This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+3 more
ReleasePort's take
Light signalThe release fixes three bugs: correct unwrapping of TypeScript wrapper expressions, accurate detection of member chains rooted at `this` and `super`, and elimination of false‑positive Vercel AI SDK matches.
Why it matters: These bugfixes resolve type‑safety regressions, prevent detector misclassification for this/super chains, and stop spurious Vercel AI detections—all critical for reliable SDK behavior in version v0.8.1.
Summary
AI summaryFixed three bugs affecting TypeScript wrapper expressions, this/super member chains, and Vercel AI SDK false positives.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Dependency | Low |
Upgrade instruction added for `tokentoll` to version v0.8.1 via pip and GitHub Action. Upgrade instruction added for `tokentoll` to version v0.8.1 via pip and GitHub Action. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Bugfix | Medium |
TypeScript wrapper expressions are now correctly unwrapped, supporting `as`, `satisfies`, `!`, parens, and `<T>` syntax. TypeScript wrapper expressions are now correctly unwrapped, supporting `as`, `satisfies`, `!`, parens, and `<T>` syntax. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Bugfix | Medium |
Member chains rooted at `this` and `super` are now detected correctly by the SDK detector. Member chains rooted at `this` and `super` are now detected correctly by the SDK detector. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Bugfix | Medium |
Vercel AI SDK detector no longer matches bare method calls like `generateText`, `streamText`, `embed`, and `embedMany` from non‑Vercel libraries. Vercel AI SDK detector no longer matches bare method calls like `generateText`, `streamText`, `embed`, and `embedMany` from non‑Vercel libraries. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Bugfix | Low |
Added three regression tests (`ts_wrappers.ts`, `this_chain.ts`, `cohere_embed_not_vercel.ts`) to cover the fixed issues. Added three regression tests (`ts_wrappers.ts`, `this_chain.ts`, `cohere_embed_not_vercel.ts`) to cover the fixed issues. Source: llm_adapter@2026-05-30 Confidence: low |
— |
Full changelog
Patch release driven by dogfooding v0.8.0 against five popular TS LLM repos: vercel/ai-chatbot, langchain-ai/langchainjs, anthropics/anthropic-sdk-typescript, openai/openai-node, mckaywrigley/chatbot-ui. Three real bugs surfaced, each with a minimal regression test pinning the fix.
Fixes
TypeScript wrapper expressions are now unwrapped
Code like:
client.chat.completions.create({
model: chatSettings.model as ChatCompletionCreateParamsBase[\"model\"],
max_tokens: 1024 as number,
});
previously failed to resolve because the resolver bailed on as_expression. Now as, satisfies, !, parens, and the legacy <T>value syntax are all transparent.
Member chains rooted at this and super
Class-based SDKs use this.client.x.y.create(...) everywhere. The detector required an identifier base segment, so every such call slipped through. Detection counts after the fix:
| Repo | Before | After |
|---|---|---|
| anthropic-sdk-typescript | 2 | 7 |
| langchainjs | 12 | 24 |
| openai-node | 23 | 25 |
Vercel AI SDK detector no longer matches method calls
generateText, streamText, embed, embedMany are imported from @ai-sdk/* and called bare. Accepting member-expression callees (this.client.embed(req)) produced false positives for libraries like langchain-cohere that expose methods with the same names. Removed 7 false positives from the langchainjs scan.
Tests
141 passing (was 138). Three new fixture files plus three regression tests, each derived from the failing real-world pattern:
ts_wrappers.tscoversas/satisfies/!/parens/<T>this_chain.tscoversthis.client.x.y.createcohere_embed_not_vercel.tscovers the Vercel false-positive case
Upgrade
pip install --upgrade tokentoll
- uses: Jwrede/[email protected]
No schema or CLI changes. Existing .tokentoll.yml files keep working.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Tokentoll
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]