token-card

Token Card

Produce an SVG card summarising this machine's AI coding agent usage — total tokens, equivalent API cost, current streak, and the split across agents — and write it into the working tree as a file the README can reference.

The card is a committed artifact rather than a hosted image, so it renders from the repository itself and does not depend on a third-party endpoint staying up.

When to Activate

• Someone wants a usage figure visible in a README or docs page.
• Someone asks for a shareable summary of their agent activity across tools.

Use /cost-report instead when the question is "what did I spend this week". The two read different sources and produce different things:

The tool this runs

@tokenchit/cli, MIT licensed: <https://github.com/iyashjayesh/tokenchit>

Pinned to an exact version, deliberately. @latest resolves to whatever the registry currently serves, and this tool reads local session logs — so a compromised future release would be executed with access to them before anyone had reviewed it. Pin, and raise the pin knowingly:

TOKENCHIT_VERSION=0.10.0

To check the pinned artifact before running it the first time:

npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball

Workflow

1. Ask before the first download. npx fetches the package from the npm registry and

executes it. That is a remote download of code that will read local logs, so get explicit confirmation from the user before the first run on a machine. If they decline, stop here and say what would have run.

1. Configure, unless this is a dry run. If .tokenchit.json is absent, run:

   npx -y @tokenchit/cli@0.10.0 init

It detects which agents have logs on this machine and records them. The file is meant to be committed and never contains a credential.

Skip this entirely when the user passed `--dry-run`, and report that .tokenchit.json would be created. A preview that writes a config file is not a preview.

1. Render the card. The bare command writes to the configured output — tokenchit.svg

unless .tokenchit.json names another path:

   npx -y @tokenchit/cli@0.10.0 sync

Append only the flags the user actually asked for, each spelled exactly as below. Do not copy a placeholder into the command — sync ignores an unrecognised positional argument rather than refusing it, so a bracketed [--dry-run] reaches the CLI as junk and the card is written anyway, which is the opposite of what was asked.

sync reads local files and sends nothing: no prompts, no code, no file contents leave the machine, and it transmits nothing to any server. The npx invocation around it is a registry download — that is the network access in this workflow, and step 1 is where it is agreed.

1. Report and offer. Print the figures it produced — tokens, equivalent cost, streak,

per-agent split — and the path written. If the repository has a README that does not yet reference the card, offer to add:

   ![tokenchit](./tokenchit.svg)

sync prints the path relative to the repository root. A Markdown image resolves relative to the file it sits in, so rewrite it for the README being edited: a card at docs/usage.svg is ./docs/usage.svg from the root README but ../usage.svg from docs/zh-CN/README.md. Pasting the printed path into a nested README points at docs/zh-CN/docs/usage.svg and renders broken.

Do not edit the README without being asked.

Stop after step 4. Publishing to the public leaderboard is a separate publish command that requires explicit opt-in, and is not part of this workflow — run it only if the user asks for it by name. unpublish removes the row and the account again.

Output

The path of the SVG, the figures it contains, and the markdown snippet for referencing it. On a dry run: what would have been written, and nothing on disk changed.

Notes

• Requires Node.js 22 or newer (the package declares engines: { node: ">=22" }). Nothing is

installed globally; npx fetches the pinned version per run.

• Reads token counts and timestamps only.