feat: audit fixes — shared MODEL_PRICING, cache FNV hash, stats --json, cache subcommand, precompiled Homebrew formula

GokhanKabar · claude · GokhanKabar · commit 6aa35fda8fe6 · 2026-03-19T08:54:42.000+01:00
- src/lib.rs: add shared MODEL_PRICING constant (dedup across stats/token_cost/mcp)
- src/cache.rs: replace DefaultHasher with stable FNV-1a hash, add size_bytes/entry_count/clear
- src/cli.rs: add Stats{json} flag and Cache{Stats,Clear} subcommand
- src/main.rs: wire cache/stats subcommands, evict_old(30) on startup
- src/stats.rs: add run_json(), use MODEL_PRICING from lib
- src/mcp.rs: use MODEL_PRICING from lib
- src/token_cost.rs: use MODEL_PRICING from lib
- src/input.rs: add missing extensions (zsh, fish, cs, php, phtml)
- Formula/tersify.rb: migrate to precompiled binaries (darwin/linux arm/intel)
- .github/workflows/release.yml: add homebrew job to patch tap formula on release

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -149,65 +149,49 @@ jobs:
     name: Update Homebrew tap
     needs: release
     runs-on: ubuntu-latest
-    # Only run if the homebrew-tap repo exists (set secret HOMEBREW_TAP_TOKEN)
-    if: ${{ vars.HOMEBREW_TAP_ENABLED == 'true' }}
+
     steps:
       - uses: actions/checkout@v4
 
-      - name: Compute source tarball SHA256
+      - name: Compute SHA256 for each binary
         id: sha
+        shell: bash
         run: |
-          TAG=${{ github.ref_name }}
-          URL="https://github.com/rustkit-ai/tersify/archive/refs/tags/${TAG}.tar.gz"
-          SHA=$(curl -fsSL "$URL" | sha256sum | cut -d' ' -f1)
-          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
-          echo "url=$URL" >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-
-      - name: Update formula in homebrew-tap
-        uses: actions/github-script@v7
+          VERSION="${GITHUB_REF_NAME#v}"
+          BASE="https://github.com/rustkit-ai/tersify/releases/download/${GITHUB_REF_NAME}"
+
+          fetch_sha() {
+            curl -fsSL "$1.sha256" | awk '{print $1}'
+          }
+
+          echo "version=$VERSION"                                                                             >> $GITHUB_OUTPUT
+          echo "aarch64_darwin=$(fetch_sha $BASE/tersify-aarch64-apple-darwin.tar.gz)"                       >> $GITHUB_OUTPUT
+          echo "x86_64_darwin=$(fetch_sha $BASE/tersify-x86_64-apple-darwin.tar.gz)"                         >> $GITHUB_OUTPUT
+          echo "aarch64_linux=$(fetch_sha $BASE/tersify-aarch64-unknown-linux-musl.tar.gz)"                   >> $GITHUB_OUTPUT
+          echo "x86_64_linux=$(fetch_sha $BASE/tersify-x86_64-unknown-linux-musl.tar.gz)"                     >> $GITHUB_OUTPUT
+
+      - name: Checkout tap repo
+        uses: actions/checkout@v4
         with:
-          github-token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          script: |
-            const { sha256, url, version } = ${{ toJson(steps.sha.outputs) }};
-            const formula = `class Tersify < Formula
-              desc "Universal LLM context compressor — pipe anything, get token-optimized output"
-              homepage "https://github.com/rustkit-ai/tersify"
-              url "${url}"
-              sha256 "${sha256}"
-              license "MIT"
-
-              depends_on "rust" => :build
-
-              def install
-                system "cargo", "install", *std_cargo_args
-              end
-
-              def post_install
-                system "\#{bin}/tersify", "install", "--all"
-              rescue StandardError
-                nil
-              end
-
-              test do
-                assert_match version.to_s, shell_output("\#{bin}/tersify --version")
-                (testpath/"test.rs").write("// comment\\nfn main() {}\\n")
-                output = shell_output("\#{bin}/tersify \#{testpath}/test.rs")
-                refute_match "// comment", output
-              end
-            end
-            `;
-            const owner = 'rustkit-ai';
-            const repo = 'homebrew-tap';
-            const path = 'Formula/tersify.rb';
-            let sha_file;
-            try {
-              const { data } = await github.rest.repos.getContent({ owner, repo, path });
-              sha_file = data.sha;
-            } catch {}
-            await github.rest.repos.createOrUpdateFileContents({
-              owner, repo, path,
-              message: `tersify ${version}`,
-              content: Buffer.from(formula).toString('base64'),
-              sha: sha_file,
-            });
+          repository: rustkit-ai/homebrew-tap
+          token: ${{ secrets.TAP_GITHUB_TOKEN }}
+          path: tap
+
+      - name: Update formula
+        shell: bash
+        run: |
+          F="tap/Formula/tersify.rb"
+          sed -i "s/version \".*\"/version \"${{ steps.sha.outputs.version }}\"/"   "$F"
+          sed -i "s/PLACEHOLDER_AARCH64_DARWIN/${{ steps.sha.outputs.aarch64_darwin }}/"  "$F"
+          sed -i "s/PLACEHOLDER_X86_64_DARWIN/${{ steps.sha.outputs.x86_64_darwin }}/"    "$F"
+          sed -i "s/PLACEHOLDER_AARCH64_LINUX/${{ steps.sha.outputs.aarch64_linux }}/"    "$F"
+          sed -i "s/PLACEHOLDER_X86_64_LINUX/${{ steps.sha.outputs.x86_64_linux }}/"      "$F"
+
+      - name: Commit + push to tap
+        working-directory: tap
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Formula/tersify.rb
+          git commit -m "tersify ${{ steps.sha.outputs.version }}"
+          git push
diff --git a/Formula/tersify.rb b/Formula/tersify.rb
@@ -1,15 +1,45 @@
+# This file lives in the main repo for reference.
+# The canonical formula is maintained in rustkit-ai/homebrew-tap.
+#
+# To install:
+#   brew tap rustkit-ai/tap
+#   brew install tersify
+#
+# SHA256 values are updated automatically by .github/workflows/release.yml
+# on each release.
+
 class Tersify < Formula
   desc "Universal LLM context compressor — pipe anything, get token-optimized output"
   homepage "https://github.com/rustkit-ai/tersify"
-  url "https://github.com/rustkit-ai/tersify/archive/refs/tags/v0.3.3.tar.gz"
-  sha256 "0fc51141572dd7439284cd5a6089922b510eedb04596b7bc63ef7d4281a478f4"
+  version "PLACEHOLDER_VERSION"
   license "MIT"
-  head "https://github.com/rustkit-ai/tersify.git", branch: "main"
 
-  depends_on "rust" => :build
+  on_macos do
+    on_arm do
+      url "https://github.com/rustkit-ai/tersify/releases/download/v#{version}/tersify-aarch64-apple-darwin.tar.gz"
+      sha256 "PLACEHOLDER_AARCH64_DARWIN"
+    end
+
+    on_intel do
+      url "https://github.com/rustkit-ai/tersify/releases/download/v#{version}/tersify-x86_64-apple-darwin.tar.gz"
+      sha256 "PLACEHOLDER_X86_64_DARWIN"
+    end
+  end
+
+  on_linux do
+    on_arm do
+      url "https://github.com/rustkit-ai/tersify/releases/download/v#{version}/tersify-aarch64-unknown-linux-musl.tar.gz"
+      sha256 "PLACEHOLDER_AARCH64_LINUX"
+    end
+
+    on_intel do
+      url "https://github.com/rustkit-ai/tersify/releases/download/v#{version}/tersify-x86_64-unknown-linux-musl.tar.gz"
+      sha256 "PLACEHOLDER_X86_64_LINUX"
+    end
+  end
 
   def install
-    system "cargo", "install", *std_cargo_args
+    bin.install "tersify"
   end
 
   def post_install
@@ -20,7 +50,6 @@ def post_install
 
   test do
     assert_match version.to_s, shell_output("#{bin}/tersify --version")
-    # Compression smoke test
     (testpath/"test.rs").write("// comment\nfn main() {\n    println!(\"hello\");\n}\n")
     output = shell_output("#{bin}/tersify #{testpath}/test.rs")
     assert_match "fn main()", output
diff --git a/src/cache.rs b/src/cache.rs
@@ -9,8 +9,6 @@
 //! is merely a wrong cached result — the next run on changed content will
 //! produce a fresh entry.
 
-use std::collections::hash_map::DefaultHasher;
-use std::hash::{Hash, Hasher};
 use std::path::PathBuf;
 
 fn cache_dir() -> PathBuf {
@@ -20,11 +18,21 @@ fn cache_dir() -> PathBuf {
     PathBuf::from(home).join(".tersify").join("cache")
 }
 
+/// Stable FNV-1a 64-bit hash — deterministic across all Rust versions and platforms.
+/// Unlike `DefaultHasher`, this produces the same value for the same input always.
+fn fnv64(data: &[u8]) -> u64 {
+    let mut h: u64 = 0xcbf29ce484222325;
+    for &b in data {
+        h ^= b as u64;
+        h = h.wrapping_mul(0x100000001b3);
+    }
+    h
+}
+
 fn cache_key(content: &str, opts: u8) -> String {
-    let mut h = DefaultHasher::new();
-    content.hash(&mut h);
-    opts.hash(&mut h);
-    format!("{:016x}", h.finish())
+    let content_hash = fnv64(content.as_bytes());
+    let opts_hash = fnv64(&[opts]);
+    format!("{:016x}{:016x}", content_hash, opts_hash)
 }
 
 /// Retrieve a previously cached compression result.
@@ -42,6 +50,39 @@ pub fn set(content: &str, opts: u8, compressed: &str) {
     let _ = std::fs::write(dir.join(cache_key(content, opts)), compressed);
 }
 
+/// Return the total size in bytes of all cache entries.
+pub fn size_bytes() -> u64 {
+    let dir = cache_dir();
+    let Ok(entries) = std::fs::read_dir(&dir) else {
+        return 0;
+    };
+    entries
+        .flatten()
+        .filter_map(|e| e.metadata().ok())
+        .map(|m| m.len())
+        .sum()
+}
+
+/// Return the number of cached entries.
+pub fn entry_count() -> usize {
+    let dir = cache_dir();
+    let Ok(entries) = std::fs::read_dir(&dir) else {
+        return 0;
+    };
+    entries.flatten().count()
+}
+
+/// Delete all cache entries.
+pub fn clear() {
+    let dir = cache_dir();
+    let Ok(entries) = std::fs::read_dir(&dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let _ = std::fs::remove_file(entry.path());
+    }
+}
+
 /// Evict all cached entries older than `max_age_days` days.
 pub fn evict_old(max_age_days: u64) {
     let dir = cache_dir();
diff --git a/src/cli.rs b/src/cli.rs
@@ -78,9 +78,18 @@ pub enum Command {
         all: bool,
     },
     /// Show token savings statistics
-    Stats,
+    Stats {
+        /// Output as JSON instead of a formatted table
+        #[arg(long)]
+        json: bool,
+    },
     /// Reset saved statistics
     StatsReset,
+    /// Manage the compression cache (~/.tersify/cache/)
+    Cache {
+        #[command(subcommand)]
+        command: CacheCommand,
+    },
     /// Benchmark compression savings across all content types
     Bench,
     /// Estimate LLM API cost before and after compression
@@ -106,3 +115,11 @@ pub enum Command {
     #[command(hide = true, name = "hook")]
     HookRun,
 }
+
+#[derive(Subcommand)]
+pub enum CacheCommand {
+    /// Show cache size and entry count
+    Stats,
+    /// Delete all cache entries
+    Clear,
+}
diff --git a/src/input.rs b/src/input.rs
@@ -37,8 +37,10 @@ const INCLUDE_EXT: &[&str] = &[
     "swift", // Kotlin
     "kt", "kts", // Web
     "html", "htm", "css", // SQL
-    "sql", // Shell
-    "sh", "bash", // Data / config
+    "sql", // C#
+    "cs", // PHP
+    "php", "phtml", // Shell
+    "sh", "bash", "zsh", "fish", // Data / config
     "json", "jsonc", "yaml", "yml", "toml", // Logs / diffs
     "log", "diff", "patch", // Docs
     "md", "txt",
diff --git a/src/lib.rs b/src/lib.rs
@@ -42,3 +42,17 @@ pub mod detect;
 pub mod error;
 pub mod input;
 pub mod tokens;
+
+/// LLM pricing table: (model name, provider, input $/M tokens) — early 2026.
+pub const MODEL_PRICING: &[(&str, &str, f64)] = &[
+    ("claude-opus-4.6", "Anthropic", 15.0),
+    ("claude-sonnet-4.6", "Anthropic", 3.0),
+    ("claude-haiku-4.5", "Anthropic", 0.80),
+    ("gpt-5.4", "OpenAI", 5.0),
+    ("gpt-4o-mini", "OpenAI", 0.15),
+    ("o1", "OpenAI", 15.0),
+    ("o3-mini", "OpenAI", 1.10),
+    ("gemini-2.5-pro", "Google", 1.25),
+    ("gemini-2.5-flash", "Google", 0.15),
+    ("deepseek-v3", "DeepSeek", 0.27),
+];
diff --git a/src/main.rs b/src/main.rs
@@ -10,7 +10,7 @@ mod token_cost;
 
 use anyhow::Result;
 use clap::Parser;
-use cli::{Cli, Command};
+use cli::{CacheCommand, Cli, Command};
 use install::Target;
 use is_terminal::IsTerminal;
 use std::{
@@ -52,8 +52,29 @@ fn main() -> Result<()> {
                 install::uninstall_with_opts(target)?;
             }
         }
-        Some(Command::Stats) => stats::run()?,
+        Some(Command::Stats { json }) => {
+            if json {
+                stats::run_json()?;
+            } else {
+                stats::run()?;
+            }
+        }
         Some(Command::StatsReset) => stats::reset()?,
+        Some(Command::Cache { command }) => match command {
+            CacheCommand::Stats => {
+                let entries = tersify::cache::entry_count();
+                let bytes = tersify::cache::size_bytes();
+                println!("  Cache entries : {entries}");
+                println!(
+                    "  Cache size    : {:.2} MB  (~/.tersify/cache/)",
+                    bytes as f64 / 1_048_576.0
+                );
+            }
+            CacheCommand::Clear => {
+                tersify::cache::clear();
+                println!("✓ Cache cleared.");
+            }
+        },
         Some(Command::Bench) => bench::run()?,
         Some(Command::TokenCost {
             inputs,
@@ -84,6 +105,9 @@ fn resolve_target(cursor: bool, windsurf: bool, copilot: bool) -> Target {
 }
 
 fn run_compress(cli: Cli, cfg: &config::Config) -> Result<()> {
+    // Evict cache entries not accessed in the last 30 days (best-effort, non-fatal).
+    tersify::cache::evict_old(30);
+
     if cli.inputs.is_empty() {
         if io::stdin().is_terminal() {
             eprintln!(
diff --git a/src/mcp.rs b/src/mcp.rs
@@ -304,20 +304,9 @@ fn call_estimate_cost(id: Option<Value>, args: &Value) -> Value {
     let after = tokens::count(&compressed);
     let saved_pct = tokens::savings_pct(before, after);
 
-    const MODELS: &[(&str, &str, f64)] = &[
-        ("claude-opus-4.6", "Anthropic", 15.0),
-        ("claude-sonnet-4.6", "Anthropic", 3.0),
-        ("claude-haiku-4.5", "Anthropic", 0.80),
-        ("gpt-4o", "OpenAI", 5.0),
-        ("gpt-4o-mini", "OpenAI", 0.15),
-        ("o1", "OpenAI", 15.0),
-        ("o3-mini", "OpenAI", 1.10),
-        ("gemini-2.5-pro", "Google", 1.25),
-        ("gemini-2.5-flash", "Google", 0.15),
-        ("deepseek-v3", "DeepSeek", 0.27),
-    ];
+    let models_table = tersify::MODEL_PRICING;
 
-    let models: Vec<_> = MODELS
+    let models: Vec<_> = models_table
         .iter()
         .filter(|(name, _, _)| {
             model_filter
diff --git a/src/stats.rs b/src/stats.rs
diff --git a/src/token_cost.rs b/src/token_cost.rs
