TiboTattle Docs

Download security

A download you can check

For each published release, TiboTattle gives you a small set of independent signals: public source, platform signing, and the exact bytes for the download you chose.

Open source Review the app and its release tooling in the public repository.
Signed for the platform A published direct macOS download is Developer ID signed and notarized. Store subjects use their own signing and acceptance evidence. Other platforms appear here only after their own native release gates pass.
Exact bytes The website shows the version and SHA-256 for an available download; the release page carries the matching artifact.
Release evidence For a specific release, the GitHub release may also publish a canonical v1 manifest, SBOM, and release-specific provenance bundles that an independent verifier can check against the artifact; fields not published are explicitly null.

Four quick checks

Open the exact GitHub release, compare its checksum with your download, and let your operating system verify the publisher. For a release that publishes them, the canonical release-manifest.json, SPDX SBOM, and artifact-named provenance bundles are release assets on GitHub and must be independently checked against their named artifact. The website exposes availability and digest; it is not a second evidence store.

Use the release page for the exact version and artifact distribution.
Compare the published SHA-256 with the downloaded bytes.
Use Gatekeeper, Authenticode, a package signature, or the relevant store to verify the platform subject.
For source/build evidence, follow the release-specific commands in the canonical guide.

Evidence for this release

These checks let you confirm the publisher and channel, the exact downloaded bytes, and—when a trusted hosted workflow for that release publishes and verifies evidence for its exact final bytes—the source/build identity. They are practical, release-specific assurances, not a promise that software is vulnerability-free.

The download page lists the exact final Electron artifacts. macOS installers are Developer ID signed and notarized; the Windows installer is signed. The Linux AppImage is identified by its checksum. Source/build provenance is never inferred from a public repository or a checksum.

Read the full verification guide on GitHub for exact commands, release-manifest fields, direct-download versus Store distribution, and authoritative platform documentation.

See the TiboTattle 0.1.23 release notes and checksums for the current downloads.

Install TiboTattle

Choose the matching platform on the download page. The app includes its runtime.

To update an existing Mac installation, quit TiboTattle, replace it in Applications and open the new app. TiboTattle automatically transfers retained history and settings while preserving existing data and credentials. No manual backup or intermediate update is needed.

On first launch, read the complete local-source and automatic-sharing explanation and select Continue. Sharing can stay off; Settings keeps your choice. This public website never scans local files or accepts contributions.

What Refresh reads

Refresh processes usage metadata from the selected Codex sessions and archived_sessions folders. It also reads state_5.sqlite for rollout lineage, config.toml for service-tier settings, the installed Codex app-server account/read, account/rateLimits/read, and account/usage/read methods. Processing and derived personal results stay on this Mac.

Read your Codex week

Estimated API-equivalent value of the observed seven-day allowance.
Seven-day history across quota-reset observations.
Allowance metadata and uncertainty when the evidence supports it.

Gaps are not zero

Unknown, unavailable, stale, partial, and unattributed are different evidence states. A retained last-good value keeps its timestamp and source. TiboTattle does not smooth missing history or turn absent coverage into zero.

Refresh and recovery

The first deep pass is bounded, cancellable, and resumable. Closing the window keeps the app and companion running; quitting stops the pass and preserves completed checkpoints. If indexing reports an incompatible schema or integrity problem, preserve the original state and seek support—do not delete the only index or change its SQLite version.

Local state and uninstall

Electron keeps personal indexes, settings and prepared contributions in its private application-data folders for your operating system. Native Mac history and migration backups are preserved separately. Ordinary uninstall preserves local data. Homebrew --zap removes its documented native data and preferences, but keeps the Electron profile, migration backups, Codex data and Keychain credentials.

Optional contribution

Local use needs no account. Fresh Electron installations enable content-free sharing automatically, with no social sign-in. Turn it off in Settings or Community to save a persistent choice. Existing choices are preserved; undecided existing installations receive three visible notices before delayed activation. Choosing now cancels the remaining reminders. Older native Mac releases retain their review-and-approve flow.

An installation credential identifies a contribution source, not a unique person or provider account. Sharing off and device disconnect do not erase accepted hosted history or local analysis. Hosted erasure is handled by the service owner. See the privacy overview for the notice schedule, shared fields, retention, and identity limits.

Community evidence

The public site is read-only and does not enroll contributors. Switch the allowance chart between Aggregate, By plan, and By model. All three compare a full Pro 20x-equivalent weekly allowance at API prices, not each plan's actual allowance or money paid. Model estimates appear only when the evidence identifies a model's rate; missing or unstable history remains a gap. Sample counts can be as small as one account; see the publication disclosure. Activity totals alone are never presented as an allowance.

Updates and channels

In Electron, check for updates in Settings → About. In native Mac version 0.1.18, choose Check for Updates to install the Electron app. You can also download the new app, replace the old one and open it. Retained history and settings transfer automatically. Linux AppImage mounting requires FUSE 2; allow execution in the file properties before opening it.

Get support safely

Use GitHub Issues for ordinary bugs and the repository's private Security Advisory form for vulnerabilities. Include the app version, install channel, evidence state, and fixed diagnostic code. Never paste prompts, responses, credentials, account identifiers, or real session paths.

Platform support

Electron downloads are available for macOS 14 or later on Apple silicon and Intel, Windows 10 or later on x64, and Linux x86_64 as an AppImage. See the download page for platform-specific installation requirements.