@keelcode-ai/keelcode 0.1.6 → 0.1.7-darwin-x64

package/package.json

@@ -1,46 +1,21 @@
 {
   "name": "@keelcode-ai/keelcode",
-  "version": "0.1.6",
-  "description": "The hosted Keelcode coding agent CLI.",
-  "type": "commonjs",
+  "version": "0.1.7-darwin-x64",
+  "description": "Native Keelcode executable for darwin-x64. Install the keelcode package instead.",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://keelcode.ai",
   "publishConfig": {
     "access": "public"
   },
-  "bin": {
-    "keelcode": "bin/keelcode.cjs",
-    "kc": "bin/kc.cjs",
-    "kcode": "bin/kcode.cjs",
-    "keel": "bin/keel.cjs"
-  },
-  "files": [
-    "bin/keelcode.cjs",
-    "bin/kc.cjs",
-    "bin/kcode.cjs",
-    "bin/keel.cjs",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "SECURITY.md"
+  "os": [
+    "darwin"
   ],
-  "keywords": [
-    "cli",
-    "agent",
-    "ai",
-    "hosted-ai",
-    "coding-agent",
-    "tui",
-    "ink"
+  "cpu": [
+    "x64"
   ],
-  "optionalDependencies": {
-    "@keelcode-ai/keelcode-darwin-arm64": "npm:@keelcode-ai/keelcode@0.1.6-darwin-arm64",
-    "@keelcode-ai/keelcode-darwin-x64": "npm:@keelcode-ai/keelcode@0.1.6-darwin-x64",
-    "@keelcode-ai/keelcode-linux-arm64": "npm:@keelcode-ai/keelcode@0.1.6-linux-arm64",
-    "@keelcode-ai/keelcode-linux-arm64-musl": "npm:@keelcode-ai/keelcode@0.1.6-linux-arm64-musl",
-    "@keelcode-ai/keelcode-linux-x64": "npm:@keelcode-ai/keelcode@0.1.6-linux-x64",
-    "@keelcode-ai/keelcode-linux-x64-musl": "npm:@keelcode-ai/keelcode@0.1.6-linux-x64-musl",
-    "@keelcode-ai/keelcode-win32-arm64": "npm:@keelcode-ai/keelcode@0.1.6-win32-arm64",
-    "@keelcode-ai/keelcode-win32-x64": "npm:@keelcode-ai/keelcode@0.1.6-win32-x64"
-  }
+  "files": [
+    "bin/keelcode",
+    "bin/rg",
+    "LICENSE"
+  ]
 }

package/CHANGELOG.md

@@ -1,120 +0,0 @@
-# Changelog
-
-All notable changes to Keelcode will be documented in this file.
-
-The format is based on Keep a Changelog, and this project follows Semantic
-Versioning.
-
-## [Unreleased]
-
-## [0.1.6] - 2026-07-23
-
-### Added
-
-- Add one-line native installers, `install.sh` (macOS/Linux) and `install.ps1`
-  (Windows), that download the platform binary straight from npm, verify its
-  checksum, install under `~/.keelcode`, and — unless `--no-modify-path` /
-  `-NoModifyPath` is passed — add Keelcode to `PATH`. No package manager, Node,
-  or Bun required.
-
-### Changed
-
-- The globally installed launcher now runs under **Node 18+ or Bun**, whichever
-  is present, so `npm`, `pnpm`, `yarn`, and `bun` global installs all work on
-  machines that do not have Bun.
-- Remove the `engines` constraint from the published package so no package
-  manager refuses to install on an older or non-Bun runtime.
-- A standalone (curl-installed) executable now finds its ripgrep sidecar next to
-  itself, so it needs no `KEELCODE_RG_PATH` or bundled npm dependency.
-
-### Fixed
-
-- `command not found` after installing with `npm`/`pnpm`/`yarn` on a machine
-  without Bun, and pnpm's engine-strict refusal to install the previous package.
-
-## [0.1.5] - 2026-07-20
-
-### Fixed
-
-- Make the trusted project settings path test portable across Windows and POSIX CI runners.
-
-## [0.1.4] - 2026-07-20
-
-### Added
-
-- Add `kc`, `kcode`, and `keel` as packaged aliases for the `keelcode` command.
-- Add safe custom command aliases with `keelcode alias setup|add|list|remove`.
-- Show client-observed TTFT and provider-token TPS in interactive and headless
-  output without mixing tool time into model throughput; keep interactive
-  context and performance telemetry immediately above the input box.
-- Make the CLI hosted-only: `keelcode login` now owns the API origin and bearer
-  session, while customer provider keys, custom endpoints, and `ANTHROPIC_*`
-  transport configuration are ignored.
-- Add `/ship`, an objective-bound deliverable workflow whose runtime withholds
-  completion until a persisted passing `Verify` receipt, a read-only final
-  review, the cited receipt ID, and a stabilized Git fingerprint all agree.
-- Discover layered `AGENTS.md` and `KEELCODE.md` instructions from the Git root
-  to the active directory with source provenance and bounded, symlink-safe reads.
-- Add stable `json` and streaming `jsonl` headless output formats with explicit
-  terminal outcomes and automation-friendly exit codes.
-- Add lease-checked detached Git worktree primitives for repository-state
-  isolation without claiming operating-system sandboxing.
-- Add standalone `proof list/show` and `worktree create/status/cleanup` commands
-  so automation can inspect receipts and manage isolated runs without an API key.
-- Add an opt-in-aware World Cup match surface with a startup Match Centre,
-  compact in-session scores, scorer-specific goal takeovers, and `/football`
-  controls. Live provider traffic stays in the Keelcode backend.
-
-### Security
-
-- Treat checked-in `.keelcode/settings.json` and `.keelcode/settings.local.json`
-  as untrusted input: repositories can add restrictions and presentation
-  preferences, but cannot enable prompt-free modes, auto-allow tools, inject
-  environment variables, or launch MCP processes.
-- Store explicitly approved per-project MCP and allow settings in an owner-only
-  directory outside the checkout, and pass MCP processes a minimal environment
-  instead of every credential held by the CLI.
-- Require an explicit permission decision for filesystem access outside the
-  active workspace, including symbolic-link escapes, and make delegated agents
-  inherit the parent permission gate and deny rules.
-- Pin each WebFetch HTTPS connection to the public address that was validated,
-  revalidating every redirect to prevent DNS-rebinding SSRF.
-- Require approval for Git commands that write through `--output` or `-o`.
-- Redact and cap persisted verification output, store receipts and worktree
-  leases with owner-only POSIX permissions, and bound gate count and execution time.
-- Make Verify approvals fully scrollable and auditable, hard-limit observed
-  output, show exact executable command text, reject destructive checks and
-  common background syntax, detect residual children, and anchor local receipt
-  bytes per ship run.
-- Hash actual tracked/untracked worktree bytes and submodules independently of
-  Git stat-cache, filter, assume-unchanged, and skip-worktree behavior; isolate
-  Git subprocesses from ambient `GIT_*` injection.
-- Reject symlinked private receipt roots and revalidate directory/file identity
-  across receipt publication and reads.
-- Block WebFetch access to unsafe URL schemes, credentials, local/private
-  networks, and unsafe redirect targets.
-- Store user transcripts, mission artifacts, caches, and crash logs with
-  owner-only POSIX permissions.
-- Clarify that `bypassPermissions` is an explicit no-prompt mode while deny
-  rules and tool hard denials remain enforced.
-
-### Fixed
-
-- Keep installation and normal startup independent of Nerd Fonts; failed,
-  skipped, unsupported, and manual-only setup paths now remain on safe Unicode.
-- Extract the optional pinned Nerd Font archive inside Keelcode instead of
-  depending on `tar` or PowerShell, and verify its SHA-256 before installation.
-- Reject Windows UNC paths before POSIX normalization can hide their form.
-- Run the npm launcher with Bun so globally installed commands work on Bun-only
-  machines without a `node` executable.
-- Avoid misclassifying an already-exiting Windows verification child as a
-  residual background process when no process tree was actually terminated.
-
-### Build
-
-- Standardize development, security auditing, packing, and CI on Bun.
-- Replace the unpublished JavaScript npm artifact with a small launcher and
-  exact platform-suffixed versions of the single `keelcode` package name for
-  macOS, Linux, and Windows on x64/arm64.
-- Fail release packing when source files, source maps, private metadata,
-  upstream endpoints, or secret-shaped credentials appear in an npm artifact.

package/README.md

@@ -1,255 +0,0 @@
-# keelcode
-
-Keelcode is a hosted coding agent for your terminal. It can inspect a project,
-edit files, run commands, search the web, use MCP servers, and verify its work.
-
-## Install
-
-The quickest way downloads the native binary directly — no package manager, no
-Node, no Bun:
-
-```bash
-# macOS / Linux
-curl -fsSL https://keelcode.ai/install.sh | sh
-```
-
-```powershell
-# Windows (PowerShell)
-irm https://keelcode.ai/install.ps1 | iex
-```
-
-The installer verifies the download's checksum, installs under `~/.keelcode`, and
-adds Keelcode to your `PATH` (pass `--no-modify-path` to skip that and get
-instructions instead).
-
-Or install with any package manager. The launcher runs under **Node 18+ or Bun**,
-whichever is on your machine:
-
-```bash
-npm  install --global @keelcode-ai/keelcode
-pnpm add     --global @keelcode-ai/keelcode
-yarn global  add      @keelcode-ai/keelcode
-bun  add     --global @keelcode-ai/keelcode
-```
-
-> On Windows, prefer the `install.ps1` script above for package-manager-free
-> installs — npm-style command shims can't pick a runtime the way the Unix
-> launcher does.
-
-If a package-manager install reports `command not found`, that manager's global
-bin directory isn't on your `PATH`. Print it with `npm bin -g` (or `bun pm bin -g`)
-and add it to your shell profile — or just use the curl installer, which handles
-`PATH` for you.
-
-The package provides four equivalent commands:
-
-```text
-keelcode
-kc
-kcode
-keel
-```
-
-To add your own command name after installation, run the guided setup or add
-one or more aliases directly:
-
-```bash
-keelcode alias setup
-keelcode alias add mycode kk
-keelcode alias list
-keelcode alias remove kk
-```
-
-Custom aliases are created beside the package-manager shims. Keelcode refuses
-to overwrite an existing command and never edits shell startup files. Package
-installation stays non-interactive so it remains reliable in terminals, CI,
-containers, and package managers that disable lifecycle scripts.
-
-Fonts are never downloaded and terminal settings are never edited during
-installation or normal startup. Keelcode defaults to font-independent Unicode,
-and falls back to ASCII for clearly limited terminals. Rich Nerd Font icons are
-an optional upgrade through `keelcode setup`; a failed or skipped setup keeps
-the safe icon set enabled.
-
-The `@keelcode-ai/keelcode` npm package is a small launcher that installs the matching
-platform-suffixed version of that same package name for the current operating
-system, CPU, and Linux libc. Keelcode's
-application JavaScript, TypeScript, source maps, tests, and build configuration
-are not included in the public package.
-
-## Sign in and start
-
-```bash
-keelcode login
-keelcode
-```
-
-If the machine cannot open a browser:
-
-```bash
-keelcode login --no-browser
-```
-
-Keelcode will also start sign-in automatically when an interactive session has
-no usable account. Authentication uses a short-lived device approval; provider
-credentials are never stored in the CLI.
-
-Useful account commands:
-
-```bash
-keelcode whoami
-keelcode usage
-keelcode logout
-```
-
-## Everyday use
-
-Start in the current project:
-
-```bash
-keelcode
-```
-
-Run one prompt without opening the TUI:
-
-```bash
-keelcode -p "find and fix the failing test"
-git diff | keelcode -p "review this diff"
-```
-
-Resume work:
-
-```bash
-keelcode -c
-keelcode sessions
-keelcode --resume 2
-```
-
-Choose a model at launch:
-
-```bash
-keelcode --model <model-alias>
-```
-
-Inside the TUI, use `/models` to open the current model picker and `/usage` to
-see the remaining hosted allowance. Run `/help` for the complete command list.
-The footer reports client-observed `ttft` and `tps` for the latest model turn.
-TTFT includes network and gateway latency; TPS uses provider-reported output
-tokens and excludes tool execution. A dash is shown when the stream does not
-contain enough timing or usage information for an honest measurement.
-
-Measure local launcher startup:
-
-```bash
-keelcode bench
-keelcode bench --json
-```
-
-The benchmark runs the installed launcher repeatedly, reports median/p90/min/max
-latency, and is useful for comparing terminals, package managers, and releases.
-
-## Common options
-
-```text
--m, --model <alias>        choose a Keelcode model
-    --permission-mode <m>  default | plan | acceptEdits | bypassPermissions
-    --yolo                 bypass permission prompts in trusted environments
-    --cwd <dir>            set the working directory
-    --icons <set>          unicode | nerd | ascii | auto
-    --no-alt-screen        keep output in the main terminal buffer
--c, --continue             resume the newest session in this directory
-    --resume [id]          resume by id/index; no argument lists sessions
--p, --print [prompt]       run one headless prompt
-    --output-format <f>    text | json | jsonl
--h, --help                 show help
--v, --version              show the installed version
-```
-
-`bypassPermissions` and `--yolo` remove confirmation prompts for operations
-inside the workspace. Crossing the workspace boundary still requires explicit
-approval and fails closed in headless mode.
-
-## Configuration
-
-Settings merge in this order, with later files winning:
-
-1. `~/.keelcode/settings.json`
-2. `<project>/.keelcode/settings.json` and `settings.local.json` (sanitized,
-   capability-reducing fields only)
-3. trusted per-project overrides under `~/.keelcode/projects/<workspace-hash>/`
-4. command-line flags
-
-Example project configuration:
-
-```json
-{
-  "model": "<model-alias>",
-  "permissionMode": "default",
-  "maxTurns": 100,
-  "timeoutMs": 600000,
-  "permissions": {
-    "ask": ["Bash", "Write", "Edit"],
-    "deny": ["Write(/etc/**)"]
-  }
-}
-```
-
-Committed or in-tree settings cannot enable MCP processes, inject environment
-variables, add allow rules, select `acceptEdits`/`bypassPermissions`, or define
-unknown future capabilities. Explicit per-project choices made through the CLI
-are stored outside the repository. Keelcode does not support bring-your-own-provider keys.
-
-## MCP and skills
-
-Inspect extension health:
-
-```bash
-keelcode doctor
-keelcode mcp list
-keelcode skills list
-keelcode import list
-```
-
-Use `keelcode mcp --help` and `keelcode skills --help` for management commands.
-MCP tools pass through the same permission checks as built-in tools.
-
-## Automation
-
-For scripts and CI, prefer structured headless output:
-
-```bash
-keelcode -p "run the tests and summarize failures" --output-format json
-keelcode -p "review this repository" --output-format jsonl
-```
-
-Human progress is written to stderr. Machine-readable results are written to
-stdout, so redirecting stdout does not mix logs into the protocol.
-Model performance is written to stderr in text mode and included as structured
-`performance` data in JSON/JSONL output.
-
-## Local data and privacy
-
-Keelcode stores account sessions, settings, conversations, caches, and local
-receipts under `~/.keelcode`. Sensitive state uses owner-only permissions on
-supported POSIX systems.
-
-Anonymous product analytics are opt-in and can be controlled at any time:
-
-```bash
-keelcode telemetry status
-keelcode telemetry enable
-keelcode telemetry disable
-```
-
-Do not paste production secrets into prompts or commit `.keelcode` personal
-state to a repository.
-
-## Security
-
-Report suspected vulnerabilities privately to `security@keelcode.ai`. Do not
-include real credentials or unrelated private data in a report.
-
-## License
-
-Keelcode is proprietary software. Installation and use are governed by the
-license included with this package and the applicable Keelcode service terms.

package/SECURITY.md

@@ -1,23 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes are provided for the latest published version of Keelcode.
-
-## Reporting a vulnerability
-
-Please do not disclose an unpatched vulnerability publicly. Email
-`security@keelcode.ai` with the affected version, reproduction steps, impact,
-and any suggested mitigation.
-
-Avoid including real API keys, proprietary source code, or other sensitive data
-in a report. We will acknowledge a complete report as soon as practical and
-coordinate disclosure after a fix is available.
-
-## Local data
-
-Keelcode persists conversations, mission records, downloaded skills, model
-metadata, and crash diagnostics under `~/.keelcode` by default. On POSIX systems,
-Keelcode creates its private state directories with mode `0700` and sensitive
-files with mode `0600`. Users remain responsible for securing backups and any
-custom path supplied through `KEELCODE_CONFIG_DIR`.