147 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
KeiSei84	633ee4aeeb	feat(limits): honest kei limits CLI + pet cache integration ... Cross-CLI subscription limits — research-grounded honest delivery after 5-parallel-agent investigation found that 4 of 5 CLIs have no public programmatic API for quota. ## Reality findings (research) - claude no public API; `anthropic-ratelimit-*` headers per-call only; Admin API exists but needs separate admin token. See dashboard. - grok no public API; `x-ratelimit-*` headers per-call only. No file. - agy interactive /usage slash-cmd shows 100% always (forum bug). No public API. - copilot no public quota API; web dashboard only. The 'gh api /user/ copilot_billing' endpoint does NOT exist. June 2026 billing migration to AI Credits further changes the surface. - kimi Moonshot /v1/users/me/balance returns $ balance only (no session/weekly quota fields). Requires MOONSHOT_API_KEY. ## Delivery (no false promises) - scripts/kei-limits.sh — probe-all honest tool. For Kimi: real curl call to Moonshot balance API if MOONSHOT_API_KEY set. For other 4: status marker + dashboard URL. - Pet integration — reads ~/.claude/pet/limits-cache.json IF present; shows Kimi balance segment ONLY when status=='live'. Pet does NOT poll; cache is populated by user-invoked 'kei limits'. - bin/kei limits arm + --json mode + --quiet mode for cron. Cache is bounded by user's explicit refresh; pet shows '(Xm old)' if older than 1h. No background polling, no rate-limit waste, no fake data.	2026-05-26 21:43:39 +08:00
KeiSei84	65d17007c3	feat(v0.42): 6 fixes from 4-CLI re-audit (CRITICAL + 2 HIGH + 3 MED) ... Convergent dogfood audit by Claude+Grok+Gemini+Copilot on v0.41 surfaced that the v0.41 'fixes' were incomplete. 3 of 4 reviewers independently found the same CRITICAL bypass; Gemini wrote a Rust test suite to verify. ## Convergent findings → v0.42 fixes [#1 CRITICAL] Symlink leaf bypass (3-of-4 convergent) v0.41 only canonicalized PARENT, then re-attached leaf as-is. Exploit: 1. kei_bash 'ln -s ~/.ssh/authorized_keys ./cfg.txt' (passes the bash hook chain — ln itself is non-destructive) 2. kei_write file_path=cfg.txt content=<key> validate_path saw $PWD/cfg.txt (allowed) → fs::write followed leaf symlink → overwrote authorized_keys. Fix: canonicalize FULL path (incl. leaf) when file exists; for new files, symlink_metadata on leaf and reject is_symlink. Now the denylist check sees the real target. [#2 HIGH] $HOME blanket-allowed = self-neutering (2-of-4 convergent) allowed_roots() defaulted to [$PWD, $HOME], denylist only had 4 secret dirs. So kei_write $HOME/.claude/hooks/no-github-push.sh content='exit 0' was ALLOWED — agent could overwrite the substrate's own policy hooks. Similar attacks on ~/.zshrc (RCE on next shell), ~/.gitconfig, ~/.npmrc. Fix: default to $PWD only. Denylist extended with .claude/, .grok/, .gemini/, .copilot/, .kimi/, all major shell-init files, and additional credential paths. KEI_ALLOWED_ROOTS for explicit widening. [#3 HIGH] Empty-section fail-OPEN (Gemini test-verified) v0.41 'fail-closed on missing config' fix was incomplete: if config file existed but section [bash]/[edit]/[write] was empty, load_chain returned Ok(vec![]) → run_chain early-returned Ok → action ran ungated. Fix: empty chain also FAIL-CLOSED with same KEI_POLICY_CHAIN_OPTIONAL opt-in. [#4 MEDIUM] load_chain still blocked tokio worker (Claude) v0.41 fix #4 converted handle_edit/handle_write reads to tokio::fs but left load_chain on std::fs. Slow/hung mount on policy-chain.toml would freeze a worker for every safe_* invocation. Fix: load_chain → async + tokio::fs::{try_exists, read_to_string}. [#5 MEDIUM] process_group only applied to bash, not hooks (Claude) v0.41 fix #5 set_process_group on kei_bash's child shell, but the hook subprocess (spawned per-hook in run_chain) was NOT in its own group. On hook timeout, kill_on_drop killed only the immediate hook process; grandchildren orphaned — the exact failure mode fix #5 was meant to prevent. Fix: set_process_group + killpg also on hook spawn in run_chain. [#6 MEDIUM] Per-step vs aggregate timeout (Claude) Doc claimed 'Hard cap on single chain + action — 60s'. Actual: each hook gets independent 60s, then action gets another 60s. For a 3-hook bash chain that's 240s max — 4× documented. Status: documented as known-limit; single-deadline impl deferred to v0.43 (not security-blocking, just a doc/correctness drift). ## Verification (8 smokes — all green) /etc/passwd → denied (system dir) ✓ ../escape.txt → denied (../ segment) ✓ /tmp/symlink → /etc/passwd writeable → denied (resolved /private/etc) ✓ NEW ~/.claude/hooks/no-github-push.sh → denied (substrate dir) ✓ NEW ~/.zshrc → denied (shell-init file) ✓ NEW policy-chain.toml empty [bash] → FAIL-CLOSED ✓ NEW KEI_POLICY_CHAIN_OPTIONAL=1 → opt-in pass-through ✓ kei_bash git-push-github → BLOCKED (regression) ✓ kei_bash echo HELLO → returns content (regression) ✓ cargo test -p kei-mcp: 3/3 still pass. ## Architecture note from Grok Grok architect flagged: safe_tools.rs is 474 LOC, exceeds Constructor Pattern 200-line threshold. v0.42 does NOT refactor (security fixes shipped first); v0.43 will extract path_guard.rs + chain_runner.rs. ## Per-CLI audit value demonstrated Claude — 5 issues + 5 minor, exhaustive line-anchored analysis Grok — architectural review with grep-verified citations Gemini — wrote Rust test project to verify findings (PoC code!) Copilot — partial fact-check, ran out of mid-task	2026-05-26 21:33:54 +08:00
KeiSei84	8086bec486	feat(v0.41): patch 5 Gemini security findings + Copilot doc bug + claude/grok perms ... Audit pass via Phase C dogfooding (security-auditor @ Agy/Gemini reviewing our own safe_tools.rs) surfaced 5 real bugs. All fixed. ## Gemini findings (5 real bugs) [#1 HIGH] FAIL-OPEN on missing config/hook Before: missing policy-chain.toml → "passing through" warning; missing hook script → "skipped" warning. Misconfig silently disabled enforcement. After: both paths FAIL-CLOSED with clear error surfaced to caller. Tests/dev can opt in to pass-through via KEI_POLICY_CHAIN_OPTIONAL=1. [#2 HIGH] Path traversal in kei_edit/kei_write Before: no validation; attacker could pass file_path=/etc/passwd or $HOME/.ssh/authorized_keys. After: validate_path() rejects '..' segments, system dirs (/etc/, /usr/, /System/, /var/, /root/), and dotfile-secret dirs (~/.ssh/, ~/.aws/, ~/.gnupg/, ~/.config/gcloud/). Override via KEI_ALLOWED_ROOTS for explicit single-root confinement. [#3 HIGH] CLAUDECODE/GROKCODE env bypass Behavior unchanged — this guard is a perf/UX optimization to avoid double-firing hooks when called from inside Claude/Grok (which already ran their own PreToolUse). Documented explicitly as NOT a security boundary: attacker controlling parent env already owns the invocation. Module header gains a DESIGN NOTE making this load-bearing. [#4 MED] std::fs in async context Before: handle_edit/handle_write used std::fs::{read_to_string,write}, which block the tokio worker thread. Pathological paths like /dev/random would freeze a worker indefinitely. After: tokio::fs::{read_to_string,write}.await — async I/O, worker stays responsive. [#5 MED] kill_on_drop only kills immediate child Before: timeout in kei_bash drops the Child handle; tokio's kill_on_drop SIGKILLs only the shell. Grandchildren (e.g., 'sleep 1000 &') orphaned. After: Unix-only: spawn child in its own process group (Command::process_group(0)), and on timeout libc::kill(-pid, SIGKILL) to take down the whole group. New libc dep on Unix. ## Copilot doc fix Doc claimed "kei-mcp exposes 4 built-in tools" without saying spawn_agent lives in tools.rs while kei_bash/edit/write live in safe_tools.rs. Validator agent flagged this as FALSE/MISLEADING. Now the doc spells out the two-file structure + adds a v0.41 hardening summary. ## claude/grok subprocess permissions Cross-CLI audit demo revealed that 'claude -p' and 'grok --print' returned empty when invoked headless with a real audit task — they need explicit permission flags to use Read/Grep tools in non-interactive mode. Added: claude: --permission-mode=bypassPermissions grok: --always-approve agy: --dangerously-skip-permissions Override via KEI_AGENT_PERMISSIVE=0 to keep strict default. Re-verified: claude+grok both echo SMOKE-OK-V41 with the flag. ## Verification cargo test -p kei-mcp --release → 3/3 pass MCP JSON-RPC smoke (all 7): - tools/list shows 4 built-ins ✓ - kei_bash blocks RULE 0.1 push ✓ - kei_bash passes 'echo OK' ✓ - kei_write rejects /etc/passwd ✓ - kei_write rejects ../ traversal ✓ - kei_write rejects ~/.ssh/* ✓ - missing policy-chain → FAIL-CLOSED with clear error ✓ - KEI_POLICY_CHAIN_OPTIONAL=1 → opt-in pass-through ✓	2026-05-26 19:48:29 +08:00
KeiSei84	75325aaf03	fix(hooks): clean up .task-*.start marker on agent_done (forgot in prev commit)	2026-05-26 18:53:24 +08:00
KeiSei84	ad6ccd2beb	fix(install,hooks): policy-chain.toml install + stale .task-*.start cleanup ... Two root-cause fixes: 1) hooks/_lib/policy-chain.toml was authored in v0.40 but the install loop in install/lib-hooks.sh globbed only *.sh, missing the TOML SSoT. Fresh installs got safe_tools fall-through ('no policy-chain.toml; passing through') because the file never landed. Extended the glob to include *.toml; chmod +x stays sh-only. 2) hooks/agent-event-done.sh now removes the .task-<id>.start marker that task-timer.sh wrote on agent_spawn. Without it completed sub-agents left stale markers in ~/.claude/memory/time-metrics/ for up to 2h (the pet's stale filter) inflating the running-agents counter. Verified end-to-end with HOME=/tmp/ksk-verify fresh install: - 38 agents on disk - 54 hooks + 4 _lib files (including policy-chain.toml) - all 7 kei-mcp-wire-*.sh scripts present - bin/kei has pick / run-via / mcp-wire arms - 'kei mcp-wire --list' detects all 5 CLIs with correct tiers - settings.json carries ONLY safety pack (Phase 2 opt-in honored)	2026-05-26 18:52:25 +08:00
KeiSei84	087be08e66	feat(pet): compact summary — sess + agents count + global tokens/cost ... The tamagotchi statusline was rendering one emoji+name+elapsed entry per running sub-agent, producing strings like: 🔬researcher·2m 🏗️architect·5m 🔪critic·1m 📐plan·30s ... When 4-8 parallel sessions ran agents simultaneously the line wrapped across the terminal. Pet now renders ONE compact summary: 💬N 🌍Tk 🤖N 💰$C Where: 💬 = distinct sessions today (parent_id from agent_spawn events) 🌍 = total tokens today across ALL sessions (suppressed when null upstream) 🤖 = running sub-agents NOW (count of <2h markers, all sessions) 💰 = total cost today (suppressed when zero or upstream null) Per-agent detail moved to future kei status command (TODO comment). Why: user feedback that the per-agent list was unreadable when many parallel sessions/agents fire. Compact counters preserve the at-a-glance value without cluttering the prompt.	2026-05-26 18:42:20 +08:00
KeiSei84	596e0b20a1	chore(release): bump v0.40.0 — Phase C cross-CLI hook enforcement ... plugin.json: 0.38.0 → 0.40.0; description updated with real counts (38 agents / 69 skills / 54 hooks / 86 blocks) and cross-CLI policy enforcement summary. bin/kei splash: v0.39 → v0.40 (Phase C ship).	2026-05-26 18:07:18 +08:00
KeiSei84	4e5e6bd2c0	feat(phase-C): cross-CLI hook enforcement via kei_bash/kei_edit/kei_write MCP tools ... Closes the "hooks only fire on Claude" gap. Phase C extends KeiSeiKit safety enforcement (no-github-push, safety-guard, destructive-guard, citation-verify, numeric-claims-guard) to any MCP-capable LLM CLI through a 3-tier honesty model. ## 3-tier model TIER 1 (full native): claude (existing), grok (port hooks to grok settings.json) TIER 2 (MCP-wrapped): copilot (--excluded-tools=shell + force kei_bash via MCP) TIER 3 (advisory): agy + kimi (cannot disable native shell; prompt-level only) ## Design (Constructor Pattern) 1. hooks/_lib/policy-chain.toml — SSoT: which hooks gate which tool (bash/edit/write) 2. _primitives/_rust/kei-mcp/src/handlers/safe_tools.rs — new module, 3 built-in MCP tools that synthesize Claude PreToolUse JSON, run hook chain, abort on exit-2, exec on all-pass. Same input contract → hooks reused as-is, no rewrite. 3. tools.rs short-circuit: kei_bash/kei_edit/kei_write dispatched before atom layer 4. 6 wire scripts: orchestrator + one per CLI (Constructor Pattern, no mixin) 5. bin/kei mcp-wire arm 6. docs/encyclopedia/cross-cli-policy.md — honest 3-tier matrix + verification ## Double-enforcement guard If kei-mcp invoked from a process with $CLAUDECODE=1 or $GROKCODE=1, the chain SKIPS — native hooks already fired. Wire scripts set these env vars in the MCP server registration for claude/grok respectively. On copilot/agy/kimi the env is unset → chain runs. ## Smoke (verified live) Block: kei_bash{command: forbidden-push-pattern} → JSON-RPC error -32603 with full "BLOCK — RULE 0.1 NO GITHUB PUSH" stderr ✓ Pass: kei_bash{command: "echo HELLO-FROM-KEI-BASH"} → result.content[0].text = "HELLO-FROM-KEI-BASH" ✓ tools/list: 4 built-ins present (spawn_agent + kei_bash + kei_edit + kei_write) ✓ ## Tests kei-mcp: 3/3 (tools_list assertions updated for atoms+4 built-ins). Build clean with toml = "0.8" dep added. ## Out of scope (deferred) - Codex CLI wiring (not installed locally) - ACP middleware proxy (transport, not middleware — ruled out at research) - Container/firejail sandboxing for agy/kimi (heavy; documented limit instead) - Native Rust PatternGate migration (optimization, separate phase)	2026-05-26 18:03:33 +08:00
KeiSei84	3fec43ea7e	feat(orchestrator): kei pick + spawn_agent MCP tool — true multi-LLM shell ... Closes the "Claude Code as single primary" gap. Now `kei` (no args) execs whichever CLI is configured as primary, and ANY MCP-capable orchestrator can spawn KeiSeiKit agents on any backend via the built-in spawn_agent tool. ## A — orchestrator picker bin/kei now reads ~/.claude/config/primary.toml and execs that CLI instead of hardcoding claude. New arms: kei pick interactive menu → set primary → launch it kei --on=<backend> one-shot launch of <backend> (no primary write) kei primary [<b>] get/set primary Splash shows `primary CLI: <backend>` so the orchestrator is visible. Failure mode: if primary's CLI isn't on PATH, prints install hint + offers `kei pick` recovery. scripts/kei-pick.sh — Constructor Pattern picker (<140 LOC). Lists all 6 backends with install status (✓/✗), highlights current primary, writes choice to primary.toml, execs the picked CLI. Honors stdin TTY gate (RULE TTY-INTERACTIVITY-GATE — -t 0, not -t 1) for non-interactive safety. ## B — spawn_agent MCP tool _primitives/_rust/kei-mcp/src/handlers/tools.rs gains a built-in `spawn_agent` tool, exposed alongside discovered atoms: - inputSchema: { name: str, task: str, on?: backend-enum } - Calls kei-agent-cli.sh internally with same DNA resolution - 60s timeout, kill-on-drop - Honors KEI_AGENT_CLI env for testing Smoke 2026-05-26 (MCP stdio JSON-RPC round-trip): spawn_agent(name=smoke-test, on=claude) → "SMOKE-OK" ✅ spawn_agent(name=smoke-test, on=grok) → "SMOKE-OK" ✅ Why it matters: Claude Code has a native Agent tool. Grok / Agy / Copilot / Kimi don't have an equivalent native sub-agent surface — but they all speak MCP. spawn_agent gives them KeiSeiKit's sub-agent capability when they're the orchestrator. The chosen orchestrator no longer caps the sub-agent fleet. ## Other _primitives/_rust/kei-mcp/Cargo.toml: tokio gains "io-std" feature (was missing — main.rs uses tokio::io::stdin/stdout). This fixes a latent build error unrelated to this PR (kei-mcp wasn't building cleanly before). Tests: tools_list assertions updated for the +1 built-in tool (3 total instead of 2 with atoms; 1 instead of 0 on empty root). All MCP tests pass. Assembler 3/3 golden tests still pass (provider field is optional).	2026-05-26 16:48:23 +08:00
KeiSei84	e4980f6ad7	feat(dna): provider+model in agent DNA; kei primary; smoke-tested 4/5 CLIs ... Makes KeiSeiKit truly multi-LLM: any agent can declare its preferred backend in its manifest. The DNA resolver picks the right CLI; `kei primary` swaps the fleet-wide default. KeiSeiKit is no longer tied to Claude Code single-model. Resolution order: --on=<backend> → manifest provider → primary.toml → claude Files: _assembler/src/manifest.rs + Option<String> provider field _assembler/src/assembler.rs emit provider: in frontmatter (when set) scripts/kei-agent-cli.sh DNA resolver; `kei primary` get/set; `kei agent` arm (DNA-driven); honest kimi handling (TUI-only) bin/kei new arms: agent, primary _primitives/cli-backends.toml mark kimi as tui-only docs/encyclopedia/multi-cli-agents.md rewritten with DNA flow, smoke results, rule-enforcement caveat Smoke 2026-05-26 (real CLI invocations): claude ✓ via `claude -p` grok ✓ via `grok --print` (DNA: manifest provider=grok) agy ✓ via `agy --print` (Antigravity / Gemini) copilot ✓ via `copilot --prompt` (1 Premium / 9s / 20.6k tok) kimi ⚠ TUI-only, no print mode; need `kimi acp` JSON-RPC client codex — register-only (not installed locally) Rule-enforcement caveat documented: KeiSeiKit hooks fire only inside Claude Code's PreToolUse pipeline. Non-claude backends carry the agent's PROMPT but not the hook layer. For tool-level policy on non-claude, route through MCP. ALSO: fix(stop-hook) — RULE 0.14 session-end-dump.sh "Recombobulating..." 4-minute hang on 18MB+ transcripts. Root cause: kei-memory ingest + frustration- matrix scan + kei-sleep-sync ran sync at session end. Now async-detached with per-op portable timeout (timeout/gtimeout/perl alarm). Hook returns in 0.03s. Raw JSONL saved sync; only index/embedding step deferred (idempotent on session_id so safe).	2026-05-26 16:21:11 +08:00
KeiSei84	3be9a8bf71	feat(multi-cli): kei run-via <backend> — agents over external LLM CLIs ... Adds a uniform launcher that lets any KeiSeiKit agent run on whichever LLM CLI you have a subscription to. Pick by familiarity, pricing, or to get a second opinion on the same prompt. Backends (locally installed, by subscription): claude Claude Code (claude -p) grok xAI Grok (grok --print; native --agent supported) agy Antigravity (agy --print) alias: antigravity copilot GitHub Copilot (copilot --prompt) kimi Moonshot Kimi (stdin, TUI primary) codex OpenAI Codex (codex -p) register-only Files: _primitives/cli-backends.toml SSoT backend table scripts/kei-agent-cli.sh launcher; loads ~/.claude/agents/<n>.md, strips frontmatter, composes with task, execs backend non-interactive bin/kei new arm: run-via | via | run | agent-via docs/encyclopedia/multi-cli-agents.md user-facing docs + usage Auto-installed via lib-scaffold.sh:77 glob (no install code change needed). Test plan: kei run-via list # status + agents kei run-via grok critic "review src/auth.rs" # via Grok kei run-via agy critic "review src/auth.rs" # via Antigravity kei run-via copilot critic "review src/auth.rs" # via Copilot KEI_NATIVE_AGENT=1 kei run-via grok critic "..." # native --agent	2026-05-26 15:05:02 +08:00
KeiSei84	518d95df80	chore(public-prep): repoint public install + marketplace off private keigit ... Public installs/clones must not hit the author's private Forgejo (keigit.com, direct Vultr, no Cloudflare, fail2ban) — that server times out under load and is the root of the 443 connect failures. - web-install.sh: default KEISEI_REPO keigit -> github.com/KeiSeiLab/KeiSeiKit-1.0 - plugin.json: homepage -> https://keisei.app; repository -> github - .gitmodules: kei-registries submodule -> github.com/KeiSeiLab/kei-registries (so a public --recursive clone resolves; repo still private until launch) - README.md: manual `git clone` line -> github Left intentionally on keigit: the @keisei/mcp-server npm registry (docs state it's an author-operated mirror, not a community service). Repos stay PRIVATE on github until launch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 21:15:32 +08:00
KeiSei84	abae256c1d	feat(install): opt-in hook packs + stack profiles (public posture) ... A fresh install now activates only the safety pack; discipline hooks and agents are opt-in via an onboarding step (step 6) or `kei configure`. "People don't need Rust-only" — they pick their own stack. - _primitives/hook-packs.toml: SSoT mapping pack -> hooks, stack -> packs + agent groups. safety always on; evidence/observability/epistemic/ orchestration/git-guard/stack-rust opt-in. rust-first/no-python only under the systems stack; git-guard (no-github-push) opt-in only, pulled by no stack. - lib-profile: extract generic _toml_array (reused by lib-packs); profile_members becomes a thin wrapper (no behavior change). - lib-packs: pack/stack/agent resolvers + selection loader. - lib-hooks: filter_snippet_by_packs (install-time allowlist) + prune_kit_hooks (reconfigure removes deselected kit hooks, keeps foreign ones); activate_hooks rewired to prune + filter + merge. No custom settings.json fields (/doctor safe). - lib-agents: install_manifests filters by stack agent set (empty = install all). - onboarding: pick_stack step (reuse _onb_read_choice), persists stack_profile + enabled_packs to onboarding.toml; i18n STR_* added. - bin/kei configure -> scripts/kei-configure.sh (re-pick without reinstall); install stamps ~/.claude/.kei-kit-dir. - numeric-claims-guard: money regex no longer matches shell positionals ($1..$9); requires decimal / unit / 2+ digits / tilde. Real money + time still caught. - gate one-liner added to 8 discipline hooks (runtime toggle via hooks-control). Verified end-to-end (scratch HOME): fresh=safety only; evidence pack adds numeric+citation; systems stack wires rust-first + 14 base/systems agents (no data-science/swift); reconfigure-shrink prunes kit hooks but keeps a foreign hook; settings schema clean; assembler golden 3/3. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 17:27:14 +08:00
KeiSei84	2ffb3a8b1e	chore(public-prep): scrub author identity + private-IP references ... Pre-public Phase 1. Remove personal/IP traces that should not ship in a general-purpose kit; keep only intended author attribution. - no-github-push.sh + hooks-and-blocks.md + ci-scaffold: drop "KeiTech unfiled patent IP / trade secrets / priority date" wording; reword as a generic opt-in guard for keeping code on a private remote. - check-error-patterns.sh: remove author-local absolute path from the tombstone comment. - graph-export-watcher.sh: default viz dir to ~/.local/share/kei/graph-viz (was a personal project path). - agent manifests (cost-guardian, modal-runner, infra/ml/code-implementer) + ci.yml: strip private memory references and dated personal incidents; keep the generic cost/ops lessons. Snapshots regenerated; golden 3/3. Kept intentionally: author attribution (NOTICE / README / Cargo / plugin). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 15:00:07 +08:00
KeiSei84	7b453aac1b	feat(msg): /msg skill — read/write cross-session mailbox by @id ... Thin skill wrapper over the existing kei-message jsonl mailbox so the user (and agents) can talk between Claude Code sessions with @id syntax: /msg read my inbox (to me or "all") /msg @frontend text send to a session (identity = its cwd basename) /msg all text broadcast /msg list | who whole bus / known recipients - kei-message.sh send now accepts a leading @name as the recipient (first token only; a later @x stays literal). --to still works. - skills/msg/SKILL.md documents the identity model (cwd-basename), pull delivery (recipient's next turn via mailbox-inject hook), and the first-contact discovery path (who / all). - README skills count 68 -> 69. Verified: @name/all/--to parsing (3 cases) + end-to-end send/inbox/who via the live script in a sandbox HOME. Skill registered + discoverable. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 14:43:04 +08:00
KeiSei84	3aff00290f	fix: pre-public audit — critical install regression + 7 blockers ... CRITICAL: lib-hooks.sh had an apostrophe ("user's") inside the jq program's bash single-quote, closing the quote and producing a parse error so EVERY install aborted at source time (install.sh:71). Caught by a full minimal e2e (rc=2 then rc=0 after fix). Reworded the jq comment to drop the apostrophe. Audit blockers fixed: - MANIFEST: drop cortex-ui (no such primitive) from 4 profiles + block; lib-menu desc no longer references it. Profile resolution verified clean. - lib-dev-hub-forgejo / -zoekt: source lib-launchd.sh (register_launchd was undefined, so full-hub dev-hub install would fail at runtime). - kei-message: portable 16-digit id. BSD date prints literal "N" for %N; fall back to /dev/urandom. Verified numeric in both code paths. - bootstrap non-TTY default cortex to minimal (matches install.sh; avoids divergent curl-bash vs direct-install behaviour and 105-crate surprise). - install.sh stamps ~/.claude/.kei-profile; bin/kei reads it (splash showed "profile: ?" before, since .installed holds only primitive names). - README hook count 38 to 54 (real: ls hooks star dot sh). - web-install warns before it discards local edits in the managed clone. Verified: 106 shell files bash -n clean; minimal e2e rc=0 (38 agents, 57 hooks, 69 skills, profile stamped, mailbox present). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 10:48:06 +08:00
KeiSei84	c347f329aa	feat(kei message): persistent inter-session mailbox + pull-inbox hook ... Any Claude Code session can now message any other (not just Agent-Teams teammates), without tmux. Append-only jsonl bus + a UserPromptSubmit hook that pulls unread into each session's context per turn. - scripts/kei-message.sh: `kei message send [--to <name|all>] <text>` / inbox / list / channels. Identity = basename(cwd); broadcast channel "all". - hooks/mailbox-inject.sh: UserPromptSubmit. Injects messages addressed to this session (cwd-basename) or "all", since last turn; per-session cursor dedup; first turn sets baseline (no history dump); never echoes own messages. - bin/kei: `kei message ...` dispatch before splash. - lib-scaffold: copy ALL scripts/*.sh on install (picks up kei-message.sh). - settings-snippet: wire mailbox-inject under UserPromptSubmit. Store: ~/.claude/mailbox/messages.jsonl. Bypass: KEI_MAILBOX_BYPASS=1. Verified: addressed delivery, broadcast, first-turn no-dump, cursor dedup, no self-echo (2-session simulation). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 15:00:10 +08:00
KeiSei84	d34a375da7	feat(install): first-run is a full guided onboarding (agents + sleep + cortex) ... Sleep/cortex setup were left as separate things the user had to discover. Make the SessionStart first-run hook a single ordered post-install checklist that Claude walks the user through: (1) /onboard projects → per-project agents, (2) /sleep-setup → nightly REM (recommend local-only, no remote git needed), (3) /cortex-setup (only if the cortex daemon primitive is installed). Confirm + run each, skippable. Fires once (marker), then silent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 21:27:01 +08:00
KeiSei84	582b51155f	feat(install): first-run nudge to /onboard projects after bundle install ... After install the user got no guidance to set up project agents — the summary only mentioned /new-agent (single), never /onboard (scan all projects → create a specialist per project). The installer is bash and can't launch a skill, so: - New SessionStart hook first-run-onboard.sh: on the FIRST Claude Code session after install, injects context nudging the user/Claude to run `/onboard ~/Projects/*` (scan stack + create per-project agent, delegates to /new-agent). Fires once (marker ~/.claude/.kei-firstrun-shown), then silent. Reset: rm the marker. - settings-snippet.json: wire the hook under SessionStart (matcher "*"). - lib-summary.sh next-steps: lead with `/onboard ~/Projects/*`, then /new-agent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 19:05:00 +08:00
KeiSei84	d89ddf0c74	fix(install): normalize null hook matcher → "" on merge (Claude Code /doctor) ... Users with pre-kit hooks that have no `matcher` field end up with matcher:null, which Claude Code /doctor rejects ("Expected string, but received null") and skips the whole settings file. The jq merge preserved null as-is, so every reinstall re-surfaced the error. Now map(.matcher //= "") before group_by → null/absent collapses to "" (match-all), one group per matcher. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 16:53:27 +08:00
KeiSei84	9866d716d7	style(install): KeiSei brand colors + ASCII banner in installer output ... - KEISEI ASCII logo (голубой) shown at install start via kei_banner(). - `[install]` prefix → тёмно-жёлтый (38;5;178); primitive names → голубой (38;5;39) in both the plan and the per-primitive install lines. - Language menu: code голубой, native name тёмно-жёлтый. - lib-log COLOR now enables under curl|bash too: detect terminal via `[ -t 1 ] || /dev/tty` (web-install tees stdout → -t 1 false → colors were silently off). This is color detection, not an interactivity gate (pairs with no -t 0 — does not violate tty-interactivity-gate rule). Verified piped-under-pty: banner + gold [install] + blue/gold language menu all render through the tee logfile. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 16:01:33 +08:00
KeiSei84	7a2f6568b3	fix(install): wire PATH in curl|bash — gate pathway on stdin, not stdout ... The PATH-wiring step (~/.claude/bin, where the `kei` entry-point lives) was gated on `[ -t 0 ] && [ -t 1 ]`. curl|bash tees stdout to a logfile so -t 1 is false → pathway_install was skipped → `kei: command not found` after install. Same tee/-t1 trap as the onboarding gates (this one lived in the top-level install.sh, missed by the earlier variant grep which only scanned install/). Eradicated the pattern across the tree: install.sh pathway gate → [ -t 0 ] lib-menu.sh profile-menu gate → [ -t 0 ] lib-wizard.sh sleep-wizard gate → [ -t 0 ] Verified piped-under-pty with /dev/tty reattach: .zshrc gets the kei-substrate block (~/.claude/bin on PATH); non-interactive still skips. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 14:12:14 +08:00
KeiSei84	2873474486	style(kei): brand splash colors (голубой logo + жёлтый values), bump v0.16→v0.38 ... Splash was cyan; rebrand to the blue/yellow palette: sky-blue (38;5;39) logo + dim-blue separators, gold (38;5;220) brand line + field values. Version string was stale (v0.16 → v0.38). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 13:49:44 +08:00
KeiSei84	6d68a3f1ad	fix(onboarding): no crash on text input, Claude Code default, explanations ... Three issues a real curl|bash user hit: 1. CRASH: typing a word (e.g. "claude") at any menu → $((ans-1)) treats it as a variable in bash arithmetic → "unbound variable" under set -u → install dies. Added _onb_read_choice (numeric+range validation, re-prompt) for all 4 menus. 2. No Claude under subscription: the kit installs into Claude Code yet the wizard offered only OpenAI Codex under subscription. Added claude-code provider (bumped kei-registries submodule c559065→b904993) + made subscription the default transport and claude-code the default provider — Enter,Enter,Enter lands on Claude Code (no API key). 3. install died at line 178 for any no-key provider (claude-code/codex/local): onboarding_run ended on a `&&` that is false when there are no auth keys → returned 1 → set -e aborted. Added explicit `return 0`. Plus per-step explanations (en+ru) and auto-select when a step has one option. Verified piped-under-pty: Enter-defaults → Claude Code, junk input → re-prompt (0 crashes), full install completes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 12:42:50 +08:00
KeiSei84	15d50f1478	fix(web-install): don't hang after 'delegating' in interactive curl|bash ... curl|bash makes bash read THIS script byte-by-byte from the pipe. A bare `exec < /dev/tty` swapped stdin, then bash tried to read the NEXT line (the `exec ./bootstrap.sh`) from the keyboard → infinite hang after "delegating to bootstrap.sh", bootstrap never started, no profile/language menu. Fix: merge the redirect INTO the bootstrap exec (one command), so the process is replaced the instant stdin is swapped and bash never reads another script byte from the (now-wrong) stdin. Verified: piped-under-pty buggy=HANG, fixed=bootstrap starts with stdin=tty. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 10:58:44 +08:00
KeiSei84	01d5aa510f	fix(install): run onboarding + profile wizard in curl|bash (gate on stdin, not stdout) ... web-install.sh tees stdout to a logfile (exec > >(tee) 2>&1), so -t 1 is false even in an interactive curl|bash. The /dev/tty fix reattached stdin but the wizard gates required BOTH -t 0 and -t 1, so onboarding (language select) and bootstrap's profile wizard were silently skipped on the primary install path. Prompts go to stderr and read from stdin — interactive stdin is the only real requirement (already the proven pattern in lib-plan.sh confirm screen). Gates now require interactive stdin only: bootstrap.sh profile wizard lib-onboarding.sh onboarding_should_run + preflight-continue prompt lib-preflight.sh CLI-install offer prompt lib-hooks.sh activate-hooks prompt Non-interactive (CI / </dev/null / no /dev/tty) still skips — verified. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 03:58:55 +08:00
denis	2fa348f467	feat(pet): comprehensive language map (60+)	2026-05-21 18:31:05 +00:00
denis	4e62e921e9	feat(pet): comprehensive reflection (60+ langs, all agents, errors)	2026-05-21 18:30:01 +00:00
denis	e8df152549	feat(pet): show session tokens + context% from statusLine stdin	2026-05-21 17:50:47 +00:00
denis	6d8f07ab90	refactor(pet): read kit agent tracking (SSoT), drop duplicate	2026-05-21 17:15:07 +00:00
denis	752654f049	refactor(pet): read kit agent tracking (SSoT), drop duplicate	2026-05-21 17:14:55 +00:00
denis	13e536ec1c	refactor(pet): read kit agent tracking (SSoT), drop duplicate	2026-05-21 17:14:17 +00:00
denis	a965ad3b7c	fix(pet): token extraction via jq totalTokens + persist token total	2026-05-21 17:05:48 +00:00
denis	ac1f0ebaec	fix(pet): token extraction via jq totalTokens + persist token total	2026-05-21 17:04:38 +00:00
denis	3c67914788	feat(pet): agent emojis + multi-agent display + plan emoji + language icons	2026-05-21 12:21:00 +00:00
denis	ac6a020612	feat(pet): agent emojis + multi-agent display + plan emoji + language icons	2026-05-21 12:20:47 +00:00
denis	e129745319	feat(pet): agent emojis + multi-agent display + plan emoji + language icons	2026-05-21 12:20:45 +00:00
denis	cb694cc96a	fix(web-install): tolerate missing /dev/tty in non-interactive curl|bash	2026-05-21 10:53:21 +00:00
denis	305787fae3	fix(install): make fresh install complete + ship tamagotchi (#1)	2026-05-20 18:50:09 +00:00
Denis Parfionovich	53ada048b2	fix(install): backup_file mv→cp -a, install --activate-hooks больше не падает ... gx10 fail при первой установке (фото юзера 2026-05-18): jq: error: Could not open file /home/keisei/.claude/settings.json [error] jq-merge produced invalid output; ... unchanged [error] install failed at line 126; rolled back Root cause: backup_file() (install/lib-backup.sh:56) делал `mv target backup`, затем activate_hooks() → _jq_merge_hooks() пыталась читать оригинал target'а через jq — но оригинал уже унесён mv'ом, открыть нечего. jq fail → rollback всей установки. Fix: cp -a вместо mv (как уже сделано в backup_path() для директорий). Атомарный безопасный бэкап; оригинал остаётся для jq, потом _jq_merge_hooks атомарно переписывает его mv tmp → target.	2026-05-18 14:33:22 +08:00
Denis Parfionovich	fc0758d2bb	chore: версия 0.38.0 единая + warning-fixes + mold для release-job ... 1. Версии npm-пакетов приведены к 0.38.0 (был зоопарк 0.14.0/0.14.6): _ts_packages/{,packages/{gmail,grok,mcp-server,recall,telegram,youtube}-adapter} 2. Rust warnings (cargo check workspace): - kei-cortex: deprecated validate_path → validate_path_lexical, удалён orphan-wrapper в read.rs, struct Input → pub(crate) - frustration-matrix: #[allow(dead_code)] на confusion_* поля EvalReport + train_from_dir (будущий CLI) 3. CI release.yml job 'release' падал на Build kei-changelog: clang invalid linker '-fuse-ld=mold' — в .cargo/config.toml жёстко прописан mold для linux. Добавлен Install mold шаг (как уже сделано в build-release matrix).	2026-05-18 13:41:37 +08:00
Denis Parfionovich	d1cbdd8892	fix(ci): vendored openssl-sys для cross-compile x86_64-apple-darwin ... CI run 26014515768 — `x86_64-apple-darwin` упал на webauthn-attestation-ca → openssl-sys 0.9.115: pkg-config не настроен для cross-compile (macos-latest = arm64, target = x86_64). Фикс: добавлен прямой dep `openssl-sys = { version = "0.9", features = ["vendored"] }` в kei-auth-webauthn — компилит openssl из исходников, не требует системного. Транзитивно достаточно одного объявления feature во всём workspace (Cargo unifies features).	2026-05-18 13:08:40 +08:00
Denis Parfionovich	5f6b4f2620	fix(ci): regenerate bun.lock — sync с package.json для CI release ... CI v0.38.0 mcp-server билды все 5 упали на `bun install --frozen-lockfile` с «lockfile had changes, but lockfile is frozen». В lockfile отставали: - @keisei/mcp-server 0.14.0 → 0.14.6 - ajv 8.18.0 → 8.20.0 - express-rate-limit 8.3.2 → 8.4.1 - hono 4.12.14 → 4.12.16 Пересоздан `rm bun.lock && bun install` под bun 1.3.14 (тот же что в CI).	2026-05-18 13:01:36 +08:00
Denis Parfionovich	a8101b8f60	fix: install audit 2026-05-18 — cortex profile + TTY in web-install ... audit-2026-05-18 (соседняя сессия на gx10, 3 бага из 5 подтверждены): #1 [HIGH] cortex profile сломан — kei-cortex depends on kei-router path-dep'ом, а kei-router → kei-model. kei-model не было в profile list, cargo build падал с «failed to read kei-model/ Cargo.toml». Добавил kei-model в cortex profile. #3 [HIGH] cortex-ui отсутствует в репо — был в profile list, но исходника нет ни в _primitives/_rust/, ни в _ts_packages/. Удалил из profile. #4 [MEDIUM] web-install.sh теряет /dev/tty — exec | tee + curl|bash делают stdin pipe, wizard'у read нечего читать, onboarding падает на первом prompt. Переподключаю stdin к /dev/tty перед exec bootstrap.sh, если /dev/tty доступен. #2 (linux-arm64 prebuild) — tag v0.38.0 не запушен на github, CI release.yml не сработал. Требует RULE 0.1 triple-confirm. #5 (non-TTY default = minimal) — уже корректно, install.sh:141 `PROFILE="${PROFILE:-minimal}"` + lib-menu.sh skip on non-TTY.	2026-05-18 12:38:35 +08:00
Denis Parfionovich	1d958b3587	fix(security): patent-leak + classical-safety audit fixes ... PATENT-LEAK (HIGH): - hooks/no-python-without-approval.sh: genesis-verify пример → my-project - docs/encyclopedia/rust-crates-H-N.md: убран термин «Genesis IP, ITAR» PATENT-LEAK (MEDIUM): - CHANGELOG: project-vortex → reduced scope - _blocks/registries (submodule bump): убраны имена приватных project-specialists из комментария agent-profiles.toml - docs/encyclopedia/skills-and-agents.md: ML/RL/CfC → ML/RL CLASSICAL-SAFETY (MEDIUM): - install/lib-preflight.sh: eval "$version_cmd" → bash -c "..." (защита от инъекции если providers.toml расширят) - _primitives/provision-{vultr,hetzner}.sh: /tmp/$$ → mktemp (устраняет symlink TOCTOU race) - web-install.sh: chmod 600 + umask 077 на ~/.keisei-install.log (Forgejo admin creds + токены в логе) - scripts/regen-counts.sh: eval "$1" → bash -c NOT FIXED (требуют действий юзера): - HIGH: @keisei scope не зарегистрирован на npmjs.org — typosquat возможен пока не задан NPM_TOKEN и не сделан publish - HIGH: install.keisei.app DNS не настроен — DNS-hijack возможен - LOW: parfionovich@keilab.io в SECURITY.md, plugin.json, ~40 Cargo файлах — intentional contact, оставлен Локальный git author установлен на parfionovich@keilab.io вместо parfionovichd@icloud.com (только для будущих коммитов в этом репо).	2026-05-18 12:05:25 +08:00
Parfii-bot	170c850ca0	fix(install): public install via keigit.com (Vultr) — no github needed ... Что меняется: - README.md: git clone instruction → https://keigit.com/keisei/KeiSeiKit-1.0.git (был приватный github, внешний clone падал 404) - .gitmodules: kei-registries submodule → keigit.com/keisei/kei-registries.git (был приватный github, --recurse-submodules падал) - web-install.sh: KEISEI_REPO default → https://keigit.com/keisei/... (был git@github.com:KeiSeiLab/...) - install.sh: NO_EXECUTE check ПЕРЕД check_prereqs, чтобы --no-execute работал без установленных зависимостей. - install/lib-args.sh: новый флаг --skip-prereqs (SKIP_PREREQS) — для CI и dry-run сценариев. - marketplace.json + plugin.json: новые манифесты (version=0.38.0 из git tag) для Claude Code /plugin marketplace add + install. На keigit.com (45.77.41.204, публичный) залиты публичные репо keisei/KeiSeiKit-1.0 + keisei/kei-registries. Anonymous git clone работает. GitHub mirror (KeiSeiLab/*) остаётся приватным как backup.	2026-05-18 11:47:13 +08:00
Parfii-bot	5b8e066888	refactor(install): production-ready финальный круг ... 1. lib-onboarding.sh раскидан на 3 куба (Constructor Pattern <200 LOC): - lib-onboarding-registry.sh (79 LOC) — парсеры providers/models.toml + onboarding_fallback_providers (14 провайдеров) + onboarding_auth_env_for_provider helper (был inline в collect_auth) - lib-onboarding-ui.sh (189 LOC) — pick_language/transport/provider/model + collect_auth (whiptail/bash select) - lib-onboarding-state.sh (57 LOC) — write_secrets + write_config + user-model-override.toml для kei-model-router - lib-onboarding.sh (95 LOC) — тонкий оркестратор: should_run + run Сам lib-onboarding.sh source'ит 3 подкуба автоматически. Глобалы (ONBOARDING_*, REGISTRY_*, ONBOARDED_FLAG, etc.) объявлены в оркестраторе, подкубы их используют через имена. 2. lib-menu.sh локализован: - whiptail title + radiolist prompt через ${STR_MENU_TITLE} + ${STR_MENU_SUBSTRATE} + ${STR_MENU_PROFILE_PROMPT}. - Plain heading тоже использует словарь. - 12 коротких имён профилей (minimal/core/dev/...) — оставлены EN как стабильные id (не переводятся). 3. _blocks/build-index.sh — детерминированная регенерация INDEX.md. Группировка по 14 категорийным префиксам + "Прочие" для остальных. Безопасно перезапускать. INDEX.md обновлён через этот скрипт (минимальный diff — добавлена ссылка на build-index.sh в шапке). Проверено: bash -n чисто, unit тесты onboarding_list_providers/ transports/models OK, non-TTY smoke ./install.sh --profile=minimal --no-execute проходит.	2026-05-17 23:57:23 +08:00
Parfii-bot	5327befef6	docs(_blocks): INDEX.md — реестр 84 блоков для assembler ... Авто-сгенерирован из _blocks/*.md по категориям префикса: API / AUTH / CI / DB / DEPLOY / DOCS / DOMAIN / MODE / OBS / PATH / RULE / SCRAPER / SECURITY / STACK / TEST + прочие. Каждая запись: `name` — первая H1-строка файла. Использование в _manifests/<agent>.toml: blocks = ["baseline", "rule-pre-dev-gate", "api-anthropic", ...] Assembler читает блоки из _blocks/, склеивает в финальный _generated/<agent>.md. Новый блок = просто .md в _blocks/. Регенерация INDEX.md — TODO build-index.sh скрипт (сейчас сгенерирован вручную bash циклом).	2026-05-17 20:39:06 +08:00
Parfii-bot	33f1376ee1	feat(i18n): расширил язык-набор с 2 до 16 ... Новые словари: uk Українська de Deutsch fr Français es Español pt Português it Italiano tr Türkçe ar العربية hi हिन्दी zh 简体中文 ja 日本語 ko 한국어 id Bahasa Indonesia vi Tiếng Việt Каждый файл — 17 STR_* ключей (тот же контракт что en.sh + ru.sh). lib-i18n.sh::i18n_available_languages — единый список (en + 15) для меню выбора в мастере. i18n_load_lang упрощён: всегда грузит английский как fallback, потом поверх — словарь языка (отсутствующий ключ остаётся английским). onboarding_pick_language теперь генерирует whiptail/bash select из i18n_available_languages динамически — добавление нового языка = один файл `install/i18n/<код>.sh` + одна строка в available_languages, дальше всё подхватится автоматически. Перевод формальный, без излишеств. Welcome баннер всегда EN (юзер ещё не выбрал на момент показа). Проверено: bash -n всех 16 словарей чисто, roundtrip всех языков работает (i18n_load_lang en/ru/uk/de/fr/es/pt/it/tr/ar/hi/zh/ja/ko/id/vi выдают локализованные STR_DONE_TITLE + STR_TR_DIRECT_API), non-TTY smoke install --no-execute проходит.	2026-05-17 16:51:44 +08:00
Parfii-bot	305140f20b	fix(install): close MEDIUM/LOW from RULE 0.26 audit ... - preflight failure handling: вместо `|| true` (молчаливое продолжение при упавшем preflight) — явный prompt «продолжить? [y/N]» с return 1 при отказе. Без TTY печатает warning и продолжает. Это закрывает HIGH bug-9: «.onboarded флаг выставляется при нерабочей конфигурации». - lib-preflight.sh::preflight_check_cli — общий helper (command -v + offer-install + version echo). Убирает 6-file boilerplate (хотя сами per-provider файлы пока не переписаны под него — это отдельный шаг). - onboarding_fallback_providers: расширен с 3 до 14 провайдеров, покрывает все 7 транспортов. Был дрейф vs providers.toml (14 vs 3), юзер без submodule видел только anthropic+openai+ollama. - STR_PICK_PROVIDER plural mismatch: whiptail и plain ветки теперь используют один fallback "Provider within" (раньше plain имел "Providers within", whiptail — "Provider within"). - STR_DONE_NEXT удалён из en.sh + ru.sh (мёртвый ключ). - Новые ключи: STR_MENU_* (для lib-menu.sh) + STR_PREFLIGHT_FAILED + STR_PREFLIGHT_CONTINUE. lib-menu.sh начал использовать STR_MENU_TITLE / STR_MENU_SUBSTRATE (частичная локализация, остальное меню — отдельной задачей). Тесты: bash -n чисто, i18n round-trip EN/RU работает, non-TTY smoke install --no-execute проходит.	2026-05-17 16:37:28 +08:00