longer park the transcript behind Jump to latest.
• Scrolling a long transcript no longer stalls the app to a force-quit. The
  transcript builds a bounded window of rows with a control to reveal earlier
  ones, an open diff draws as one text instead of hundreds of rows, and hover
  stays off mid-fling. Fast scrolls stay responsive on conversations of any
  size.
• Tool rows classify shell intent by program name, so quoted commands land
  on the right card and echo "a > b" stays Shell. Repo-relative paths
  resolve, multi-file edits name each file, and a cancelled command closes
  as failed. Muse task starts survive replay order. Muse todo answers read
  as "4 todos (revision 2)" instead of raw JSON, and a failed one fails its
  card.
• Handing a long conversation to another agent keeps early turns. The inline
  summary is unchanged; when turns fall out of it, the new agent gets the
  path to the full history beside it and reads further only when needed.
• Model lists parse the Codex answer by id, reap a hung list command with
  its process group, keep provider-qualified ids visible, and share one run
  across Refresh taps. Picker Enter stays inside the visible filter and
  prefers the exact label, so a typed model id no longer selects the Agent
  row. A stale Effort filter clears when the new agent has no Effort
  section.
• A new automation starts on an agent. It opened on Shell, and a shell command
  belongs in the prompt field. Shell is still in the picker, at the end.
• A phone that cannot reach a computer names the fix. It showed the
  transport's own words, "no direct address" and "no_such_peer". Usually that
  computer has never had "Reach devices from anywhere" turned on, so the relay
  has never been told where it is. The recovery card now shows only for that
  never registered case. Timeouts and wakeups get a retry card instead.
• The vault is password-only. No identity-encrypted copy of the key sits on
  the server or on disk, and the app asks for the password again after a
  host restart. Password change and recovery rotation replace the key, both
  wraps, and every enrollment in one step. Recovery rotation needs Supporter
  or higher, like the rest of vault sync.
• A remote machine cannot be talked into reaching a third one: forwarding
  sent over a peer's own connection is refused at the door. Screen and
  terminal streams re-check permission for as long as they run, so taking
  access away ends a live stream, and vault rollbacks are refused.
• Android private keys live in the Android Keystore. Each key is verified
  before its plaintext copy is removed, one bad entry no longer blocks the
  rest, and a wrong vault password leaves the dialog open for another try.
• Windows model Refresh reports a host failure in a banner instead of
  crashing. Old hosts answer from cache.
• On pull requests, the art on the connect card is centred. Choosing which
  repositories tokenstat may open also stays on that screen after you connect.
  It used to vanish as soon as one repository worked, which left the Account
  screen as the only way back to it.

Full changelog