@kvali/cli 0.6.2 → 0.6.4

package/README.md

@@ -33,4 +33,8 @@ kvali watch            # hooks and phone notifications only, e.g. in the backgro
 
 Kvali also comes as an editor extension (VS Code, Antigravity, Cursor, Windsurf): search for "Kvali" in the Extensions view. Source and docs: https://github.com/webGrandpa/kvali
 
+Everything stays on your computer, with no telemetry; only phone notifications, when you set them up, go to the ntfy server you choose. [Privacy](https://github.com/webGrandpa/kvali/blob/main/PRIVACY.md) · [Security policy](https://github.com/webGrandpa/kvali/blob/main/SECURITY.md) · [Third-party notices](https://github.com/webGrandpa/kvali/blob/main/THIRD_PARTY_NOTICES.md)
+
 MIT © Giorgi Khiladze
+
+Kvali is an independent open-source project, not affiliated with or endorsed by Anthropic, OpenAI, Google, Microsoft or the makers of the other tools it works with. Claude Code, Codex, Gemini CLI, Antigravity, VS Code, Cursor, Windsurf and the other product names here are trademarks of their owners, used only to say what Kvali works with.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,64 @@
+# Third-party notices
+
+Kvali's own code is released under the [MIT License](LICENSE). The editor extension and the `kvali` command (npm package `@kvali/cli`) also bundle the open-source code listed below. Each keeps its own license, reproduced here as its terms require.
+
+| Package | Version | License | Where it is used |
+| --- | --- | --- | --- |
+| [Preact](https://github.com/preactjs/preact) | 10.29.8 | MIT | The editor extension's Agents view |
+| [qrcode-generator](https://github.com/kazuhikoarase/qrcode-generator) | 2.0.4 | MIT | The QR code for phone setup, in the extension and the CLI |
+
+The release build checks this list: it stops when the bundles contain a package, or a version, that is missing here.
+
+## preact 10.29.8
+
+The MIT License (MIT)
+
+Copyright (c) 2015-present Jason Miller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## qrcode-generator 2.0.4
+
+QR Code Generator for JavaScript
+
+Copyright (c) 2009 Kazuhiko Arase
+
+URL: http://www.d-project.com/
+
+Licensed under the MIT license:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+The word "QR Code" is a registered trademark of DENSO WAVE INCORPORATED.

package/dist/claude-plugin/.claude-plugin/marketplace.json

@@ -0,0 +1,13 @@
+{
+  "name": "kvali",
+  "owner": {
+    "name": "Giorgi Khiladze"
+  },
+  "plugins": [
+    {
+      "name": "kvali",
+      "source": "./",
+      "description": "Live progress for Claude Code: plan progress, the current step and its time, what the agent is doing right now, and tokens, in a pane beside the chat."
+    }
+  ]
+}

package/dist/claude-plugin/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "kvali",
+  "version": "0.6.4",
+  "description": "Live progress for Claude Code: plan progress, the current step and its time, what the agent is doing right now, and tokens, in a pane beside the chat.",
+  "author": { "name": "Giorgi Khiladze" },
+  "homepage": "https://github.com/webGrandpa/kvali",
+  "license": "MIT",
+  "types": "./types/index.d.ts"
+}

package/dist/claude-plugin/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Giorgi Khiladze
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/claude-plugin/README.md

@@ -35,3 +35,9 @@ claude plugin test packages/claude-plugin
 ```
 
 `hooks/model.ts` holds the logic (plan, step timing, the "is it working?" line), `hooks/register.tsx` connects it to Claude Code's events and draws the pane, `types/index.d.ts` declares the state it keeps.
+
+## Privacy
+
+The plugin keeps its state on your computer and has no telemetry. It sends something only when you set up phone notifications: short status lines to the ntfy server you chose, never code or prompts. [Privacy](https://github.com/webGrandpa/kvali/blob/main/PRIVACY.md) · [Security policy](https://github.com/webGrandpa/kvali/blob/main/SECURITY.md) · MIT License
+
+Kvali is an independent open-source project, not affiliated with or endorsed by Anthropic. Claude and Claude Code are trademarks of Anthropic, used only to say what this plugin works with.

package/dist/kvali.mjs

@@ -905,6 +905,7 @@ var AntigravityAdapter = class {
       agentLabel: this.label,
       id: st.id,
       title: st.task?.title || st.firstInput || current?.title || "Antigravity conversation",
+      titleFromPrompt: !st.task?.title && !!st.firstInput ? true : void 0,
       projectPath: this.projectOf(st, ctx.home),
       model: st.model,
       turn: st.turnStartedAt !== void 0 ? { steps: st.turnSteps, startedAt: st.turnStartedAt } : void 0,
@@ -1476,7 +1477,8 @@ var ClaudeCodeAdapter = class {
     }
     const activeSubagents = [...st.subagents.values()].filter((s) => now - s.updatedAt < 6e4).length;
     const window = /\[1m\]/i.test(st.model ?? "") || st.maxContext > 2e5 ? 1e6 : 2e5;
-    const title = st.customTitle || st.aiTitle || st.summary || st.firstPrompt || "Untitled session";
+    const ownTitle = st.customTitle || st.aiTitle || st.summary;
+    const title = ownTitle || st.firstPrompt || "Untitled session";
     let activity = status === "working" ? st.activity : void 0;
     if (status === "working" && st.phase === "tool" && st.open.size > 0) activity = [...st.open.values()].pop();
     return {
@@ -1485,6 +1487,7 @@ var ClaudeCodeAdapter = class {
       agentLabel: this.label,
       id: st.sessionId,
       title: truncate(title, 100),
+      titleFromPrompt: !ownTitle && !!st.firstPrompt ? true : void 0,
       projectPath: st.launchCwd ? findGitRoot(st.launchCwd) ?? st.launchCwd : void 0,
       cwd: st.launchCwd,
       model: st.model,
@@ -1824,6 +1827,7 @@ var CodexAdapter = class extends JsonlSessionAdapter {
       agentLabel: this.label,
       id: st.id,
       title: st.title ?? "Untitled session",
+      titleFromPrompt: st.title !== void 0 ? true : void 0,
       projectPath: st.cwd ? findGitRoot(st.cwd) ?? st.cwd : void 0,
       cwd: st.cwd,
       model: st.model,
@@ -2106,6 +2110,7 @@ var GeminiCliAdapter = class {
       agentLabel: this.label,
       id: st.sessionId ?? path5.basename(st.file),
       title: st.summary ? truncate(st.summary, 100) : title ?? "Untitled session",
+      titleFromPrompt: !st.summary && title !== void 0 ? true : void 0,
       projectPath: st.projectPath,
       model,
       status: phase === "idle" && tasksProg.total > 0 && tasksProg.done === tasksProg.total ? "done" : phase,
@@ -2444,7 +2449,22 @@ var HookHub = class {
       this.setHub(true);
     });
   }
+  /**
+   * A web page can make a browser call this port by pointing its own host name at
+   * 127.0.0.1 (DNS rebinding); such requests name that host, so only local names pass.
+   * Hooks call `http://127.0.0.1:<port>`.
+   */
+  localHost(req) {
+    const host = req.headers.host?.toLowerCase();
+    if (!host) return true;
+    const port = this.server?.address()?.port ?? this.port;
+    return host === `127.0.0.1:${port}` || host === `localhost:${port}` || host === `[::1]:${port}`;
+  }
   async handle(req, res) {
+    if (!this.localHost(req)) {
+      res.writeHead(403).end();
+      return;
+    }
     const url = req.url ?? "/";
     if (req.method === "GET" && url === "/v1/health") {
       res.writeHead(200, { "Content-Type": "application/json" });
@@ -3141,7 +3161,7 @@ function formatPush(kind, s, details, extra = {}) {
   const stepName = step ? step.activeTitle ?? step.title : void 0;
   const nextName = step ? void 0 : s.tasks.find((t) => t.status === "pending")?.title;
   const planLine = p2.total ? `${p2.done}/${p2.total} tasks${details && stepName ? ` \xB7 ${clip(stepName, 80)}` : ""}` : void 0;
-  const title = details ? clip(s.title, 120) : void 0;
+  const title = details && !s.titleFromPrompt ? clip(s.title, 120) : void 0;
   const lines = (...xs) => xs.filter(Boolean).join("\n");
   switch (kind) {
     case "needs-you":
@@ -5123,7 +5143,7 @@ function qrTerminal(text, color = true) {
 }
 
 // src/index.ts
-var VERSION = "0.6.2";
+var VERSION = "0.6.4";
 function parse(argv) {
   const opts = {
     json: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kvali/cli",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "Live progress, tokens and phone alerts for AI coding agents (Claude Code, Codex, Gemini CLI, Antigravity), in your terminal.",
   "license": "MIT",
   "author": "Giorgi Khiladze (https://github.com/webGrandpa)",
@@ -17,7 +17,8 @@
     "kvali": "dist/kvali.mjs"
   },
   "files": [
-    "dist"
+    "dist",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "engines": {
     "node": ">=20"