23 commits

Author	SHA1	Message	Date
KeiSei84	633ee4aeeb	feat(limits): honest kei limits CLI + pet cache integration ... Cross-CLI subscription limits — research-grounded honest delivery after 5-parallel-agent investigation found that 4 of 5 CLIs have no public programmatic API for quota. ## Reality findings (research) - claude no public API; `anthropic-ratelimit-*` headers per-call only; Admin API exists but needs separate admin token. See dashboard. - grok no public API; `x-ratelimit-*` headers per-call only. No file. - agy interactive /usage slash-cmd shows 100% always (forum bug). No public API. - copilot no public quota API; web dashboard only. The 'gh api /user/ copilot_billing' endpoint does NOT exist. June 2026 billing migration to AI Credits further changes the surface. - kimi Moonshot /v1/users/me/balance returns $ balance only (no session/weekly quota fields). Requires MOONSHOT_API_KEY. ## Delivery (no false promises) - scripts/kei-limits.sh — probe-all honest tool. For Kimi: real curl call to Moonshot balance API if MOONSHOT_API_KEY set. For other 4: status marker + dashboard URL. - Pet integration — reads ~/.claude/pet/limits-cache.json IF present; shows Kimi balance segment ONLY when status=='live'. Pet does NOT poll; cache is populated by user-invoked 'kei limits'. - bin/kei limits arm + --json mode + --quiet mode for cron. Cache is bounded by user's explicit refresh; pet shows '(Xm old)' if older than 1h. No background polling, no rate-limit waste, no fake data.	2026-05-26 21:43:39 +08:00
KeiSei84	8086bec486	feat(v0.41): patch 5 Gemini security findings + Copilot doc bug + claude/grok perms ... Audit pass via Phase C dogfooding (security-auditor @ Agy/Gemini reviewing our own safe_tools.rs) surfaced 5 real bugs. All fixed. ## Gemini findings (5 real bugs) [#1 HIGH] FAIL-OPEN on missing config/hook Before: missing policy-chain.toml → "passing through" warning; missing hook script → "skipped" warning. Misconfig silently disabled enforcement. After: both paths FAIL-CLOSED with clear error surfaced to caller. Tests/dev can opt in to pass-through via KEI_POLICY_CHAIN_OPTIONAL=1. [#2 HIGH] Path traversal in kei_edit/kei_write Before: no validation; attacker could pass file_path=/etc/passwd or $HOME/.ssh/authorized_keys. After: validate_path() rejects '..' segments, system dirs (/etc/, /usr/, /System/, /var/, /root/), and dotfile-secret dirs (~/.ssh/, ~/.aws/, ~/.gnupg/, ~/.config/gcloud/). Override via KEI_ALLOWED_ROOTS for explicit single-root confinement. [#3 HIGH] CLAUDECODE/GROKCODE env bypass Behavior unchanged — this guard is a perf/UX optimization to avoid double-firing hooks when called from inside Claude/Grok (which already ran their own PreToolUse). Documented explicitly as NOT a security boundary: attacker controlling parent env already owns the invocation. Module header gains a DESIGN NOTE making this load-bearing. [#4 MED] std::fs in async context Before: handle_edit/handle_write used std::fs::{read_to_string,write}, which block the tokio worker thread. Pathological paths like /dev/random would freeze a worker indefinitely. After: tokio::fs::{read_to_string,write}.await — async I/O, worker stays responsive. [#5 MED] kill_on_drop only kills immediate child Before: timeout in kei_bash drops the Child handle; tokio's kill_on_drop SIGKILLs only the shell. Grandchildren (e.g., 'sleep 1000 &') orphaned. After: Unix-only: spawn child in its own process group (Command::process_group(0)), and on timeout libc::kill(-pid, SIGKILL) to take down the whole group. New libc dep on Unix. ## Copilot doc fix Doc claimed "kei-mcp exposes 4 built-in tools" without saying spawn_agent lives in tools.rs while kei_bash/edit/write live in safe_tools.rs. Validator agent flagged this as FALSE/MISLEADING. Now the doc spells out the two-file structure + adds a v0.41 hardening summary. ## claude/grok subprocess permissions Cross-CLI audit demo revealed that 'claude -p' and 'grok --print' returned empty when invoked headless with a real audit task — they need explicit permission flags to use Read/Grep tools in non-interactive mode. Added: claude: --permission-mode=bypassPermissions grok: --always-approve agy: --dangerously-skip-permissions Override via KEI_AGENT_PERMISSIVE=0 to keep strict default. Re-verified: claude+grok both echo SMOKE-OK-V41 with the flag. ## Verification cargo test -p kei-mcp --release → 3/3 pass MCP JSON-RPC smoke (all 7): - tools/list shows 4 built-ins ✓ - kei_bash blocks RULE 0.1 push ✓ - kei_bash passes 'echo OK' ✓ - kei_write rejects /etc/passwd ✓ - kei_write rejects ../ traversal ✓ - kei_write rejects ~/.ssh/* ✓ - missing policy-chain → FAIL-CLOSED with clear error ✓ - KEI_POLICY_CHAIN_OPTIONAL=1 → opt-in pass-through ✓	2026-05-26 19:48:29 +08:00
KeiSei84	087be08e66	feat(pet): compact summary — sess + agents count + global tokens/cost ... The tamagotchi statusline was rendering one emoji+name+elapsed entry per running sub-agent, producing strings like: 🔬researcher·2m 🏗️architect·5m 🔪critic·1m 📐plan·30s ... When 4-8 parallel sessions ran agents simultaneously the line wrapped across the terminal. Pet now renders ONE compact summary: 💬N 🌍Tk 🤖N 💰$C Where: 💬 = distinct sessions today (parent_id from agent_spawn events) 🌍 = total tokens today across ALL sessions (suppressed when null upstream) 🤖 = running sub-agents NOW (count of <2h markers, all sessions) 💰 = total cost today (suppressed when zero or upstream null) Per-agent detail moved to future kei status command (TODO comment). Why: user feedback that the per-agent list was unreadable when many parallel sessions/agents fire. Compact counters preserve the at-a-glance value without cluttering the prompt.	2026-05-26 18:42:20 +08:00
KeiSei84	4e5e6bd2c0	feat(phase-C): cross-CLI hook enforcement via kei_bash/kei_edit/kei_write MCP tools ... Closes the "hooks only fire on Claude" gap. Phase C extends KeiSeiKit safety enforcement (no-github-push, safety-guard, destructive-guard, citation-verify, numeric-claims-guard) to any MCP-capable LLM CLI through a 3-tier honesty model. ## 3-tier model TIER 1 (full native): claude (existing), grok (port hooks to grok settings.json) TIER 2 (MCP-wrapped): copilot (--excluded-tools=shell + force kei_bash via MCP) TIER 3 (advisory): agy + kimi (cannot disable native shell; prompt-level only) ## Design (Constructor Pattern) 1. hooks/_lib/policy-chain.toml — SSoT: which hooks gate which tool (bash/edit/write) 2. _primitives/_rust/kei-mcp/src/handlers/safe_tools.rs — new module, 3 built-in MCP tools that synthesize Claude PreToolUse JSON, run hook chain, abort on exit-2, exec on all-pass. Same input contract → hooks reused as-is, no rewrite. 3. tools.rs short-circuit: kei_bash/kei_edit/kei_write dispatched before atom layer 4. 6 wire scripts: orchestrator + one per CLI (Constructor Pattern, no mixin) 5. bin/kei mcp-wire arm 6. docs/encyclopedia/cross-cli-policy.md — honest 3-tier matrix + verification ## Double-enforcement guard If kei-mcp invoked from a process with $CLAUDECODE=1 or $GROKCODE=1, the chain SKIPS — native hooks already fired. Wire scripts set these env vars in the MCP server registration for claude/grok respectively. On copilot/agy/kimi the env is unset → chain runs. ## Smoke (verified live) Block: kei_bash{command: forbidden-push-pattern} → JSON-RPC error -32603 with full "BLOCK — RULE 0.1 NO GITHUB PUSH" stderr ✓ Pass: kei_bash{command: "echo HELLO-FROM-KEI-BASH"} → result.content[0].text = "HELLO-FROM-KEI-BASH" ✓ tools/list: 4 built-ins present (spawn_agent + kei_bash + kei_edit + kei_write) ✓ ## Tests kei-mcp: 3/3 (tools_list assertions updated for atoms+4 built-ins). Build clean with toml = "0.8" dep added. ## Out of scope (deferred) - Codex CLI wiring (not installed locally) - ACP middleware proxy (transport, not middleware — ruled out at research) - Container/firejail sandboxing for agy/kimi (heavy; documented limit instead) - Native Rust PatternGate migration (optimization, separate phase)	2026-05-26 18:03:33 +08:00
KeiSei84	3fec43ea7e	feat(orchestrator): kei pick + spawn_agent MCP tool — true multi-LLM shell ... Closes the "Claude Code as single primary" gap. Now `kei` (no args) execs whichever CLI is configured as primary, and ANY MCP-capable orchestrator can spawn KeiSeiKit agents on any backend via the built-in spawn_agent tool. ## A — orchestrator picker bin/kei now reads ~/.claude/config/primary.toml and execs that CLI instead of hardcoding claude. New arms: kei pick interactive menu → set primary → launch it kei --on=<backend> one-shot launch of <backend> (no primary write) kei primary [<b>] get/set primary Splash shows `primary CLI: <backend>` so the orchestrator is visible. Failure mode: if primary's CLI isn't on PATH, prints install hint + offers `kei pick` recovery. scripts/kei-pick.sh — Constructor Pattern picker (<140 LOC). Lists all 6 backends with install status (✓/✗), highlights current primary, writes choice to primary.toml, execs the picked CLI. Honors stdin TTY gate (RULE TTY-INTERACTIVITY-GATE — -t 0, not -t 1) for non-interactive safety. ## B — spawn_agent MCP tool _primitives/_rust/kei-mcp/src/handlers/tools.rs gains a built-in `spawn_agent` tool, exposed alongside discovered atoms: - inputSchema: { name: str, task: str, on?: backend-enum } - Calls kei-agent-cli.sh internally with same DNA resolution - 60s timeout, kill-on-drop - Honors KEI_AGENT_CLI env for testing Smoke 2026-05-26 (MCP stdio JSON-RPC round-trip): spawn_agent(name=smoke-test, on=claude) → "SMOKE-OK" ✅ spawn_agent(name=smoke-test, on=grok) → "SMOKE-OK" ✅ Why it matters: Claude Code has a native Agent tool. Grok / Agy / Copilot / Kimi don't have an equivalent native sub-agent surface — but they all speak MCP. spawn_agent gives them KeiSeiKit's sub-agent capability when they're the orchestrator. The chosen orchestrator no longer caps the sub-agent fleet. ## Other _primitives/_rust/kei-mcp/Cargo.toml: tokio gains "io-std" feature (was missing — main.rs uses tokio::io::stdin/stdout). This fixes a latent build error unrelated to this PR (kei-mcp wasn't building cleanly before). Tests: tools_list assertions updated for the +1 built-in tool (3 total instead of 2 with atoms; 1 instead of 0 on empty root). All MCP tests pass. Assembler 3/3 golden tests still pass (provider field is optional).	2026-05-26 16:48:23 +08:00
KeiSei84	e4980f6ad7	feat(dna): provider+model in agent DNA; kei primary; smoke-tested 4/5 CLIs ... Makes KeiSeiKit truly multi-LLM: any agent can declare its preferred backend in its manifest. The DNA resolver picks the right CLI; `kei primary` swaps the fleet-wide default. KeiSeiKit is no longer tied to Claude Code single-model. Resolution order: --on=<backend> → manifest provider → primary.toml → claude Files: _assembler/src/manifest.rs + Option<String> provider field _assembler/src/assembler.rs emit provider: in frontmatter (when set) scripts/kei-agent-cli.sh DNA resolver; `kei primary` get/set; `kei agent` arm (DNA-driven); honest kimi handling (TUI-only) bin/kei new arms: agent, primary _primitives/cli-backends.toml mark kimi as tui-only docs/encyclopedia/multi-cli-agents.md rewritten with DNA flow, smoke results, rule-enforcement caveat Smoke 2026-05-26 (real CLI invocations): claude ✓ via `claude -p` grok ✓ via `grok --print` (DNA: manifest provider=grok) agy ✓ via `agy --print` (Antigravity / Gemini) copilot ✓ via `copilot --prompt` (1 Premium / 9s / 20.6k tok) kimi ⚠ TUI-only, no print mode; need `kimi acp` JSON-RPC client codex — register-only (not installed locally) Rule-enforcement caveat documented: KeiSeiKit hooks fire only inside Claude Code's PreToolUse pipeline. Non-claude backends carry the agent's PROMPT but not the hook layer. For tool-level policy on non-claude, route through MCP. ALSO: fix(stop-hook) — RULE 0.14 session-end-dump.sh "Recombobulating..." 4-minute hang on 18MB+ transcripts. Root cause: kei-memory ingest + frustration- matrix scan + kei-sleep-sync ran sync at session end. Now async-detached with per-op portable timeout (timeout/gtimeout/perl alarm). Hook returns in 0.03s. Raw JSONL saved sync; only index/embedding step deferred (idempotent on session_id so safe).	2026-05-26 16:21:11 +08:00
KeiSei84	3be9a8bf71	feat(multi-cli): kei run-via <backend> — agents over external LLM CLIs ... Adds a uniform launcher that lets any KeiSeiKit agent run on whichever LLM CLI you have a subscription to. Pick by familiarity, pricing, or to get a second opinion on the same prompt. Backends (locally installed, by subscription): claude Claude Code (claude -p) grok xAI Grok (grok --print; native --agent supported) agy Antigravity (agy --print) alias: antigravity copilot GitHub Copilot (copilot --prompt) kimi Moonshot Kimi (stdin, TUI primary) codex OpenAI Codex (codex -p) register-only Files: _primitives/cli-backends.toml SSoT backend table scripts/kei-agent-cli.sh launcher; loads ~/.claude/agents/<n>.md, strips frontmatter, composes with task, execs backend non-interactive bin/kei new arm: run-via | via | run | agent-via docs/encyclopedia/multi-cli-agents.md user-facing docs + usage Auto-installed via lib-scaffold.sh:77 glob (no install code change needed). Test plan: kei run-via list # status + agents kei run-via grok critic "review src/auth.rs" # via Grok kei run-via agy critic "review src/auth.rs" # via Antigravity kei run-via copilot critic "review src/auth.rs" # via Copilot KEI_NATIVE_AGENT=1 kei run-via grok critic "..." # native --agent	2026-05-26 15:05:02 +08:00
KeiSei84	abae256c1d	feat(install): opt-in hook packs + stack profiles (public posture) ... A fresh install now activates only the safety pack; discipline hooks and agents are opt-in via an onboarding step (step 6) or `kei configure`. "People don't need Rust-only" — they pick their own stack. - _primitives/hook-packs.toml: SSoT mapping pack -> hooks, stack -> packs + agent groups. safety always on; evidence/observability/epistemic/ orchestration/git-guard/stack-rust opt-in. rust-first/no-python only under the systems stack; git-guard (no-github-push) opt-in only, pulled by no stack. - lib-profile: extract generic _toml_array (reused by lib-packs); profile_members becomes a thin wrapper (no behavior change). - lib-packs: pack/stack/agent resolvers + selection loader. - lib-hooks: filter_snippet_by_packs (install-time allowlist) + prune_kit_hooks (reconfigure removes deselected kit hooks, keeps foreign ones); activate_hooks rewired to prune + filter + merge. No custom settings.json fields (/doctor safe). - lib-agents: install_manifests filters by stack agent set (empty = install all). - onboarding: pick_stack step (reuse _onb_read_choice), persists stack_profile + enabled_packs to onboarding.toml; i18n STR_* added. - bin/kei configure -> scripts/kei-configure.sh (re-pick without reinstall); install stamps ~/.claude/.kei-kit-dir. - numeric-claims-guard: money regex no longer matches shell positionals ($1..$9); requires decimal / unit / 2+ digits / tilde. Real money + time still caught. - gate one-liner added to 8 discipline hooks (runtime toggle via hooks-control). Verified end-to-end (scratch HOME): fresh=safety only; evidence pack adds numeric+citation; systems stack wires rust-first + 14 base/systems agents (no data-science/swift); reconfigure-shrink prunes kit hooks but keeps a foreign hook; settings schema clean; assembler golden 3/3. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 17:27:14 +08:00
KeiSei84	7b453aac1b	feat(msg): /msg skill — read/write cross-session mailbox by @id ... Thin skill wrapper over the existing kei-message jsonl mailbox so the user (and agents) can talk between Claude Code sessions with @id syntax: /msg read my inbox (to me or "all") /msg @frontend text send to a session (identity = its cwd basename) /msg all text broadcast /msg list | who whole bus / known recipients - kei-message.sh send now accepts a leading @name as the recipient (first token only; a later @x stays literal). --to still works. - skills/msg/SKILL.md documents the identity model (cwd-basename), pull delivery (recipient's next turn via mailbox-inject hook), and the first-contact discovery path (who / all). - README skills count 68 -> 69. Verified: @name/all/--to parsing (3 cases) + end-to-end send/inbox/who via the live script in a sandbox HOME. Skill registered + discoverable. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 14:43:04 +08:00
KeiSei84	3aff00290f	fix: pre-public audit — critical install regression + 7 blockers ... CRITICAL: lib-hooks.sh had an apostrophe ("user's") inside the jq program's bash single-quote, closing the quote and producing a parse error so EVERY install aborted at source time (install.sh:71). Caught by a full minimal e2e (rc=2 then rc=0 after fix). Reworded the jq comment to drop the apostrophe. Audit blockers fixed: - MANIFEST: drop cortex-ui (no such primitive) from 4 profiles + block; lib-menu desc no longer references it. Profile resolution verified clean. - lib-dev-hub-forgejo / -zoekt: source lib-launchd.sh (register_launchd was undefined, so full-hub dev-hub install would fail at runtime). - kei-message: portable 16-digit id. BSD date prints literal "N" for %N; fall back to /dev/urandom. Verified numeric in both code paths. - bootstrap non-TTY default cortex to minimal (matches install.sh; avoids divergent curl-bash vs direct-install behaviour and 105-crate surprise). - install.sh stamps ~/.claude/.kei-profile; bin/kei reads it (splash showed "profile: ?" before, since .installed holds only primitive names). - README hook count 38 to 54 (real: ls hooks star dot sh). - web-install warns before it discards local edits in the managed clone. Verified: 106 shell files bash -n clean; minimal e2e rc=0 (38 agents, 57 hooks, 69 skills, profile stamped, mailbox present). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 10:48:06 +08:00
KeiSei84	c347f329aa	feat(kei message): persistent inter-session mailbox + pull-inbox hook ... Any Claude Code session can now message any other (not just Agent-Teams teammates), without tmux. Append-only jsonl bus + a UserPromptSubmit hook that pulls unread into each session's context per turn. - scripts/kei-message.sh: `kei message send [--to <name|all>] <text>` / inbox / list / channels. Identity = basename(cwd); broadcast channel "all". - hooks/mailbox-inject.sh: UserPromptSubmit. Injects messages addressed to this session (cwd-basename) or "all", since last turn; per-session cursor dedup; first turn sets baseline (no history dump); never echoes own messages. - bin/kei: `kei message ...` dispatch before splash. - lib-scaffold: copy ALL scripts/*.sh on install (picks up kei-message.sh). - settings-snippet: wire mailbox-inject under UserPromptSubmit. Store: ~/.claude/mailbox/messages.jsonl. Bypass: KEI_MAILBOX_BYPASS=1. Verified: addressed delivery, broadcast, first-turn no-dump, cursor dedup, no self-echo (2-session simulation). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 15:00:10 +08:00
denis	2fa348f467	feat(pet): comprehensive language map (60+)	2026-05-21 18:31:05 +00:00
denis	4e62e921e9	feat(pet): comprehensive reflection (60+ langs, all agents, errors)	2026-05-21 18:30:01 +00:00
denis	e8df152549	feat(pet): show session tokens + context% from statusLine stdin	2026-05-21 17:50:47 +00:00
denis	752654f049	refactor(pet): read kit agent tracking (SSoT), drop duplicate	2026-05-21 17:14:55 +00:00
denis	13e536ec1c	refactor(pet): read kit agent tracking (SSoT), drop duplicate	2026-05-21 17:14:17 +00:00
denis	a965ad3b7c	fix(pet): token extraction via jq totalTokens + persist token total	2026-05-21 17:05:48 +00:00
denis	ac1f0ebaec	fix(pet): token extraction via jq totalTokens + persist token total	2026-05-21 17:04:38 +00:00
denis	ac6a020612	feat(pet): agent emojis + multi-agent display + plan emoji + language icons	2026-05-21 12:20:47 +00:00
denis	e129745319	feat(pet): agent emojis + multi-agent display + plan emoji + language icons	2026-05-21 12:20:45 +00:00
denis	305787fae3	fix(install): make fresh install complete + ship tamagotchi (#1)	2026-05-20 18:50:09 +00:00
Denis Parfionovich	1d958b3587	fix(security): patent-leak + classical-safety audit fixes ... PATENT-LEAK (HIGH): - hooks/no-python-without-approval.sh: genesis-verify пример → my-project - docs/encyclopedia/rust-crates-H-N.md: убран термин «Genesis IP, ITAR» PATENT-LEAK (MEDIUM): - CHANGELOG: project-vortex → reduced scope - _blocks/registries (submodule bump): убраны имена приватных project-specialists из комментария agent-profiles.toml - docs/encyclopedia/skills-and-agents.md: ML/RL/CfC → ML/RL CLASSICAL-SAFETY (MEDIUM): - install/lib-preflight.sh: eval "$version_cmd" → bash -c "..." (защита от инъекции если providers.toml расширят) - _primitives/provision-{vultr,hetzner}.sh: /tmp/$$ → mktemp (устраняет symlink TOCTOU race) - web-install.sh: chmod 600 + umask 077 на ~/.keisei-install.log (Forgejo admin creds + токены в логе) - scripts/regen-counts.sh: eval "$1" → bash -c NOT FIXED (требуют действий юзера): - HIGH: @keisei scope не зарегистрирован на npmjs.org — typosquat возможен пока не задан NPM_TOKEN и не сделан publish - HIGH: install.keisei.app DNS не настроен — DNS-hijack возможен - LOW: parfionovich@keilab.io в SECURITY.md, plugin.json, ~40 Cargo файлах — intentional contact, оставлен Локальный git author установлен на parfionovich@keilab.io вместо parfionovichd@icloud.com (только для будущих коммитов в этом репо).	2026-05-18 12:05:25 +08:00
Parfii-bot	0be354a920	KeiSeiKit-public — clean state ... Single-commit clean baseline after security scrub of niche-tells, project codenames, internal jargon, and contributor-email leaks. Contents: - 100 Rust crates (_primitives/_rust/) - 37 agent manifests (_manifests/) + generated specs (_generated/) - 67 user-invocable skills (skills/) - 33 hooks (hooks/) - Composition blocks (_blocks/) - Documentation (docs/, README.md) - TS adapter packages (_ts_packages/) - Assembler (_assembler/) - Roles (_roles/) - Templates (_templates/) - Forgejo CI (.forgejo/) Author: Denis Parfionovich <info@greendragon.info> License: see LICENSE.	2026-05-01 12:09:03 +08:00